SeroXenPTO.rar
- SHA256 8ae0f170187701c391a7ef44d957dde423be508bff66e13ad7e375153230011a
General
- Target SeroXenPTO.rar
- Size 49.5MB
- Sample240404-ldwhgabh68
- SHA256 8ae0f170187701c391a7ef44d957dde423be508bff66e13ad7e375153230011a
- MD5 540f399062f2e223ff671c7d80eb2474
- SHA1 a2027ca68b1703e03a836d8e563b4770d29c5391
- SHA512 c47555a5501eb029d390711fec1cb747378e1cfd7d0f968e574295805ac2de58e509cf79ff3da8ddbe94e94e4304e6b39b28acb2a179ef6222c41bed62c894c2
- SSDEEP 1572864:uMVF3K/MX3oMWm5c/NrsDL2ZVbdo/Wk+jgIg:132pm5O1ILqc/Wnng
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Quasar family
- Quasar payload 2 IoCs
resource yara_rule static1/unpack001/SeroXenPTO/Quasar.Common.dll family_quasar static1/unpack001/SeroXenPTO/SeroXen.exe family_quasar - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SeroXenPTO/C5VM.dll unpack001/SeroXenPTO/SeroXenPTO.bin
File Explorer
-
SeroXenPTO.rar.rar 49.5MB
-
SeroXenPTO/BouncyCastle.Crypto.dll.dll 2.7MB
-
SeroXenPTO/C5VM.dll.dll 1.1MB
-
SeroXenPTO/Cake.Core.dll.dll 111KB
-
SeroXenPTO/Cake.Powershell.dll.dll 24KB
-
SeroXenPTO/Gma.System.MouseKeyHook.dll.dll 57KB
-
SeroXenPTO/Logic.NET.dll.dll 472KB
-
SeroXenPTO/Microsoft.VisualStudio.CodeCoverage.Shim.dll.dll 7KB
-
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll.dll 124KB
-
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll.dll 9KB
-
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll.dll 99KB
-
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll.dll 25KB
-
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.dll.dll 58KB
-
SeroXenPTO/Mono.Cecil.Mdb.dll.dll 43KB
-
SeroXenPTO/Mono.Cecil.Pdb.dll.dll 88KB
-
SeroXenPTO/Mono.Cecil.Rocks.dll.dll 28KB
-
SeroXenPTO/Mono.Cecil.dll.dll 338KB
-
SeroXenPTO/Open.Nat.dll.dll 69KB
-
SeroXenPTO/PTOAuth.dll.dll 2.3MB
-
SeroXenPTO/Profiles/Default.xml1016B
-
SeroXenPTO/Quasar.Common.Tests.dll.dll 7KB
-
SeroXenPTO/Quasar.Common.dll.dll 65KB
-
SeroXenPTO/Renci.SshNet.dll.dll 786KB
-
SeroXenPTO/SeroXen.exe.exe 38.6MB
-
SeroXenPTO/SeroXenPTO.bin.exe 161KB
-
SeroXenPTO/System.Management.Automation.dll.dll 353KB
-
SeroXenPTO/System.ValueTuple.dll.dll 62KB
-
SeroXenPTO/Vestris.ResourceLib.dll.dll 77KB
-
SeroXenPTO/client_obf.bin6.7MB
-
SeroXenPTO/dnlib.dll.dll 1.1MB
-
SeroXenPTO/protobuf-net.dll.dll 279KB
-
SeroXenPTO/settings.xml483B
SeroXenPTO/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1b52566d7aa215ee5583d5a5d2cfbc6cfdcd881c47c7785318552bcb41b7cff
- MD5 0b2aa376251567dbdc15b3a2a0d10c65
- SHA1 7e88ad9b36d47ec158d38f97e25f1a2a2fce014e
- SHA512 4cd784ea4fa8c51e5d9c9591b06b7b383a9713ed95a6037ff783838116dc0e24674b8e2f3a908b1e8e1dc18869e9ac5deb03ccabe3d17f18ffb13db695ce609c
- SSDEEP 49152:UEVmH5OGnsDVHKL54fKXyrJZd6HIksfqjQN/kIUcXYQ3:EH5OGIOsKXjQ3Uc73
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
37:4d:dd:80:d0:6b:63:20:d7:8c:09:38:8b:aa:f9:b6:e1:63:dd:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
2783214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/C5VM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de6f08708b8bc6562828c7787769d14752b2c1ab0b0e9b34b1ed44987bd2f842
- MD5 37691c7533a9327f520ebe21faa72191
- SHA1 328ba7fe8627883bc3e31b7bf1cd317b442a4c08
- SHA512 b6334eba7103a986d4e2c12b38f34d084ce8d6b986ccb9775ec5d623b988546ce97308ddeb0239a5ec25e9d5782a27c777af7f89e757fdd35047723c4a0afdb4
- SSDEEP 24576:sR4E2L2p0QUSOuf4bB8BSpCcpsB7cVGKjCMF4X0eHKfuJVPwgiRkj97EJXn8t7k8:YTV/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1111518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Cake.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 25fcb11500bffc21f1ae6cf3f5c4ff2e9450f41f01b6b02bcb5873f6f9b279f0
- MD5 c547895e4f6a86bf9db103260d5ce792
- SHA1 88491d4d711ccf09f50abbe8799afd27cbef5851
- SHA512 29cc3a8ea9986aabd3995fa403b919f6623226a5604ac5e073c5ef90c8c3a75845b098610e472e9e0d1bf2cc197092afc6710f1a17cc8aabc34fa71fa617c41c
- SSDEEP 1536:mSopfJvJPMCPGDFeCnyz1QECafmgOJu5a/p4D6mVENcdt6:mHJP5uDF5nEtVegOA5a/p4Z6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5d:12:0b:39:2e:a6:c7:aa:d0:0c:36:e1:b5:96:e7:d3:53:c7:ff:30
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
118478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\projects\cake\src\Cake.Core\obj\Release\Cake.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Cake.Powershell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d3494c0a006915c348d57cce502a0e56d01d6dc1631907604e95e7c323d54112
- MD5 271c0ad2a4f25c06d437254ad2d91d68
- SHA1 dc347e8af6bdf8aaa2017070166e38c73660d195
- SHA512 92e3cb01d285a93930dec1b76f9184352ba849b413b2568655f2e4a67cd480d2388caaf6b6d8dbbd7e705a693edd850d105c57b39534a352d58036b7323966f8
- SSDEEP 384:pR/zbDSq5s/W44uhQrl0qntPMN4GqTPmydIOnDg4ulTGvd:H/zbDSx/Uui5p04fPmEnD1uad
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8a:a8:10:52:a7:57:d5:83:91:65:e6:18:fa:6d:8d:7c:d6:22:4e:80
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
29530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\cake-powershell\src\Powershell\obj\Release\Cake.Powershell.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Gma.System.MouseKeyHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a62784297ff461a71e549dd75d0437d37b1cf8d2b88305c6c028ced7555213f7
- MD5 0bf4660c28d0ddf365934c1333c62c2d
- SHA1 cf6313bf4f36a00f37b546f7cc5afd93a16bd821
- SHA512 2fd46027bb551aab5fc80185d38b391d53eb34e553fe648b908301ef95a8733043f6d3efc80e547fb25adb02bead39b4c73cd9bc4643190dd128b4d36048ce0b
- SSDEEP 768:vYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8Gr:AncoU48/AzPwYpNZ6rXJ8Gr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d0:1c:3e:7f:2a:e8:8c:ff:be:e3:ea:13:b8:ad:61:b7:c0:92:ce:5b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
52410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\globalmousekeyhook\MouseKeyHook\obj\Debug\Gma.System.MouseKeyHook.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Logic.NET.dll
- SHA256 adc96b974ab1520ea0a18b7223f2e0084a52fedc4841f4074c738007fcf3b39d
- MD5 f7c48e31a7b79a58cdd0a41b6d57147d
- SHA1 6cc9ffdd9f5e70330eb12f0aea8bf890b85a2e88
- SHA512 d038abb5220a19b588bc1ad76ee10b2bd20fbfd357a5f8ae6d150a6c419648b518865f96f420c000618ec25ebccd143b0cfc91fde4d754ca6d1b10a6a27985ec
- SSDEEP 12288:RvVCoVD990usfOlCdXXJy1sw5D99GJuY9HArdoZqqiZm:R8oKdpyuw5D9wJWojgm
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d7:6e:09:70:37:50:1e:4b:b6:1f:e1:4e:fe:72:5a:ad:83:26:6f:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\C5\source\repos\Logic.NET\Logic.NET\obj\x64\Release\Logic.NET.pdb
Name
.text
Size
470KB
Virtual Size
469KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
SeroXenPTO/Microsoft.VisualStudio.CodeCoverage.Shim.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1b0c98a0ef3ab84d4dac3459bcdde70928eecb02ef4d575d3f264ff054800529
- MD5 dfefa869d2f7675dcbe00beaae68e35b
- SHA1 376832c08f93aa72fa240c63debd044426a0519f
- SHA512 c102383f5ce1b92d4b30737e8636cdb0f835aacfb479094c286b7f7f31008064f9229a460aa1e3b03c70db40b0d3d1fc2f9ff0765cba7f4b26b7c13ec06dbae1
- SSDEEP 96:CQabibnD54HXPQGxvKAWQDdiDL1Il5SWPTgleSn6WPLYu8G7GX:CqjDofNxCV1I2W7e6WT0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0a:7a:9c:00:f9:bc:ea:8b:0a:1a:1f:6d:6c:3b:ec:44:5b:cd:d0:dc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
11374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
F:\binaries\Intermediate\vset\shim.csproj_kqmet5lz\objr\x86\Microsoft.VisualStudio.CodeCoverage.Shim.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5bfc5abe8bfcf35e4562d4782e5babeb5708db2d8714fd2170212384d2652d9b
- MD5 c462573a9dd520cd2e03652ca0ec9396
- SHA1 f872d79e5027b87548d1e6e3cd66c1fe4f0efc88
- SHA512 3b021015e005fbbbcca15e3249833e53715c57d867e7f876c00a5d5943bac3c192a63b02daeefc082b7f16373eb6503da0f8ca5722a272ef6d77df39b9e23320
- SSDEEP 3072:19DFl7hiU7MK/C2ZZ6uw2HZRBUDIrmbu+c3B5HZttOPVY7PzaL2CKJ8Yo:9iUAK/CoNHZPULST3B5HZttOPVY77aac
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:bf:52:e5:b7:28:ed:8f:c9:6b:bc:e0:35:d5:3b:b3:00:0e:e2:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
131338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\4790\s\src\Adapter\MSTest.CoreAdapter\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.pdb
mscoree
_CorDllMain
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bd19ce084093cb05a4186115857fb9d474c40da992a29629333b4b4247a4dedd
- MD5 4539091fa699d00d9f55bd2281139dad
- SHA1 faccb1f6f70ea6fc19d5466b3ee53c660a313aa0
- SHA512 2bffc4db6f65a33aa925009a64eacc2e995faa82c8aac11edbba9e9b4ddb1de79af4d15e92af7644a62f6343b8170804341069ed791d892e20806499eb855682
- SSDEEP 192:uCwc44i5A4vBYfWcUeKD8xJ5zBy/TW0xk:xi5AIBIW+KDq8LW0a
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a7:d9:c5:aa:a1:d3:e2:75:6a:46:13:55:a7:dd:32:83:02:ac:d7:8b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
14278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\4790\s\src\Adapter\PlatformServices.Interface\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec9a93948560fd6f5e219e01850946ef94992e18a0309b27d8df5f3420b23ac2
- MD5 f838683824ebb1b333e7056b529e69d3
- SHA1 d268808d3eac421a69ef4bb5b38fd86e65fdbf4b
- SHA512 d4131748842e149be5a7e75a6b7f362ad572973477c74ca6b21ae276acac6359ac6f7c49d0c6fd770775a77b612ef15fa820ae87cdc285511048fa27271db3c0
- SSDEEP 1536:ftdZMxG+d5x8JcNBaVV7nOHzVbKihRauFHQgMNfaElrsff95gUdR16gKAh8W1J:f44cNBSpOHBKihRaEQAEqff9VdRf8AJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5f:65:71:f0:46:1f:d6:7c:1d:d6:18:91:1c:3b:38:1d:67:a7:c9:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
105934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\4790\s\src\Adapter\PlatformServices.Desktop\obj\Release\Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.pdb
mscoree
_CorDllMain
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 772a5b4160b0f68043e1fcf08c05fe6e7db064cc3d8fb967baaca74b52f7685c
- MD5 4777abb42cb84efcb672f88ec9c822b9
- SHA1 1920baf31c6afd29dd58a570ab6cfde4a2b0e47b
- SHA512 e39596a6dd6643aa0c4b53d95589133aeafbe0826610c08259407a24620c523d4055ced35c8fac67cd21b8aeea6d19465aaca9d76c3dadca0d2edf228094c5c0
- SSDEEP 384:grDjuKfEO77j7K+Hw63UZg+fzlgl8hb4bb/6bQfEKAM29cSaKjmST2ozngxYaWH/:EfuKfVzsgFCQxA5/mWng2O2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d3:c7:d9:ad:7e:b5:23:e9:82:75:fa:6f:d2:f6:95:1b:5e:47:0f:90
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
29698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\4790\s\src\TestFramework\Extension.Desktop\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c527e9a559da4ffec4c78e535b51d87a73703266428a6464c7fa79cbe706238
- MD5 324815abb2445918ef92d6b9ef33cb9f
- SHA1 f2c566e4013e97ee86238b4d8c3f1c05134cabd7
- SHA512 ddf842da018318baeefcc6c9e291dfaea79f970c1f5ece4b023092833b3ccf9a571c445787e2e45a1835ce8cb6edca120a7c6736521af7bce08b2b4ba2f1813e
- SSDEEP 768:kQK6GEpsh6tjavt/VhlPeMHi3klMdARhdhlD7pxva6K8W2FXvhLmiqc0WvnZHXMT:JDGEpNyr/CMfTCpRivvDWN+gqHof0q3V
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:0e:a1:3c:e4:6d:79:5a:d2:03:ce:74:d0:8c:e5:a0:ca:75:5c:5b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
63598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\4790\s\src\TestFramework\MSTest.Core\obj\Release\Microsoft.VisualStudio.TestPlatform.TestFramework.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 91d67e936fff5d3ac2749c9b13ceebbdea1b3bd4bc24c5cffe55ea9ab4f2eecd
- MD5 308bff23291c88669892a50e65652d76
- SHA1 951baafb6ae175722e3285f1908b174a83a77bf0
- SHA512 85183ee053984d7b94e727860da237f85b06042713841f467d433b4d74875be231e712dece0514bd473078a0b0bddb0803c7cf2c2d7345fa27fe541b3d41a4bd
- SSDEEP 768:sr5EYZep98C87KHeBUZwrEF7b+gxfM3AkMus4iWJq9F4CRIcZwMRTIzyAt9U2T:sr59g98C87KHeBUbwgKirbdwMRTzAt9R
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:6c:6c:d8:a4:36:06:98:60:45:94:87:5c:69:53:83:5e:7b:35:a1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
49130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f14d1eb2f0fa845bf1ec4a388024a204ff5ed8ad067740fb0372ff8f0236055
- MD5 c218304c5a8186312a9360ae28092cf4
- SHA1 d6ce633f2d43e1a7efb223604db7763e2c651442
- SHA512 a190663d5854e2ca096a8abcb2475d4ba2005cd1d9417d876cf706d1000c474c63e26c2ce52b004e50b5af6744a3f99ef215e51c44c335f43a8e7fbffe172c7b
- SSDEEP 1536:qU2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rj:t2MRtrfrR+Pe/xAiAzpQ7y1C9rj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f2:d2:2c:27:ab:1e:13:fc:dd:bf:28:47:e7:83:46:71:f9:ca:24:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
94650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 736e2df0e2365b3d25da3c76783506669b4055477a5b0b0736527985fe6a09d2
- MD5 e6195a1f9eb3b2859eded91946cc4e01
- SHA1 4eb50da3f54d8acc76e6a84ec5ce11d67418f2bd
- SHA512 e0f225f712cbb98dc2adb023ad162bee8a1a572fac5d8c8d1cebd8f2f5d49ee93c684d0393c0af447a68ac15f4cf51cb927af934fac9c682113a7236cd33070a
- SSDEEP 384:d0ve8JOuJTiC7n2NwxEXCnjB+RXcMeDz8PmR1ugLoaeuLMBG9UphJAprjEduFLHj:d+meiCyrXOwS8uRssveum1peFLHFBbOa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
31:e9:fb:33:02:07:17:f3:54:3b:7a:e0:8a:5a:78:7f:bf:f1:86:79
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
33582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f7af51f2f4daddb812dc0662d1cbcca7709009a50402ab42e93853ce5a5231f
- MD5 6930ba212fe20aed8da228fc4c9ee3c0
- SHA1 bfedc88f33504349c15bbe02a75794a40978af4f
- SHA512 4f0f852c36a37762b83a4174f37503becb667924448609c2cbfd7596239d10b5e7ef53bb1214b4f7b4c5cde42d3b9d1a70758ea422c4983b3348ba61e61f1b99
- SSDEEP 6144:ZFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusA:TdfiKI4RzWSyuR
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
84:8e:05:ae:58:45:1d:35:7a:97:64:09:34:fb:1a:d1:e6:63:f1:32
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
348638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\Release\net40\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
335KB
Virtual Size
334KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Open.Nat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcc97db5c226d251bd77f812ee1f2a02ac8f5d9b90849dfea75bf5285744b4af
- MD5 b4a7971e8670909af6c07653b22f826f
- SHA1 3d6ff9a071610b6b4b559a746fcebcccf9178f8b
- SHA512 0a128c6d07fb0054086d49ff8109537632bb09662d2e2e5f5ddd06236aa4bc40ff82a2285cf3e34e2b0ebb6fd11ca120b9cceb56241da757232aff952652da76
- SSDEEP 768:uF6vHHLFkywkNh5qtHMjkCifoydVXw5FxusiolecziijiSvD+ZGFa4Pw6OdrGHUI:KGmyJNh0tbt3MLQ9W2rG0YddF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
50:40:3c:93:34:a6:e2:f3:6b:50:54:1d:2a:c8:0f:3c:9f:86:4f:5a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
75530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/PTOAuth.dll
- IMPHASH 4453de7a211a4e62586f684333e33f76
- SHA256 4287556856619243ab4546046cea447e2481b2e7a1e7a26855f28d49918bfd87
- MD5 ced7e9cdea3c1dceedab64214c6dcb83
- SHA1 73da7147478f83db810de4680e1e4fad13281a93
- SHA512 dee3a60236f044b7bee7baa384db5b9ecaa291d83583fa40cbac561e1419a481901a728d632653c150d5588ed29336fd64473e5ec5dbf11e7ca294c8dd278faf
- SSDEEP 49152:2COdg51mM0knpovqeMWgzQ41R9aMG9rZRikJNyVAuO2HA:2Jq5EkpEqeMbz9m3RZn/n2g
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
75:c1:88:33:74:08:12:a3:88:11:a8:c2:20:16:ed:20:4e:dd:5a:5f:ea:70:52:39:7e:65:54:e7:83:74:d1:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Chains
Aug 6, 2021
PE Signature issue
Digest
29:19:8f:99:bf:0c:d9:29:c7:4c:1c:5e:0a:fa:fd:20:0e:c9:e8:24
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Chains
Aug 6, 2021
Subject
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Serial Number
1c:61:33:df:84:c8:81:cd:c0:1f:82:77:4d:bf:e2:4b
Issuer
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 30, 2021 - Jun 30, 2026
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Serial Number
1c:61:33:df:84:c8:81:cd:c0:1f:82:77:4d:bf:e2:4b
Issuer
CN=Patched.to Code Signing Certificate,OU=Development and research,O=Patched.to,1.2.840.113549.1.9.1=#0c1061646d696e40706174636865642e746f
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 30, 2021 - Jun 30, 2026
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
5010837
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxTimeoutA
CharUpperBuffW
winhttp
WinHttpReceiveResponse
crypt32
CertCloseStore
bcrypt
BCryptEncrypt
wintrust
WinVerifyTrust
credui
CredUnPackAuthenticationBufferW
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
PTOAuthCredential
PTOAuthFree
PTOAuthGet
PTOAuthSize
Name
.text
Size
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pto0
Size
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.pto1
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=153, id=261, version=29395,
count=19, id=260, version=29395,
count=14, id=260, version=30328,
count=10, id=259, version=30328,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=71, id=261, version=30328,
count=15, id=257, version=29395,
count=132, id=1, productName=Unmarked objects,
count=1, id=265, version=30401,
count=1, id=256, productName=VS2022 v17.0.0 preview2 build 30401, version=30401,
count=1, id=255, productName=VS2022 v17.0.0 preview2 build 30401, version=30401,
count=1, id=258, productName=VS2022 v17.0.0 preview2 build 30401, version=30401,
SeroXenPTO/Profiles/Default.xml
- SHA256 2b31dc602654d2ce209c69b02f5cff9046942406a76c976bda400ef47373a514
- MD5 2ffcc04969560f036c866b5de3b581fb
- SHA1 83190452d6100266f7be1ab3a91a83684b4cd6ff
- SHA512 fb387a7c436c1ffd798bb529051302da51c3a62db26233df4dce92e9f801132c48dac8871f832d8d7503f9f60a6715513701802d1e6e5f79777e7d165404a7e4
- MD5 SHA1 SHA512
SeroXenPTO/Quasar.Common.Tests.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d4e1a22b89a247dbfb98f63e82d338b2138630d6ab6b40e2192bc0eaff327d9
- MD5 a750cb6b455577ca1f5d7679cd7b3bc3
- SHA1 fd74c8f68ef0fa7d10f96289b07b5ba09b18a6a0
- SHA512 d18bac37580ae5c88637d497abed6c1bde58706a27e887085045c93c60b374600af356221b4aac4cb3aaa1d605322cfbaba96ee51e4b0c5deda518d333f2c5a4
- SSDEEP 96:5W2zmDjGTY4XpsGD/pzLrSS/B4uhCd08ijAm6tuX8G7GXUB9tY:kyTYisMFSS/B7hCd0lGIWUB9O
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
67:1a:f2:b2:66:b8:75:33:f9:f1:15:a0:42:2a:2f:d5:e2:f3:b6:d2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
11910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Quasar.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa1a9aec3a7bddd4732462c7dc48eb13fa0e7f0675a739003840be7a8ff8bc9a
- MD5 2619ca00c128ccfc2b06ccfa461bedde
- SHA1 748456ea96142bcd1df3fac6eaf23b91acfc3497
- SHA512 1615742435669132087a34fec2832f66b6476176c9b4839c5a64299a95c47ca2ffd1fdac015875178eb7d02320cd1ce0090cc908557527f5cf102ca8f38835c5
- SSDEEP 768:CiF6Vg9HIxFMu9brfp0kUE0DBTohfDgx/FDgoFzpKZL8EU4+YoIYlYEY7oAaI+wb:O5uz1eMVB9HnMPb0xsCEUa8w5QM
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
PE Signature issue
Digest
04:d4:7f:4e:49:80:90:b8:44:d7:d6:0a:35:97:82:45:54:1d:da:bc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
71922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Renci.SshNet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57e8f49f8347c5e9444c138846a85868c52829b8ee99f0bde905e4fb3127339f
- MD5 38cd4058d861c08800a2a52ab41f929d
- SHA1 9f5f747f2bd6bcb75ff2935833c617718fbe39cb
- SHA512 3e0761550179952e60263ecbe803f0fd3ed32c03712e36e4f6cde53d1a039869bb210d04c1c1bda235226d362dc93d290e7f42291822b5daea4247070a891435
- SSDEEP 12288:q5lqga6rBEEKAeWgVmfedIASjLrj3xVvPTrPTrQ2irclmKJMElmMSSMs2:SaPEKRGzGc5Dk1fr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3e:9b:7a:5e:8e:a1:77:0a:82:27:53:1e:8f:5f:31:c4:cd:1f:d9:75
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
739754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\development\SSH.NET\src\Renci.SshNet\obj\Release\net40\Renci.SshNet.pdb
mscoree
_CorDllMain
Name
.text
Size
783KB
Virtual Size
782KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/SeroXen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1
- MD5 89a7d73bad622bbd0b9dfb8e80f8c42e
- SHA1 f1ac96f1d956254c6b2209f457355da89c987d8f
- SHA512 760e8e7087ac107ec9e12caaa26968142ddd62ddd82d0e6abfcaa35de8f03917323e97147e72b63fb3dca27756726f4f8fa68f89f9e5acc70898c4c4b0a7bdd0
- SSDEEP 786432:anvEMOXrlkmTo5oJqpP2jXHUOqL4UoncLbd+fMY4RPHpHCpqBa4CE:anMMIrX05LsT0OqL4Uocd+fM/PlCpqcE
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
PE Signature issue
Digest
92:91:9c:08:de:7b:01:3c:33:6c:21:e5:08:45:c9:fd:94:9b:f3:6e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
40395734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
38.5MB
Virtual Size
38.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/SeroXenPTO.bin
- SHA256 a601e5352480503c69e2baa53c589a40881051965b4220bed1c17a5b36735b35
- MD5 839acc7894ecd3b706277a7c754d1ab3
- SHA1 03ceb5f2f82b4e2f6a1b41da9300564d78e0b13d
- SHA512 46a713c005b2acc8db03023c63073603fc4a10e578429fe3783279e739b57942892ef5332e8ecf72e7157c50ee02ab1f10a3e681399e72b83714730f945314fd
- SSDEEP 3072:olAIk5qzYHg7n2BqNX4GECtRBZAk+5mELcWeKbYj5CSqKZb:O0i2BqR4GE6bx4IhKbKU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
SeroXenPTO/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 45b9f7a9304d95782b7a33c56f244273610b55d09c0cc4606ff0e60a1d691fce
- MD5 fcdd963b1a3396feddce34580fd3ae1a
- SHA1 97f2cccbdfba8dabc478c7c396e3911efeb42b2c
- SHA512 5a2000f60269a7fd793a1a6d3a5d72627ec4941f18f56a054b8b44bdd1ee1da894e088c474d89ef122a3a5d423c7d0553ac87a22ed8ff596f6e61bc0c0cf27e8
- SSDEEP 3072:3/SDqTIE+QQVVBCTmAG17iT+Lt8D/1L2iLZdrs81sDotEKjRmarzRm+5gSBZqoEA:3/PXS6WK2iLZdgotEKj9rzRmkgSBAotp
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1c:14:c3:36:cb:e7:4b:09:75:6c:22:cc:fb:67:e9:69:55:ae:14:fc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
359678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/System.ValueTuple.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c4dd509d90986971ff0734d78b0706ce6ee439a0e6486993160939cd4536fdf
- MD5 8263620fe149733bf77dbbc1ed0404d6
- SHA1 f33de515add1dfe9d661b715a0320281809e8e56
- SHA512 1a13cb3aed5d5018099d9945a03265f4a52229b77cdbd6d30fa88d2f5dee1231719528e16f196b3a378615f9c7b2b8c12985355ea116a4f79ce0060a074e8cad
- SSDEEP 1536:Q784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaAa:Q7N1r9KGI04CCAa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e0:5a:d1:da:4b:60:60:fb:28:f2:b5:1c:59:6c:d7:66:96:16:eb:e0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
68586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2025cea895d10ef139c8a15b7dbe44a788527803109916b24418b3f69211a22d
- MD5 05a261f82ee764da3538bfe315267c13
- SHA1 3d5753a08b28ef4a15e0743ebef206a9e8e9b0bb
- SHA512 8179c33ecc760d74c18583342ade2c9bc3e97ddeaee59470326ea1e4740f40772a22ad321b61149bdd9cc8bf4156d3942009ae9d2fd5ca70ff6780b2e8e70dc6
- SSDEEP 1536:KSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7n/:KJYD0Z9FGu11teI1r9ea3/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a1:e7:cd:a8:ae:d8:2e:0e:29:0b:8d:23:e1:a3:df:a8:4a:2a:08:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/client_obf.bin
- SHA256 5cc3069b04a6c3dfe0a530aa2b1266fd0566ad506ee5068bf31e284e0713dedf
- MD5 0baaafdb29d86302709539592862b6de
- SHA1 482929f569cacdff7546c2a50e8ccfac91106741
- SHA512 eebe3b250da6434b5a1653ac798685cbb1532768dda9db4c7d25a10ec41c58ef298896ecefd18d814b5fe9fb8930aa226905432ac80dcab138a21e3be9d802c5
- SSDEEP 98304:kY7MUd8P9deVbyoInY0ya1zPxxW4fHmpYlExIkj5pZUQdFl4/gwJjGC0dpXZdNdM:kY7M08PLtnYexRvcQE2C5xaYwJjGC2Fw
- MD5 SHA1 SHA512 SSDEEP
SeroXenPTO/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d6ef70286bdc71c9973aae7069b038bb245ffb83234f98a56359b613810d392
- MD5 c044f897673c5d72f631204d36d0dcad
- SHA1 6965c721fd730787f505bc6ed630f065b5fcfc19
- SHA512 5d34825accbbb5afc75fa3932de089430a4184e19f9b35ff7d02e0240445d44e1d8642c0487dd0cfa10791c31696de18cfbee0b626374e7729a428e0de4bb12d
- SSDEEP 24576:IHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcMEE:jm/BQWgwwb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
79:28:90:20:b6:c8:23:95:7d:ad:2c:81:09:76:ac:82:d1:cc:3a:29
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
1167430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ef3c0837dccaaeaf80df19de3bf5b1924afb0dff0971528d0238fc7fab8bc94c
- MD5 b56edaf753f06bb4d799708df3bca66e
- SHA1 e3473ec064a0991312b208f2b905cf46c1975e67
- SHA512 817d6c93a5e5a9e4f5e51e0f11728809aea1dea55f484771fed241f3106e4e2963402f7daa6715f2a089a754e4c9c9ccb29f9835ade829dedad9c373cd4f3507
- SSDEEP 6144:6kWu4n53u8Q5w+8yxIxM2NUpwMTRHslVzs:H4n5e8kXOMkUp9GlVA
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
35:4a:a9:1b:7b:0e:7d:52:0a:9d:c2:b8:a3:a1:82:e6:01:cb:5f:55
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Chains
Mar 29, 2024
Subject
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Serial Number
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Issuer
CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}
Timespan
Jul 29, 2022 - Jul 29, 2023
Minor OS version
0
Major OS version
4
Entry point
290498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SeroXenPTO/settings.xml
- SHA256 dad7cd2b6fc0503f2f6e3452619958094ff82af090759482726dd015b1218fd9
- MD5 eaae4aa79a0f1b881d61626f568f5ce6
- SHA1 c0f6b3366d22a8f899484d8306e0601ca3516fac
- SHA512 20366806db45990b6d4480ac79372a7ca7ace552f50f79f12f320e09e7199909894fb151f0fc3269dea3aba97e865a474602c21f5369069f675600fe498702e8
- MD5 SHA1 SHA512