BLTools_v2.9_Cracked.rar
- SHA256 da5d423ee2f8103c5d68005c79e05e220177eea2e0af7d06a5666b8ceeb77c3c
Overview
overview
10Static
static
3BLTools_v2...ed.rar
windows7-x64
3BLTools_v2...ed.rar
windows10-2004-x64
10AlphaFS.dll
windows7-x64
1AlphaFS.dll
windows10-2004-x64
1BLTools Pro.exe
windows7-x64
10BLTools Pro.exe
windows10-2004-x64
10CookiesCreator.exe
windows7-x64
CookiesCreator.exe
windows10-2004-x64
1Extreme.Net.dll
windows7-x64
1Extreme.Net.dll
windows10-2004-x64
1License.dll
windows7-x64
1License.dll
windows10-2004-x64
1MaterialDe...rs.dll
windows7-x64
1MaterialDe...rs.dll
windows10-2004-x64
1MaterialDe...pf.dll
windows7-x64
1MaterialDe...pf.dll
windows10-2004-x64
1Microsoft....rs.dll
windows7-x64
1Microsoft....rs.dll
windows10-2004-x64
1Ookii.Dialogs.Wpf.dll
windows7-x64
1Ookii.Dialogs.Wpf.dll
windows10-2004-x64
1Presentati...ml.dll
windows7-x64
1Presentati...ml.dll
windows10-2004-x64
1SMDiagnostics.dll
windows7-x64
1SMDiagnostics.dll
windows10-2004-x64
1Settings.ini
windows7-x64
1Settings.ini
windows10-2004-x64
1System.Win...on.dll
windows7-x64
1System.Win...on.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BLTools_v2.9_Cracked.rar
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
BLTools_v2.9_Cracked.rar
Resource
win10v2004-20240226-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral3
Sample
AlphaFS.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AlphaFS.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
BLTools Pro.exe
Resource
win7-20240611-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral6
Sample
BLTools Pro.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral7
Sample
CookiesCreator.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
CookiesCreator.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Extreme.Net.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Extreme.Net.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
License.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
License.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MaterialDesignColors.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
MaterialDesignColors.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
MaterialDesignThemes.Wpf.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
MaterialDesignThemes.Wpf.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Microsoft.Xaml.Behaviors.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Ookii.Dialogs.Wpf.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Ookii.Dialogs.Wpf.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
PresentationFramework-SystemXml.dll
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
PresentationFramework-SystemXml.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
SMDiagnostics.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
SMDiagnostics.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Settings.ini
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Settings.ini
Resource
win10v2004-20240611-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
System.Windows.Controls.Ribbon.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
System.Windows.Controls.Ribbon.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target BLTools_v2.9_Cracked.rar
- Size 4.9MB
- Sample240625-dg6hvaxcpg
- SHA256 da5d423ee2f8103c5d68005c79e05e220177eea2e0af7d06a5666b8ceeb77c3c
- MD5 1e166404858c946e9f51828a7969e2b0
- SHA1 9a25d1a2cc8463660b1b7df048ad3c22b89f1e33
- SHA512 a3ca92100a9deb0549f3357714453f78130928feb867bf228a1c9d698f940959c0cdba628ec5391a8101c34167cda73140eb8a8a6a5e72cdb9688c3260f479ce
- SSDEEP 98304:QT7zp0szuikd5wxo82DCGIPx5KTL+8IJ79nq3iIClbxcv3UP0R:QT7eszPM5Ep3z9Xbx9P0R
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/AlphaFS.dll unpack001/BLTools Pro.exe unpack001/CookiesCreator.exe unpack001/Extreme.Net.dll unpack001/MaterialDesignColors.dll unpack001/MaterialDesignThemes.Wpf.dll unpack001/Ookii.Dialogs.Wpf.dll unpack001/PresentationFramework-SystemXml.dll unpack001/SMDiagnostics.dll unpack001/System.Windows.Controls.Ribbon.dll
File Explorer
-
BLTools_v2.9_Cracked.rar.rar 4.9MB
-
AlphaFS.dll.dll 359KB
-
BLTools Pro.exe.exe 2.4MB
-
CookiesCreator.exe.exe 200KB
-
Extreme.Net.dll.dll 121KB
-
License.dll5B
-
MaterialDesignColors.dll.dll 295KB
-
MaterialDesignThemes.Wpf.dll.dll 9.1MB
-
Microsoft.Xaml.Behaviors.dll.dll 142KB
-
Ookii.Dialogs.Wpf.dll.dll 103KB
-
PresentationFramework-SystemXml.dll.dll 8KB
-
SMDiagnostics.dll.dll 47KB
-
Settings.ini3KB
-
System.Windows.Controls.Ribbon.dll.dll 717KB
AlphaFS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd
- MD5 f2f6f6798d306d6d7df4267434b5c5f9
- SHA1 23be62c4f33fc89563defa20e43453b7cdfc9d28
- SHA512 1f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211
- SSDEEP 6144:QDyJst+jyCnzLp9hvHsPvPvPvS2JQvlojidPp:QDyJsvCnzZf4U1d
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
373054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\jjangli\Documents\GitHub\AlphaFS\AlphaFS\obj\Net452\AlphaFS.pdb
mscoree
_CorDllMain
Name
.text
Size
356KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BLTools Pro.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ca0ff532b658ce9451485b2218bb3d2c8de127ffd10f223e8ec1a4b28692cb47
- MD5 83f99f02a18a7d14ca644bdd6728f316
- SHA1 26c52db891cce149a8aec18e9a515b25eed5736e
- SHA512 11589de8094fa6df60b81c64970fad82d5c45eca207e018b93dab252cf54e33bb2fd8ada70d4180d33f4bad513c44e6dedba9b36277ec8aaa193a6418d4fa370
- SSDEEP 49152:5hvS3JoR3cgG6fQLSYRnOiBQBr3XAu0aXlpxW37XtkUbK+Aqo8:5QJo93G3HaBr3GalPe7XtfblLo8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2461246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CookiesCreator.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a61fe2cf0e51860f3bfde5b6159f926748f7d2d0b7b397831bf695f63cf99106
- MD5 aee127951627898ff120d3f4a3ada964
- SHA1 1da0e77703872601b7cd6b74a5696d286a7545af
- SHA512 221f166ba5dd946a51301bb254a433f76c6d9cdd616d8bb3c07d88a32e3be845d348975ce0166e0a004be25d696acfce84573676f52eb79951f897302ed13866
- SSDEEP 3072:C/lXPYzLKksPnCWBxfI+ieRR0bC9BxfI+iek:mCCxQ+ieRuWrxQ+ie
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
123634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extreme.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd
- MD5 f79f0e3a0361cac000e2d3553753cd68
- SHA1 4314bcef76fddc9379a8f3a266b37d685d0adb79
- SHA512 c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355
- SSDEEP 3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
129182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\scarf\source\repos\Extreme.Net\obj\Debug\Extreme.Net.pdb
mscoree
_CorDllMain
Name
.text
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
License.dll
- SHA256 04cc5b3b49a7e9e9b6c66c7be59a20992bf2653746b5d43829c383fb233f88fa
- MD5 b08a5c34cf0a06615da2ca89010d8b4f
- SHA1 626a77d86d9d12d1772f788cf67c8e77fd9f797a
- SHA512 5dce742cd0f649461b08f8f8018e0fa39ef19e813a74a91f434a15754a4fa8be83096e8fa49cf1828ac011220b7ad3724e7e4ea9cce7937a3168169d8e561b2c
- MD5 SHA1 SHA512
MaterialDesignColors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b5ec30c93b1d2b4631ee2b178750ec92e302e2e331090ec9783981b9572354f8
- MD5 5c108c4da6d03f0fa2c3b4dc7890cb52
- SHA1 48af67b6166068b6f138306bbd1157c7583c6e73
- SHA512 48d055610eead361809bd839c66ccdca1d5e0d9dffe15af9d15afa106ee7791c8b17acb91f2aba5cf3dda2997b049bcf70b43c3b56b8b01f1fc7bb845ce6c91b
- SSDEEP 1536:wr1In+fq1fDfDemxD0EsXpGX0EOAcTtU7fKoVxbzQcV:G1WB1PerAjOAj7fKoVxb1V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
307850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignColors.Wpf\obj\Release\net462\MaterialDesignColors.pdb
mscoree
_CorDllMain
Name
.text
Size
293KB
Virtual Size
292KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MaterialDesignThemes.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 344e2cee979e979932f504dc76bd75e97ae1ff46caa3fe2795adfe0a866347f7
- MD5 824cbf63999f954aa1747f79586a4d3c
- SHA1 5f1cd6346a45024bbbe09e304c12b6f6bf227d5c
- SHA512 d36149f7cb5ffc62dac6bb4521105d09fac988de567e181fdca4f23e5079aca5f4292e1d314f797f1a597263ddac0210060cb71c111565717e3a288a47770c51
- SSDEEP 98304:PW8EOPXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCRM:PW8lnJ45/9iD54+V11bFv4z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9595722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\MaterialDesignInXamlToolkit\MaterialDesignInXamlToolkit\MaterialDesignThemes.Wpf\obj\Release\net462\MaterialDesignThemes.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
9.1MB
Virtual Size
9.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Xaml.Behaviors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e77a1dd5e2df4d4af801376cc3428b082eb49fcb6e647b933967fae12ad9d5d
- MD5 95f46f34c099421d917d5feadbb33edb
- SHA1 3d1cb9cf59000012734901a35baeb3d9c1dd5db3
- SHA512 c9c9f72980316c68ad2a8dbe2c6c563c0deddfc9e845674d0e2f5313a0ae285d60a755e2ca04164f78b37a36521259307b3eb7d43f5ec9a9de5507bda7e4c1b8
- SSDEEP 3072:lN+EM1X0WlL9JAn11M1dXcGkOsizI35rCj8SIP:v+ll79in1h6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b2:63:8a:cb:ae:08:38:57:4d:ee:95:eb:a6:58:3b:10:80:3d:86:3e:1c:8f:0d:12:62:f5:87:f8:01:ae:17:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 21, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
141502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb
mscoree
_CorDllMain
Name
.text
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ookii.Dialogs.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 285aa8225732ddbcf211b1158bd6cff8bf3acbeeab69617f4be85862b7105ab5
- MD5 932ebb3f9e7113071c6a17818342b7cc
- SHA1 9ce2d08bc3840632092325abcc8d842eeb8189d4
- SHA512 6b6086cff7b916c0c4536e3c7cba4ba17d6c4be2e4a88a5877be852e197f1f9c9c120d1295acf2b4277a9badd8cfd229ef3c1ab2049d0aeec22d3033be156141
- SSDEEP 1536:qgoPBGuyAy52V+gtTLq6ZUc68h8O0SB/XBboIawHUPV5bKLh8sm6b0gl:qgwBGu2IV+ghd68WOxXBbx+5of
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
110858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\ookii-dialogs-wpf\ookii-dialogs-wpf\src\Ookii.Dialogs.Wpf\obj\Release\net462\Ookii.Dialogs.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemXml.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2222139c832cf3827122767072f7dc888f3499bfabc0ba4f60e31a44fd5c451
- MD5 df76602772b6e8b068ff808c4150fc64
- SHA1 a4af669e11bf185be865d8629ec9498ff75d081f
- SHA512 ed9ebac341547accf3e0d8c73b381b8dbc3393f8de47046c032e2a7dfffa965495b126baf5b6ee7c9460088e25734eb7ec2fef790f5bbeeef93e589a490fa907
- SSDEEP 192:0y/Rs7qoQh3vcXP+dKsY1tsbCyo+hCkPd2JCWfDW:0o4TG3k/+StfyoMCkPd20WfDW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
PresentationFramework-SystemXml.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SMDiagnostics.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82be741e31b0c14d7d58af55a6f6afb802545f6fd2e84b813bc70b1a61f32508
- MD5 19c5bfde8f37ae18d239985b01d0e32d
- SHA1 b9dca60a3498984ee6f5687324df54785e555810
- SHA512 9c4597eed270d4440a525c3ce63bd449c0e40b3035b3c0f14b10d527a5c54e9bd411eb49f0ad3a187a14982aa15f1862b65e765461455058dafe83c6101a4c64
- SSDEEP 768:GV45cPVwlDqB8XZ1wqumY7tNGJ+5Qm8tHDOMjqDxKR:GS+VDB8XZjuxGJ+5QvJqDK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
SMDiagnostics.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Settings.ini
- SHA256 2d8ea31ac3c89cbbabbb6985748ecc915ad42bacb8ecce524de20899ce4d65e1
- MD5 da3ee416f4b08e66e14dd92940846d17
- SHA1 8d201fb2931e937698825dc08b3420b9ba9c5240
- SHA512 034a6f174bfb662b5b4727fde519d97b4025c908b5b5374d5fe55a77c9b0def44db51a3104c3f79dffd0c74a6ae7e13ca6a260c8dd67b7f84510107650377665
- MD5 SHA1 SHA512
System.Windows.Controls.Ribbon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 db48e241e68be9089e3951ed62ec5ef0cc0976c9eb75a5012446da0e5368fb3f
- MD5 747335d0f0bf35643934ec98c8157b9c
- SHA1 07c906189a1970278f6ffb00da848ec13c079811
- SHA512 e2dd45d8d47f6cf30960228448e65ee6f06e836a200afbfd355cd9b27a86250be7d109cedb6832e6c5711a27cd28542cd95833cce3eb22a5642ba63caeaedfe4
- SSDEEP 12288:I4Hw9HSNAqMDcnexymWQvEXlzEOIF6HX6w:I2S4nexymWaEXlzEOIF6HX6w
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
739794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Windows.Controls.Ribbon.pdb
mscoree
_CorDllMain
Name
.text
Size
714KB
Virtual Size
714KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ