XWorm 7.4.rar
- SHA256 5a8fc818ec7156109b02c21b7ed1af701aec03a3c7c7758333839b84f075e54a
Behavioral task
behavioral1
Sample
XWorm V7.4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWorm V7.4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target XWorm 7.4.rar
- Size 70.3MB
- Sample261004-pgt1latsbx
- SHA256 5a8fc818ec7156109b02c21b7ed1af701aec03a3c7c7758333839b84f075e54a
- MD5 6bf70b6981e2184798836caab62035f6
- SHA1 96b0feee80bc51d6cd0f5ad21d56b8aaf9762e19
- SHA512 96b3f83bc051ef1a02fc20883200828765c6f13370b47d8ea40472e1280d2a66abbd16206bc3c5abb1fdf4c861714f652c770f9109a74d5f455309f515b09ef3
- SSDEEP 1572864:CXXvfEC13h25wOOa8ELi+yHcukf9yKd5iOsJkEJfp7UEJDn:CXXvfEC1R25wvPqVj4hBJ7
- TLSH T107F7339B1E902212D8D155824B0E4C4AB71AF743FC8C1D0C1D972AF6A9EF862FB971F5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
gdgregergedrge.ddns.net:1723
Mutex
-
vwvgut3T8sN6QTwT
Attributes
-
Install_directory
%Temp%
-
install_file
vshost.exe
aes.plain
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/lsass.exe family_xworm - Detects DonutLoader 1 IoCs
resource yara_rule static1/unpack001/Plugins/RadarScope.dll family_donutloader - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/SteamTokenLogin/XWormSteamTokenLogin.exe pyinstaller - Unsigned PE 61 IoCs
Checks for missing Authenticode signature.
resource unpack001/FastColoredTextBox.dll unpack001/GMap.NET.Core.dll unpack001/GMap.NET.WindowsForms.dll unpack001/IconExtractor.dll unpack001/MySql.Data.dll unpack001/Plugins/ApexLogic.dll unpack001/Plugins/AuraNode.dll unpack001/Plugins/BerylSync.dll unpack001/Plugins/CinderFlow.dll unpack001/Plugins/CipherLink.dll unpack001/Plugins/CosmosEdge.dll unpack001/Plugins/CrypticPulse.dll unpack001/Plugins/DaggerPoint.dll unpack001/Plugins/DivineMesh.dll unpack001/Plugins/EonVault.dll unpack001/Plugins/EtherNet.dll unpack001/Plugins/FalconScope.dll unpack001/Plugins/FeralCore.dll unpack001/Plugins/FissionGate.dll unpack001/Plugins/GraveMantle.dll unpack001/Plugins/HelixPath.dll unpack001/Plugins/HydraWire.dll unpack001/Plugins/ImpactWave.dll unpack001/Plugins/JadeOrbit.dll unpack001/Plugins/KryptonKey.dll unpack001/Plugins/LithiumLoop.dll unpack001/Plugins/MarrowShift.dll unpack001/Plugins/MetricShell.dll unpack001/Plugins/NeonDrift.dll unpack001/Plugins/NexusGrip.dll unpack001/Plugins/NordicPeak.dll unpack001/Plugins/OrbitSift.dll unpack001/Plugins/OxygenCloud.dll unpack001/Plugins/PentaCode.dll unpack001/Plugins/PhantomArch.dll unpack001/Plugins/PlasmaJet.dll unpack001/Plugins/PrimalVail.dll unpack001/Plugins/PyreTrace.dll unpack001/Plugins/RadarScope.dll unpack001/Plugins/RuneMark.dll unpack001/Plugins/SaberPoint.dll unpack001/Plugins/SectorNine.dll unpack001/Plugins/SilverGlow.dll unpack001/Plugins/SolarSpire.dll unpack001/Plugins/StaticVoid.dll unpack001/Plugins/StellarLift.dll unpack001/Plugins/System.Management.Automation.dll unpack001/Plugins/TalonVista.dll unpack001/Plugins/TitanFind.dll unpack001/Plugins/UnityAxis.dll unpack001/Plugins/Vanguard.dll unpack001/Plugins/VectorFlow.dll unpack001/Plugins/VividSnap.dll unpack001/Plugins/VortexLoop.dll unpack001/Plugins/XenonTrack.dll unpack001/Plugins/ZenithPixel.dll unpack001/SimpleObfuscator.dll unpack001/SteamTokenLogin/XWormSteamTokenLogin.exe unpack001/XWorm V7.4.exe unpack001/lsass.exe unpack001/neux_20aza.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Guna.UI2.dll
File Explorer
-
XWorm 7.4.rar.rar 70.3MB
-
Background.png.png 924KB
-
FastColoredTextBox.dll.dll 343KB
-
Fixer V7.bat122B
-
GMap.NET.Core.dll.dll 2.9MB
-
GMap.NET.WindowsForms.dll.dll 147KB
-
GeoIP.dat1.2MB
-
Guna.UI2.dll.dll 1.9MB
-
IconExtractor.dll.dll 10KB
-
Icons/A.ico97KB
-
Icons/B.ico112KB
-
Icons/C.ico131KB
-
Icons/D.ico125KB
-
Icons/E.ico100KB
-
Icons/F.ico106KB
-
Icons/G.ico164KB
-
Icons/H.ico108KB
-
Icons/I.ico264KB
-
Icons/J.ico115KB
-
Icons/K.ico9KB
-
Icons/L.ico9KB
-
Icons/M.ico361KB
-
Icons/N.ico361KB
-
Icons/O.ico361KB
-
Icons/P.ico97KB
-
Icons/Q.ico66KB
-
Icons/R.ico20KB
-
Icons/S.ico20KB
-
Icons/T.ico27KB
-
Icons/U.ico27KB
-
Icons/V.ico20KB
-
Icons/W.ico19KB
-
Icons/X.ico42KB
-
Icons/Y.ico22KB
-
Icons/Z.ico22KB
-
MySql.Data.dll.dll 1.1MB
-
NAudio.dll.dll 502KB
-
Newtonsoft.Json.dll.dll 695KB
-
Newtonsoft.Json.xml.xml 696KB
-
Plugins/ApexLogic.dll.dll 1.4MB
-
Plugins/AuraNode.dll.dll 220KB
-
Plugins/BerylSync.dll.dll 263KB
-
Plugins/CinderFlow.dll.dll 440KB
-
Plugins/CipherLink.dll.dll 2.3MB
-
Plugins/CosmosEdge.dll.dll 228KB
-
Plugins/CrypticPulse.dll.dll 1.8MB
-
Plugins/DaggerPoint.dll.dll 367KB
-
Plugins/DivineMesh.dll.dll 83KB
-
Plugins/EonVault.dll.dll 1.6MB
-
Plugins/EtherNet.dll.dll 14.3MB
-
Plugins/FalconScope.dll.dll 2.5MB
-
Plugins/FeralCore.dll.dll 252KB
-
Plugins/FissionGate.dll.dll 16KB
-
Plugins/GraveMantle.dll.dll 241KB
-
Plugins/HelixPath.dll.dll 188KB
-
Plugins/HydraWire.dll.dll 412KB
-
Plugins/ImpactWave.dll.dll 249KB
-
Plugins/JadeOrbit.dll.dll 39KB
-
Plugins/KryptonKey.dll.dll 207KB
-
Plugins/LithiumLoop.dll.dll 411KB
-
Plugins/MarrowShift.dll.dll 679KB
-
Plugins/MetricShell.dll.dll 209KB
-
Plugins/NeonDrift.dll.dll 196KB
-
Plugins/NexusGrip.dll.dll 213KB
-
Plugins/NordicPeak.dll.dll 1.4MB
-
Plugins/OrbitSift.dll.dll 208KB
-
Plugins/OxygenCloud.dll.dll 88KB
-
Plugins/PentaCode.dll.dll 62KB
-
Plugins/PhantomArch.dll.dll 176KB
-
Plugins/PlasmaJet.dll.dll 1.6MB
-
Plugins/PrimalVail.dll.dll 200KB
-
Plugins/PyreTrace.dll.dll 100KB
-
Plugins/RadarScope.dll.dll 261KB
-
Plugins/RuneMark.dll.dll 4.4MB
-
Plugins/SaberPoint.dll.dll 4.4MB
-
Plugins/SectorNine.dll.dll 257KB
-
Plugins/SilverGlow.dll.dll 118KB
-
Plugins/SolarSpire.dll.dll 4.2MB
-
Plugins/StaticVoid.dll.dll 2.5MB
-
Plugins/StellarLift.dll.dll 83KB
-
Plugins/System.Management.Automation.dll.dll 2.9MB
-
Plugins/TalonVista.dll.dll 219KB
-
Plugins/TitanFind.dll.dll 232KB
-
Plugins/UnityAxis.dll.dll 725KB
-
Plugins/Vanguard.dll.dll 198KB
-
Plugins/VectorFlow.dll.dll 75KB
-
Plugins/VividSnap.dll.dll 264KB
-
Plugins/VortexLoop.dll.dll 418KB
-
Plugins/XenonTrack.dll.dll 2.5MB
-
Plugins/ZenithPixel.dll.dll 540KB
-
SimpleObfuscator.dll.dll 1.4MB
-
Sounds/Chat.wav45KB
-
Sounds/Intro.wav238KB
-
SteamTokenLogin/XWormSteamTokenLogin.exe.exe 11.7MB
-
XWormSteamTokenLogin.pyc15KB
-
XWorm V7.4.exe.exe 22.1MB
-
lsass.exe.exe 38KB
-
neux_20aza.exe.exe 564KB
Background.png
- SHA256 2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b
- MD5 c93ee3abeff4ac24936471f80b36ec7a
- SHA1 0120649571a4b692ff5d10aae8dd87dffd3a0f81
- SHA512 dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5
- SSDEEP 24576:raWlRrTw9AK8jrGL+sUGBcD1MoEX1r/HXKIIfnbY:r/3w/8jzG+OomB/HXKa
- TLSH T1041523D6478670A5AECAC71881C71F777696DFA0AE64436DA6031BCCC3C0D525CE2BB8
- MD5 SHA1 SHA512 SSDEEP TLSH
FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 991a22d9a8b9b867adffdcd6e827d825d3774220362b89167e54ceaeda3f4910
- MD5 700c503265b576dc02c8f2a4dbbb1c99
- SHA1 cec3965dec340900bca99399804701eb125efb5e
- SHA512 19726d3819d9af096f8b3ca312e2a20d39be248a6cd7b0467704f9aae157b4676c7c77dc2ba258204cd9829c4e9560b3a7edb08c1d4989373e6e5a2edd0a6d99
- SSDEEP 6144:MJ6HtSS4AqV7Ql2m8BI2/A/4SikfG7mRML9GXSo/DInsq2LD/keNrdAvMiiYhZzf:M4tSS4AqV7Ql2m8BI2/a4SWyRMLHkIbc
- TLSH T1C0741A2426FC0655EB7F97BC97B5800CD3F9B123599FD35E8AA024DA2B23341D866363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
356878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
341KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Fixer V7.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
- MD5 bcc0fe2b28edd2da651388f84599059b
- SHA1 44d7756708aafa08730ca9dbdc01091790940a4f
- SHA512 3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
- SSDEEP 24576:FIVZLRYIVQd9INo3FDbWX7SsOobBTEAjg+m+ZFNwaxwGoHQ/jzK+:+oWodbi9XFEAjg+m+ZFKaxw
- TLSH T1EE9508007ED0DB26D16B4E33D5E75010D3F2B4A26BB2E70F72D5A77C145378AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:22:ce:41:1a:e8:9c:9e:92:46:cc:c0:c9:06:fc:f3:4b:8d:c1:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2031518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Icons/A.ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/B.ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/C.ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/D.ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/E.ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/F.ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/G.ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/H.ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/I.ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/J.ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/K.ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/L.ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/M.ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/N.ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/O.ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/P.ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Q.ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/R.ico
- SHA256 29c5baccc5eecccfa611da3ce166f99be4ff739121f720e224062aad05c62703
- MD5 0520c7197d7e9de06336011d5769af24
- SHA1 51afd1fe6b32b89dcab1d9b2c2a559daea523d24
- SHA512 58332542c02c0c5a115ce9fb57148f6e5ca8866e7ea214f1fb1252810f3e2a1e39676386c2197ad4b826956c5635c460c3c5367fb920faa4b7a1a80ea0a7505c
- SSDEEP 96:nhbbjflRlJl1qCwHk7B26JAzJaXOy1jmWbezRhH+BuNBnpj8AIwgBGf:nh3jfbLeCMkt4JaX/bqRhHGeh8AIwgBe
- TLSH T1559246C180C9199CE1AE4D7B0CC1256F8D67D9CCFCEDA5CA51E63D3EB9B3101AA1161E
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/S.ico
- SHA256 9e6025ae86d1cc0c1138a32bb113529fade9c05f1324c22c0f8b7ea457794971
- MD5 d9c2c5d3f14ed150b0cb81db7d8b5ca0
- SHA1 b0b59af9aa9788493f086e9fac28b76a92a1f60e
- SHA512 d756790003328b205e8af4b1fdf6209fef66230ba21eb18eb6ec8ba966534394ab15f80717e0283d45ad41b0e4442be98bf28d0f5d31dd1a1f427bcb77df3622
- SSDEEP 192:/WmPT4w/FsN0fPTM4GJKknPx9fFHOJhJJJJJ2hJJJJ4eiK6uzsQticbygb6FUush:/l/WN0EKkn5Mm63LY
- TLSH T1DA927FCEAF989D15D92483F2045107D6027DFD8AE863974B2368B1E19E3AC931B77DC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/T.ico
- SHA256 0a92cfd516fffc6f16a9ec6a45a4742ac1857241a1f2de352e07a8d5d990c553
- MD5 2347a0f68a678ee1f85dd94ea39949e4
- SHA1 161965b6bdd977e77cfdd2622e7cd6e92b540843
- SHA512 52f21a6e18a16906ead0e8e36846a5cede4644b7cc4e7a624b1e2859b784e4460520f852430f6718eda5f5d7f5a0a34ef0f93bff05b4feb32bc3327a54a092fe
- SSDEEP 768:wOk3O/bS8lMoFJnSUjtP6i2EHBrmFjHFispOczWCcHYFHN5HuuOxuzft:hk3O/bS8lMoFJnSUjtP6i2EHBrmFjHFj
- TLSH T1EED25AD839712B44E8F157F62802C677E4AF9EA6C8F2D7A9C4C1CC573056A0C9CCAD29
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/U.ico
- SHA256 0ce01216e9e095a10241600a839c2b405ccdc9a9738f678aeb9e554a6846e194
- MD5 bb2ae39e13e12249e0ada9bf469df049
- SHA1 2adad5c70cc014cd14a8b185022956be74d72917
- SHA512 5b550896a2cb28698d37559fc80ffa3d74334328a89c335687aa7a161f4188a62aaffc78170615cdb1f63226a2954cd27c660c8fe0ce1bfade9a8ba615df55a9
- SSDEEP 384:NS4H5vL2HtGEj+P4GdLAkTRoKQU0PAPEqtYdorehJ9rlai:NfH5sf6dnTRoG0POZtxro3Ui
- TLSH T1FAC2AF8DAE798A1DEC943971C9793619274BCC7B4035E26B0CA178129B3337C6DD28C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/V.ico
- SHA256 57472023161c31b07b19dd3553d81d706fc961b465fdf0ea8132ef7b9d8a299f
- MD5 dcb332db52e5e94b433e96d7340f2466
- SHA1 9f5a6ce03b3306bbf87d302b9a7a7b0b31628b55
- SHA512 80e2fb216c46360c0b135f261cf8dd417d0e33aad2e6843d42a4565f64c02962326d3f7343a9c6060e4fb962c987262208331bd4096dafe758844aa148032d45
- SSDEEP 384:xcZ9l999999999999hyWQ+zuuuu102zt9T:xcZ9TyDWuuuuSKtp
- TLSH T10DA268D9BF490A55E11881F9E53FCBB24233CAF850754CE1DC07AE86785D674CE2C286
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/W.ico
- SHA256 7a1ed5a0c3a42f3f82ba2f09c72960678e7906932eba5ad3c2ce7ca8c1451d66
- MD5 9c550ae1868855bdcac606978bf699e6
- SHA1 2d437b4c271e91b2091b61dc19752a4622c39802
- SHA512 21e606979c3ba5d9b25a350e6c46af6e67c88108e4eb00ab134495280a46535dd7771cdafcf13907c9d25bb73162f7c6b84857d1b6bd9fd5b9e1fb59e89cab99
- SSDEEP 192:XQUzZZIweB28vjQvKinwHxAJjBA2Oa/Uxl+1:AL27yK6aOa/Uxlq
- TLSH T11E9245C68456D7F9D1CF097AC64786F721B01CB91B663BF4BA463140F088395FA6B688
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/X.ico
- SHA256 a115102fcf0fb1c5e4bd9721f10126e8b27655e8f1c6ea0f3c7d2a66dda0ad5a
- MD5 8d1b76a36f8e234c51d9952dd8828425
- SHA1 e97899e10a0ab77ee5de7f527c543999bb94da3b
- SHA512 e8ed42e2ee9e40ab3d80df1777604d00a7f586d59e8986567bfe8487554739d7471a37fdd18882e37c004f926f68b8a9eeeed28312ad1fd01f172ab1393fe9a4
- SSDEEP 768:7PraExoqGouoSqWSLMwl9P/VWg0chOgcS:7raExxxuwWdyZNWguXS
- TLSH T15D13BFB81989B6E0DF4790F7E07889BD83598B594D093752328237FBC522B9E3583DC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Y.ico
- SHA256 6c9a51e34754c0f32ee6fa3974b23bd2c8181a9e236b4aba02ba20b586742092
- MD5 f637523c8e8df0173e952078677007bb
- SHA1 47a6c19013ee18cbce426615178481d233a6fe40
- SHA512 531868c388fd72ab8971eb88ef2a4c5b5191e03e11b60d6df30b7407cac68d38f1d2a4f4e514e2cfd06ace89278ce7dc03bec6cf26814487394e41f26fe21b2d
- SSDEEP 192:EdPuZgFNTvanN0eD1HttA49J3HFZLWz4ymrxVwooqk8zc0aqkAZdUBxJwnKbs:EdPFFW6c1jFpVZy4/M8TaqXLEDwnOs
- TLSH T181B2AF727618A6F0DFF991B37718AC926289E34DFC7D009C9D419790DA5EF430B242E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Icons/Z.ico
- SHA256 c8b639f5285b51dbe372d24bdcd5ae18109237261277a8a00e57f790f62f5486
- MD5 694adf44280274d07ec2be70dc24db84
- SHA1 3bdbef334d34f763474b8c3eb46c68653837e47c
- SHA512 287c6b46646d5f1758e9202c9b5f309608da77bfbb86314e2f10547f5739e376e5af47958aee5bbafde8c6d6293873d61b4012ea270acf0e7c48d0767a067b45
- SSDEEP 192:K7O93kHCWdGvun/gXTI1Wgqt28OgF7o+CYJYbzKk8OuAf7ly6wTb5fCMbrU:Ka93kHCoGqghgqtLwX82Bp816arU
- TLSH T1DEA21A49D791D4FBDAFB4AB2D5A5758AB4CB6C6C3366F6498B84B0C113BF60E08170C2
- MD5 SHA1 SHA512 SSDEEP TLSH
MySql.Data.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9974ec9c4b5453b6a00f2235edcfdcaaad931928c35faf8aac0bb57ef69d782
- MD5 94e00465e44f5782938e27df2dc7362e
- SHA1 2970ceef0c1e6cfe3b8714c428c8857c7b157ca7
- SHA512 25cd34b4ff0e2fe9905f836240aeeeb3202c62a9604c46ae4535016cbad43a31389b9ef11b2f6836ec5f458114aca97a1c63edbf9d598a24f35c7ab6be763e20
- SSDEEP 24576:Y/G6E9m5a3wZC7FuuDqUDcEepg7kiOKTt:9qgVLcEepKuK
- TLSH T103456C0037F9EA29D6DF9679E77596184BF1E905B102F75F1208E5A92C33B408E40BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1179402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\sb_1-14799416-1710747233.08\connector-net\MySQL.Data\src\obj\Release\net48\MySql.Data.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/ApexLogic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b2630e3433dd2d50df05f6743f8c5bf4be0aaaefd0b7e1cd2cae92cbf024830
- MD5 86d9a66323a7ecae53bd8a41dd76c174
- SHA1 13027c2fe9ae978bbc3b0911e4db1695a648ddbf
- SHA512 fbb7ff523b470629ebcd02f6d389f621999030fad28fbabb8e5b503d4f7b43b256d92028986e5cdedbce8027446435eb9a51a14101e98b16f2032f262692c876
- SSDEEP 24576:QLIrdj6cRIwi3etcihIXvcQizAaUkEVGEEofvStLue+Zi:7Jj6eOGcb0QgAa1EVGEh3gAi
- TLSH T1226512B9381BAA2BC764C73FC1D65829F13E94B391C26B6F249387104F026E9D7C6719
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1449986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
0F)kgF
Size
613KB
Virtual Size
612KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
I `nY-
Size
580KB
Virtual Size
580KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
طئةو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ةيةس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/AuraNode.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7bafd173a30e599d670b91427b7d24795143f0d77c09dd6c9fca13af150a4c6f
- MD5 d84f14824405bbb10da2bb126965cb8a
- SHA1 7daf80b867b8c132ff6fd8893444548dad070cc9
- SHA512 97c63fcbe72f9f07953604b0905146d4c19678b1fdd50827d2c6469e27e0c66defafe2cad6b035c11d80f740f383121b95b255c5be6125e13c58f6c739365318
- SSDEEP 6144:uAVH9ZtyXefRYiXMhAOw0zBii/0dSw6l:uAJQXe6ic6Ow0zBii0dSw6l
- TLSH T137249EA43A566632EB2E8B3FC093780DD13EF7731383979F295706454E166F2978AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
262146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
9c`=$\
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
;IL`0A
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
وءضة
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
جؤؤو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/BerylSync.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a01b2d43c5cba2b14fec1e59f1651aa30febc558e5b23e2c9d99df2e9f53e7f
- MD5 555682b2e3844000d46db1939ed17422
- SHA1 2516555f1028474a0cafc569fa3ab91c29acbfe0
- SHA512 5986b4c093f3f70b78878b59b46ad49b972e37c33de9ffe7257fc2f68d40e994a47ca04a4c3b21e5bed8e2ee12440726a816359ceda3828023129971b8b9fe4b
- SSDEEP 3072:Bs/ztWljPmg6tpgx4yDKNLEaX9Sg3LZ3j2kMZZbJVBVrLBctDUP0TPFBEZRt:G/R2PmaxMdX9NxjnMZZ7Pow0TF
- TLSH T1AE44AEAB3456566AC76DD73EC2EB9829E13ECA771F43675F289317108D026F0D78AE00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
=zaFt{&
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
p% hH
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
121KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
كئذر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
عرغس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CinderFlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f370cc92d6e2ccbc519ff560030d3f14183f3a3d6904d2200bfc592d52b8149b
- MD5 54102735721a2b52fa0495c265bd4f7a
- SHA1 8b5a4fc3ee86d236e602b595be42dae56018ccc3
- SHA512 44c4f5a894c49db391533571eecd525e033fcc19ce8d3674c2e761a48fc6bffa4cce4ecec12fce075b9406ab59b5d32e7e440084e6124f789256d8a9b132abb0
- SSDEEP 12288:O/jpw3TuuSvxojZ81WaQZvT7lRBkd9+zvWE:O/Gjulqjq1WfZ7A
- TLSH T1C1A4D0F635625A23C72ECBBEA2C35C19E03EDF7326821A5F189366008C427F5D787A15
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
483330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
os
Size
202KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
R*$
^q
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
يجظه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
وعوغ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CipherLink.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a71ea7367b53600b8579599d762766849e1e6750a2f05c8ab2030d6cdf78b30
- MD5 8370d4046a02221979a8ec114814df25
- SHA1 37dfc83d0b49bd7a196f97e8fd0bfae8eb8285cd
- SHA512 991e8511cdbc7bee6d4493f7f21bbcd882b3b5a5e579a266d304aedfeca82378b0fbd886729bf15a8c3c7ec8ec0e0da02510b132d9ae1fbb8198fa1e609aa96d
- SSDEEP 49152:OxU+gkeZAyUPrHeh07ThlBUh7//4u77cIAUH4c+OSupJL:OxM2Lq//Rfcnc9x
- TLSH T157B50105A7E885EBF1BB93B8C8A28441C7B1BC059775DBCF2B4019EA2E177908D35763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2407454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CosmosEdge.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 88b08e71e67f0f4610e96e667d4b7f331ea5aa5372f13fbcabbbbbb41ffde73a
- MD5 efbac3eecc4a904fe0fa77074a4ac441
- SHA1 2793230d9bab508888736ff8a89d0256805c04ea
- SHA512 1e628b12d6005698b2c3a06bc9421e91847b1a2a039e7e02afa89a963f6a27edee15959b26c69257c8c7a897fb487615f47fab53afc4ff9efb0f4a314140fcb8
- SSDEEP 6144:xLEMzYxiN+0bMOAyiVKT3Q+85WMuQw3pl9Z:xLjXMKiVKT3QFjuQw3pln
- TLSH T10D34AEF739651923C72EAF3F81A34925F13D8A7B4B039AAF18D706144D566F0EB86E00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
262146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
hd% !\9
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
@\44
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
آؤكو
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
زخجج
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CrypticPulse.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 000cfccf2026b977748dc32e9c4ae8e5cb6e726ecf2554598ad44464e91cb6be
- MD5 0c95aa98ee51260d0c419ba134f6ee20
- SHA1 cf850d7b6f44a21586484fda52deef2c8f42deda
- SHA512 b823c8fa228f9fd073fdd1a9c12ab01821e28eab12737823c72293884970b5472c01bf4e5e1cd7154d7b1b5cbbb691cad554a5c73464f05f95b88bf87c12f594
- SSDEEP 24576:8cCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfDp6XssJxSPH:8H7uRfbQswUZcSByYGv5uZEdSv
- TLSH T1D0959D12B7D6D1BED1AE40B98A774919E2B1B8405B25CBC79AEC133D1F233E05D3A316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1941006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/DaggerPoint.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ec512b958e6884d4586e331d13eaec6fc64bca53886f89340b8edfe8b37e26d
- MD5 30b444e0ebc7f3a5764b12af74a9a2c2
- SHA1 9a1f87e8fefb56def66c7faab58c118412243607
- SHA512 5417f1400252f565fd76b54b27abfbfff173b6824b1e8fb92da68b8c9bedd33632a9b713f0df527af283cbc31b127a53e821817c3171f7b68b9e5420d3a58943
- SSDEEP 6144:v3KIHG5oKl37LtfSyUemqexCwpvZeyajh2dZ21PSwqDS8hl7rCZFo2xX:yJnft1tTuCTyat2dZoqDS8hlvCZFo2
- TLSH T1E184DFA8393955B7D62EE73FC0C39465D13E92F32243AAAF246362304D125F4CB97E16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
409602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
)@]M7h
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
A^0U .
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
كفلت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
إهءش
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/DivineMesh.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/EonVault.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 068008c26dd532a06e14394ec3a31917906c797582ca9d7c7bedf41a12740b09
- MD5 0815539e99c6af573e16cbc0ff402342
- SHA1 7917994c52fb898e865e1f93b64c67e350fe47e8
- SHA512 1823330ca717b797f6a266d5b92937d0baba2ffca5ba40a0b2715557b64f48b0063d6cca54a8d1a7e8bee12aca90f624ae26383b7a50d856baf05ed283266f76
- SSDEEP 24576:TCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlf:+7uRfbQswUZcSByYGv5u
- TLSH T10A759F62B69AC1BAD4EE80B9897B961EF7B6784407348BD712D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1639246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/EtherNet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 351d24433567b9ea704c2e4a884807752aee0eb513bf45dc7e0bc678a57c9f54
- MD5 8e1ff68af99336ba3faedc518dfc0d52
- SHA1 e434dd76b40b721a6e1dc690e7fdd8a90b5d20aa
- SHA512 1ea22a94e86f6013eb947f3e0af88caf783c2a493dfd68b24fc4d3acf2cbd91f217a3d21ccd192b82170b472cd2bada2393f7a7cd166783afc16ea1c3940856e
- SSDEEP 393216:i2HsIHU9aAPwDbbpNGKSWpyCH/5/bxY4H:i2TyobtwYp3FH
- TLSH T114E6237C74D4E8B3DBE601B68D6022F2A63EBC17F7C1B4B9984E871049273E9ED21456
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15073282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
QV s/K|
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
j J0
-0
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
11.6MB
Virtual Size
11.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
こす��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
りき��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FalconScope.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2672478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FeralCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b95c28895caa93432b74252cdeddb35f687a19f85b52613fb617ada2e847717
- MD5 f083da4d26fa99cd36c81a2b7775597e
- SHA1 5cefdb89edde28e52c644756534a3217f21c5fc2
- SHA512 c9c5684d10baa47fcbb7a279e1c9e192abce54f1fd1934d04644d2f5a35657db7b92fac0bcfbab567acdb877c7f5373b8ecc3fb7f643711bb75ef85bb5928d5e
- SSDEEP 6144:2F/sQ08FH0Q9kaHEODGVxcdF61lpLm4XtH15w:RGH0Q2aHXCxe6h
- TLSH T13A449E7935295922D7EEC73FC28AA899D13FDAB31342676F18A326103E429F19747F04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
286722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
OUWBa
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
M<t^E}9[
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
خءحخ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ذؤغإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/FissionGate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b811703326822407e49ea0c1151e962470e8dc5bd23fe19c61f3200a794cf998
- MD5 6e83657f22d2096b8cb4791941bb8300
- SHA1 c4e756660db09cf7bd94782216f42166651b3f51
- SHA512 22e624a09df88cf530343efce63f89e1de62adb7873c9f651194656707eaa79e247b41d1e8c71b07b5f5b1387c32fab66372322b78ee3701a038ff1ef00c050b
- SSDEEP 384:LNsDP97BkZ3pBkHEk8G1QxFUzTNnrYFXoMZlS9xPCn:LNuR+ZZ+mScWfEoMZQ9xPg
- TLSH T1B57229AC67F08371C6BD0BB24872A2026B71D605D853FF5E5CDC70960EA7689C784BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/GraveMantle.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ba4aa361a80c4ea88f267d3eecde64daf69ce6f202838fed6ce36f656b4541e0
- MD5 c2c3ffd06709d4f7effa2ea650edab6c
- SHA1 ba564f311006d3212c0fecb0ec109bf50b00cbd7
- SHA512 36de83a82bc2b88a8f1fd78e32ca5fa4828128edc199ff3f0fd8a93249cf9ac13faba8a3fbab52ee4d807a74dc7164043f8d6df71eec6c0de9184e44a3fe5726
- SSDEEP 6144:RiO7BivAlibhrt59aNNihJePJpeDSbVvyXVkaHmEFfhb7RQhfw73Z5zaKW:UuABBLSoG3USbVvyzpb7RofwdBah
- TLSH T1F334AEA839261426C72FCFFE81D79419E13EF6B35F42665F28A70E114E123F4E64AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
t,xF8'
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
>Hv c~^Z
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
بءبس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
قخصت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/HelixPath.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87003a78ca138348791d561b0d32437d3fa9c931b57e8465c01fcea5971c719e
- MD5 f978b1ff403bd512f932e462dc2bf046
- SHA1 01246056ee0c2b973d8c3eb75b54a2cf62ce9e6c
- SHA512 64161b1c2ddaf66eccce9097c0b6072e45c41bc969a77cc01bc9d476923e63d1a2b3e126060366300e55ac4f78eb26349d975228ea99f49ebc922253ec8c00be
- SSDEEP 3072:kRWo0y/6pTGIumoYEqFUAcfGg9DrZ0KJX4+Ov9LIlJ4F+b4Nk5kkJd3:QmxGIWQuDrZ0KJX4+Ov9LIl/bok5t
- TLSH T1FB146D7837122925EA2EAB3FC297B955D23EF3731342665F366F12514F021F0978AE18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
221186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
!,?Maah
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
v?4
TS}
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ةحيم
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
قزخر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/HydraWire.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da5495a72a8e014e4776f1aa3efe1628a687bb4aeda3d1c5c6bfcfa71cba6712
- MD5 b9d200144fe8f2e2733d73bb39063b8c
- SHA1 ddf3ad5e1a43d63782b9516582e153e8bc8b2c33
- SHA512 03d2d646cc9317710ad71079a2d928e2fdeeaa79df353d5cac9f398982c69f934d2ace72bb121a827a74aef20ace7a6fb1fb8f17b667257925429485eb0b90af
- SSDEEP 12288:s+F4pzICFS+MHpyipqEGzmESgYb4kpNzH/q4:saqIC7MJqE5jxjq4
- TLSH T14894C0ED29996923E77E873FD1934418E23F8AB25242576F2CA317408E477F19349E38
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
450562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
dirh
r|
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
�Tp
Size
204KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
غآزك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ؤئنه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ImpactWave.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 587abdd08cb32e5c1780ced38a799ab50add04882fde7f7e32292406c79a8cb4
- MD5 b57ebde770c74a02b4abe4e20cd4cd65
- SHA1 8c58fcabc6c57f65ecdac9ae77b19328b36dc64b
- SHA512 41db5ddd8c51a192153de8699d4a30f75a046d6e7afd8c242b81e0b78189b843e6ae83f236e7bf6ac4a4d5f70c7c0d44c6cd1a50de1bb42a71c5b6e956c814aa
- SSDEEP 6144:i9sl/zi2ZLdNYWPrBrldTwD0QKCJsOdisM22lE89NFmGs2H8pey:Cye25lOPKCJa9N8Gs2cp
- TLSH T1BE44BEB42A655A32D76DCB3FC0CAAA29D13ECBB313835B5F186346654E025F4D78AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
286722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
-1FKFIr
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
8 ^T;
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
نضوى
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
فشىغ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/JadeOrbit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f38415db4e35f47611f8266a1b753c712ecd64b2f54e1cf29f7a9a61bfcf644f
- MD5 79c9ee6b7a72a7f7f75ac62b1d318a79
- SHA1 a467c1a66be06fbf6dc8f8b268c756633862d6e9
- SHA512 4d80347758b1a79b18fdba5082740703d9d1fe5e16334a51ca597448727104a4f7a72087c457dd64e0b6fc125f2df5b76769f633f236a245133b707c674c96a5
- SSDEEP 768:PofXMCBlQ6Kms0b6GE30Qs1YKtq9oQog1zqoPPz:PyXTa6NEBs1YKwo8fL
- TLSH T147032B4937FA0621F1FE0AF5C873A7289331F5935506D70E2AC9A0696B736C29610FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/KryptonKey.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ffc87b460d490e218769c72b46724b73ab6add0bc46236e5649acfcd46159c81
- MD5 d246bd4171bb18a6ef6c12446acbc641
- SHA1 fa7c5aa91089dc3616d30223a3a154f111763796
- SHA512 58e6e5f5ce19b2260343c27422aec21953cdd3056e083abaa127913929a34807478b4012ba57811d596f235f22b6e619655b0ebcc001a662a51f8819cb6707e2
- SSDEEP 6144:piHFPaCXRv34V9qspVlDUiQK98T2Rx0FZ8rjxQ5:zmzsprDUiNWrFZ8rjS
- TLSH T147248CB635959A26D71ECBBEC1C75C58E03EEA720E825B6F29631E104D133F0DA87E14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
C 7 Yc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
o7RKf E.
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
111KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
شرته
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
رإثس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/LithiumLoop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c375193ca7074df4255f3ab43c796f69fb5938f44bddc0dbeeb6625f94c5c7d
- MD5 ef0ecc62b119c64dca88879473004743
- SHA1 da6008c1194f5c500737afb0abda2a9125896368
- SHA512 b3b188e2c0143c58f2724f55235ca494cf2a51943378c25e16d9dfec3bafd335f25af7e9313aa268f216075c8bbe7bde8540dfd7809f37b4c459b6d7d6f01d93
- SSDEEP 6144:YOGhT+dobK+lCMk/bvFVoGSqgmOG3Jg+/Mg+vwq8uRvi8UCPKaNT/2Wfkn+X:YO+f3Y/rAG5JyPquRvi8UGTVOR
- TLSH T19494CF693565AA27E7BAC63F82C75828E13FC97B5B43675F285302104F026F4D78AB1C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
450562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
D Y*
uH
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Nox&,.n~
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
رآغس
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
بميإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/MarrowShift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16d6313caaab8d850895af6e8033aaabe65498e99a2faf3b49d2c084d7a34ce0
- MD5 e51c412c8df19249adb10b0cc8b39f88
- SHA1 f2e999d3e1d0218a6fe1215a1534049e40d97398
- SHA512 e50a511075998764512eee7133c001bb66c3a427a60084d90a6ab5acce650cbe5ee2211f580e0e684b7e8ca9d7e5d32b11c600d0adf3052023586ad61012140e
- SSDEEP 12288:JVnchrRTHcQ3nrn6xtI9qR5WKygA5KeirCDD/:JtJQ3nrnMI9MUnr5Kei+DD/
- TLSH T168E418203FE8E01FE4AE73B5D4E1972156B4E6427296FF8F258056E80E833886C555BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
700934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/MetricShell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 42e299741caf374e3d5353dd4a6d199910c1ba5dbe5d65bf9225c80a4fa7dc0c
- MD5 565a00f87b9fc1373886735c47dea37e
- SHA1 808addc907e5c49cab6ecff23b993921d6b6539c
- SHA512 6af861e85762d5c9b3b977a2a2b10f9cca02f4c2fb8d0f9fca156dec5eb28c32fc44438cebc1b5abe5e31b2f0de4ec56c14c80638a82c5d855ba2c33845696c8
- SSDEEP 3072:kVGnG3dWfvCBiLiHcBcSkslSXOJ0E1i8qedf/UFAEQFDrgP0+gcZQN3GgY:GGnqA3mcBcSpUXINq2Dzhc2Nv
- TLSH T128247CE93B915522F66ECF3E81879849D13DCBB31783A67F24670A118E12AF0DA47F14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
245762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
%pw0T {T
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
]LAdS$
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
يبظئ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
شهون
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/NeonDrift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee0cbe0c92d40ad0c66ea044b2a38a186b61d0750562f6d9e48c5931e80b50d6
- MD5 c0598b044c569e821f8e0df40f3a25a0
- SHA1 c9eca47eab3f7be74b742e66ff3a3e30896ee075
- SHA512 5e321f165d9a8fb67b85b381056c2cd6bce7d65f718d2acdabb0c9403038c3e44d813098f27245e5c31321e50df051bb7557554b56191b57e981aa6b624ab842
- SSDEEP 3072:vH7BI8u/CnKYNul2b+5st7Eb42jJutmvNEQH9thWglbPqiKFfZhMPgVPfdS:vbBI8uMlZt7EzuwFxHhlYf
- TLSH T11414BE68B76819EDCE8E2DBE809443C78B7895A2DB1363EE199245B10CD53E40B61F1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
,
%j{
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
M% )>(H
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
广原��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
肥南��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/NexusGrip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 205ccc49d98dfdc9f730bbcf80b2860c5d9381c5eca24b5dcb4a58f04b8fa4d7
- MD5 4f7528097772b02d77ac6db9ffaf8fe0
- SHA1 c88036efe1fdd9bc0a3d7035461e6fe695210262
- SHA512 324beb52e725c7fd6d95c80c817a5d7156d3d79eb8ae15215e8d702d35c7f478a36b08878ebac7dda2b9a34d1d9b7ff1ed3a4ad695aac52e6bf2ecae270ab361
- SSDEEP 6144:2s2SyFBsUEpUJ9tRhs+kr4GTYKmqfvRR2yGmhC:h29Fn9tRh8r47Kmqfv2yGmh
- TLSH T1CC248EFA399A5623CB3F9B3FC1879859D13DCBB31283665F25A706004D226F1DB4AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
L+Ce QW%
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
JDe5spy-
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ىرءك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ىفاك
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/NordicPeak.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9cda1851bae66258401866077c9bd6d8bce9abd9154372b59fed599ab8e5897b
- MD5 edc57af0dfef2bbb80d44e6199fdfc44
- SHA1 c5f7d26ca11da5c54a6ba01ac6d0a9891601eb97
- SHA512 3d7b64cd19de4a9b3e86385f5ee6cd14855bb9b15cf785d2ad2e91700210e9747587ffd2c8140bdff643a136a43f22556cd0fde84a596cb7b9f09df04f1f95f3
- SSDEEP 12288:evUk4Cz+x/KEth2wZtK1xLaFBFYguwEdIIFbV4sAKa+wEp8Ta1i/w/ME20:eP4rxKCYfKFOw3IFJ4cTp8TaM4/
- TLSH T1CC65838565429639FB8C1E732A05D70E492240AAA751BF090DD78D50B8E7FBE18CDCBF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1472750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/OrbitSift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afe528a38eac589f13f26d1f350f7c87595e1baf02c4d6b2e2a5e908bc0ef174
- MD5 855db96880943ed44a6ac6ec58aaa514
- SHA1 449b1eaf597a0ad06c7dc6ac48382ded8bbe6829
- SHA512 ae133fde0785faa56a7c2e250943b9c17507369e3651cca5198bf2e9f329e648e5737806d4f80d30fc6584a86e4054b5e12752aac808f6ef58d497fbaeabe991
- SSDEEP 6144:2XVKIJ5A5aDsqZP2Tx3prFetG13Zv+yY:2nJ50agpZeo1pvlY
- TLSH T1FE249DE835155622DBBEC73EC2878887D23ECE77234256AF14E316505E06BF4E78AE14
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
F(dd$t\
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
qh<Z`]y
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ببقق
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ةآصخ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/OxygenCloud.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66e18f8c94cc0938f99ad2a46494a331d3d0d5051f076dd75b81a429f8acde38
- MD5 2e196ca7f33a35d83b1d96775d306bd4
- SHA1 8320471565bd8a3ab1669669744e384833f5a51f
- SHA512 46a56fc89cff38b9021797730aa686cb91b5b29a3b0e899658fd06377c84e84202121c773f114432c535b41ea1012377234ff69e0d59441e84117595011b9442
- SSDEEP 1536:jIGHIpBFX4jm1RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRROA4T/CE2rvhndgVah:kGGFX4DA4GXhndgcsV7sqBSZ
- TLSH T113931988A5F3CC67DA9C8DF70D63154E2D788C932112EE295BC7C2A5A7827D10B1E673
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PentaCode.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c8216a20197cc365e90089ae9dcbb8f8448ca8887409ca1b89dd7d221479fa1
- MD5 320f182444a4aeb430c74dfd0b2bbfa7
- SHA1 9e4aa3e18117958eb45a810f4a71836387fa965b
- SHA512 a2ace9c46acee02da9dd042f1629295ef1b85777fddc28b7645362a54df49c70485416e7b72dbd442f37500a7abeb9e7051b5518dd73b1cb25ce6011a7597327
- SSDEEP 1536:tE3P82P1EMS36K+B+iV/zmWykkkxxlbvtU9:QAH9+RzPykkkxxlbvt+
- TLSH T179535C8977E58A34E2FE0A35887397189372E19B1513DF0E16C6A06A7F733C18551BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PhantomArch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 47eb4560884156bdbe539c4b2852e31149dec39a425920eee899c361ef1c246c
- MD5 a4da2d2aee3ccc3ffeb8ea2216c6003d
- SHA1 bb765ef1ff756bcb215e62bb140c27531f31e969
- SHA512 d8f5c3af0476697ab8d1bf05ae6b596c6be5060e2d192e8ced237a6529f03fd3d25ca5f981bf72363646de3f11c61e5dc27721469d6f615a40f1fe3f0fcc9f47
- SSDEEP 3072:yG7DGnEXZN9TQprimeNRRC9A4M6z97jBa89SKgoji1QU87Hh+CucRd:j7DGnEXxsUmWA/9YzoW1QU8V+CucR
- TLSH T1BC0483C4A57392A4CA8DBFF3256F139E127A2CE62505FA594FC7E1D9AC412C20B1C877
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
186206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PlasmaJet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a59b0165a57709d24cf481d15984006929f8601b7ac774a2b5ac140f5e5ace73
- MD5 9837b64af52b4b59e6849b8a40ffe8bd
- SHA1 902daaf4f1be83b4ced58019da50a41be87b3d1a
- SHA512 ada148fa10a3195df4113fbfecb23e7288abba64aaba105ad8400d70ad674144efe1a8f767b01fdeac02ff225a2e4945709820dfdba5e1bbfe8c073610a7da92
- SSDEEP 24576:GCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfCJ:97uRfbQswUZcSByYGv5u
- TLSH T137759F62B6DAC1B9D4EE40B9897B961EE7B678440B348BDB12D4172E1F337E01E39311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1670958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PrimalVail.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ccb3195374a9be9636584c6805fa532cf9a9765a2b8e9539b0eb7a0b4ab4f553
- MD5 c5f5f14aed404293e2de48b68cb9c186
- SHA1 6ad9d7b023844d68454c94c0e3bfb1c9d96ffb96
- SHA512 bfbedd10ea7c265d8380011ff08a7209436e0f0357970304ce3aee3f507133936c444f2b3a10f227ad6985d1aa66134720848f523a30be8c154c1e209da74b2f
- SSDEEP 3072:9P/0Y+NbLbHUeK+/oD8xKb0sbUTTAe7FLQ6gWSFPhFAK6Ms77:9X9+lLUeK6xi437VNgBPhg7
- TLSH T1C9148C6939655526DA1FCF3FC193B819E13FEBB22282279F24671E204E067F49B47E04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
237570
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.U|-^s
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
8kfg-)
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
إخأح
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
عيؤي
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/PyreTrace.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7629163ae38fb4392b1081a290030ceb67febdcaa8f7a5712b82d97a991c79d8
- MD5 41c2697ad6c82bd4cbc8f8187ebb8f3f
- SHA1 7419a8115aca60a565b0b3b06b2d0057bba02bde
- SHA512 4bc6a6e349fed04b2e72e7bd6571e6219b24a612a0ec143b2cac9ed70138742e71ecb32d1be5190c9529a67c0a730409c46bc6078f5ff6deb84ded23dd4b600b
- SSDEEP 1536:BYOj1HP8ca6qKiMRXLgmj29xy8XVx0F4FX9+Q7RnVfJbhxSTN1:e4kv9M5gD91P7+aRnVfphxS3
- TLSH T106A34CFD36A1D937E65F8B78C4449263427D5EB3CB5372FD2DAD88600D216E2EA02D21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
139266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
Fu}D -'o
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
V$?E4S
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
にも��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
そに��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RadarScope.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 85beb16b7fcc71efa6377b6494508ab4f52dd04135d07a5392c69a11479c2ccb
- MD5 9b12fb86c68d6cfae2fa67b2c0a3204b
- SHA1 8e9bdeb355ab4d564be5655e606ccae5e8c043a0
- SHA512 1ca93dc0e22851c0ccf2769978a586d365151b1c5d1a73f5ab4414a3a02c19228d5ca9f07e1a96afba69a734d4a80657af17e2c61b7c5c2be295f1c0c9995484
- SSDEEP 6144:wdCTlkH9+H5rsGB0XEYMSqm6ysBfvgEEvqWBX:gel29+HUIm6JB+SKX
- TLSH T17044E045B2B38EA3F27C81B3C9C0C92A6771A046A611F71B0BC6C540FBAFAE05B54775
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
259KB
Virtual Size
259KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/RuneMark.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da1061c91058558d1817876e49986e3681ba48e3ebb7146b4de48e11a088fc50
- MD5 eebf5939d7b788193d13ff247b5b7a67
- SHA1 6714bac2a43b77d1b0f3a7cdd774e1128388e1a1
- SHA512 cf4f8a49774e5d04b87a5c4a2f88c73281bd39b09fb951674e82bd6846930dc25a3d7ead914275ea2f7f2e10f3f0ba6e9afb6d6d91c45bc8aff75431b2619f18
- SSDEEP 49152:2lEcbwRmE63g7FFHxUZ2MZsibvK8UzbP/c+32FV3aBsxBZVeCtb4TkQNcj:2lpwRmE6wJ89siIb
- TLSH T180269D4567F89E23E1AEA37295F000216BF0F86AB323D74B6591A6F91C13B816D4137F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4655294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SaberPoint.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 da1061c91058558d1817876e49986e3681ba48e3ebb7146b4de48e11a088fc50
- MD5 eebf5939d7b788193d13ff247b5b7a67
- SHA1 6714bac2a43b77d1b0f3a7cdd774e1128388e1a1
- SHA512 cf4f8a49774e5d04b87a5c4a2f88c73281bd39b09fb951674e82bd6846930dc25a3d7ead914275ea2f7f2e10f3f0ba6e9afb6d6d91c45bc8aff75431b2619f18
- SSDEEP 49152:2lEcbwRmE63g7FFHxUZ2MZsibvK8UzbP/c+32FV3aBsxBZVeCtb4TkQNcj:2lpwRmE6wJ89siIb
- TLSH T180269D4567F89E23E1AEA37295F000216BF0F86AB323D74B6591A6F91C13B816D4137F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4655294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SectorNine.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37a38d220bd483b47014a21cf409a620471ad34bf287d31c465b28e42ab9cfcf
- MD5 7cba78a92f0aca9642546c13000244d8
- SHA1 d956a147f491a30e542e1747d23458f1919e8cc7
- SHA512 64f5509bfd0c168577d158d70eb07f5aee4c911f1e65b5dabad9a44b6fa0bd5ca3b39450d566bc5b6a4262f3ba281663ffd5ed01a7933a645f7bf23c77c81683
- SSDEEP 6144:fwz3I8z3dzpmtYsl65Vwy6L8tpXc1O4PSs2uGVVVl:fwzYmNlmK46TwzIjXiO4r2uGVVj
- TLSH T16A44AEA934655A36D77EF73AC1F78868D03EDABF02425B1F148366145E02AF4F78AE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
90cBy
z
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
1E AB
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
حأهإ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
إذإظ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SilverGlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16a2798e1531f10acc2518a498e25f1110b0a30688522d8e948f5298b3ad5d9e
- MD5 80c111859ebbbd5b101532832b26761c
- SHA1 99ef500a580dd47e0f3a90230b4615af89ce12de
- SHA512 bc75b0e65dc3d63bd32c67d9bf3e3e3230a8080e044be4a2437cb8de3fb5a3eb578080f3c9f081836760af3bc313aaf396b03fec01d8e053ae6347715dce48f4
- SSDEEP 1536:o79H1DCH6hC4ZQ3BddS1PjCxIngXpRz/5h/V0fOiqwki/ur7IlKSZvdZny4c:aFCENZ+dSCxIMxh/V2Oipc7Il1vu4c
- TLSH T1B5C3D888B5B3CC65CA99DEFFA5E34B4E22BE40D32501EB111FC7DB989C526C50A08977
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
127294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SolarSpire.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 18573362a15bd14ba7194ffae8dbf7a2db5755fdf7c5da43f6eae3f9321c9f6b
- MD5 4dc846e677dc66a9c6633ce90b8c1b93
- SHA1 a911e7e7afedd2f0ed798f6eb7be4243dceeefad
- SHA512 aefeeab7e453fa73a1457777d3418feac3201c3fb807beb18a45cd8f864cccc7bbbbe293e0e3f09ed1b9c4a2df05627035ec56c3e1fba95e978dab6db26c09ab
- SSDEEP 98304:jmwfnyEdYorbv9bYIlUqpGdOq+xYbt9xUu0RUnG7:qwPFye9bYIl9pSO5xY7xUuJn8
- TLSH T1C116F11437EACE6BC2A55633D6F453652333E865F3B2C70B52A6AE3E09437005EC9369
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4431874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
oo"igo
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
4-W=Ep
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
AF24B1B
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
FE360FCD
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/StaticVoid.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5cb62954bee72039d191a39715bf887d0fddba1ced6058fd84c96873e7404f68
- MD5 21960d97a472ad7fe847a05f1231b458
- SHA1 16556bde7a7b2e6967bf5bf7a2b92ea0b40a6193
- SHA512 6409e3910f8a951ad1dc84a6c5b32fcf24f373e3ea8bce325ff0cda17d67b9a2bf5a3bc896a4892a99b2341406e5ad3f6f14d7155ece14a840a6d8562d4d95a2
- SSDEEP 49152:jY+F5n7uRfbQswUZcSByYGv5uslbXOuc:s+F17ul5ylbXS
- TLSH T155C58D41A7C599AFEA9916BDA6A34A1983B0F4804FA7D7CB47CE123C2F273D42D74311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2673406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/StellarLift.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 680ec3a3e7a90dfedc1e572e25cc1a17a1782e882005d88e53db9965136b81b1
- MD5 ff94c16016c40e70013db9321ffe9926
- SHA1 60e11f4def0fe9459f5d0ee87059621870964867
- SHA512 8040180f232ccbaaae36384c959592bb23000587dda454c9646cb748ce639b6c046edb061919060d7b961a061997905d91076116b1d0152961bdd7ac86a58c8a
- SSDEEP 1536:qPJayHUz3L54RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRDCHZO7iJK8NWI9I1k:Op07wC5O7BI9IQmMGyNz
- TLSH T1E38329C496F3C566D6C86AF711937E1A2674418731C2FB220BD7C998EE87AC15AC3873
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ac3217b73c9a7fe926572f0f9816b5eac3527421fcbf0350855b17c1e854c5d
- MD5 4214698ad147ea8e83cc0e7dcf883db3
- SHA1 8362a128ce9965a3f0c1d2a89631c6fba7b9dc3b
- SHA512 4bd679032d486d6a71ea3ded6e448926bd4b59b16e0f1f02e1d9efda020e1fa68fbf9fec92271b917ccd9f0d61294f1e53c430b33e75ffc76ca182f083627c45
- SSDEEP 24576:HO2WmZTqz8w3VCSOllassgrzV+SPQg6NfNaJe2yXtLZxrd3sZAURMpbr+q0Rxg/d:HSCSc1rzMSTJkXtGY1iq0Rxg/pO
- TLSH T15FD5D401B3EE0E5AE5BB4B7AA4B9011146F7FC166B33D74F5548A0AA1EB3740CD523A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2681886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Management.Automation.pdb
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
320KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/TalonVista.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a690c4aaca7a9d18e3c3fbe6064aeb53938a7fb2f9f6f34eeafbcbcdd7826bc4
- MD5 5a65c188bbd5b1670a7c144a8047b204
- SHA1 79412e1b5db75cc21421a70bd17b9c6156723cd8
- SHA512 d8baa1c35ce9230afd9bedf30c0c0c7a224ef7752832991688a3249271ec3f7eae068ec113baf3a14b15f1bc7949d04cbefe587564e6c191c0ce0aa84403cf4b
- SSDEEP 3072:ebylIZ0HcdrTz1z2fjmXVTniw3lTVFwJnTlLT0syHBji4ABBnRrnv5zEanmwKlRd:o0HAnzijgAKtUT9T0si+fvBnVtnPaG
- TLSH T191249DA536012626FB2E8F7FC1A7B919E33EF7731342565F295302508F416F4A78AE18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
253954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
V~zqH
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
!+y O
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ضإدر
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ىحنه
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/TitanFind.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 830da300a32cda26f6e930876ee45815818a08fde80eb0915f923f8941b81505
- MD5 24fc58f9c2b648f9629c8d3df617b140
- SHA1 caa1e60b43152cbb307cacb4867e83b0e520f4cc
- SHA512 a7fbeebfe683bd7ef32348567d85ff5e7e399e89d89729dab20bb384d197d082fb8db7a405dc7729da4e629a79fb6bef5fff63a647dd65f98a8548d31c4039e1
- SSDEEP 6144:37zUSWUQf5wYowg/XPd38i4URU0LzvWKn8vCRs:PTQqJ/1yURP8vCR
- TLSH T1BF34AEB93C562A22DA2D973FC0D3D81CE23E86B31242665FD8A747501E266F1E75BF04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
270338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
?j>m\Ug
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
'_ g>cnl
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
قفثت
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
اتاا
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/UnityAxis.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 356593e85350876c5e661dab2bcbf05836d316902cf4a866effb06539eea04e7
- MD5 c3ef7d1336d02bcbc25bc313080d7d59
- SHA1 8635a807fae7a00711022d5cc7d4258e1df7e82b
- SHA512 50cb00b1272fea1e86b3d54995f3f46a32b9febdd19c127200abc9d9be87ff15a9a3d690a692e50df19f760581b3acb8859deab9d17c8320e77356a1ef82df85
- SSDEEP 12288:EiCNXWez+LWPx8Z8UUZV5qTmcTJfAbFZzPlauYynCjxKjlFkJ9TlKnkdoNNH+9EX:EXXHz+qPx8Z8U/TJfAbrjgJ7xSEBKnvf
- TLSH T191F4D0B538A59A67C769D73FC0D74828E13ECAB262429B5F34D307049D4B6F8D38A718
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
778242
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
f/%i
Size
205KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
yWS>9 8
Size
328KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
آضنأ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ئذجش
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Vanguard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b59e1be553220c92d51ba2bc6f995faa10232daef5dfa60df52e41afeafaa922
- MD5 6edc9641752f760e4f9d0fe7a8c3a25e
- SHA1 769bd739350fd434fb727057f6ee9b0767f09001
- SHA512 10c97ba20d075527b7ef1b528e18da4edff1a40fc2c2a447a71bf324be66578fbedf20fda7978eac160854c1f5fc2b51679245a66fdbc99a16ff15473672f90c
- SSDEEP 6144:MZE66Ln1p5eZqVHCaYYLAwe8RuHqys6KUbeeCvE2:M26c1pQZqVH4YUw5RMTsWe62
- TLSH T1ED149D787BED6619DE8E4DBD10AD861F433C8263570A22FD157642A10EB37E60793E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
FSA $n
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
#'Y)0(G
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
广阳��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
和贵��
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/VectorFlow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3935ae2d95dcb3882ed3dea9608cb6d911e583fbba631b505fefb3ef2653400a
- MD5 ec31bd12e7387a37caa3fc64b58c8b3b
- SHA1 ce670e9405aacca794c72b4a95e4df365a0bf2a2
- SHA512 5515565a4b3d377b7d45d0ed3bb666f8ba9ffea0cadcc0fa2df67dd0a3c763b1ba59a0ecaeb3c8d4b9ffc2f34f93f4fd00b0e1986cba1101c5f3ceb49c587647
- SSDEEP 1536:gUHh5VtnielcOuilKUzBzN0bUq6z3JN0/:LBTtiqcOZAUdzN0bUq612
- TLSH T1E173298969E7F469D6DFB7F705B399DE227840627B03FB260BD2CA945D136C8CA10036
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/VividSnap.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09032b654b6c0b3c2a1102239a895e6ea8ceb89a221ab15a3f117ac78d0e170c
- MD5 a54386753daa3852bf9a6a6608b6a40b
- SHA1 22b3280d16eccdc61b2a75c0c245a4705d205e64
- SHA512 59807d96c6073cc2fcc1022d795fa136c8a08377a51bcd6e3538681176fc51ac93c65fbc90d7b13f19b613630171362ba1bee21f557e5423c016b861ab368a02
- SSDEEP 6144:OiSop0TbSdlSNb2URskebZeUQmHNjB2i0nlQuvG2lS:kUmbSdlSNb2TbwUQmHNjBYnlQuvGr
- TLSH T16344AFBD355A6537C72E8B3BC3C35818E17D8AB3D2825F5F185346604F026F5EACAA18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
'xe~Yw
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
"4D
)f
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
تشدز
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
حظكأ
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/VortexLoop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f0bdcd1b977b8e1ff1a76b9e2730e055bde8a42dca805ee4ca394b3f644d867
- MD5 780282da4a2062c6822a2dfa87506d4d
- SHA1 ff025e6383d02af1ca681bd7201ccb72d41e0130
- SHA512 9e75054e0c7205dfa94bdcbea4c9c049657a2e9a78f004c5d32d89cb448d3d91f3f0b8a6f7f95331418893026dae33c2033b712b507c544ba96f5c094ce3666b
- SSDEEP 12288:hEaYXLEApbzzGHsnNk/Pz6sPRrZFBsNTjxWuJ53H:wTpb/HNYzFR/Wn53
- TLSH T14694CFAB34265522D72D933EC1E79C28F07ECEB65B826B5F299307114D066F4EB4BE04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
466946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
s~+}`H
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
VsTau^
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
جفيح
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
يآاص
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/XenonTrack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89dd2e64dcec3143d5dc4674b05c3fc91fe16ae62569396994f9c402160b7249
- MD5 e28e7b320648f887f69410816682685a
- SHA1 c16ad409d23467396076e5531d7c9a6ed050785c
- SHA512 e66af234ad1e242d278a06fb05f0dd54fb33d1da7dc2ad6a80673890f470f2d62832d488e46e4ce9282705489fab42e311360ffb19cce1b2f780e617b2b7abeb
- SSDEEP 24576:B6jLLWCs4uvW4jfb2K90oo+C8JwUZc0PY0yNuVC9Hbv50eFGPlfje7eelX6jTQa8:B6jnt7uRfbQswUZcSByYGv5uZseNpG
- TLSH T12FC56C4162C5AEAFD76C01B5B6A29A0493B5F4845B23FBC7569E237C1F2B3E00D76321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2672478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/ZenithPixel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 483b849150e3e62b70fff928608ee870501d5db6add115e0f941983187710296
- MD5 5327d62f3664e1f49ac9b1d245d997a9
- SHA1 c8826eb3a8fa4a72b744e2d7b3b49d22ff2da375
- SHA512 c4b2bb994a3d4aff32b8413047c2e3cb33c89a6ff580bfe0201bd24b14dc1c08919c0cca5f71b403f713fb428337b9ab6c140bb43018b13bcd598fedd18bb111
- SSDEEP 12288:P0OeMv3MrIb8CkZKobg3Wi1kRuSvazv+Uro:MOe+WIb8CkZLbg3Wa3Waz2j
- TLSH T16EC46E21BBE0851BD16F33B2E0E60B2A57F1E4467726EB8F548096EA5ED37534C40B93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sounds/Chat.wav
- SHA256 45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e
- MD5 832a3652fd780edcdb2439ec33532c0d
- SHA1 f0754ee6519d77700f5ee5b744b8c99386d7b577
- SHA512 3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4
- SSDEEP 768:QVPqefmaP5C3KduJn13jSHYHzIcr6DPW75Pvi3Fy5NQbIbhuJLA+LhDclY3Rp6:yP1mU5GlJnBS4TIQ6o163ofQ8b4Pfm
- TLSH T1B9235CD0E142DE00C4829D6ECE16E5E047337A95EF4B67173004BF6A39E35C2AA6E7D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Sounds/Intro.wav
- SHA256 e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
- MD5 ad3b4fae17bcabc254df49f5e76b87a6
- SHA1 1683ff029eebaffdc7a4827827da7bb361c8747e
- SHA512 3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
- SSDEEP 3072:FU3hYG9X9JzhaLL5+QYKHZDa6D+4LT92KEpcP+b8FGUt0Ybs5e9jXjubLtNmBNs9:GjVsLL5lva6D+4P9llWvaGe9CHeBNm
- TLSH T177347CD2E104A690D83989329D1669954B233AEFFF8A33353084F73674E3442DB6D6DB
- MD5 SHA1 SHA512 SSDEEP TLSH
SteamTokenLogin/XWormSteamTokenLogin.exe
- IMPHASH 351592d5ead6df0859b0cc0056827c95
- SHA256 c53e944d97dc63801bc2d7d520975fcb4ceb71911fdf04bf1c86e1489814febf
- MD5 d4007a83505ba64e22a620f08ef8cb8a
- SHA1 554b2677c0c5e66d5dfffec18f0916d6ee62ae99
- SHA512 c01538eaf3901d2a9e8a90638341701c857dc48b3b6cd946f75e20f75c02cf01585656b48d9f7a3a81ba9131faaccc6c984f87ccd984cbcbc7ac9dfbcaa33f6e
- SSDEEP 196608:pqYMFkI1AUCv3YNIGmk0xuc1NwO8urHQZD9BKG+5fc2S/ErXKEtw+B/onXmMsqgr:poKcCvHbxx9rr8u0ZDvV+53SM8+BoXZ
- TLSH T15EC63314BBD109EAF9E3E23A87508CB9D3707C032792CEDB839486212D776E51E36756
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
53040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
TranslateMessage
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
GetMessageW
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
HeapSize
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesExW
HeapReAlloc
WriteConsoleW
SetEndOfFile
FindFirstFileW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
FlushFileBuffers
SetEnvironmentVariableW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=7, id=257, version=33140,
count=141, id=1, productName=Unmarked objects,
count=27, id=260, version=35213,
count=1, id=258, version=35213,
XWormSteamTokenLogin.pyc
- SHA256 c070f4dda8adbd0d85aeb3957540fe2b0f5d08e0ff860d545ee212c7e8cd00fb
- MD5 41af5efff1ee6355a15a2bd42f70a994
- SHA1 ff26332409c73985948994a59ad908577a0c6cc2
- SHA512 f23343c65536141f46982ea5b5cd00ab941bdc31bf4c1d4d4fa8871d33cea483b172d0828e23833b3c6648aa8033a0fcc2674df07f26f61b1b841af5f2139af0
- SSDEEP 192:IB9UifMaCAWvhk/Da+ykYJoNGGxoMJaxxGLu5H16mxVh03Z7wi4FkW95kCSCyaJ2:29UTaCm/tykO6OEmxL0Jwi4eWRE2S
- TLSH T14C72A146D4C05C12EF74A076849944D4A3AD9EDBB2198A37321E32B98FDFF6A8D6530C
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V7.4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 98f0a3fe8cedb340ace6bd1dcb57360d75e52b63074fb39cad09811da8ff4378
- MD5 69798950c9f217f0f1ac75264a7fea40
- SHA1 864b00372a97975c8c56bfe56d8837b52bc038a2
- SHA512 dcf3117d985086868e88ec9f972fd80edc9185c5334498bc32a88b09d389029190cde6053b0cbbfd8c509f1804c01ff5badc64bc84f75bf7aa5e84569cf64a15
- SSDEEP 393216:bdoTzMjoCm1w7UzfRVM1EOJOy0VM4Mas+M0HKefOd1p:bdyCmG7UM1ky0VM4MvbM+1p
- TLSH T15D379F64B4B4587C91627A3B05B2170A6B38BD1AD65E75F50E8FD00E20F23F4ED2D9B8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23108414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
22.0MB
Virtual Size
22.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
lsass.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5227036b2e00655fdf927d6915654a82a57c15efe5f558d415278f91c3276377
- MD5 792cccf07231ab0f9a680e1aa5ea811a
- SHA1 94f38fbee8ed1e15a5582266ff0120fa84ce390a
- SHA512 ea08b627fd6e5e88d01ce40a3b96b73a153cbf747f5da170addb253e526458300550ebe3d7c34ad17961fa24174b6116da7a119f0e1faef6acff853d3ab1c51b
- SSDEEP 768:0oypfvJiN8xn1smM6tQW9qLTFR9fKjOwhfbXL/:NkP51sJz/FR9fKjOwxrL/
- TLSH T123035C087B944225C9FD6FB51DB3A2070771F6079A13DB4E0CD58AAA1F77AC48E017EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
neux_20aza.exe
- SHA256 d96ae7267d09b561735f379dee2960b617a706e653c83325b4be6bae19b89063
- MD5 f20bf7f9201862cee7e5c7270204a043
- SHA1 cf3bb3bf54524af2e54300fbc7d0b4262910677c
- SHA512 106abce771b5c590d79371f90506b06a54522548555c6e69f5ffca37fd4c3984c1bc965c6aaa9a078c6587da665b1d9b47f6421e37f7a30eac040db79d23c7a1
- SSDEEP 6144:lhQNj/aWMtJM304OtK4bTBw+JKjPfapWDD84gBSs+9QSQspDzl6DxAvQHrE+pFdo:MVAK4bTi+JKbCIds+y0xJewCLX
- TLSH T160C4281B2BECCF2FC58B0635F066443AF272D1167511EFB68B60A99D3B0BB42940E576
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
562KB
Virtual Size
561KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ