EclipseRAT.7z
- SHA256 e7b7cc62dc6d8111922782cecb665e68a0574e19db3de5faa5b04d896dfbbad3
Overview
overview
10Static
static
10EclipseRAT...da.dll
windows11-21h2-x64
1EclipseRAT...ey.dll
windows11-21h2-x64
1EclipseRAT...at.exe
windows11-21h2-x64
10EclipseRAT...ox.dll
windows11-21h2-x64
1EclipseRAT...re.dll
windows11-21h2-x64
1EclipseRAT...ms.dll
windows11-21h2-x64
1EclipseRAT...I2.dll
windows11-21h2-x64
1EclipseRAT...or.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...op.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...ks.dll
windows11-21h2-x64
1EclipseRAT...ry.dll
windows11-21h2-x64
1EclipseRAT...io.dll
windows11-21h2-x64
1EclipseRAT...re.dll
windows11-21h2-x64
1EclipseRAT...di.dll
windows11-21h2-x64
1EclipseRAT...pi.dll
windows11-21h2-x64
1EclipseRAT...ms.dll
windows11-21h2-x64
1EclipseRAT...MM.dll
windows11-21h2-x64
1EclipseRAT/NAudio.dll
windows11-21h2-x64
1EclipseRAT...on.dll
windows11-21h2-x64
1EclipseRAT...or.dll
windows11-21h2-x64
1EclipseRAT...rs.dll
windows11-21h2-x64
1EclipseRAT...ry.dll
windows11-21h2-x64
1EclipseRAT...ns.dll
windows11-21h2-x64
1EclipseRAT...es.dll
windows11-21h2-x64
1EclipseRAT...rs.dll
windows11-21h2-x64
1EclipseRAT...fe.dll
windows11-21h2-x64
1EclipseRAT...ol.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
EclipseRAT/Andromeda.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
EclipseRAT/Dynamitey.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
EclipseRAT/EclipseRat.exe
Resource
win11-20240508-en
windows11-21h2-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
EclipseRAT/FastColoredTextBox.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
EclipseRAT/GMap.NET.Core.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
EclipseRAT/GMap.NET.WindowsForms.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
EclipseRAT/Guna.UI2.dll
Resource
win11-20240508-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
EclipseRAT/IconExtractor.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
EclipseRAT/Microsoft.AspNetCore.Http.Features.dll
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
EclipseRAT/Microsoft.Extensions.Primitives.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
EclipseRAT/Microsoft.Threading.Tasks.Extensions.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
EclipseRAT/Microsoft.Threading.Tasks.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
EclipseRAT/Microsoft.Win32.Registry.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
EclipseRAT/NAudio.Asio.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
EclipseRAT/NAudio.Core.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
EclipseRAT/NAudio.Midi.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
EclipseRAT/NAudio.Wasapi.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
EclipseRAT/NAudio.WinForms.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
EclipseRAT/NAudio.WinMM.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
EclipseRAT/NAudio.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
EclipseRAT/Newtonsoft.Json.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
EclipseRAT/SimpleObfuscator.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
EclipseRAT/System.Buffers.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
EclipseRAT/System.Memory.dll
Resource
win11-20240508-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
EclipseRAT/System.Net.Http.Extensions.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
EclipseRAT/System.Net.Http.Primitives.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
EclipseRAT/System.Numerics.Vectors.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
EclipseRAT/System.Runtime.CompilerServices.Unsafe.dll
Resource
win11-20240419-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
EclipseRAT/System.Security.AccessControl.dll
Resource
win11-20240426-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target EclipseRAT.7z
- Size 15.3MB
- Sample240516-saw36aaa92
- SHA256 e7b7cc62dc6d8111922782cecb665e68a0574e19db3de5faa5b04d896dfbbad3
- MD5 8cdec702c27200704700afa2ba636d15
- SHA1 df9d2cf6fb2c98475d820990f3f4e9f372f8cdcf
- SHA512 5eb7aeff8250d8bdce93becddf9dec29618917aec841bb3c95ddfe1be115a667257b84b20c614037b191f6eb201be857dd076cc530d74c6e2007201144681d77
- SSDEEP 393216:YkFoU/+gA2hcv0o8k4EdMoJpCGf2ABSuZffgbdlvC:Oc+QhoLM+pSAgu1fgZla
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/EclipseRAT/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 19 IoCs
Checks for missing Authenticode signature.
resource unpack001/EclipseRAT/Andromeda.dll unpack001/EclipseRAT/Dynamitey.dll unpack001/EclipseRAT/EclipseRat.exe unpack001/EclipseRAT/FastColoredTextBox.dll unpack001/EclipseRAT/GMap.NET.Core.dll unpack001/EclipseRAT/GMap.NET.WindowsForms.dll unpack001/EclipseRAT/IconExtractor.dll unpack001/EclipseRAT/NAudio.Asio.dll unpack001/EclipseRAT/NAudio.Core.dll unpack001/EclipseRAT/NAudio.Midi.dll unpack001/EclipseRAT/NAudio.Wasapi.dll unpack001/EclipseRAT/NAudio.WinForms.dll unpack001/EclipseRAT/NAudio.WinMM.dll unpack001/EclipseRAT/NAudio.dll unpack001/EclipseRAT/Newtonsoft.Json.dll unpack001/EclipseRAT/SimpleObfuscator.dll unpack001/EclipseRAT/arkx64.dll unpack001/EclipseRAT/vk_swiftshader.dll unpack001/EclipseRAT/vulkan-1.dll
File Explorer
-
EclipseRAT.7z.7z 15.3MB
-
EclipseRAT/Andromeda.dll.dll 43KB
-
EclipseRAT/Dynamitey.dll.dll 164KB
-
EclipseRAT/Eclipse.exe.config796B
-
EclipseRAT/Eclipse.pdb859KB
-
EclipseRAT/Eclipse.xml.vbs .xml 23KB
-
EclipseRAT/EclipseRat.exe.exe 7KB
-
EclipseRAT/FastColoredTextBox.dll.dll 323KB
-
EclipseRAT/FastColoredTextBox.xml.xml 132KB
-
EclipseRAT/GMap.NET.Core.dll.dll 2.9MB
-
EclipseRAT/GMap.NET.WindowsForms.dll.dll 147KB
-
EclipseRAT/Guna.UI2.dll.dll 1.9MB
-
EclipseRAT/IconExtractor.dll.dll 10KB
-
EclipseRAT/IconExtractor.xml.xml 740B
-
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll.dll 14KB
-
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.xml.xml 2KB
-
EclipseRAT/Microsoft.AspNetCore.Http.Features.dll.dll 31KB
-
EclipseRAT/Microsoft.AspNetCore.Http.Features.xml.xml 44KB
-
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.dll.dll 20KB
-
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.xml.xml 13KB
-
EclipseRAT/Microsoft.Extensions.Primitives.dll.dll 35KB
-
EclipseRAT/Microsoft.Extensions.Primitives.xml.xml 34KB
-
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.dll.dll 46KB
-
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.xml.xml 63KB
-
EclipseRAT/Microsoft.Threading.Tasks.Extensions.dll.dll 30KB
-
EclipseRAT/Microsoft.Threading.Tasks.Extensions.xml.xml 19KB
-
EclipseRAT/Microsoft.Threading.Tasks.dll.dll 36KB
-
EclipseRAT/Microsoft.Threading.Tasks.xml.xml 49KB
-
EclipseRAT/Microsoft.Win32.Registry.dll.dll 22KB
-
EclipseRAT/Microsoft.Win32.Registry.xml92KB
-
EclipseRAT/NAudio.Asio.dll.dll 33KB
-
EclipseRAT/NAudio.Core.dll.dll 184KB
-
EclipseRAT/NAudio.Midi.dll.dll 45KB
-
EclipseRAT/NAudio.Wasapi.dll.dll 169KB
-
EclipseRAT/NAudio.WinForms.dll.dll 40KB
-
EclipseRAT/NAudio.WinMM.dll.dll 56KB
-
EclipseRAT/NAudio.dll.dll 7KB
-
EclipseRAT/NAudio.xml.xml 4KB
-
EclipseRAT/Newtonsoft.Json.dll.dll 490KB
-
EclipseRAT/Newtonsoft.Json.xml.xml 467KB
-
EclipseRAT/SimpleObfuscator.dll.dll 1.4MB
-
EclipseRAT/System.Buffers.dll.dll 27KB
-
EclipseRAT/System.Buffers.xml3KB
-
EclipseRAT/System.Memory.dll.dll 145KB
-
EclipseRAT/System.Memory.xml13KB
-
EclipseRAT/System.Net.Http.Extensions.dll.dll 21KB
-
EclipseRAT/System.Net.Http.Extensions.xml.xml 5KB
-
EclipseRAT/System.Net.Http.Primitives.dll.dll 21KB
-
EclipseRAT/System.Net.Http.Primitives.xml.xml 151B
-
EclipseRAT/System.Numerics.Vectors.dll.dll 113KB
-
EclipseRAT/System.Numerics.Vectors.xml179KB
-
EclipseRAT/System.Runtime.CompilerServices.Unsafe.dll.dll 21KB
-
EclipseRAT/System.Runtime.CompilerServices.Unsafe.xml13KB
-
EclipseRAT/System.Security.AccessControl.dll.dll 30KB
-
EclipseRAT/System.Security.AccessControl.xml215KB
-
EclipseRAT/System.Security.Principal.Windows.dll.dll 14KB
-
EclipseRAT/System.Security.Principal.Windows.xml86KB
-
EclipseRAT/arkx64.dll.dll 1.3MB
-
EclipseRAT/resources.pak9.1MB
-
EclipseRAT/v8_context_snapshot.bin643KB
-
EclipseRAT/vk_swiftshader.dll.dll 5.1MB
-
EclipseRAT/vulkan-1.dll.dll 970KB
EclipseRAT/Andromeda.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f02f37555e44c069a2cecb6d82be1a3fcc54812e10bda8eea117bd2b7c226491
- MD5 bebcfac651d4d80b53b87108f40e4058
- SHA1 50cd4fd5c5ff864f2a1803d84f3329ceb693ef4a
- SHA512 addbf8f73caf270d901eed0372dc5c795fc9349662b841419912c7bdc400fce8b28d426d71fa9c73904b9acf94c526ae6c625ac107725894a5dfbd806d6e2e56
- SSDEEP 768:P1u+uKbhZVkik8UdnGVHfSXwBQ71R8hKHWgCJwuvIxAyYQAJU+ZS2SuS8SZS9ySN:PkVAav8WChZLU+j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Whoami\Desktop\Firesharp\obj\Debug\Andromeda.pdb
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Dynamitey.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db29f47dc1918253a36a09ff5804d14ddc81098ecf627e668ca617e3a0e2ab5e
- MD5 c5fa3518d32e1e5290113ac31f3bbc6d
- SHA1 3a735f84575d3e19408f2c0b60a032166cea51a7
- SHA512 c1c508a014501f558df21ca9bc063eee1aa117a9c34617e76d9cc88f7d2d1a348377446c1f997fdff3564fe1e1424f113e36f309822563cfa1b471eb4b909a9d
- SSDEEP 3072:RnLcuy9J8ZC/jpYZ0u+yegE1My1KnSe+Iev:pLcTJ8ZC/jp+09vG+Ie
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\dynamitey\Dynamitey\obj\Release\net40\Dynamitey.pdb
mscoree
_CorDllMain
Name
.text
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Eclipse.exe.config
- SHA256 ff676c93101f6c8dc0f11f720ee2fd75a22d26ec2b8d9abe89695b3298c8046f
- MD5 ab908b46de24905e570dcfa28901de12
- SHA1 2c87e14dff480a6bf0bacf398ca840564f432785
- SHA512 dd2bbb6abafce8ff87106f39514feb6594465cedc5c2ff52eb0b0c5be2091ce3c0608fd7205f0667def1ee27d1926c857adbd1f88020b7fa0cdc72a3dab14b90
- MD5 SHA1 SHA512
EclipseRAT/Eclipse.pdb
- SHA256 8c2b3b89c2807b8b441a789815aa66db6f3a73d732d276b7d5e899b91b6ebf65
- MD5 484f67e412806447310992824f181ab0
- SHA1 659580d4ef3bd79e4a9bece8adebe1f41c885a49
- SHA512 c1c0b2d5b247d3eaabd90e8622b3096b9ecea170b544cd675aaeaff3336828aa0f2e35049ae1a92f2f4b407e28daa75ecec3cd2daa29940c742dfebb5c789f1a
- SSDEEP 12288:wgU/a8HSUbNoX5Njox1VuLJhm65IyFId:kSobA7hmaIyFe
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Eclipse.xml
- SHA256 f7013c9e7618ccb931134087d3b2bb1788f20cc1ddbe1fd866c7452538e9e76f
- MD5 2d4d3c1bbe00587860f699379bb42856
- SHA1 03d63bd338e77a24f615bb07fa7b76d4e5ba647f
- SHA512 704470f508fc575b231eb0d7144f7b173ba0ff5eaa7bad6eb69fe9e412f589d542a555be9085bfe76c8a87a5745a662a4efc0027eb47210bcacdcfacde66bf75
- SSDEEP 384:BObi90Ft0NW5ZukoQBOBykPpimCsECABV1xq0yxKKp/mt5YDOqt6H1YBrflES/Mz:kehSQu9
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/EclipseRat.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 31e6573e37d06a71b3025c0e9ed4901093ed5262bc60bbbdf7ce1ed28ebb021a
- MD5 960d70161f0ac1ddd8093955446bdcbc
- SHA1 5943c81939f9b43228e2fe2f65e90c54660ae47f
- SHA512 8f3f6091fb3d09d4cdb0f9540bbbc2de0562dd5bb77c8446db49f274be7b173cbc0aa24206e25838cc6b6c6578440c0ecfd1a17acc94c50ebd014cbe16617c14
- SSDEEP 192:+9yqvjp73xsznGjcJr9emxan6mUqlwc6nYZKvkV/9dXq:+9Jv1dOnGjcJrQmxan6m/ec6nYZSkV/2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/FastColoredTextBox.xml
- SHA256 f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027
- MD5 70d49dec6a333f1d94fb1e77c663525c
- SHA1 184b544e672f4c4cb9ed9cf010da568eed16623d
- SHA512 b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2
- SSDEEP 1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
- MD5 1915011997fdb9aa95f15e567f4e6070
- SHA1 40a7853f14d6d4919279965f026d57cf9a104998
- SHA512 5cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
- SSDEEP 24576:XJXD/hBn13g+Yi9oE7IYbO9ZY/NJdAjED+aE0qUaiIwpHQ/jz2Y:JTIYbGQdAjED+aE0LaiI
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
58:f7:61:2a:89:fd:07:27:00:87:bc:4a:ed:f1:dd:3f:c5:e9:29:c2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 21, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
2033246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c359ce857982f45b09af49dbccfb2ae302839acf1956e8325e7f854b339a8c9
- MD5 7bcf61e29e5cbcd1b81d9ab72cbfed93
- SHA1 d082613177dd1711c18426d4f83921dd932bc7b1
- SHA512 ce84af38dc63374d304d4e3b6c098892588df5ca5e921505c410b2a24ec0137dbc3120bc713cc0e4bf7836c57b7db224dd3264ea454cbfdb1ef78c9ffb19b6d9
- SSDEEP 192:vyB0L3vIFktNlrgyLY5ZJeU5cs7hnvR952:vyeL3/gyLYPJR5RJG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\my\Lib\IconExtractor\IconExtractor\obj\Release\net4\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/IconExtractor.xml
- SHA256 abd5b0adc717dba0d4b098fcef362328d42301d8dc90718390e5cdbe5eb0c267
- MD5 5df1bc39dc11a928be141edf9a30270b
- SHA1 2fd7a69633c5a2d92c087326d961915211b529c6
- SHA512 85fe57285be29735a32e6f21549e9339352c368fce15a38ba9869aa19c85eb3e25f4518dda91b4cb022fa6e03afd85db8a1986d6683f64fc072a83e42968bf0d
- MD5 SHA1 SHA512
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dc55b200190e101780720ea8c8d3b53f2b5653ebe6f0e0676f1b64595ba9d132
- MD5 4d9d797c82b0af93625718ca9012c17a
- SHA1 910eee42753057e3e1849391e5fd4746c1f876b3
- SHA512 3c812b52c00e8771849d991f8a518a0af4ad3b52332c86078a3de08077625784804ff0fd95bf568743f06cd4b26ec3b7634eb02b1aefa2394a8dfcd21dd4c369
- SSDEEP 192:RaH+I0E34OcCA8zWh6LWTWv14UgLaDyuHnhWgN7aMW2aoinEqnajxFiIi:c0W4OcD8zWh6LW+c4HRN7B+ElbiIi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e7:db:b3:36:5a:65:92:3d:92:63:7a:16:52:81:5d:fc:da:7c:e5:7e:b1:81:2f:cf:e9:59:b3:90:dc:6a:57:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
11742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Microsoft.AspNetCore.Hosting.Server.Abstractions/obj/Release/netstandard2.0/Microsoft.AspNetCore.Hosting.Server.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.xml
- SHA256 3b09892875a847bae03ce7ba112659b06c7211b204e275b17c3ba664acd2dada
- MD5 cc51d0b68fad8f0d0828ce5b6684d3f1
- SHA1 1755f89617932f3b15e6361532995c3913aa06bc
- SHA512 768784035395c6643368526a130161ccb37a2873938fc724dd04b56132869e59c7548ca4249b732f1889104ecadce645c1ee24e8f1c5f1050eb4be958e680c86
- MD5 SHA1 SHA512
EclipseRAT/Microsoft.AspNetCore.Http.Features.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 276c50519e010fab6cad092f192e470d07e44c633399a4bbe9303d9c9aed0a98
- MD5 2cc772c2e93d19e28098e17a6a6eb03d
- SHA1 790b8f91cf0688b92152112305b9c076ccb7d889
- SHA512 980eac653eaf674310b9ce543bfc967deca56b3ed47b917e4916e7a7eed13584e05deaa5639c2f3eb6e0671c2795e6948d1a22adca1d8aaecbe77696aa2088a3
- SSDEEP 384:T3IDcGf5H2ZZ6X8P1Z4MPbguVJNMU0Ecd1z2jzJNStRm2ioTTNzMSbWlzWX+VkWY:bIDcUH2ZRXPsaS3JiANzzbWzIBNnD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:2a:4a:dc:29:25:f2:83:dc:57:81:e1:dd:9f:f0:7e:d2:49:e3:9e:f4:f2:1f:be:91:81:d7:a8:01:39:e7:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
28626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Microsoft.AspNetCore.Http.Features/obj/Release/netstandard2.0/Microsoft.AspNetCore.Http.Features.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.AspNetCore.Http.Features.xml
- SHA256 aca44a8380860f8436455943096073c38517ea3ffbdd7c9a8b7268ce6d5b9228
- MD5 6f0dc6191e8a91ce494c50980b7e13a7
- SHA1 5f5d0dbba3425be8caf2995c26bc2ff435acee0f
- SHA512 1e8d1ff00c33c699a3d3d92959a638836df453d850935bf0aa6eafb59de72d795a5ea2d31d32587a430c54171b7a2d7beef8f6b3e70f4fe55d0b41e10c394453
- SSDEEP 768:84jqrx8KmTLPVM+/lvoTvovdltctQS32ci/BJSO:84jqVaPVXlvoYltctQS32h/BJV
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 32ccdb2ab4348f195d247f920d1432c0cbb1cc5fd548fec8ee562c438aa48849
- MD5 d8e064ad8f2419f204723cf7caa7ab0b
- SHA1 f19f20d758dae8563fc4914c737e06f1292f58e2
- SHA512 b2ed620bc914433435e655f7a1c956735f959c3e8c60a182d96ab0a59a54c81ffa0c52214d88c6e48ca82e198ad7e9fcb603d6dc017ec64399fcf40d3178c341
- SSDEEP 384:0aEsyjAb8TG/ZvozRjz6r5c3JABzWSPTWC4c4HRN7+eRl3t3MmW:0b/Q4JApaB+eKJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cf:6c:15:57:2f:51:4f:4b:54:76:a4:55:14:81:46:6e:16:5c:02:36:48:ec:42:ff:88:71:ae:03:c4:ff:13:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
16062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Configuration/Config.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.xml
- SHA256 e1513a8b14bb878c2895f9577389a1d3afa90ded8fcd565ec24bea2b5988a307
- MD5 fafac14a8ad00efad97d34efd4ef98b0
- SHA1 df4638bc5bf5efc045b5c86b2165ad84a76ffb5f
- SHA512 96c5aa0d6048e666a83b9f529b4d390153027f58baf10e95efb5604a26de369fc2937e6377eb4ebb3467fab3741b584b5b0e16e6dc31c3105027ddc08139cb5e
- SSDEEP 192:T+IUYvJyfAsRgE4YghPvwSG2BWpY0JQE4QqoZQ9Yfoym0:FUYvJyzNQ25ENjG
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Extensions.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 42bbc209a1a39f3bab6652478de1bc7dd240146e3b668d34253425eb663bcc4f
- MD5 30f911d2ff61105f7b5680006a9e4def
- SHA1 12285ffda48a642f3b06b06ce73f79341475c006
- SHA512 bcc6e1b979a370d1e11083327776364620e7055cf21d05f56f5867839de77c5c3823bd1adf123865533263fe7766a6fde6e66a55535c705a9097662e1181d463
- SSDEEP 768:HOBVTHyqXeGfbUnEsxaWYUeIBuiglpTcZZzBqyVO:HOvdXNN4aLUrBuiwi/zBqyVO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
58:cf:d9:33:80:1e:f9:cd:b2:2a:3c:52:d2:ad:6b:38:33:8e:24:01:0c:03:d8:0c:59:b8:2f:fe:46:39:55:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
31942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Primitives/src/obj/Release/netstandard2.0/Microsoft.Extensions.Primitives.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Extensions.Primitives.xml
- SHA256 6081738d1c70d640b35604cc36068c7d06054cf15287c4c802edb4bbd6176f3e
- MD5 45c591d76817e66a0c3d2f29d3d40319
- SHA1 79fe32ee2d6d3ff9238bb0e3891961ca4b1c163f
- SHA512 0e7454ec81a743b0e0cbe316ca77d1f554761331d5a4e6e9457b3f6708889220d6d075729343f5b4d9ed3509568c85729332c138d5dcdf8396c8159ec9f794dc
- SSDEEP 384:S0bU/w1qhU40q1zGZ+xI+xanQlRDWgS7IdVn43qyRGIVnxIo2Z5T3ZDbDK:sgRq1zGCfan2RCgS8dN49RGSnxZU5Nm
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
- MD5 e548a93d16964e52868c47cef1c98f2e
- SHA1 4b96b0aa48f6ac050a764c7d65f4129a9bb8cf21
- SHA512 fd1377b5d2d792eccf2ab9a01529838f178126fd6748da8e27cbc908ea83813fb4de021aa88989186459fef1c11be76aaf8b29b2291203d5f34f98361acf77ab
- SSDEEP 768:bsoKLggFUyETHj0Y5m64r+B6yP5wwWGZ8iJvHWrI:DKUgSyyD0Y5tVwwlZ8AWrI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
13:67:c4:ba:e2:93:bd:65:86:c6:f5:d7:c3:a6:f0:d0:68:02:49:2e:d2:ee:3e:84:02:0d:ef:5a:04:f6:d3:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
65:a4:f9:42:4e:b2:d6:f8:6d:38:be:bf:7a:f7:33:75:39:73:cd:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 7, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
36398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.Extensions.Desktop.csproj_1a077422\Release\Microsoft.Threading.Tasks.Extensions.Desktop.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.xml
- SHA256 a0424523759ca90016e19a00bb976e45a29ef0cb23b99b0bf243d3ac79aeb912
- MD5 6ff75bbb87238b3e779b2cc05bcb7fc6
- SHA1 9403b5aeac113ecdb2494f2351526b55812149d0
- SHA512 bafca1bbc3ab33d691f94d0d5877b52a94976dca325128eaff6d1af023c3d3ec56ddd1b389f37c4c4dc5247a927a96d02d020624eabca3bcd8cd75013c976016
- SSDEEP 1536:Ay7HYn40E+FIq0YNYzGJyFchKsWbPY1VVr4GrVxXL3yH:Ay7HYn40E+FIq0YNYzGJyFchKxY1VVrW
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Threading.Tasks.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
- MD5 6aa2393ff1fde1a61d0cf51730428f74
- SHA1 3c847a95a6547aa49919789d7a0cb6ed76122849
- SHA512 1af984ec56885cdea9a0e379d659b65196713571377e2db267259dbc1f8748f1a610b0183a8fea3730f0049c3468f632240475730563c6413cbc88cc76032d91
- SSDEEP 384:5qL9uaxv+fg8SA4nrzrRzoGbSOW12nWH1q//0GftpBjHoH3HRN78xLsltr/wn:+MfmrRzZ+QD8idoH5r
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
51:12:8d:19:6c:68:96:8d:65:c0:81:e5:96:de:0f:06:56:f8:d9:2f:31:1b:73:0e:8f:91:bd:0d:11:bb:8d:50
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
c3:47:c4:de:4b:ec:44:bd:02:60:10:62:63:59:8e:43:90:d5:cd:f3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 7, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
20894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.Extensions.csproj_15f6194d\Release\Microsoft.Threading.Tasks.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Threading.Tasks.Extensions.xml
- SHA256 5e6908589a0356d4e3e2abe6a44f9f4d40fa41b00bd13fea6b7ebb21054019f6
- MD5 4c9a527b716d470b70385990e9528e43
- SHA1 3b03aa6b3fd6bd27e8fd7b7dc4137d56d5db33b0
- SHA512 3e3fad0da2c663b074e732d8a7ceea379ee92ba96b9379fb4ab49a3f422202f772d24272c9eb44516371b7046d346eae591a968512a31135274bb205171b4834
- SSDEEP 384:ryZpvcRAfi6KTu6Gr1/gV0Dh0yd6/U+LUj8UwRUyO1dt:zoyQ6MJftyA
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Threading.Tasks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- MD5 d01819bfe03222dfa9e35a36555b6b6c
- SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b1:13:00:5b:36:13:ce:2f:23:c6:0d:0b:cf:75:20:94:18:94:2e:63:26:8a:ed:9d:e5:a9:f6:b2:54:92:bf:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
8a:50:28:53:0d:ab:5d:2d:e6:72:c7:e9:b0:73:fe:e5:94:2c:a4:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 7, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
26462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.csproj_97b2926c\Release\Microsoft.Threading.Tasks.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Threading.Tasks.xml
- SHA256 4d3e9cd7064ccf9d4098a4514b30a4e8c9607c63d41e60058b4f144e76d46754
- MD5 58ce53b954afa8eafee0d70787c0ccfe
- SHA1 dd265368d2a6efc12b21f5a9a6c810328754ba5d
- SHA512 9646453babe01601f59589129f0475ce2720771fbd16e0b0b418c4cfded48364cad20079d0a262ae7990190989808d85df44dadf39ca2bfc3195ef2da2076002
- SSDEEP 1536:gcJVbfz7vVnYWLALpq0iNwKDCAOuUgntfC/+eUBZAnVd/KRuBecDhE:gcJVbfz7vVnYWLALpq0iNwKDCAOuUgnt
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Microsoft.Win32.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
19162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Microsoft.Win32.Registry.xml
- SHA256 486bbb53ea7cda26d344929bd80829f604bd19713f1b39cd7a7ea956c189f324
- MD5 343b6690bbfefe724d44538b1d149367
- SHA1 1ee1734ffe8a3e12c52a5285d0e3647bb2cd5ce6
- SHA512 6b0bb40637dd695ac3cf88b6c19e58a9fecc2a1e0e756d177e37a302d85c383b53a55b0fb4c798b463378cb58f3b757cb0d2563b75f20091bf9267312caa920e
- SSDEEP 768:b17maeRYxC03ATT7weF0S4t3QZe6J6w6xo6u6sb3:b17mF0HtROzFT7
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e87935c813b7f92d358871541636918010b46384cda03a82872d5a7e95af8ad
- MD5 eca1fcebac1d36048548f0fa78ea1f00
- SHA1 ad561ec8945ce320b766f1792335969838ac1820
- SHA512 c0fdf1fbcda213b4c01e9bbf5caac2bca37a9481f1992f2cc2d5a182ceb9e2177d99bd8695583947125fff47f9d2327afe96aaa65bb4b53dd935a8d4774ba819
- SSDEEP 768:XehRrWpB5henv0HTYdpVCYKo9coe6ttHjB4L:XehRr68847UGtHF0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f297e28c7061e4294fc65a6be1629d951b0496950f0060c919fd9f305f27aa91
- MD5 306981c15e48a97621111055af6c80e0
- SHA1 02bb965bb2a8a4150461221d06f0f1cdb68b38a9
- SHA512 b14739f7cffe09b8bad2ba88c531bc3f8e00f9a4e8ab7cf5fd9db8b10bbdca391437e3f02a1d67c315ebb276329755fb8d7bab5d41ed3482d35688be0bc21ce5
- SSDEEP 3072:Fw75DbLDpM5qqDxNUZlg8hPaYnQvmPtG5EC1f+xVROY1kquSYsM+S7UV:etbLDpyTDxNUZlzaVmc5ECkVR7mfQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
191106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
182KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e2b59a26a3432dcc7105011809ea428d11ae06046c64dcfe4772683ffeeac99
- MD5 a25633defc5ae2e967d6933337ecb18b
- SHA1 8335ed274a36a6048c85aa7d518feb833d594d7e
- SHA512 8036eaf59c1cf93e3b9114c8871fb9f04a96a4a90f7f61886b6b30c102590beb6b2115292d472359479f3676c83abfb78bd272213888e838433b017f970acf2d
- SSDEEP 768:CwWDUSfzw3fpAU/rEC9iLAOQKKdMsMNjxhJUsVyae9iWvmYRMUQ6LUqu5/EAS7Bs:CwWDUuzwiU/gC9GAO7KdMsMNd3ve9lvg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c25e5c0694dc709c72fe01182db5ccfea9229f65bc7deaa9b0298234c84a8fc8
- MD5 cefea34e55fa19e89eff8460475af986
- SHA1 5870f8ec79819fed7a8980f4f4e9f5e4a106dd70
- SHA512 9cf220b2692209bc5940e895cba5ce4f1521e66d2e116620db022af2689efd41050d2b5df2ed7cf2cddb034ae4615d0243a85c2ab54e835e279053f5fc8b2bed
- SSDEEP 3072:yLGThp5D8DsebSl0UAnbfqXlA4DokMu9Sp5KjyPIVpFL02bXEA:yLGTP5D8DJbSl0UAbfqXcoslIZb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
179214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d990e527ed479f8d2a0c808bd769b7b2e03acd0693ac4e0e8843dc239189adf
- MD5 c637600f25fce3c3999a76dd7d8bb863
- SHA1 553466c88f0726019e0f427889984c7de5cc5994
- SHA512 eb98cef0fd0dec2bd48158def591e7b387c457c1287a284b9548092bbe2536c849fe1d71db51b4390efdf0a0a6040cd1a72e02deee6e58d053e64553e63f808e
- SSDEEP 768:8NMJ4j7TupqLq+VHDvtiT8dD9WCPRtbQDmZ1RCT+JjQ2fPj9N2fo:6uiqP8dRWMzbQDmPf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 33f702554e65eb282cefd6b185ffffe5da3a366af83ba0315535ab4fcfb3291c
- MD5 b573987e03c15ef1de5574e3c12bf651
- SHA1 d9ba799313d4839e7eb321ffbb202a9a1cb37f15
- SHA512 0ea9606f859f75643a99072f3223d08780899ecb25d9583c41f50eef900de0c319c16d5eb9dc9e4c0aa24a2b207e73e5b113c23cc227b4412ac67b31d112a4cb
- SSDEEP 768:XQFu51JOtZiWr3CJBTNgUEXahPrDVSve+u1tgMgGd8GbpDrXa8Rcer+7Bj:XQ8zrWr3CJZNGahP9Sv1u1tgufpDuPj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 797afeb19ec991ec660dcd20b367156fae63f9e491d5e3e40ae74d77dd5a4bd4
- MD5 6e654bbde745769e65072b5472b502b2
- SHA1 99091366d6bec66a34fbeeeb114e0f8af11db19e
- SHA512 027af0a708f34eacd7e69f7333d46a14d18b31af845fceffe390af6c8d44de690b85d6265b7cd89aa1b9f5a19461722f6685774da57157f3f2aa33beaa1e9d46
- SSDEEP 96:BBFskeJHn4jZkcLqEm5ND7AVUhkon1MrtrRGP5pkQcQDSd2E:B7kHn4kcLaD7zSon1MRljQcQDSr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net472\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/NAudio.xml
- SHA256 463fefaf3e8e89c2f6d3efabe72358a8e38ceef2eacc56aade6729b867b7defc
- MD5 e3f53c712e3db67ca24ba1096897cdb4
- SHA1 36cee1097cd8aef51bcd2472f215d6c4421f596a
- SHA512 715cbd4a083df6192279cd6cb8cc96fb411fbc63d98c8af67c5a7704b9ff7d0b78a160ab5caa9919e020d05be2299f6824299a200fe479acd8d7925e2c85c29f
- SSDEEP 48:Hojj1HFU0po61W3UggLGFlcBS6vmjO3HEcF0QNvaWU5S9Azu:c1HFyt3kei86vmjO3EoEC
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0edfac6be11732ddd99db66821ee47408c2dc1e9bed68e5ef9a8e130c565b79b
- MD5 cbd6029abaa8e977d3b7435c6f70dd0e
- SHA1 ebb89d4d7659ef77b658a86ad00dba0ead869f4c
- SHA512 96754c8a846311ca59f8ec38185c2a204017bc8bc73bae1fdee63b66f3cc459017ed34ca164b53d625abfae683683b278e1aaa66346023018411ae70fe9e8059
- SSDEEP 6144:EUjGZDUI+aj1pJcggovoff4dCWycRrMikC7qEACBdr0tqngai0p7eofLPsT:xz8Dbvon4dnkKd7Q0nyofLP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
507566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Development\Releases\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
488KB
Virtual Size
487KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/Newtonsoft.Json.xml
- SHA256 50090e2d5f180d453777d213f8b3981aa4f81deed242e159ac18de1b20554a39
- MD5 93bf6ea3562e374af6c2f1df1c91dc86
- SHA1 74ae67e9801ddd54801c696e73d201062106662c
- SHA512 53fed3fed5529a68eaae584700edfbbaf29a421a64cb07cfb9873b22a719f9b2ec8a4b8c2628263c6ecb128acd42bc919f000bfb8f9cf55098c964b5f31289ab
- SSDEEP 6144:lXkCDf/lUeZolCSsVIeR0R+CRFo9Tt82mwfTKj+spjoqoyO185QyMYFLsgfl2:j
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9444b5a41a816b193c033bec199d74cdfc8298ed8300a3c39a4e953dec137494
- MD5 b66c85efa4d6f8c698476735c1ff4ecc
- SHA1 e523519ece3200133c5077993920d14d436b8484
- SHA512 7a648b004c49074c557624254bfc5072e10b8094e49102d91406bcbac30d78293c84b8bbb4e0a522ffebb873ae4d47ce2a2888c0d858d6e3e5ffd1d1066933d4
- SSDEEP 384:HICREYcfpyXOT9Z7a6WmYWXXC77q0GftpBjmfFxT4bHRN7jzlxRx6:HIiE9QXM1KiC6bV8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b7:fd:c6:4e:3f:0e:c4:6a:46:dc:61:3d:22:32:31:cf:6a:33:a6:e7:2e:9c:36:84:16:6a:68:71:65:28:ba:4d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
88:20:b4:f5:f9:76:f7:25:eb:69:ef:08:4d:63:05:1d:06:6a:e5:e8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
17210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\500\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netstandard\System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Buffers.xml
- SHA256 5047e342f6e3860e8b37b77207d5e10c5007e07692777eb504d0ced628da022c
- MD5 0c727c6cf7e10fb85310c46ec17ac47f
- SHA1 f7c922b32655da2732cdf9e980dad7337ea87d5e
- SHA512 32d95683a8ae55e0eaa6a6c401b01e1ed50389c2382edbdd05a59a39afe78fb8bb10e49ff4696aaf702b98aee0a2ac4857ea330ae133aafeaac3b514efbe2ea4
- MD5 SHA1 SHA512
EclipseRAT/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 63cca774a231ed2f7ca888b4b6c6d2357cb4848aa3040b2f0e67430158c21ed2
- MD5 89ec6e101de3a70ed140c62c2980f24e
- SHA1 f5e64ed69c1845556038d70f88a081a92f7ea4a6
- SHA512 8af03e678ca0047e481a76a383e75c11e9474b032db4adbc7e89adff62449bd0067801a8f4a0f5d47fabafbff319d69f5d5dbdaf0d0689025490e787e7138c22
- SSDEEP 1536:7xi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6nY2F85bmhqABtl5ys1G5aVxu3c0:d0vDkSutmhFyYqA6qAVTk5SxH0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c8:1b:b5:8d:56:66:f6:ae:5d:c5:73:ba:af:b2:66:68:40:b8:c2:78:b0:73:29:3a:0d:23:45:58:f4:40:68:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
21:24:13:b2:d4:e2:4c:7a:5e:bd:c9:c4:55:80:2f:f3:cd:87:cf:65
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 6, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
136286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\65\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Memory.xml
- SHA256 d5714c96607eb1a9d0f90f57ca194d8a9c3ede0656a1d1f461e78b209f054813
- MD5 add19745a43b2515280ce24671863114
- SHA1 cf44e6557fde93288ff2567a002a69279965caba
- SHA512 8d7e564fa61411b5c28f29b07855dd112687edcb39b991803c7c7de67b6894b309102ac9b52409b56b7bb5c9101eb4cdfb21fcfbf5d835e4a153e188cb97cc87
- SSDEEP 192:19SSrAVfjSE0wxiMiLiLiXdCjticiciAiJiziPNjNei5i9zhi+ipOUTJ:1gbXKKXppPmcPi6LmJ
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/System.Net.Http.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c0bddab3c67c22716b63dd16c0ae86706ee6bbd12b66d357b9096dacc4e5917
- MD5 c070eb8eb6cac283fae57164638f9cc9
- SHA1 0dc661a49aa6a3ec69f95973a62fbc2379d35dee
- SHA512 22ba4fc9057f3c9ff59b4352dcd0eba55f67848b31337f31b0cd7da0a2f3d5b7e170f885ad519b03a0827f6863ad10411cf7200c9c5949e5d743b7086df0dda3
- SSDEEP 384:MCOi8W3Bo530GftpBjcuH3HRN726lFfQKn:ntBri2uH2MYKn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f0:cb:f2:73:8a:cb:73:72:15:55:d3:77:01:59:f1:b5:23:79:e6:08:a5:9b:e7:c3:27:2a:0f:b7:b9:7e:2e:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
6c:47:36:16:81:07:02:b5:c2:c4:7b:a2:03:44:b1:79:e3:d5:66:a5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 21, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 23, 2014 - Aug 23, 2015
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
11358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4745\2098\src\intermediate\System.Net.Http.Extensions.2.0.csproj_f427da9a\Release\System.Net.Http.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Net.Http.Extensions.xml
- SHA256 9e448cb00f3e97bc73987015ca377aabf2c71e78e0e565e5a4c3fd4f9d624d8d
- MD5 f01ea45c5a8f07c1c4961a6d2413fbe3
- SHA1 36649c13e8e44d75e1bd6bfc6bdfa44c83d21e90
- SHA512 b635549af4ea314ee3b48425d5fa142155f6975e423a46a845c9eeb0d4d6526f94fd91daac5063ea0ebed29687793d99e7c3ffa1da9ea955044efcb40aeb7c9f
- SSDEEP 48:VRbedE2vSlgOasW0GOsisYeF51aGvUlgGF51aUvklgpIyF51apIvivalW4F51Dph:VaJkJJJ7k4JD/JB
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/System.Net.Http.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 380b2e298165798db42368d066c3049c2dd8c3d3eaf1425c6a86b3647ba2b577
- MD5 c84e8005accc371bea6dd9a91ace0549
- SHA1 e98c9b6c59aa2a58611679a6c220b9edece9199c
- SHA512 b4aa79fd29a3f45078904d5c3f3f8ad8130bb9705be6224054935ad982e2da36411796a893e3f749e343756091dca1d488930ec51a30cec77f55878ab810c9f6
- SSDEEP 384:DVGy/WBbw/zX0GftpBjKkH3HRN7oSlVel:5xmZigkHowC
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2f:eb:e9:14:62:a4:73:89:c5:4b:f1:45:9b:8f:d8:6b:4b:6b:47:4f:ab:70:cc:62:42:57:00:13:8b:79:e3:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
f0:b1:9d:08:47:2c:45:46:3a:1d:41:8f:06:f9:31:ff:d2:96:12:11
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 21, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 11, 2013 - Feb 11, 2015
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
10862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4745\2098\src\intermediate\System.Net.Http.Primitives.4.0.csproj_1582a194\Release\System.Net.Http.Primitives.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Net.Http.Primitives.xml
- SHA256 8b5fe6f65f3cdba25bb72da6d6bd4fd47857d41643ecf47fe1baff59f9a71f6c
- MD5 6553c6b30bea53316bd2c9114be149dc
- SHA1 3433b0f22c537576333d70739638f784379b66e7
- SHA512 18e9178c464fd86cd00effb8b43a15fff235c96ca654b468a443baa5cdb0bc1445db0448cd5c0369ef32bf3e125277376f82e881a7e4f19339eaf83e86fa2738
- MD5 SHA1 SHA512
EclipseRAT/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a044d77edb6e8db4053bf67cc671e7687c226c1b9b0963a81ebe359ce79dfdf7
- MD5 482d88247171630099d81400dc0a1aa7
- SHA1 359f9f8a3e0ee63f9eb6bc56e3bac300c731c080
- SHA512 b14d84f24842669a09054a30e97927a02de2d113319fa80246506ec0ba9dd51d22f87a35ec7a8bbd145921acfee26a06db0006ce93fab0e108dcedff1ec3d8b0
- SSDEEP 1536:xpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQt1vOTbbe:6SyLhZ/X9xb1YKqn/unQPvOTX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:1f:d5:cc:fb:1f:1c:47:93:cf:6e:77:e3:0b:45:48:4b:05:6c:8a:a4:8c:2a:a3:8e:c9:d0:a9:9f:91:75:c0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
f3:0d:5f:81:ec:1b:a9:cf:89:e4:c5:df:fc:9a:6e:62:56:25:8a:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
103786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\500\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Numerics.Vectors.xml
- SHA256 996e11f72e5bb4f58b080ccaf94c325f8cabb175070dde109516a5069ed17708
- MD5 a556041fb2f0f8acfb89fce08a9de8f0
- SHA1 e2a3b3acb380a4eb626b44ff6ee04a37110a3389
- SHA512 116d6c3c98e0cc70718a7b0ce38826fde8ef00cfe9a8d00c721bc1bf2297f39a5b256143ba6568a87bc6d0506d53a3bae12b7899655454536dec13ac455b2a17
- SSDEEP 1536:9zlgmfTCpKdUqMGFYBlF8Yza2HbyJtJZJ9JaGN4AscoqrbuCeBqaiaIacasa7c12:9zhfTD227fX1HKg1agk
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/System.Runtime.CompilerServices.Unsafe.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bac58578ec05ecb8c234bf3402a0aa1491a5e437b03008b431e78d663ab52b78
- MD5 0f362259a185486a72628244b6a09a90
- SHA1 e52460151a5a144ffee9a4d72ec3d5d5f3ffb474
- SHA512 4b03c8a696d01776ca942a04412a4f215def4bf7532f1c2954fcbfbeb98ac1cd0779550d3543835f0942101acfce639faa8986b5df1c1f9446944f1e686e9098
- SSDEEP 384:ISOOdUvT1Dm0GftpBjAaQHRN7EVQZlcoXuLv:I+21DViuLc3IuLv
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
eb:72:7e:b0:6b:09:b4:44:ce:b5:c1:82:5b:db:9e:e5:fb:c9:73:8b:72:a8:a6:4d:f8:77:f0:e6:21:d3:71:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
PE Signature issue
Digest
f7:35:94:8f:07:83:df:36:5a:8c:92:b7:64:8c:3e:2b:bb:68:9a:d1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 6, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
12798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Runtime.CompilerServices.Unsafe.xml
- SHA256 63e32ebb4b26c25f65ddf26b5fa9d7147a9c8b45df355db90ac706afec980036
- MD5 26cd9e7e8a62bb97cace4e4ac16987a0
- SHA1 e705414be72b4866bc3ad02b9529656014c63cb1
- SHA512 aef9cf14e85d954e86b7c9a3ab35398de0e1ee97a6ce383f82bce789dcb2355c8ab781007f88b2d5e8f94d2e4cf940319fe0bf746e937f600f8425ca885973cd
- SSDEEP 384:1/uXuAB8fmAc26yQew6griJriurt8rtTpkE+EDJOgOha/MU:1/A3WfmAc2rQew6griJriurt8rtTpkEX
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
26694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Security.AccessControl.xml
- SHA256 80e7a82cc367c7443a7693ec7f1c4ebee39a02ec891a218b4653b656ec3b6e6d
- MD5 501acf59f00d746b9c6855a32714a80d
- SHA1 700239d4b2ea6d792cdd296e43705a7c421eb752
- SHA512 67ffe6ec9e9c09d3a4d867dc9881772290ec17e3df80ba9f6dba0d6426d7df3c16ed39c60c7055175dd24dc03f5ec5aa4cfaa542479bc84f237f5f6aae93a1d9
- SSDEEP 768:Y+yQfcxj1sHgM9PLog6ZbWz97mJBU/qj4ba5KwxS7N+FyvJugqCb:ixj1sHgMTb
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
- MD5 b40bda63658a012d46f930c243b77056
- SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
- SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
- SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
66:14:6a:1c:ea:9c:3d:ac:d8:5a:fb:65:4e:52:79:df:9d:05:29:ea:6b:fd:f3:7b:a3:29:c0:13:11:0a:76:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
11394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EclipseRAT/System.Security.Principal.Windows.xml
- SHA256 8e65fc9d6d70b8bdcd1501ea9c8ca236f2fdf82695ff05453616af5ef864fcdc
- MD5 e2476a35189d7d07d2340129f3d2f031
- SHA1 df0ba5ac242c5b2d684d54484ce36edc97b5b7b1
- SHA512 ad6f545920610c8a71663e9481a6f69b3a5e228c8f1866a0d9aa1c74365b58bd4427b69f5caa1499825a8995bfd0cfe0717d69886ba89baa9580a32c96ce5d60
- SSDEEP 768:Y+XykpU++oJovtXE/sca2j6tJSw9ca5+0a70m0je0C36l3XzHMBndMcoKUkA+ZKr:JjB6a36aVDy+ZK0AQQiELFTCzuB
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/arkx64.dll
- IMPHASH eb523a1a6018f1d54403a048e7843b26
- SHA256 bffb9e1b30a3db4655d29f0671caf6e50d10f047329abdb99bbb81c4c9c668cc
- MD5 4b8bb1d72dd7d6a3233bfbd7757aad8b
- SHA1 518a11b90fc87b0fc19bc0fec52dc048ca378459
- SHA512 a45e4c66f1395e34c81b481795a24aebaace684e349e02bc14b8c00d3587e5f7ddd57a8b36810b751e25244cc832a207bcd7b077bf6154c8658d778f2adbb212
- SSDEEP 24576:oOrp3UZ5Uzp7GCJOE5avlSGnwZ4MuJDCIzUvOh1Ot:oOrpWe7GeOxMGwZ45DHic
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
774384
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
chrome_elf.dll.pdb
kernel32
AcquireSRWLockExclusive
AddVectoredExceptionHandler
CloseHandle
CompareStringW
CreateDirectoryW
CreateEventW
CreateFileW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalProcessorInformation
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersionExW
GetWindowsDirectoryW
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32EnumProcessModules
K32GetMappedFileNameW
K32GetModuleFileNameExA
K32GetModuleInformation
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
LockFileEx
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
RemoveDirectoryW
RemoveVectoredExceptionHandler
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointerEx
SetLastError
SetNamedPipeHandleState
SetProcessMitigationPolicy
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SleepEx
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WerRegisterRuntimeExceptionModule
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
lstrcmpiA
lstrlenA
ntdll
NtClose
NtCreateKey
NtDeleteKey
NtOpenKeyEx
NtQueryValueKey
NtSetValueKey
RtlFormatCurrentUserKeyPath
RtlFreeUnicodeString
RtlInitUnicodeString
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ClearReportsBetween_ExportThunk
CrashForException_ExportThunk
DisableHook
DrainLog
DumpHungProcessWithPtype_ExportThunk
DumpProcessWithoutCrash
GetApplyHookResult
GetBlockedModulesCount
GetCrashReports_ExportThunk
GetCrashpadDatabasePath_ExportThunk
GetHandleVerifier
GetInstallDetailsPayload
GetUniqueBlockedModulesCount
GetUserDataDirectoryThunk
InjectDumpForHungInput_ExportThunk
IsBrowserProcess
IsExtensionPointDisableSet
IsThirdPartyInitialized
RegisterLogNotification
RequestSingleCrashUpload_ExportThunk
SetMetricsClientId
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting
Name
.text
Size
971KB
Virtual Size
971KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
60KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.crthunk
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
362B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CPADinfo
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
malloc_h
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
EclipseRAT/resources.pak
- SHA256 43a70ef718619fa77560983e1ad246ac1133042fb2fc6675a3eaf71de12266b4
- MD5 a3248235d9a5c412eaff789fc318367c
- SHA1 46265bfd6ccf55370064307ad4e3df8770a1e410
- SHA512 f3308c31a591301784d2a24e9b3a9e8d64189dfb279851c23b44a478b8a450ae0a9ea15c756b489235dcf1a0322060bae9b6a95d0ce82309e60d24232f7e3da0
- SSDEEP 196608:xEIeZpyF1gBGOXxIuMwGDK7Skr6/2oj2snmm4bdr2aN:leZp+MBIup97SkrU2AB4Jh
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/v8_context_snapshot.bin
- SHA256 38bd3610023c1f6bae1452096bdc3298a90baea4438afa08a74584aa75f997f1
- MD5 bbc5480d9f231e5d0564edbb2a53284c
- SHA1 87a6ea5db959ed7b038cc6edb2676263576490de
- SHA512 d75aaa676710b1629c3e99cd60e185e5bc67e8d9f65d3f875daa88b7fc229c430fa52d02d799a703488375be39c7ea268170e5bd21cd9ccfbc8dcd86234e6168
- SSDEEP 6144:gPm2hiHvnyB2vD5zwqIH2jjHnL3GWaa/rTKaU8STvx/scy7syEI92WkPZ2Ak:KkHPdvLHjGWaarO3/rasg2lPk
- MD5 SHA1 SHA512 SSDEEP
EclipseRAT/vk_swiftshader.dll
- IMPHASH cff2e3bc77a72caa699e7cda3a0c38d8
- SHA256 d81546bce0c5671f4101da450b62dcdd98c7c71f063b9863fcfa17c9f20f4ca9
- MD5 b0e40a40b53d79bb04c29ce593ef8c13
- SHA1 4820c6ff151578dc5cc37eea478a2a622325237d
- SHA512 08aab10fc45b6fb3d82201ddba154c132661f12fa059f6bddb4f8a4711badc9f9004fdafd12a2df7de69c49be797d19dacf9816ef19f5e10bd0070ed556c28b7
- SSDEEP 49152:C11wwg+2zcmMotjXHCT1H8mcKdPricwQ+XK2fDZEAjPe9pZzDs9VafQKkqo66lKK:m1rGM2t14ZzmVqQ3t3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
4052608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vk_swiftshader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
ConvertFiberToThread
ConvertThreadToFiberEx
CreateFiberEx
CreateFileW
CreateRemoteThreadEx
CreateThread
DeleteCriticalSection
DeleteFiber
DeleteFileW
DeleteProcThreadAttributeList
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetLogicalProcessorInformationEx
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeProcThreadAttributeList
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleTextAttribute
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
SwitchToFiber
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
user32
GetClientRect
GetDC
IsWindow
ReleaseDC
gdi32
StretchDIBits
vkAcquireNextImage2KHR
vkAcquireNextImageKHR
vkAllocateCommandBuffers
vkAllocateDescriptorSets
vkAllocateMemory
vkBeginCommandBuffer
vkBindBufferMemory
vkBindBufferMemory2
vkBindImageMemory
vkBindImageMemory2
vkCmdBeginQuery
vkCmdBeginRenderPass
vkCmdBeginRenderPass2
vkCmdBeginRendering
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkCmdBindPipeline
vkCmdBindVertexBuffers
vkCmdBindVertexBuffers2
vkCmdBlitImage
vkCmdBlitImage2
vkCmdClearAttachments
vkCmdClearColorImage
vkCmdClearDepthStencilImage
vkCmdCopyBuffer
vkCmdCopyBuffer2
vkCmdCopyBufferToImage
vkCmdCopyBufferToImage2
vkCmdCopyImage
vkCmdCopyImage2
vkCmdCopyImageToBuffer
vkCmdCopyImageToBuffer2
vkCmdCopyQueryPoolResults
vkCmdDispatch
vkCmdDispatchBase
vkCmdDispatchIndirect
vkCmdDraw
vkCmdDrawIndexed
vkCmdDrawIndexedIndirect
vkCmdDrawIndexedIndirectCount
vkCmdDrawIndirect
vkCmdDrawIndirectCount
vkCmdEndQuery
vkCmdEndRenderPass
vkCmdEndRenderPass2
vkCmdEndRendering
vkCmdExecuteCommands
vkCmdFillBuffer
vkCmdNextSubpass
vkCmdNextSubpass2
vkCmdPipelineBarrier
vkCmdPipelineBarrier2
vkCmdPushConstants
vkCmdResetEvent
vkCmdResetEvent2
vkCmdResetQueryPool
vkCmdResolveImage
vkCmdResolveImage2
vkCmdSetBlendConstants
vkCmdSetCullMode
vkCmdSetDepthBias
vkCmdSetDepthBiasEnable
vkCmdSetDepthBounds
vkCmdSetDepthBoundsTestEnable
vkCmdSetDepthCompareOp
vkCmdSetDepthTestEnable
vkCmdSetDepthWriteEnable
vkCmdSetDeviceMask
vkCmdSetEvent
vkCmdSetEvent2
vkCmdSetFrontFace
vkCmdSetLineWidth
vkCmdSetPrimitiveRestartEnable
vkCmdSetPrimitiveTopology
vkCmdSetRasterizerDiscardEnable
vkCmdSetScissor
vkCmdSetScissorWithCount
vkCmdSetStencilCompareMask
vkCmdSetStencilOp
vkCmdSetStencilReference
vkCmdSetStencilTestEnable
vkCmdSetStencilWriteMask
vkCmdSetViewport
vkCmdSetViewportWithCount
vkCmdUpdateBuffer
vkCmdWaitEvents
vkCmdWaitEvents2
vkCmdWriteTimestamp
vkCmdWriteTimestamp2
vkCreateBuffer
vkCreateBufferView
vkCreateCommandPool
vkCreateComputePipelines
vkCreateDescriptorPool
vkCreateDescriptorSetLayout
vkCreateDescriptorUpdateTemplate
vkCreateDevice
vkCreateEvent
vkCreateFence
vkCreateFramebuffer
vkCreateGraphicsPipelines
vkCreateImage
vkCreateImageView
vkCreateInstance
vkCreatePipelineCache
vkCreatePipelineLayout
vkCreatePrivateDataSlot
vkCreateQueryPool
vkCreateRenderPass
vkCreateRenderPass2
vkCreateSampler
vkCreateSamplerYcbcrConversion
vkCreateSemaphore
vkCreateShaderModule
vkCreateSwapchainKHR
vkCreateWin32SurfaceKHR
vkDestroyBuffer
vkDestroyBufferView
vkDestroyCommandPool
vkDestroyDescriptorPool
vkDestroyDescriptorSetLayout
vkDestroyDescriptorUpdateTemplate
vkDestroyDevice
vkDestroyEvent
vkDestroyFence
vkDestroyFramebuffer
vkDestroyImage
vkDestroyImageView
vkDestroyInstance
vkDestroyPipeline
vkDestroyPipelineCache
vkDestroyPipelineLayout
vkDestroyPrivateDataSlot
vkDestroyQueryPool
vkDestroyRenderPass
vkDestroySampler
vkDestroySamplerYcbcrConversion
vkDestroySemaphore
vkDestroyShaderModule
vkDestroySurfaceKHR
vkDestroySwapchainKHR
vkDeviceWaitIdle
vkEndCommandBuffer
vkEnumerateDeviceExtensionProperties
vkEnumerateDeviceLayerProperties
vkEnumerateInstanceExtensionProperties
vkEnumerateInstanceLayerProperties
vkEnumerateInstanceVersion
vkEnumeratePhysicalDeviceGroups
vkEnumeratePhysicalDevices
vkFlushMappedMemoryRanges
vkFreeCommandBuffers
vkFreeDescriptorSets
vkFreeMemory
vkGetBufferDeviceAddress
vkGetBufferMemoryRequirements
vkGetBufferMemoryRequirements2
vkGetBufferOpaqueCaptureAddress
vkGetDescriptorSetLayoutSupport
vkGetDeviceBufferMemoryRequirements
vkGetDeviceGroupPeerMemoryFeatures
vkGetDeviceGroupPresentCapabilitiesKHR
vkGetDeviceGroupSurfacePresentModesKHR
vkGetDeviceImageMemoryRequirements
vkGetDeviceImageSparseMemoryRequirements
vkGetDeviceMemoryCommitment
vkGetDeviceMemoryOpaqueCaptureAddress
vkGetDeviceProcAddr
vkGetDeviceQueue
vkGetDeviceQueue2
vkGetEventStatus
vkGetFenceStatus
vkGetImageMemoryRequirements
vkGetImageMemoryRequirements2
vkGetImageSparseMemoryRequirements
vkGetImageSparseMemoryRequirements2
vkGetImageSubresourceLayout
vkGetInstanceProcAddr
vkGetPhysicalDeviceExternalBufferProperties
vkGetPhysicalDeviceExternalFenceProperties
vkGetPhysicalDeviceExternalSemaphoreProperties
vkGetPhysicalDeviceFeatures
vkGetPhysicalDeviceFeatures2
vkGetPhysicalDeviceFormatProperties
vkGetPhysicalDeviceFormatProperties2
vkGetPhysicalDeviceImageFormatProperties
vkGetPhysicalDeviceImageFormatProperties2
vkGetPhysicalDeviceMemoryProperties
vkGetPhysicalDeviceMemoryProperties2
vkGetPhysicalDevicePresentRectanglesKHR
vkGetPhysicalDeviceProperties
vkGetPhysicalDeviceProperties2
vkGetPhysicalDeviceQueueFamilyProperties
vkGetPhysicalDeviceQueueFamilyProperties2
vkGetPhysicalDeviceSparseImageFormatProperties
vkGetPhysicalDeviceSparseImageFormatProperties2
vkGetPhysicalDeviceSurfaceCapabilities2KHR
vkGetPhysicalDeviceSurfaceCapabilitiesKHR
vkGetPhysicalDeviceSurfaceFormats2KHR
vkGetPhysicalDeviceSurfaceFormatsKHR
vkGetPhysicalDeviceSurfacePresentModesKHR
vkGetPhysicalDeviceSurfaceSupportKHR
vkGetPhysicalDeviceToolProperties
vkGetPhysicalDeviceWin32PresentationSupportKHR
vkGetPipelineCacheData
vkGetPrivateData
vkGetQueryPoolResults
vkGetRenderAreaGranularity
vkGetSemaphoreCounterValue
vkGetSwapchainImagesKHR
vkInvalidateMappedMemoryRanges
vkMapMemory
vkMergePipelineCaches
vkQueueBindSparse
vkQueuePresentKHR
vkQueueSubmit
vkQueueSubmit2
vkQueueWaitIdle
vkReleaseSwapchainImagesEXT
vkResetCommandBuffer
vkResetCommandPool
vkResetDescriptorPool
vkResetEvent
vkResetFences
vkResetQueryPool
vkSetEvent
vkSetPrivateData
vkSignalSemaphore
vkTrimCommandPool
vkUnmapMemory
vkUpdateDescriptorSetWithTemplate
vkUpdateDescriptorSets
vkWaitForFences
vkWaitSemaphores
vk_icdEnumerateAdapterPhysicalDevices
vk_icdGetInstanceProcAddr
vk_icdGetPhysicalDeviceProcAddr
vk_icdNegotiateLoaderICDInterfaceVersion
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
835KB
Virtual Size
835KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
101KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
86B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
EclipseRAT/vulkan-1.dll
- IMPHASH 1cca81ae4aa193b35ac4e7a2c9d50b0f
- SHA256 9bb9e4518b12181adabeef90cda8be63b14c48d5530edd09d3f94d6bf5dc9637
- MD5 909a565934a345ba9e03c9fee41b01b0
- SHA1 0637b6a8e8dcd1d8921b70fd287497500d6e8414
- SHA512 49a7e2dc30c62ced4e677cf9da0c0470e6c0a630527c406bf1bf389e71c5f3fce59ed15c1359f94abbf037ff27ed704386133ab5b3e63f4f7e92d526a5e3dd66
- SSDEEP 24576:AZZuQ8uG53XLvUMbJg6Z5W1DYsHq6g3P0zAk7J1eXdoG:KYL53XLvvJg6Z5W1DYsHq6g3P0zAk7J
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
470880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
vulkan-1.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetDllDirectoryA
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
advapi32
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
cfgmgr32
CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_DevNode_Status
CM_Get_Device_IDW
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
CM_Get_Sibling
CM_Locate_DevNodeW
CM_Open_DevNode_Key
vkAcquireNextImage2KHR
vkAcquireNextImageKHR
vkAllocateCommandBuffers
vkAllocateDescriptorSets
vkAllocateMemory
vkBeginCommandBuffer
vkBindBufferMemory
vkBindBufferMemory2
vkBindImageMemory
vkBindImageMemory2
vkCmdBeginQuery
vkCmdBeginRenderPass
vkCmdBeginRenderPass2
vkCmdBeginRendering
vkCmdBindDescriptorSets
vkCmdBindIndexBuffer
vkCmdBindPipeline
vkCmdBindVertexBuffers
vkCmdBindVertexBuffers2
vkCmdBlitImage
vkCmdBlitImage2
vkCmdClearAttachments
vkCmdClearColorImage
vkCmdClearDepthStencilImage
vkCmdCopyBuffer
vkCmdCopyBuffer2
vkCmdCopyBufferToImage
vkCmdCopyBufferToImage2
vkCmdCopyImage
vkCmdCopyImage2
vkCmdCopyImageToBuffer
vkCmdCopyImageToBuffer2
vkCmdCopyQueryPoolResults
vkCmdDispatch
vkCmdDispatchBase
vkCmdDispatchIndirect
vkCmdDraw
vkCmdDrawIndexed
vkCmdDrawIndexedIndirect
vkCmdDrawIndexedIndirectCount
vkCmdDrawIndirect
vkCmdDrawIndirectCount
vkCmdEndQuery
vkCmdEndRenderPass
vkCmdEndRenderPass2
vkCmdEndRendering
vkCmdExecuteCommands
vkCmdFillBuffer
vkCmdNextSubpass
vkCmdNextSubpass2
vkCmdPipelineBarrier
vkCmdPipelineBarrier2
vkCmdPushConstants
vkCmdResetEvent
vkCmdResetEvent2
vkCmdResetQueryPool
vkCmdResolveImage
vkCmdResolveImage2
vkCmdSetBlendConstants
vkCmdSetCullMode
vkCmdSetDepthBias
vkCmdSetDepthBiasEnable
vkCmdSetDepthBounds
vkCmdSetDepthBoundsTestEnable
vkCmdSetDepthCompareOp
vkCmdSetDepthTestEnable
vkCmdSetDepthWriteEnable
vkCmdSetDeviceMask
vkCmdSetEvent
vkCmdSetEvent2
vkCmdSetFrontFace
vkCmdSetLineWidth
vkCmdSetPrimitiveRestartEnable
vkCmdSetPrimitiveTopology
vkCmdSetRasterizerDiscardEnable
vkCmdSetScissor
vkCmdSetScissorWithCount
vkCmdSetStencilCompareMask
vkCmdSetStencilOp
vkCmdSetStencilReference
vkCmdSetStencilTestEnable
vkCmdSetStencilWriteMask
vkCmdSetViewport
vkCmdSetViewportWithCount
vkCmdUpdateBuffer
vkCmdWaitEvents
vkCmdWaitEvents2
vkCmdWriteTimestamp
vkCmdWriteTimestamp2
vkCreateBuffer
vkCreateBufferView
vkCreateCommandPool
vkCreateComputePipelines
vkCreateDescriptorPool
vkCreateDescriptorSetLayout
vkCreateDescriptorUpdateTemplate
vkCreateDevice
vkCreateDisplayModeKHR
vkCreateDisplayPlaneSurfaceKHR
vkCreateEvent
vkCreateFence
vkCreateFramebuffer
vkCreateGraphicsPipelines
vkCreateHeadlessSurfaceEXT
vkCreateImage
vkCreateImageView
vkCreateInstance
vkCreatePipelineCache
vkCreatePipelineLayout
vkCreatePrivateDataSlot
vkCreateQueryPool
vkCreateRenderPass
vkCreateRenderPass2
vkCreateSampler
vkCreateSamplerYcbcrConversion
vkCreateSemaphore
vkCreateShaderModule
vkCreateSharedSwapchainsKHR
vkCreateSwapchainKHR
vkCreateWin32SurfaceKHR
vkDestroyBuffer
vkDestroyBufferView
vkDestroyCommandPool
vkDestroyDescriptorPool
vkDestroyDescriptorSetLayout
vkDestroyDescriptorUpdateTemplate
vkDestroyDevice
vkDestroyEvent
vkDestroyFence
vkDestroyFramebuffer
vkDestroyImage
vkDestroyImageView
vkDestroyInstance
vkDestroyPipeline
vkDestroyPipelineCache
vkDestroyPipelineLayout
vkDestroyPrivateDataSlot
vkDestroyQueryPool
vkDestroyRenderPass
vkDestroySampler
vkDestroySamplerYcbcrConversion
vkDestroySemaphore
vkDestroyShaderModule
vkDestroySurfaceKHR
vkDestroySwapchainKHR
vkDeviceWaitIdle
vkEndCommandBuffer
vkEnumerateDeviceExtensionProperties
vkEnumerateDeviceLayerProperties
vkEnumerateInstanceExtensionProperties
vkEnumerateInstanceLayerProperties
vkEnumerateInstanceVersion
vkEnumeratePhysicalDeviceGroups
vkEnumeratePhysicalDevices
vkFlushMappedMemoryRanges
vkFreeCommandBuffers
vkFreeDescriptorSets
vkFreeMemory
vkGetBufferDeviceAddress
vkGetBufferMemoryRequirements
vkGetBufferMemoryRequirements2
vkGetBufferOpaqueCaptureAddress
vkGetDescriptorSetLayoutSupport
vkGetDeviceBufferMemoryRequirements
vkGetDeviceGroupPeerMemoryFeatures
vkGetDeviceGroupPresentCapabilitiesKHR
vkGetDeviceGroupSurfacePresentModesKHR
vkGetDeviceImageMemoryRequirements
vkGetDeviceImageSparseMemoryRequirements
vkGetDeviceMemoryCommitment
vkGetDeviceMemoryOpaqueCaptureAddress
vkGetDeviceProcAddr
vkGetDeviceQueue
vkGetDeviceQueue2
vkGetDisplayModeProperties2KHR
vkGetDisplayModePropertiesKHR
vkGetDisplayPlaneCapabilities2KHR
vkGetDisplayPlaneCapabilitiesKHR
vkGetDisplayPlaneSupportedDisplaysKHR
vkGetEventStatus
vkGetFenceStatus
vkGetImageMemoryRequirements
vkGetImageMemoryRequirements2
vkGetImageSparseMemoryRequirements
vkGetImageSparseMemoryRequirements2
vkGetImageSubresourceLayout
vkGetInstanceProcAddr
vkGetPhysicalDeviceDisplayPlaneProperties2KHR
vkGetPhysicalDeviceDisplayPlanePropertiesKHR
vkGetPhysicalDeviceDisplayProperties2KHR
vkGetPhysicalDeviceDisplayPropertiesKHR
vkGetPhysicalDeviceExternalBufferProperties
vkGetPhysicalDeviceExternalFenceProperties
vkGetPhysicalDeviceExternalSemaphoreProperties
vkGetPhysicalDeviceFeatures
vkGetPhysicalDeviceFeatures2
vkGetPhysicalDeviceFormatProperties
vkGetPhysicalDeviceFormatProperties2
vkGetPhysicalDeviceImageFormatProperties
vkGetPhysicalDeviceImageFormatProperties2
vkGetPhysicalDeviceMemoryProperties
vkGetPhysicalDeviceMemoryProperties2
vkGetPhysicalDevicePresentRectanglesKHR
vkGetPhysicalDeviceProperties
vkGetPhysicalDeviceProperties2
vkGetPhysicalDeviceQueueFamilyProperties
vkGetPhysicalDeviceQueueFamilyProperties2
vkGetPhysicalDeviceSparseImageFormatProperties
vkGetPhysicalDeviceSparseImageFormatProperties2
vkGetPhysicalDeviceSurfaceCapabilities2KHR
vkGetPhysicalDeviceSurfaceCapabilitiesKHR
vkGetPhysicalDeviceSurfaceFormats2KHR
vkGetPhysicalDeviceSurfaceFormatsKHR
vkGetPhysicalDeviceSurfacePresentModesKHR
vkGetPhysicalDeviceSurfaceSupportKHR
vkGetPhysicalDeviceToolProperties
vkGetPhysicalDeviceWin32PresentationSupportKHR
vkGetPipelineCacheData
vkGetPrivateData
vkGetQueryPoolResults
vkGetRenderAreaGranularity
vkGetSemaphoreCounterValue
vkGetSwapchainImagesKHR
vkInvalidateMappedMemoryRanges
vkMapMemory
vkMergePipelineCaches
vkQueueBindSparse
vkQueuePresentKHR
vkQueueSubmit
vkQueueSubmit2
vkQueueWaitIdle
vkResetCommandBuffer
vkResetCommandPool
vkResetDescriptorPool
vkResetEvent
vkResetFences
vkResetQueryPool
vkSetEvent
vkSetPrivateData
vkSignalSemaphore
vkTrimCommandPool
vkUnmapMemory
vkUpdateDescriptorSetWithTemplate
vkUpdateDescriptorSets
vkWaitForFences
vkWaitSemaphores
Name
.text
Size
650KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
263KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ