Liberium 2.1.zip
- SHA256 485ac0a2e429f186f2e86e94441fc9befdbd58d2e863246e2751efe61ec264b3
Password
123
Behavioral task
behavioral1
Sample
Liberium 2.1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Liberium 2.1.zip
- Size 21.7MB
- Sample240905-nnqfbazcln
- SHA256 485ac0a2e429f186f2e86e94441fc9befdbd58d2e863246e2751efe61ec264b3
- MD5 284984eb1c34f255c4025b5253d1ffca
- SHA1 f7566176dc4dc048cc4c59dd272408614b8cd07c
- SHA512 152d4c0e2844af9d7a592101b8962350f12b0a4de49006d4e46386475501be4033ad3cc32b629d287f93af79a096b16654184f62c80fdace8c674e47ac592ada
- SSDEEP 393216:FIVFI090JId0F2LP5aYf0MohpcrzTsUKZLvmbAqgefm9GILzjw2jWti26utQ9QbH:I++06d08tu1mDsVZLvXqzgLDsg3ubtDB
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Scripts/sigthief.exe pyinstaller - Unsigned PE 70 IoCs
Checks for missing Authenticode signature.
resource unpack001/GMap.NET.Core.dll unpack001/GMap.NET.WindowsForms.dll unpack001/IconExtractor.dll unpack001/Leb128.dll unpack001/Liberium 2.1.exe unpack001/MaterialSkin.dll unpack001/NAudio.Asio.dll unpack001/NAudio.Core.dll unpack001/NAudio.Midi.dll unpack001/NAudio.Wasapi.dll unpack001/NAudio.WinForms.dll unpack001/NAudio.WinMM.dll unpack001/NAudio.dll unpack001/Plugin/Action.dll unpack001/Plugin/AntiProcess.dll unpack001/Plugin/AutoRun.dll unpack001/Plugin/BotKiller.dll unpack001/Plugin/BotSpeaker.dll unpack001/Plugin/Camera.dll unpack001/Plugin/Chat.dll unpack001/Plugin/Clipboard.dll unpack001/Plugin/Clipper.dll unpack001/Plugin/DDos.dll unpack001/Plugin/Desktop.dll unpack001/Plugin/DeviceManager.dll unpack001/Plugin/Explorer.dll unpack001/Plugin/FileSearcher.dll unpack001/Plugin/Fun.dll unpack001/Plugin/HVNC.dll unpack001/Plugin/HostsFile.dll unpack001/Plugin/Injector.dll unpack001/Plugin/KeyLogger.dll unpack001/Plugin/KeyLoggerPanel.dll unpack001/Plugin/KeyLoggerRemover.dll unpack001/Plugin/Map.dll unpack001/Plugin/Microphone.dll unpack001/Plugin/MinerEtc.dll unpack001/Plugin/MinerRigel.dll unpack001/Plugin/MinerXMR.dll unpack001/Plugin/Netstat.dll unpack001/Plugin/Notepad.dll unpack001/Plugin/Performance.dll unpack001/Plugin/Process.dll unpack001/Plugin/Programs.dll unpack001/Plugin/Regedit.dll unpack001/Plugin/ReportWindow.dll unpack001/Plugin/ReverseProxy.dll unpack001/Plugin/ReverseProxyR.dll unpack001/Plugin/SendFile.dll unpack001/Plugin/Service.dll unpack001/Plugin/Shell.dll unpack001/Plugin/StealthSaver.dll unpack001/Plugin/SysPlug.dll unpack001/Plugin/SystemSound.dll unpack001/Plugin/UAC.dll unpack001/Plugin/Volume.dll unpack001/Plugin/Window.dll unpack001/Plugin/Worm.dll unpack001/RjControls.dll unpack001/Scripts/sigthief.exe unpack001/Stub/Client.exe unpack001/Stub/Dropper.exe unpack001/Stub/Joiner.exe unpack001/Stub/KeyLogger.exe unpack001/Stub/UserMode.obf.dll unpack001/Stub/Winlocker.exe unpack001/Vestris.ResourceLib.dll unpack001/WinFormAnimation.dll unpack001/cGeoIp.dll unpack001/dnlib.dll
File Explorer
-
Liberium 2.1.zip.zip 21.7MB
-
BouncyCastle.Crypto.dll.dll 3.2MB
-
EntityFramework.SqlServer.dll.dll 577KB
-
EntityFramework.dll.dll 4.8MB
-
GMap.NET.Core.dll.dll 304KB
-
GMap.NET.WindowsForms.dll.dll 154KB
-
IconExtractor.dll.dll 10KB
-
Leb128.dll.dll 7KB
-
Liberium 2.1.exe.exe 6.1MB
-
MaterialSkin.dll.dll 6.4MB
-
Microsoft.Win32.Registry.dll.dll 22KB
-
NAudio.Asio.dll.dll 33KB
-
NAudio.Core.dll.dll 183KB
-
NAudio.Midi.dll.dll 45KB
-
NAudio.Wasapi.dll.dll 175KB
-
NAudio.WinForms.dll.dll 40KB
-
NAudio.WinMM.dll.dll 56KB
-
NAudio.dll.dll 7KB
-
Newtonsoft.Json.dll.dll 695KB
-
Plugin/Action.dll.dll .ps1 27KB
-
Plugin/AntiProcess.dll.dll 10KB
-
Plugin/AutoRun.dll.dll 357KB
-
Plugin/BotKiller.dll.dll .ps1 26KB
-
Plugin/BotSpeaker.dll.dll 14KB
-
Plugin/Camera.dll.dll 98KB
-
Plugin/Chat.dll.dll 47KB
-
Plugin/Clipboard.dll.dll 13KB
-
Plugin/Clipper.dll.dll 15KB
-
Plugin/DDos.dll.dll 113KB
-
Plugin/Desktop.dll.dll 779KB
-
Plugin/DeviceManager.dll.dll 14KB
-
Plugin/Explorer.dll.dll 499KB
-
Plugin/FileSearcher.dll.dll 15KB
-
Plugin/Fun.dll.dll 48KB
-
Plugin/HVNC.dll.dll 39KB
-
Plugin/HostsFile.dll.dll 13KB
-
Plugin/Injector.dll.dll 50KB
-
Plugin/KeyLogger.dll.dll 17KB
-
Plugin/KeyLoggerPanel.dll.dll 13KB
-
Plugin/KeyLoggerRemover.dll.dll 6KB
-
Plugin/Map.dll.dll 13KB
-
Plugin/Microphone.dll.dll 509KB
-
Plugin/MinerEtc.dll.dll 24KB
-
Plugin/MinerRigel.dll.dll 21KB
-
Plugin/MinerXMR.dll.dll 26KB
-
Plugin/Netstat.dll.dll 19KB
-
Plugin/Notepad.dll.dll 13KB
-
Plugin/Performance.dll.dll 15KB
-
Plugin/Process.dll.dll 16KB
-
Plugin/Programs.dll.dll 17KB
-
Plugin/Regedit.dll.dll 32KB
-
Plugin/ReportWindow.dll.dll 13KB
-
Plugin/ReverseProxy.dll.dll 15KB
-
Plugin/ReverseProxyR.dll.dll 15KB
-
Plugin/SendFile.dll.dll 24KB
-
Plugin/Service.dll.dll 14KB
-
Plugin/Shell.dll.dll 16KB
-
Plugin/StealthSaver.dll.dll 221KB
-
Plugin/SysPlug.dll.dll 13KB
-
Plugin/SystemSound.dll.dll 507KB
-
Plugin/UAC.dll.dll 24KB
-
Plugin/Volume.dll.dll 502KB
-
Plugin/Window.dll.dll 16KB
-
Plugin/Worm.dll.dll 3.0MB
-
RjControls.dll.dll 31KB
-
Scripts/sigthief.exe.exe 6.4MB
-
ServerCertificate.p124KB
-
Signatures/Exodus.exe_sig4KB
-
Signatures/FL64.exe_sig7KB
-
Signatures/MarketApp.exe_sig25KB
-
Signatures/NVIDIA GeForce Experience.exe_sig9KB
-
Signatures/NordVPN.exe_sig14KB
-
Signatures/RGBFusion.exe_sig8KB
-
Signatures/TLauncher.exe_sig17KB
-
Signatures/TOTALCMD64.EXE_sig10KB
-
Signatures/Update.exe_sig19KB
-
Signatures/Wireshark.exe_sig8KB
-
Signatures/brave.exe_sig10KB
-
Signatures/chrome.exe_sig10KB
-
Signatures/clion64.exe_sig11KB
-
Signatures/firefox.exe_sig10KB
-
Signatures/iVMS-4200.Framework.C.exe_sig21KB
-
Signatures/idea64.exe_sig11KB
-
Signatures/logi_crashpad_handler.exe_sig10KB
-
Signatures/obs64.exe_sig9KB
-
Signatures/phpstorm64.exe_sig11KB
-
Signatures/rufus-3.21p.exe_sig9KB
-
Signatures/steam.exe_sig11KB
-
Stub/Client.exe.exe 43KB
-
Stub/Dropper.exe.exe 9KB
-
Stub/Joiner.exe.exe 9KB
-
Stub/KeyLogger.exe.exe 11KB
-
Stub/UserMode.obf.dll.dll 136KB
-
Stub/Winlocker.exe.exe 30KB
-
System.Data.SQLite.EF6.dll.dll 196KB
-
System.Data.SQLite.Linq.dll.dll 196KB
-
System.Data.SQLite.dll.dll 384KB
-
System.Data.SqlClient.dll.dll 217KB
-
System.Security.AccessControl.dll.dll 30KB
-
System.Security.Principal.Windows.dll.dll 17KB
-
Vestris.ResourceLib.dll.dll 76KB
-
WinFormAnimation.dll.dll 37KB
-
cGeoIp.dll.dll 2.3MB
-
dnlib.dll.dll 1.1MB
-
x64/SQLite.Interop.dll.dll 1.7MB
-
x86/SQLite.Interop.dll.dll 1.3MB
BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- MD5 SHA1 SHA512 SSDEEP
Password
123
Digest
f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 19, 2021
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 18, 2020 - Mar 23, 2023
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
3221146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EntityFramework.SqlServer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- MD5 SHA1 SHA512 SSDEEP
Password
123
PE Signature issue
Digest
8e:c5:11:28:68:d6:51:bd:1d:88:7b:a2:95:b6:a4:1e:10:90:40:df:99:35:39:92:62:d9:0a:b7:28:af:67:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
587890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/EntityFramework.SqlServer/Release/net45/EntityFramework.SqlServer.pdb
mscoree
_CorDllMain
Name
.text
Size
566KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EntityFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- MD5 SHA1 SHA512 SSDEEP
Password
123
PE Signature issue
Digest
4b:23:17:75:a0:e1:0d:cf:78:75:af:e9:4d:d3:dd:b6:84:55:8d:90:dc:2a:e5:20:27:57:dd:97:7a:9e:24:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
4947982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/EntityFramework/Release/net45/EntityFramework.pdb
mscoree
_CorDllMain
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
316730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.Core\obj\Release\net472\GMap.NET.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
301KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
- MD5 2110dc2c787880b9ed2ef58f17cf8da9
- SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
- SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
- SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
162494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\juder\source\repos\judero01col\GMap.NET\GMap.NET\GMap.NET.WindowsForms\obj\Release\net472\GMap.NET.WindowsForms.pdb
mscoree
_CorDllMain
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Leb128.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e9f5e8cdcaa564d6354c15e2fb4d33dbdead917a2e1388050a68bfb1876ff01
- MD5 e6650e116617c59d46b6f2d3498ee138
- SHA1 f499cf553215a2f4190f0c1e9d35b43dc9e1b092
- SHA512 09f9b493a5accc6ba3e724627b74189e08c34a6f30557a5e07f849957db48b22d496fa38a40640b591c67ed3d9cd797f350136fcc6c5f8fdab6c3d645429cc34
- SSDEEP 192:lxAvycMDDDDDDDDDDaZF6URpVJVXKy83:/+F6URpVJVXz83
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
13534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\Leb128\obj\Release\Leb128.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Liberium 2.1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9d12b9fb18f031c13648d2aff2bf8c7df9ed654e0c6eb8f62bc52987a9b8c571
- MD5 eb5f70a725c9338a846d7f6e95aa2fc2
- SHA1 0b39c505232a33842cde9b13ea75e4bc1e9004fc
- SHA512 d9558084fbb97cfbf26b57e174ffe65fe470e35d4c952357cba1251302175cd7ce6a8e75d28bdda9196074a96b3196a2d96921652c98d01a3bdfa3b21726690d
- SSDEEP 49152:oryTHM925rnKoH7w+JaHgbX6c3QYCU/50+VE6KqANkKVMUFltKITwMzde:oH925rNP4oCq50cie
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
6256190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MaterialSkin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b0e1b3af6d2b8b3d02b6cd52849277c9c8066c2ae565e68253d4551c37492d3
- MD5 022f385e55d9d3d42a33b4ca999bf22a
- SHA1 5d2f22d51d2e87ae8d1f2c1acd3f08f4fdddf107
- SHA512 7fd663b56a2894d1db2ee1032067091f72a4ac301ee8cd392030c6ab186e3bb960d8e35a8591204fc23e9b5a145a2a9ab0092b1c9e6ae5c9c2dc2adf907a891c
- SSDEEP 98304:iZavd9tWpmIgMlqVz+rQVe97lwu9cXvBxDh3DYnskFb06vSXvfnjMK3aYLB+8uNl:ivKv8XcXD4K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6747698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Mes Documents\VS Projects\MaterialSkin\_release\MaterialSkin-2.3.1\MaterialSkin\obj\Release\net45\win\MaterialSkin.pdb
mscoree
_CorDllMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Win32.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
19162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net472\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e785e38af8a00a2d0b6e99a11e8c1d0b8d353f195456152d874e605afa3e5190
- MD5 1e6c4443b20d533dc92c0e968bfe649b
- SHA1 f0270d51de100bb577171593ad8f8a8fb0b09d40
- SHA512 423f793b851e32bf35f13813f4a4b94f313599edf7b9bc4828d44bdfd1b21ba51c87af9633c1ecc203acbc021ac61ec32c8cee3ce16927c5e19a3334bf14392c
- SSDEEP 768:HoE6MFY/dEMKix0thSCBsFY/dEMKix0GjRjrEquHp/U65x9LB:IE6IjrEquH26BN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Action.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1f9502cf04a94bd34e984aaf572837826b1f52f5fa173e29c1313ee90614b1db
- MD5 e9a39c1d164e90c997776591e2e309b4
- SHA1 f36bb5fe87cde4d83585f3e661914636d0f41f8f
- SHA512 b64fc4b29f52440de23e8d58e2317835c2a4455e716fb99d7492b1b128c6c0d45861aa301bab5d4544278d1e8268b53ceb5bba0ca876e75f0cd60daffb45c041
- SSDEEP 192:DsGYHQ8s3Zjrt+5Gie/4tush6ibn7NBaTt:Qned+5Gie/6ussibn7vaTt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\AntiProcess.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e06785e240b87f39e667a3edffa68f2830a1055120856148573b6710f63d527
- MD5 e5fb9b25f852a8b5355dd0a111fd08f5
- SHA1 f308a2c4d71b1c2627ec0df65e33f3b95e64b810
- SHA512 b99aa01cfbb178f2f59c8b69912b4b0a3239e9ced3de0290a506b42c81880b05397a4181ba07c5285d9cfe2725feb72d3c68dcbd1647b7ff9bb8553eb60670d8
- SSDEEP 6144:ltsANPVlFHG7QU9V1X7E0AECRdq6sLtMwNEamxkUu1t:gAOn1L1AxOMIWxkUu1t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
371542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\AutoRun.pdb
mscoree
_CorDllMain
Name
.text
Size
355KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5760b67a9770a2e2ad169602451b98f314b9348c913ce991c61b97a8c61d2ee8
- MD5 e5de92953d8827818f8ba428f7542e66
- SHA1 12d7630f77e76adffe131017243bfb47b9f878fe
- SHA512 1960499959450d26cb56b6290407f6629dd6c730f7a0a0545eb02100e1db7bdc690a1d173997fad38191822025fb2f84fe07b27638c71324358cbd9205f1f0a8
- SSDEEP 384:jcBitRM8UqlFY/dEMKix0GhmggD8bwKSs7fL1gFt9et/mRv7WlvZma8IlJbD:jWitG8jFY/dEMKix0GoDk5d/8v7IDb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\BotKiller.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2de25104c6b73a0878c599def833bd7287e17c8ba45f628a1dc7f381fbf27817
- MD5 b1fbf2f82c89f121dc7b150735e10dd6
- SHA1 f5b51021b5d80e133e07a0e0f67890a9cba48ff6
- SHA512 e816132ffd13018c8d3cb8edabfac22fb7a832f9477c7c8037b71873d50283caee9419de0748ae36486716998fab78fc1d108e49711647e2889d634cdbe0c00d
- SSDEEP 192:rRlXXmgxQ8wbwlpaFuC+yYYJUT8kUD/4pHc2gPM57lL+ry0gOeMlvOvlRL:vXfQ7sp2Z+yYYJrkK/282ggF6gbvlRL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\BotSpeaker.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f2628924cb5d79f08606d37dc1eab3ff9eb92a94432423fd076938a0ed7513b9
- MD5 675fb5342359b7606ac3cbf2600d1b38
- SHA1 4d5be6e28a0025b26067798be1ea47be5b074212
- SHA512 4b1b116f6b0c0cc608cd2027137a94770733c83a88e479356308b389afece5a89de0527e900ea33ed180068b6e0215d475571f1fc3a81ff7d1118a3df2b081ab
- SSDEEP 3072:FCCQQCCc23F99bb99fLgUsOOMMOOQOfVkBmQEQIpZL+S+Y37kkFJV:FCCQQCCcw99bb99fkpOOMMOOQONcpIpH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Camera.pdb
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a9e32b903b4cf54db29be27a47ef587c807ca1b62c22d69856e5d3da07797ca0
- MD5 e879f7d42568b26b258c5e582972b704
- SHA1 e3c7ed297bcee5d1aa93b1487b29f7fccd01c914
- SHA512 18237aa4992d28934dfdf75b21d6bd317d2ff8c040287a86d32758fd04702bf1f4560562df11dd06f6f624732fc5f5edb4c16c250f62de60b0b479198c303e70
- SSDEEP 768:wqVJNCa72NLlpjnGFsT+5asw+rBdNZTgM/Bc69b9D+ETzYwLgec2:5V2aWTiFw+LTc695D9ztu2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28b22fac2008814da21e03c3fc39a705a60c64c458be815d865811e5b5933221
- MD5 8f21ffd11973d02c3654404b563c9653
- SHA1 25cdd5df5f53a4e6d3db6d5e588bd567b3e90f2b
- SHA512 2724eaaa255b24dd2d3add72e6bea3f63e612bcbcd83d73ab83625cee3fba678fe6a2037b73c83da70f83402d169625ef0c0eaa7ba2d7eca49da94ba606a4e7f
- SSDEEP 192:+pR8sh0G3FrPpaHHS+r+g9kA8nH/4KNl6mMB1AZ2YFVvYCDdEbCr:dsJPp+y+rVkA8H/LGoLvYyEur
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Clipboard.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8776721b19d341e88ff95a578b21dea67d569c86a7b7c5f1a444d464b29f9504
- MD5 d8667c4bbf677ad691d66653aee54155
- SHA1 6c45b1a73e25522c726a57fc8655a3b4e0a65e65
- SHA512 39c2b2bf51073de104e6230ebb4909092e71d5ab350c03d5a2d90c0037c34865fb57642e4582adc32871a543af5489746cefd9e130362e42d890bc2761beb03b
- SSDEEP 384:oN7IcTrT3d/c+I+c6kJ8ep/RIOSOglOpM:odIcTXNk+I/6ep/bJM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21434
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Clipper.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ef515f6fc24569616b83fc80d4020f8e121bf2a0dda228908cd448b64af1057d
- MD5 1bf538ea390578ce382a93c0698a27e2
- SHA1 40d53e4f744e84f88e8e68c35de7d8dbeac3558f
- SHA512 dd7e305c38f80928c069a759b89fb20d0e49c45dbddfeeca08e63a275a604d878071d8ad1c0812dccaa8f06896b7ace13fe0a64d69a1304c0148b2de27721af6
- SSDEEP 3072:dshGcFjKyO+bwqlWj/RxfZwqjHDgAwlY:+pKHXwl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\DDos.pdb
mscoree
_CorDllMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3dde48eb36aaf91b4695c84c0e4a6b5f01323fdd6843ce82b627339bff5a075b
- MD5 fa1c202397e582b97ae9a04da101b065
- SHA1 d4e46fc3088fed7fbb7a9fae80d7832766bda3e4
- SHA512 db66a626a16e2950b3df33709f22dffa8355a8febf1fe9debee85a4b1b710f86888336c1d469a2094ec2b01d05f638f393ad8372e7e79d44378b9eb051484639
- SSDEEP 12288:qJqOo1aiGeJ0MRKI0xRtEHgmtI8pHuE4po8U5BAst:qJqOo1aizXRgxRtQ5BA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
803174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Desktop.pdb
mscoree
_CorDllMain
Name
.text
Size
777KB
Virtual Size
776KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78ce4f8fce2fd45f862e2f397aa45e19ef0e7ae9095db629e66713e168da9460
- MD5 c8a57cc3598c7fba32cdb0ba0bd42ee6
- SHA1 14de75df8778a1fc504f2214a56c667dc113b37c
- SHA512 e802aa244dec7938da2212d24a0fe4733b3b417320ae348b472d0a02d22a34a7a280f679360cf4def5570269a288765d1e5f7bc7bf9e526bbf6d10628526b6d6
- SSDEEP 384:cAyzPdtmpq1+C/OkP/1ksgnmOq/wWea+D:cAqt6y+2P/zAg+D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\DeviceManager.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5295e1ff38d4d52da634b0bd34766c8b10fa59267ad6f2c2515e1e1844be8266
- MD5 d9fd648211d374129c2a8b45728dd0f2
- SHA1 df60d2b2030323fadfd9a069af13ffbd2a906362
- SHA512 4b944493027aa0647b9f87579f6eca4ba2332a10203cdcf6ef3d2cc5d6116528b299725fe97671a8ebba96e13eb904035d4a4a98994b853c3a1a6998179d89bf
- SSDEEP 6144:k4nSNHQs2dP5yGtSV41QJDsTDDtUMle6ZjxLV/m9HVJksDVJ5RIUGZ79:y8P5pS4YsVUCe65fm9EWZJGZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
517294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Explorer.pdb
mscoree
_CorDllMain
Name
.text
Size
497KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28b4ccff3febd9b5e8bbb9430c84b33a270ae7e8f2795543925d28d4bf14bc2b
- MD5 cc79533bb87a0bd5febb2ab7b467c63e
- SHA1 2c8d173d44fc5f00800e141fe12b600272324223
- SHA512 99677e60ec67fa740ae46e8ba7627ca94726a8efb7c35a1e7d49899b5e6af1c21c0791b349f0d6b690bfd9830f133f7369cfffc0b7c45619a4f1adf07d8584bd
- SSDEEP 384:f/ZuGc6BX1PIphh+5P9U9rkdg/22nGefpGHzdeX:f/ZuDiXVQz+52adg/+ecHzdeX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f889ae0a5a523e01b12a3b935441350c995e0b3d9888f1810fb69ca029ea00a4
- MD5 87b8dc678d3711d45c232d1d949736a6
- SHA1 4aa6b94787cfd47aff33bd7e8cf452368294326c
- SHA512 2db73d1be06ad588134833eaa56676e66a15155796baa51f5394151609dd9466642ed9fce9babb48535794edef7f077a6d1d26875d68ecef1b95d1d834e013e1
- SSDEEP 768:IzhlKS4g2amhVK/6cCGI0TYX/dj+fnIpX0/isVuLaY8XjCm6:klAh/c52X/x+fnoguz8XL6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2fee2d5122972d75c88c56ae1b323e5eb937519589d5b3ed8a75884f5bfdfaf
- MD5 d3abb40c0ff0a9d084693ffee3b45914
- SHA1 19ca80cb95c335d5e1bb9a2ae51205256ebd5f60
- SHA512 dbe1d45d2af9d744c9653cb239af1c255071918ec43f641210da71b4a321e2d0e787f801fd9dfe1523c7bbc9d4b2f2a459ba7140a53035d8c79def66bf91fce7
- SSDEEP 768:TaSbanA5GcWJ3NgIp+K11F/nahhCxcNJE:2SYDJdgw+KtuFE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\HVNC.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bde26eb7e2be52fedc77d2249f5821aabce1f889f3a2ba596c3774f0f529644
- MD5 6caed0963782e7afc68f8843bd588560
- SHA1 187ced4df9dadf96bf55a46a702758e022d50796
- SHA512 3f283f6cf26021d7ac209eb9e929c956f8cf97702f1f98237da7a3d0103bd6bb1438b98d42a528bcca68781b0c93cdb17b6db8550d68e589b07091ab4950b372
- SSDEEP 192:yxy4Ny7DBrrbFv+4paDwC+v17Pk5D8JLA/4o/Lw0gU4RAPlCOSl9:L4g7DBHLpql+v17PkF8Js/1TNgDRQg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\HostsFile.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dff3705a184a9e1c4a970752a8c02dadec87213a558f0d3f59fb9d6033275d72
- MD5 e16c5e793a73438786b81f45d49081a7
- SHA1 b7d8a30fc49adc8b9aeb48ae821a52f301ebe1be
- SHA512 1d6671a3d6978cb505a8afb8ac8c36c9b4c55f879af3e71850c3b8d1b2cbe7ffd28fabe64b71313bec949b83d153c3493342b4028058abfdf8e2095aa5e8d751
- SSDEEP 768:T7GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeKL+P/UB2zB:P4nsycq2yWvYAHAdDlyytL+W2zB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Injector.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5345f3f1d3464fd9bd2137698eeb780ddc8c72ba0b6fa0f7b1a60d4f3925a167
- MD5 bc728ecc6ab3d9da17e1324d1be4c639
- SHA1 eac51651f4fe7e4879ccfa3fe7a595573a0b8be4
- SHA512 4aaa1d2b9fd02262ee70a325669e677a5345cd28511b48ee6dbe5897f2f40a8e62d68e981acafaef7275d1a20664242490abd2c5936900dde35928a0eb2bbb37
- SSDEEP 384:ePdRa6BDsKBFwXcrI+B+TnOAeR/LQXmmVxp9hn00HcUUC:iRHBwKocc+B/5/DmBo08UB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\KeyLogger.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f6073e1e600c0e2b15b19cf360c4b503fab0e87b7f6900be846f5b8333b684f1
- MD5 49234a30029aea84ba96cff92843924a
- SHA1 80fb5fbca169474a3646c8be623b251b5237b089
- SHA512 dc0bbfd74dad9e3c57c1e66ced83623a01fb3dd4b1d8c2b43c3dff11374acee735b25b5e14ade7619381e8deea1f590542bafc0db01b497d833ec8ee9b8d3a18
- SSDEEP 192:nhpm0OZNpbyJunOqaltJpaDBE+mFTk5sopp/4obTOLSv3lf5fKKvS2A:vc/byUO3Jpqa+mFTke0p/1HOQ3lf2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\KeyLoggerPanel.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec42e91bbb45e071af3c1b77808ee37f687cd0c476d4b70c8430cf3183b8ec26
- MD5 2a73a2c626bc05815eb9e19939555275
- SHA1 451c3027673e9787b81397c4ab9606aa7b654e8e
- SHA512 53ee76684901c56a9496e52c5571a226f60fbcc129f1d10fb0b0fe9095875d79e45bb26c5818da6f8954d04e7045c879061bf54a65b57c4054ee21696521dae7
- SSDEEP 96:/X3+wVn3Nf+725gMy/4Fk5mWnKEHM4ZpW3PrKwh:P+S3Ng22My/4+5o6nTymg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\KeyLoggerRemover.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60d010d0295dc78d41dbea259951d149fff02194923ca9ebca4cf9aae22090d9
- MD5 996af9cae5e29258098ba5d016abd31e
- SHA1 38303b623901c674245aeb6fc3187ec17cac2c19
- SHA512 fe49bfb2eeb1a6d4624c57b6dc28b25d302da353cf8627d78b680306c17d34a277335b15faf272bf5f7b49b83dcde5d515588e87553a9667efb5aed089c2021a
- SSDEEP 384:JZM/XGl0RpqT+edk9mX/1lClCj5uUco/He:3M+l0HQ+rI/ClsaQHe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Map.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f6dc4fe5c7a2daa2af5ec233bbb3b78af634e3af73329e3730f137a497b27bb
- MD5 9d5b41b4469b0f1055a9182ddc670723
- SHA1 f05ad89e5766e63d274d90d50585e46359f5dfe7
- SHA512 6ec045f73958759f5004f2e8194a764d6a08a6c64e8a239c7ac2f07d145f3714414a957f3579bb80e6f048d06b26e723fa729b098bf493355ce7ae5fd698d228
- SSDEEP 6144:UJrr8vmnEA5XvPZW/7wPS9rUVXcTksUo9FvQGNAZpXqcdjnjoF2phUJMiSF1:UJP8v0XjP4UVX2k5QDeginjRUJlSF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
527282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Microphone.pdb
mscoree
_CorDllMain
Name
.text
Size
507KB
Virtual Size
507KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/MinerEtc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3df18123b26151d8f9c84583dd29b635ebafb31a714edc1b870c9b086a4965e5
- MD5 3ba17fc4b8820b422c1a3be96978e265
- SHA1 28d9df7c8555108feb898219f92cfde802943337
- SHA512 bcc19674278288f1b13b4af46525f18a8a6d02d2c310c2c8ebeb07f9264a256cdfd02f5684740109db505a141922e34d61a5600ad4ee328a57b23643dbe65b53
- SSDEEP 384:cCXdbUGngLXIY6xmWQDVE9hnd6k0ZLvDB6MFzDs/Klykm6PivII4A4d03lLFl3:9IZYtm1Gz+r6/hjjvIIKmp/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30466
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\MinerEtc.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9220f75122b9de44ddf33bdfbe389d3067ec8d00a16b9b139718e5614b06add3
- MD5 a79b3eb83af787c67331428423f2b4f2
- SHA1 718b391be5066c65749b64201339bb07e153eecb
- SHA512 9a005e3e17c82a0958358812a3e15cd15ab266f2bdb9f81c71d445d7e64723ec4027d14b3f977a18b9c355d1074e6ed1cb735532561a969789962b417914026a
- SSDEEP 384:EhudgZf7rfP0W7f916dJkgC7azDHL6ncHDB5B/8lTNFhMG3H+am8jDQe0wlXlRB:ER7LMi97gvHZJ/EJeaDMxy5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\MinerRigel.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/MinerXMR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cca83762621d41a942b2152e8b92026ff14e562f98082c51f0760569a402805
- MD5 fb879c2410783e709a71c11592ddb783
- SHA1 f90f3d9c0ba69aa674964e98636fd36f702adce6
- SHA512 a09e2f17496660be89457cef672cef8dff19e5ae0959b36b1da15c82ee7e22dbac39e297a98a009b243fba4459c646720edd155c65c6c9fa9e7387c93b982632
- SSDEEP 384:aZ2dJIu+8Wzy+YlxmffwDvehwd6k0zLvDBiMtDy/flykmXSlbkYlypAm/miGwKEq:7ROyznmwjdmr8/AjkplAAbi5KEq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32530
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\MinerXMR.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f11bfd67f20cadee18421b5fb6272d77c81869afbdbb76e50c93ad6ebdfc1d3
- MD5 b0ef49a2e21f06527230bc4c60f11cac
- SHA1 d47114d4e4f3992fb2bb05c57c428b8850c1a20a
- SHA512 98b1376486e51f3e48d58f69309094787eb6cfd78dc3441049c59833c31e3cc57ed6095da08633fca2e8dcb4dc363d752009edf51e8e078c4b66f1ef5c2fdf1b
- SSDEEP 384:YaDhKPyc9LHkpidA9p9+k+Qbh5kE/1TGFSqlyy1m:/nUHkMduB+/E/c4qP1m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7c97b41409874f1d7e68455f758a035e19ec09fc169ee45d1f182bd574962247
- MD5 69e42cec2db26864c30ec840c7491d13
- SHA1 8c85618f5bdcd2bed82ee94364727f4889d9c80d
- SHA512 d88342d2999bd0fb47c51760c6c7cd883b4bbc5036e93d879d06f186f0086d135e922e5d291a9961e172292017d5b066d32d9e8f9644f87e3bef5a17b51a76e1
- SSDEEP 192:rylNyZM/5XlTY7cpaDPS+fvk5D8cN/4ofrw0Z0vGaGZ:mlgZ+953pq6+fvkF8q/1TNyGZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Notepad.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 85478f9a37b12e1b3c2ff57c4aafac496b21664e5a91300450104175060e911f
- MD5 da38899479acae0a180bae015b035564
- SHA1 6a794a018ca200b6dbd0333eee733c49a53205f0
- SHA512 ba74e14eb55d2dd7d308a1f5a3cfff29cd390609406bb9e7a10fb851fb4637869ff1680c6682da3892c8c279ff2988a963cbfd728f11230bf95b4687064fdaf8
- SSDEEP 384:/M3ysBpHQ+GmkylVpt7j/1fGV2x/wqvtpbt3:JYw+8Y/AV2x/rbR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Performance.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e915e5dd7386d811a840ea4d15ad5a44718b711bc4d65f84403257f24e9075f2
- MD5 9f6c45dd59216b17310cea8fda702137
- SHA1 b486132f11edb1c1681dc5ce690430840bc88f20
- SHA512 81bd81b7ef48a3d63088051522f07800bb837c5bcff30369e9d5ae0da3df688c63b3a1a84549beb967ed963b9bb2db516e179673ec91cf617859feb9ab446c81
- SSDEEP 384:R3d1Vy9EAyg0tGC6pJV+Kh/hdNbk/W0X3/gfGI6sFm5/n:RTw9EAy3tOP+ky9/nPes
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Process.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08cc4401207d41e412361bd43fd8c072c8fd20ce9644dd62ecfa6b6bc5290cc3
- MD5 0993a39a2aceee3b59d8a534df80bab5
- SHA1 7b7c7367ffea1dbf6e0f5076cdc1585b6c3f3c27
- SHA512 d071a04f381a2517802d7c31eb150def48095d0b801873cf023261366939693ab6ee8b4ccd5e4b21b8fad11601e3d109d0ca6f1a15e03b635493bef28b5cbaad
- SSDEEP 384:C+6nLsYHNcpmGQ+zL7u7kLPL96/7s2NaMz6R8hHU:C+jzQ+/LM/XNTpG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Programs.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 be1bb3b91178a590da4b31a372514798011e822186b4ba82699044dab5e7ce8f
- MD5 7dc0e8daa1a6b2cddbd0b9036056da0e
- SHA1 bb2d4c2dd696d0ecc6eb9a80d166155c388fec63
- SHA512 4e7153d8c7084b607f33aa57d22fcaed6759854f3039e4b68df65a288b879ee988d6523c24b10edc52ccce53772be58bbc5e2c4f600d236636bc9b892231b2a7
- SSDEEP 384:omo6Xc3UszkIVZzwEQB3ApJ9p7YNsgZBmqk+VehvFM1V3OnW+Z//rffJHBMRfFnt:EJtztxQNATi+aef/bM+Zw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 182bf6f624252c1a8a1aeb2c5687e9444d02a5258f69e4a38f4bd6758265d8a6
- MD5 c0cd518cb77c2f566c8e16b1ee4dadcc
- SHA1 deae4a81aeee11ad335d020ff86c6f62c50ce9b4
- SHA512 50864c0133804aa058ef002332473c8c10a7028cf6060d91bffc8b7c5baaeb50604aa2b58fa8c8d2fa12390fadb5e263bc5b2882cb11f77c3a84c76652839c84
- SSDEEP 192:9YSuE+qmAVQyjpRRpas5eZ+QQLkxzw/4oJS7pP7JBCC3A:9Y1E+t8QyDRpHc+QQLklw/1JgpjjCuA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\ReportWindow.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 300c06829f904a1c8f53dc5ad3307fd61eccf36888eed66d612bd6a2bc6b14bb
- MD5 7bc3da1b43fbbe927a1e6fd04cb7bbd0
- SHA1 202ec01eff6c245a5032dfdfea7ce7b7d2d7db98
- SHA512 da2be1b38f7be5870f3cbbebdc2ef1078512104cf631152c268735912ca1df0b2cdaa17cb35ead7d041441cd6a76353a2fa8bdfcfdc097a2f3159fc220bc9143
- SSDEEP 384:PknaSmAO5sTscXwbbEE3auvPKV3vPmW+Ar4Bag0t/+Iw+zHWK/eaXXC:PknaSLO5sGxQGW+BEbt/P5/eaXXC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ecc8e3d0f89b792ced877b5bcf2d9a740748a16954c487a47a54485d40214cea
- MD5 e05f20394f556bd4ad887f2e8cec7611
- SHA1 f7a9f37a06c4a9687779c7c5644760b6f21ffab0
- SHA512 3c751b16604305858425d127b6b5a39b2f7ffc33e46cce024e7bf3da013fe18a3046cf362d4785f2fa9f2212d5b771b21bb13875db392dbaa7861e63dea20a85
- SSDEEP 384:AgdJYiO39HYZ4dgAPYLlmjzYWBty4/KODQZQqfstfOe3c:AgdJqt4Z4dQMjHX/jDQZ9stme3c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21298
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\ReverseProxyR.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0466f72131407454d80173b30894d8bd37bf923a10db0909f5502f35a75f7f74
- MD5 26b41ee21a0bccb116db714f23c6155e
- SHA1 26c4ea1808eb0689d7ce25068ea59894a0f661b4
- SHA512 82a155fbe8b12cf6377bcdb5e858a4237f99781a0a81cccc7afcdd47e8cdcab2f95715918a1ac60569087ed1cca11c1f60ad1d371bd0723907fbe78fb66a0a42
- SSDEEP 384:DAgXCmS3TMCVD2eXx77W03SkLVFfUho5MZX/gCQzW5l16CaRllVZkiKRGfQIQJ9T:DAXmS3vaeXDnMh7/wzW5l16CasV93j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b06d5aa9ef2f16d707625697cfd9a549c328a30c3e931fb58d256feb75bdc3e
- MD5 39ef8069639a73f07892a850baee91d9
- SHA1 10f53547eeb35344ed5443bcc956a17595e30208
- SHA512 5a70f34e180b219c644ec8e4aa16ce2b5ff1b5bfd0313f86d07ddd6b55268e77c542828c3692a270f3e696059b2017f6240d974ff8d46f0db18cd7928946d8e0
- SSDEEP 192:4VGJqZuB9O8MA0paseE++4dkjNz2/4pvsTynhPau2C+0/1Jz:4EAunqpfN++4dkjZ2/2EwhQCxz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Service.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fb45b324abf59294132dcc9209b9702b15957f14b07985498f6e4ac805a65dd7
- MD5 db0e2a366b21cb65034ef6b28d7a47b0
- SHA1 472ee46da1ba88a2f6f5f1cb53e666cc271347c0
- SHA512 a96291e8084cffdc72ba98e8a52de9de115670aee19fb5d6cd07565d3ef7986d4701309cea00791eee7b01d1cdb87782081ff5a45f13202d8a4701fa1b5a066d
- SSDEEP 384:hgnL2Z5rpq/v+vL7vpkFJPEtZY/gqS2gMOXO:KnLIVav+6DP/9gfO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Shell.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 754373d3807a8ca40ffb12e576e176e10f5997785bae034076877a2567bf5e25
- MD5 f6518ec7ae4ca7dfa739fae6596223b3
- SHA1 a8950015841f57a69c2b60f75a2ce1a3ce375ce6
- SHA512 3440e369d6964b190b14e28bf816f7d4d2de39e1b04dc66d8cf3a9957791b2442e693e8021c29075a36e9d22c96517c8a8767b96eb248accc09e0c6f804112a7
- SSDEEP 6144:2g3B/PGUUuZYXjxKd01xcmF+SI/lr4fED:B3BnGUUuZYXj11xcTJ/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
232362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\StealthSaver.pdb
mscoree
_CorDllMain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cedfafe1369753a7b2929ac9561c8a8b787a9b2b6fe2421063fe3880f19d882
- MD5 81595354b44526f6fe00fb883f2e8cad
- SHA1 980c510916a4c219f38a69412f42c09a835f1c4a
- SHA512 96d66b022b70481eadb2fc3d228b9f387ea779ce9013c7045724caa999ea3f73c3d990f2161dfad4cb2557cfa8fe788f9903abbb1c08fdc3cd8a47a521aa82ba
- SSDEEP 384:al4bFgJiyh1BpqOu+7lpA8m4/17NNZyOglpQb:al47y73nu+PLm4/jNYOgyb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\SysPlug.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f48875441e08097d605b69f71874f48614838c6558ada742cbe645865d8e1d94
- MD5 1611c8e32e871120c32ce222c5310b03
- SHA1 e296e9fdfeaebbaf5bcb7a659462bed703ff12f6
- SHA512 94cc161a402a7f7f215387d0fe32447d6cceded8f6256f3fca92385f69a32c6129d70d38b6305eb7600382f3ba8f83f9d11c8772ffed2e8bf69bcd3a14740850
- SSDEEP 12288:icqWBkcFRKUUm7Tvk0eQsRXlWQ3ezrGWOK:5Bk6RKUUmk0eFR1WuTWO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
525114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\SystemSound.pdb
mscoree
_CorDllMain
Name
.text
Size
505KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7069ecbf473800b0e22f9d33b5df75c81612244c8b6f89d8eae34c37bece2254
- MD5 e83d3fe3cbbdb7d62607a726128c003f
- SHA1 3e9b833f44cfded94bc476ab11946b7cd14f6012
- SHA512 02e8eb5b4d62a7d160f524011b5968036af0de63bed23447fe63cb755e7b572aac1dc5ee26c557aeef7dfc11d17b6baf639c6366b11f574912aadc3725a52987
- SSDEEP 384:FrzAMtQfDaQ2XG/ILCG+2YoER20IHzAAkYGbHFtslaDu51/vZvHTcP4ySBDH:FrMMt8D2rLCG+2UiHzf1/ZQP4yCH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\UAC.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b679ee786d63ad527568191a0ab83814ae243a043935551c68e4590435f74ac4
- MD5 9a3eac52a36a87f5d3ccf25782c178df
- SHA1 17762cce8a7c1616fddfd434f29df5c695015c8f
- SHA512 fa21ab6c6b84762178335ae65b8b299aefea22a8a52f191ded925395e043aa94b6d735945e1161941e8d90442dc3fc8bb03be74218d068921c76af81901b25ef
- SSDEEP 12288:4rjKsSrv7c0it6zJOdFIWk8+Ph1PcJDpfVfo:EWsSrv7c0it6zJOdFIW/+Ph1EJDpfd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
520178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Volume.pdb
mscoree
_CorDllMain
Name
.text
Size
500KB
Virtual Size
500KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b987271f4ab80feff4a8a83a7c646c58642596bcf39c4f96699e26b156032ca
- MD5 5d1b036e185b65b555ba9519347a20cc
- SHA1 d92110e773a0d6291c0697d39526157e54324685
- SHA512 e7cdd5b70d814f00d4e90889c49f229579fcb56d359aafd60bcd8ee06f33b72a6c362065620499468e07d06718899cdce6c389a6b1a83c9bf9bae41c0e5e5255
- SSDEEP 384:gnZkgo94os7VczpqFQ+3arWssiko/1v2aWvM8D2KNKs8888888888Oqm/hIS:gnZkgYZsY9+fo/YaAM8D2K4DqOn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Window.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 36352e177aad072523cc24ae753b8b47a5eb2e2d38d504b5c5dacb231305589a
- MD5 3351bac7f988e87a55da77a0ea87df7c
- SHA1 9c3a7f93972be292ae88ff603593a72b6f8d95f5
- SHA512 9c0286921ad9e626b5f342559977f16c624af4a281f98121f3021d59dfdb44eb1be6e3cc61c430e1ad86f30eedad5edf6d9c19c9643c3260e249e9182afc28e4
- SSDEEP 24576:6rDXK8VRSzaywtGN0UE6r7SVtuVQchsBrq5nHsd0:+Di4tGcJrs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3165974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Server\bin\Release\Plugin\Worm.pdb
mscoree
_CorDllMain
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RjControls.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ee6c31ab5c76286cc58c94fb11b00c8163bde35918ebb39cc6d4c3bfc62e36f
- MD5 889492bfc195bf189ef7649233da68af
- SHA1 0c1c83d6965340593e7607d86a2ae06f6cea4e51
- SHA512 52d5fae0544501a9359e0b420e31c3191d93a8ffd5aebbbe05c2a4191e417c0afe28be58b21957bf2265ebc186878c3f9be63a92043caf747ab4f071fb109b5e
- SSDEEP 768:YZrDUywW4PaIDWB15WYRnsb6IBhdaoej3Fc:kDUNxaIDsubf0jS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Libs\RjControls\obj\Release\RjControls.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Scripts/sigthief.exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
- MD5 3e261becbfe12d7a5ffdbba91c76011b
- SHA1 2e5849aa0be921849f42121544895ce405fd9af1
- SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
- SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31937,
count=1, id=258, version=31937,
ServerCertificate.p12
- SHA256 b8177366a1c932b61b18711b0547b6e6cb92ac64816d4c415e715e37803ad231
- MD5 a4472e78ee606f426a623897f03a912c
- SHA1 22dec2c55f96c1d1c5bcd0c76d551fc4eefc57fb
- SHA512 90fdb478e8af73fb6f8d63e5b1edffadca41d129a7960141095d6724be64eaf6cd0bf0e2b96989a16f4a2109ebd53e599688a51aea0c817da33cf694eae4960f
- SSDEEP 96:juboPDiAN7IoDCzveLwQ4kEi9/gRZNke2oPSZx+/0nDou2B:sABIoOreLUji946eu+sDA
- MD5 SHA1 SHA512 SSDEEP
Signatures/Exodus.exe_sig
- SHA256 e9ffd546881ee3fc40721d466696fa1e01cb448ca157e2b452b8d1a9106b8b9e
- MD5 2d612df3cd9fac26761e61491af1df1c
- SHA1 31e10b0b22df297a59a96eb15dbd135653f8ff29
- SHA512 15544d52d39312194a28f1593fe656b8a51bdc57c87ffc3862ec0a5abe928a9428746484ff1cc8728e9930f96cb3cc66461b9cb547e523b7bff0b9379233aadf
- SSDEEP 96:BkfTd0PmfrrQG28cYG28CEjlH7xXmUbxJ/2F69lxQKclIC:B2IYiYF8LTX72SlxTcl/
- MD5 SHA1 SHA512 SSDEEP
Signatures/FL64.exe_sig
- SHA256 190e518041da81a833b25c870cfc7108a9ffbd2c4e0668b8175dd0c3a4b341db
- MD5 51d35a4b24664bbc137e7dcc0be2b482
- SHA1 99ba986fdd04915fce6fecd16dc8655bab7d3f8c
- SHA512 a763cbc7acfc423818513a3a71ca03d9f4290505e6d621fa0b389c568c07281bd9d7bb474bcf60960535bc1a3df0223addceb749d163356877d11cef3c6a778a
- SSDEEP 96:qnTb6NDlkBlpHpi1IddvFFSNSRvrm+8GHrgDYb3JUfhdyEi7ZHeE5gfWVDUtl:YyDWpHEKdddFSNgvr78mrOYFBZHlqWWl
- MD5 SHA1 SHA512 SSDEEP
Signatures/MarketApp.exe_sig
- SHA256 b37e2980ef13016e896ef69019deb85b24de37acc9685e267d8f7873ef0bbe0a
- MD5 aab8503526c3cbeb44a4a293bfe788f7
- SHA1 bbc5d1aaff6a3773953ca3155e059828f23c715a
- SHA512 2a5049168725b3ca6a9c93c605094ce2a0d2af62bad10449e451484b9581baa276046d5ff732c878f9e01a01ece98e6f419f709a562d61641e6fddef219dbdcd
- SSDEEP 768:Ir2uGTi3lKFKcMkOr2uGTisNKFKcMkKdpq:I2TuIri2ThIrEg
- MD5 SHA1 SHA512 SSDEEP
Signatures/NVIDIA GeForce Experience.exe_sig
- SHA256 5fd46f771abd9e1761c086f18cedf14e468647c812aee29a5d998f303dec68be
- MD5 e47acaa12c4f0cfa30b3f1e03bce45f5
- SHA1 552742c374b7e033fd514b780d5b5cefa0abd8d6
- SHA512 ced27bd154391d28b91c4637ec5823e99f88a56e5d2cbc1d3f6c648c34ce432d1d7fca0bd2d8522b910ad6099a8bd738a1c207e56c093c68e74c8fe7024cb509
- SSDEEP 192:DIYiYF8ahU7DNDlQZYSsDO4NKzYJzkLRCji2j4WIzla33ob16l8g:DIYishuNcY7D9NEwi2jHF8g
- MD5 SHA1 SHA512 SSDEEP
Signatures/NordVPN.exe_sig
- SHA256 b5a5c8a5178506d45c872bdc5eda0693acbba417e6ad20d7c8cb4c3ec2620f24
- MD5 1beabb526d63b32cb8ad63c9f97d5195
- SHA1 b5dd257cb0d3c2dc7d81f93b7ff7e052c503472e
- SHA512 fdd68f51269eb630cb65be3eea32131f82862ed4dc0328d25ad054170fe90650f501d86af11b04662a116132f83d00e3c344385f5aa2ecb1821eed14d635b018
- SSDEEP 384:JMQiY9/uo6ki2Qufi1zcoKiCUV1VF0hXHMGBk7/UMQ3hnZ:ur2Qua1z5CUV1VaXLkjmZ
- MD5 SHA1 SHA512 SSDEEP
Signatures/RGBFusion.exe_sig
- SHA256 013d3ada70bd382333e4189c05253adaf237b865330d9490a5bd799b7fb490ef
- MD5 6859d41071774651c4101ad98bf5b930
- SHA1 b6f75a67e4ecd4425d4bb4fe440886b0cb517afe
- SHA512 fc8c827b77148d6ece71600a9e93b4eb23e1ac53c234e2f2f2e39359890c60023b351ec521d70fe5f034b187cd8989fbb822304f9d1e55537e58e1c465d51369
- SSDEEP 192:6WWSVZPzmCeJ2UzZ0y2sE9jBFKWJfsHRq3XT:FVRmCu2Ut08E9VFK4ii
- MD5 SHA1 SHA512 SSDEEP
Signatures/TLauncher.exe_sig
- SHA256 a49c24d12c4c6595cbd280b96e5c891debff50d99589da03e58b25e51ac01d2b
- MD5 f390420ad7e8846b6669e583264f179a
- SHA1 ead420d6fb1d0374d5272e8e174c743a8716e567
- SHA512 092983d02b7c54385909100493792f004d6f9c6e5b15aa8a89761523e1f93c4dbcbb96f5f938c61fcc4660e3f713ba57ae7537d5da02b4cb7453b2f73fb6b77a
- SSDEEP 384:v5pq6jAAUxzUHE99IblNOr5pq6jAAz/UHE99IbF8:v5pq/ZUHEPu2r5pq/YUHEPui
- MD5 SHA1 SHA512 SSDEEP
Signatures/TOTALCMD64.EXE_sig
- SHA256 b5272a567533beac74a4dde52a86232ddfda8648d6f9111f9472b955fc99ac68
- MD5 490889bec03862a33250a4d39f2d1f71
- SHA1 98fd6f74023d86a6b82ef91002ecd3b814045d34
- SHA512 ad05b11727db479e0f3f5fb55bf3d7449445299bb6a5669d736092591e69100c66b8bd87105dbc5bbb07e436fcd1bc7d2112a24d5eefb09344b451d4832f61a8
- SSDEEP 192:XWkspPIKfhig1/C5q8jgfi1jsgO7fpGmGoj6gs2oEhZnpHmzafqru9:GtpwKNsqj8jpmpGmGovy8ZpHmzafb
- MD5 SHA1 SHA512 SSDEEP
Signatures/Update.exe_sig
- SHA256 5c0fc232811bd4ece9ea39953a735cf0ba1fabf662bb3934a95e357e5b90aa00
- MD5 acf2b1fc6cc32c0f68fdd82d34057219
- SHA1 874732cb50a254f6df921857fc34a9ab67ba3780
- SHA512 d79d907ecf12a88db98738050ed70308852afff4b91888e8ff40afc6cf541438fd4608679fedc0998859514c30845022416721538e9ffca8ad8134ef548afad8
- SSDEEP 384:1kEZsHLs6BPxh8E9VF0Ny8NhqakEZsHLwWPxh8E9VF0NyBCZk:81PxWEGbChPxWEvik
- MD5 SHA1 SHA512 SSDEEP
Signatures/Wireshark.exe_sig
- SHA256 cda36a63055529165b43848f924a24dca7acd3b7e15959d779523958515572ec
- MD5 fc1ee7bbf43e5993f1c09173fb16b84b
- SHA1 ae40f7eafed9b68f7d22bc4767adefc7932022ca
- SHA512 75f05440a76bb2fdaf4c71cfec24f341dd45fe775a04b732809d623cff48e5f8dfded9437230427a9efbee8a9a5b6a12165339e5259deb7d7ba591f42c625e89
- SSDEEP 192:8wpPIKfhig1/C5yFgfJm91hMeufH0JOqsmVgz28WhBqO47C:7pwKNs3JMhMeu8JN77hh/GC
- MD5 SHA1 SHA512 SSDEEP
Signatures/brave.exe_sig
- SHA256 4dcfb5c7b9da7f878a7956f5ab9b960ba5a1bcc2017332126f9f06d721c52c2c
- MD5 8ac197d05cf6003662eb1e4971251f26
- SHA1 49a49a2b224f12e1ef97e122fbba0cf6d0d2c8d4
- SHA512 f51c238a15236d76051d8f6b8cb4e5cbc431205cdaeb31f05036457a0eaf71d96700644eb7bb5cd9a5ba66fa25b0f89dc49e7752174bc4327ab68a1680aa1e04
- SSDEEP 192:TNyby2sE9jBF6IYiYF84+noPOJB3SbruA7NPKChv2d5k7f:TNyb8E9VF6IYiTPxsaPpd5if
- MD5 SHA1 SHA512 SSDEEP
Signatures/chrome.exe_sig
- SHA256 a6489457e4400183689669f10bd99422fbe33c8edb5634d95dc29fbddbb96bc6
- MD5 0967f02ea1a40889029b7a97a8209039
- SHA1 b518777dff9c98d70fc3bed3b1b45dbcca534d1c
- SHA512 f36535bcdc6ceaa739e1f49f145b409112835034efad676d587698523c44208ef85028cf82c36621813e299616b992ffc102bb4e81c0463de4daaf186e7a73ac
- SSDEEP 192:XWBIYiYF8m/Ex72f63YLa0Dx+noPOJB3hy2sE9jBF0NyfVl9Wl:GBIYi6y33SIPxh8E9VF0NyfT9Wl
- MD5 SHA1 SHA512 SSDEEP
Signatures/clion64.exe_sig
- SHA256 c62780a92372a3588e1d34a99ad170f9624e38e464862a72152d089d41fd8c6c
- MD5 232c1582745dd72f27732fd5de9aa927
- SHA1 76ce659ee207f604d39cf33e5c8d215d8888387a
- SHA512 fcd3e579ad3e2ca8309508d59cd558c1ba991dc397030e71946bc5f83a1a89ccfea0db94cbd81f12a4b9443280e7eef01ff1ca997a39da33fa8857fedcfa1327
- SSDEEP 192:fcuIuJfjJFer3PNwsVwlfBCXPWHboVqsn8OYoTisEPKLKI//i64m/XB:fyunFWlwwwlJCe7oVqsZniPKOIim/XB
- MD5 SHA1 SHA512 SSDEEP
Signatures/firefox.exe_sig
- SHA256 2cb7b1c22d6761b550869da0f425089d8f8edbdbd1bba45496731972be06b037
- MD5 9523458b4a3e35185893abb7e53044cb
- SHA1 c0fa39c14f0d18f61f06a18a6e3e6e418dffe955
- SHA512 ee080e789f256ce9f449d678788f83be0127e0844768d2365a5a3e6fb5a9241cd912c6a9c2c85f89e8ae5b7deb501c85fa21fa649c0dc536b5369896971876a4
- SSDEEP 192:M7x0KDWpH4AAANa3Gy2sE9jBF0NyQ+noPOJB36b2jTml0x:2vDG/t8E9VF0NyVPx6b2fml0x
- MD5 SHA1 SHA512 SSDEEP
Signatures/iVMS-4200.Framework.C.exe_sig
- SHA256 342a394bde1e61ed388250fb0caa8fb48d4d4dcacafc213e7920326a346cc223
- MD5 61f6fa235b921c9e750b53814ae12e95
- SHA1 89c5011661e6c433b4b1a3fedf0b4e5f6a545fba
- SHA512 44f868020f9554bb31c68c43ffa86f5d4e48b84a81c2bf6cabcacad282f3e6fe36efe3419fe6d2b0985bb18f541825c402cae68201e7ccab16d95b08324f5e6e
- SSDEEP 384:vMQqC/uDTrvVqGBkNl6bCIJWuFRTm4XWMQv/uDTrvVNWuFR9Y8JN77hhso:GPDVtkNlTOTk4rPDVNTL73heo
- MD5 SHA1 SHA512 SSDEEP
Signatures/idea64.exe_sig
- SHA256 ce6b2b57a700ad033194cd396b09c6dd43e022e01337e344cbcb2e18952eccd4
- MD5 f3fbe6c8de3d3759487a2fb588d17b5e
- SHA1 5bb4655f0884a32b7f062fd22de4d74ba10f100e
- SHA512 924fb0735daedd62728a9a7ea715bdc09be93868657133b74a507b252c4c7f998c161fdcfaf1bdd8249c5c049e301d998d59f7d80354097144892e3a5be429b4
- SSDEEP 192:ChuIuJfjJFer3PNwsVwlfBCXPWPZfcCU7TJWOYoTisEPKLKI//i64m/bv:ClunFWlwwwlJCeRf+7d/niPKOIim/bv
- MD5 SHA1 SHA512 SSDEEP
Signatures/logi_crashpad_handler.exe_sig
- SHA256 f27da615a73ad1c35ae6ba0ae8190808920be2d0cff18345dce290002a7a63bc
- MD5 ca872e1deb83319d7a5ab55eb95281d5
- SHA1 025f87e746775f14462dbd523dece35e69046b49
- SHA512 ef20e16741c1529e55aa0ba7566daf9eceace09c7525607f0a8a81523fa793604be6790708a96205eb7bc8004fbf54154124206b218133b87f50b0c64bfff785
- SSDEEP 192:n2T3+4RyncO67CU5rR8IIYiYF8nHPTSofousUwNhMvU7lU6QJKXPgxw8Uu1:au4scj5rR8IIYiRSofousHMx6QJKX4xJ
- MD5 SHA1 SHA512 SSDEEP
Signatures/obs64.exe_sig
- SHA256 47b6d2260b6ff378ac89890facb2f78e839858f5719fae832b5210182e7f8654
- MD5 b59b755ae675838c151632498739891c
- SHA1 f6c7bf8f63c218b6b5d5018f5b7ce2e7655ce116
- SHA512 8aecb12381858003a844b5884ebad00ccf6f538d34538676ec56e16bb23bb27f0062eb973d786da280dcb906221a02122ab99444d174785226dc0f3d446e85e0
- SSDEEP 192:kcmNyby2sE9jBF6IYiYF84+noPOJB3n07Fj2AAXBzFvnUJR/yu:kcmNyb8E9VF6IYiTPxnk6nBzhU/yu
- MD5 SHA1 SHA512 SSDEEP
Signatures/phpstorm64.exe_sig
- SHA256 4b2bb63abb71fcd79c579f4c4a1676f3236328bbef07a7cb3faee03dc19d2960
- MD5 a54ff09b1e539b2904998c6cd7922f7c
- SHA1 fef87ff35d8e9d9b52564bd58ccd18a6b7870221
- SHA512 de9e5c27acc3eb98bb1ec2a989625143d91f773494e98021538f03aede658bb5b30c2f01c0fb9d19d2b8187c0623e84a22ba19a7e7a89d43dcad5983d413bb24
- SSDEEP 192:LKuIuJfjJFer3PNwsVwlfBCXPWPv5QiUNPOYoTisEPKLKI//i64m/GS:LwunFWlwwwlJCeHqDMniPKOIim/GS
- MD5 SHA1 SHA512 SSDEEP
Signatures/rufus-3.21p.exe_sig
- SHA256 c2181866cf1c114a4c8910ab3f7d7a7e027dc0246ce58d6555ce0154a5a0d1a1
- MD5 bbdf221aeb679c6665dbedc1fcae51e1
- SHA1 6ce5bfe94b33e32d40e4ad32846caa6566c6a39b
- SHA512 ac51b78d7628a08c9fa9cfa1837f6597e1931a703438489d71a798a0570b960f352884db94132279fd79f6abd8274f426804e6263a9552fdc4c7738efa6d1a22
- SSDEEP 192:2qpPIKfhig1R7JNfVZCg2txKBysIsHfH0JOqsmVgz28WhBq7T:2qpwK3PVZAUksIsH8JN77hh+T
- MD5 SHA1 SHA512 SSDEEP
Signatures/steam.exe_sig
- SHA256 ee560220bc2252c7975a34d3729c71fb796107ba2b3eac935249ff70491c23be
- MD5 7863eb6ec9f67fba79fa05c5086bf626
- SHA1 3bdb11530312e9a2bf522cfb576f31a9adf59d27
- SHA512 73090fdfb8385ca7dc02f506fffbd386ce7003c0732894763c2d247d320bc5f596b9b34a01df06ce59c30865f38d71ee9d42800462028b52084e62189f56039b
- SSDEEP 192:XNyQDbnPvy2sE9jBF6IYiYF84+noPOJB3z7W76ub0R52p:XNyQH38E9VF6IYiTPxzIb0R4p
- MD5 SHA1 SHA512 SSDEEP
Stub/Client.exe
- SHA256 1aaaafda79eec1de509658c93f7fbeca99b8b720667ba6c43b55d530399eda45
- MD5 bd28eb79f29c609d0ca1ab313ed803b7
- SHA1 c77d4f10376c2da265c0696afa7aac6c761126f0
- SHA512 b6b0dfa3dd48b50bb7b88b08d7ec26bbc9afa03b870595c5ca2cc486f9da20a0973155d4f20e67c6c9e69744025193fce789e0972a0eebb95cc46f017133ed03
- SSDEEP 768:upNGZlr21xEHUo9R/hz1DSWZQYJ2s16JSdGRAQyeYeemZaRjkRvObyCmwBfz911M:upgAEHvBhz1DSWZQYJ2s16JSdGRAQyeP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Stub/Dropper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d911dbf9f7d1d28767982bd41f008be7599eb7957103d160f2c167ed4a326076
- MD5 a1ea2f07f2dc8ad979b8079c51415da8
- SHA1 a0d5322c26584760d9d909a38e28947e6b0985ae
- SHA512 c496e73b76c77699f58841966268027f87213b04b574bf1594e646f9b44fa685f37a3a88ffcf6bac7cc693af4636130f0d217460a0027ddcfc5e4dbfbb9693de
- SSDEEP 192:pe9suPhKz/riCfgy4m4ZUlEw4NIUFVeDxQc:pe9LPhK6sgyr4zq0Ve9Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Dropper\obj\Release\Dropper.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/Joiner.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a0c4450e5baf728aaf18a19038477ffcd02f2c9d96aac977716c04409742dbc6
- MD5 1447985d8788c23631a7332985940118
- SHA1 eb9d64eae44074e50d5cd334dd6b3725bcdb5147
- SHA512 293218182affa0c68b9b2c7d467e46cf3e10090fd1d4265a1b030b864e62578df900d7f86ce507be71e48149f50503294db33e8deefe74ec720aecfe728308d2
- SSDEEP 192:wphYgU+MD2u7aylytIZtjF+IrsxVUvA5:shYgtu7aylkITFNrsxVkA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Joiner\obj\Release\Joiner.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/KeyLogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b8bb0937e6ce6670a9362e617753f397b14752885f8072ddc875104cd8fbf53c
- MD5 fbb2874c5cce7c569d3720f07c5629d6
- SHA1 40156bb423ffe2511aaf710b9108401b5a7096d5
- SHA512 f0ae12a7942305af77ad1e3bf9308eee7ed880d81ff9eb285a848231387cc7b98e787553c74e7ad252e5debb30463eb2e23660aa0e6c73857bc70fbd793f0e05
- SSDEEP 192:DMduMewJ5Gr9RDaOvNs5AkxHblRYWG1v0dD6HVNb/pKy:KeM5GWOFUXhbLY7sDYV5RK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\KeyLogger\obj\Release\KeyLogger.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/UserMode.obf.dll
- IMPHASH 6dbf95d81ab0cb2039f47259ddec333f
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetModuleHandleA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.0Dev
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=7, id=265, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Stub/Winlocker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a0aee361aa97edd4efbaeeb07a2d995626101eead6a86377d463cf2efe736a82
- MD5 4ddb582636318a6e85eaab09ca75c9b0
- SHA1 4c148a5d01e2419ad6c80346b863fa6068d9bb01
- SHA512 08ad3566bd34dc3402210d2c31c52f55a3107c451d7babe3075e11a682ff528f65622e21e17d5022a097d15c0e8c6dabeccb77465493131cc40037ee2b9b4de2
- SSDEEP 384:8WOAvFEcg9MvfWCtw71ZIV8uMAjDulJzfxEDTlSDSfolob0K4ZEOwykj6eRD6ap/:vOQEc+cDTlShob0lUD6aZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\Liberum Screen Rat\Stubs\Winlocker-main\Winlocker\obj\Release\Winlocker.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SQLite.EF6.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 857a287f7f39097c2f70ff0ce681d35196daee60b43f255bc72b842a351208c4
- MD5 6f69454f7206eb6fb00b1f15d13718d9
- SHA1 c1472ad5c91da5e729bf419b8546657b2152915c
- SHA512 27c193cb2d25938bc508312c38932a25d63a8ecf49c9af6ad2819d1291f44f2b4435725dfef2dded2e0f3415aa73c8af276084899302f8b196a993dde85ae095
- SSDEEP 3072:9Nh7rnOCmxzBE91M+I1X+IZ/6KP8czmLhL:9b7Zmx1E91AuQ6KP8c
- MD5 SHA1 SHA512 SSDEEP
Digest
bb:d8:c5:bb:bd:68:c2:c0:c5:da:67:9a:6b:8a:d7:01:1e:85:69:bb:87:83:c5:eb:ac:08:54:90:1c:cc:77:c5:dd:1c:f9:a5:45:39:35:fc:bf:dc:3b:f8:4a:f7:d6:7f:6a:de:c3:1a:f6:8a:98:da:9a:45:63:66:b7:1e:a6:81
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
99:65:26:d7:c9:e8:76:61:13:07:44:be:3f:37:0f:19:ae:9f:33:c1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
190322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.EF6.2015\Release\System.Data.SQLite.EF6.pdb
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SQLite.Linq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4fa3cc89f5c3cfa0f794c1f849b0ea8d081e5c0e69d7fb2d834caed08d1140c0
- MD5 bbb0d3ddaaba530dc111e665a4891217
- SHA1 cea5a71ff0305083a9add3c4755a8e54ab10f869
- SHA512 ebf248bb57355de887770d91ea2b40a98e0760335a57dc6ea92ab89e65177cae95eb1c08116855c8eeeca81d4022ccdde2fca7cf34fad68b4ff0e14b74c93b89
- SSDEEP 3072:0Nh7rny2puIm199zIsd9IZ16KP8cfYLcgML3:0b7G2wbdLm6KP8cwO
- MD5 SHA1 SHA512 SSDEEP
Digest
19:74:b5:53:55:33:c4:62:97:af:ea:b8:18:02:ef:ac:98:60:8a:00:c6:b1:1a:48:ec:49:45:ee:07:93:1e:87:b9:79:5d:16:76:f8:74:aa:98:f0:20:16:38:f5:a9:fd:d8:f2:d2:8c:b2:30:38:e0:4b:aa:af:f5:25:1b:6a:68
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3f:8f:87:1d:f5:4f:a3:52:19:ab:82:91:cb:f5:8d:99:1b:51:70:a9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
190166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SQLite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d
- MD5 55c797383dbbbfe93c0fe3215b99b8ec
- SHA1 1b089157f3d8ae64c62ea15cdad3d82eafa1df4b
- SHA512 648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757
- SSDEEP 12288:5vXCrbE724yjK3r/fFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchs:h8dDm3r/7
- MD5 SHA1 SHA512 SSDEEP
Digest
05:b0:4c:75:7e:c1:9a:ea:48:df:6d:68:e0:4d:83:26:82:55:53:44:03:4c:b5:c4:a4:4b:e3:30:86:b0:60:d1:96:8a:ea:ad:83:0d:9a:a0:c3:3c:22:b7:20:3b:53:c0:84:d9:51:b4:e2:25:84:29:24:67:99:5b:0c:9e:f9:8e
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
12:d6:a7:c7:d7:cf:38:0e:4e:bf:20:38:8e:19:b5:11:95:ce:5d:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
381862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SqlClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d81f4a40b0cd8a28ea552d935ff8a7b86f70d746bd969ae9b3a783a5c8e6546f
- MD5 2cf3623600d7948d2d3b2ec51a75022b
- SHA1 d00c8be9945b6fbd22929dd0e666799cf0670673
- SHA512 1dbe67568aefdd9e3d85117b54ab6062efa15f2f2526f9e9c6e78c295bf4e873d2a7066c53b3c5fddbfe8446fb636c29a9bbef5d768aa7290c39ee6ae24da825
- SSDEEP 6144:XXFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFQ:HFRf60FhFoFmF8cjcsc4FEFbFgcbFmFQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f9:51:1e:09:e5:65:c5:36:26:ca:16:1f:05:b9:9d:ea:a6:44:d8:1b:de:89:06:85:57:04:1e:0e:41:0e:a6:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
218902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Data.SqlClient/net461-Windows_NT-Release/System.Data.SqlClient.pdb
mscoree
_CorDllMain
Name
.text
Size
206KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
26694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
15:1f:de:b6:f3:56:f1:80:ad:c0:ff:4f:a8:55:41:ad:fa:07:51:b3:2c:1f:9e:57:30:1f:5d:fa:af:6c:1b:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 4, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
14422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WinFormAnimation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WinFormAnimation\WinFormAnimation[master]\WinFormAnimation\obj\Release\net4\WinFormAnimation.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bdb84aa16678189510def7c589851f6ea15e60ff977ea4c7c8c156504e6ac0ff
- MD5 3d913aab7b1c514502c6a232e37d470e
- SHA1 28ac2d1519ec5ea58b81fe40777645acc043b349
- SHA512 311e8f73c52dd65cbaf9f6e008b3231090ea99edf3471bac63cca4156a37a0d874ac590b19c01b15e05345bb6a5b636a11698bbd4e88c59c138dd3f358800027
- SSDEEP 24576:2gW20arTgWkk7z2B3Kqwf11Ot9Awr89Iv7f+NGGL:XC3o4swrY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x64/SQLite.Interop.dll
- IMPHASH a42f73521c784fa06f1d886fcbcefcba
- SHA256 9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961
- MD5 56a504a34d2cfbfc7eaa2b68e34af8ad
- SHA1 426b48b0f3b691e3bb29f465aed9b936f29fc8cc
- SHA512 170c3645083d869e2368ee16325d7edaeba2d8f1d3d4a6a1054cfdd8616e03073772eeae30c8f79a93173825f83891e7b0e4fd89ef416808359f715a641747d7
- SSDEEP 24576:YPUxmkgSxPgobZPRjZ22H6edtOZzWySRO3mlE0i/Yl5P+qF+8k+ao/si6:8UxXPgo8e6WYBSJZSS5P97I
- MD5 SHA1 SHA512 SSDEEP
Digest
cf:de:a6:58:6d:f1:ba:ab:46:cb:60:08:e4:1a:5f:83:16:67:26:51:0b:b5:b9:8a:c9:8b:ed:b5:c8:82:6d:c1:e7:36:aa:8a:82:fe:da:08:1c:7c:47:a3:78:cf:af:fe:92:cb:b8:fd:17:10:3d:e8:ca:87:5b:a3:f2:a6:35:30
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3e:e8:ad:96:a2:e1:d0:66:85:77:ae:c2:41:dc:ef:f3:d5:76:58:fd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
WriteConsoleW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
AreFileApisANSI
SetEnvironmentVariableA
RaiseException
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
lstrcmpiW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI013768ea228eaf06
SI03ee1370ff2172fd
SI050169b0f137dcac
SI061f9351f6b79d40
SI066df4a47deb7b95
SI075258fe7332f5c9
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0b65268e19d3b81d
SI0e7c9abcb195c68c
SI0f556a49067bf550
SI0fe7fecb92f1b44b
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI15d5f41c81892f13
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI24f5c83eaddd65e8
SI252aeb4a9d3dc2ff
SI2b074e8cf29cb472
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI349980d776ee39ac
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3974af1f94b94613
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI57335d3e329eea8d
SI5887bf867911838d
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI64119fb980b7e962
SI6479b9cf07b87f67
SI674c3bc07fc17979
SI6901b186cfd089f2
SI690ffdcfd9cda629
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI6e6c544c028b2de9
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI72b05b1ad5f34d61
SI75fe921d50a95fe0
SI768767362ea03a94
SI77ffe3fede90bfbb
SI783104ea11038afc
SI79f6c64948ab63d2
SI7a4943591207dd14
SI7b97ee05aa1e64c7
SI7c373366af3ee2f7
SI7cd7250399b1ea60
SI7da3b9691a73b4a2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8dd2c969f2a6a31e
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9bf461db9bf83c22
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SI9ea49276dcf9849f
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa1d7e21a548b910c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIa8e1a742a358dc07
SIa9b758d3ae2e9aea
SIab3ed5feb3c43f0c
SIada7f27769d7f95b
SIae9562605f0b7c06
SIb391996b7b633820
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIb84ee16d149e7562
SIb94a6bc97d77e69f
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc0bb4eab77f5a999
SIc21d402df09e0c69
SIc26100c97b176329
SIc28b5d2d1f102994
SIc2d8715ee8c9e908
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIc5d5610a73781fac
SIc8c63d94dd03040b
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd2334250b08e199
SIcd6b4ac0aeff7202
SId00f524badf4f5cf
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdbbe1b52f304f379
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIdca7c218fe9393fb
SIde347320a2d725fa
SIdeb28053ce71d5b4
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe2cb515ade8c0235
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIeea5cda6d9846aa5
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8090240c1414098
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfcfad09d1b0a60ec
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
263KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=241, version=40116,
count=128, id=243, version=40116,
count=37, id=242, version=40116,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=16, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=153, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
x86/SQLite.Interop.dll
- IMPHASH 39ace63b362beb47a2a7a8202a5c4f2d
- SHA256 83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae
- MD5 8be215abf1f36aa3d23555a671e7e3be
- SHA1 547d59580b7843f90aaca238012a8a0c886330e6
- SHA512 38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b
- SSDEEP 24576:eiDAYMz2epP8AEXn8z7qsyb8c+gntHKuvKtBLtTvD0nsrFSK96fYlYyv:1AYMza36enEuyjpTV96A2yv
- MD5 SHA1 SHA512 SSDEEP
Digest
3b:1f:3a:ac:fb:ed:36:06:88:31:ea:b4:6d:f3:a1:e3:8d:2e:7a:dc:11:66:12:9b:f9:bb:8d:7d:d5:0e:57:cc:4e:89:0a:bf:27:24:68:97:37:c9:ea:55:87:a3:86:1c:e3:da:c3:21:ee:3d:b2:c8:6c:40:c6:40:7b:27:ce:61
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
18:28:ac:13:a6:25:5d:21:f8:30:42:d7:18:8e:57:cb:ff:65:3f:df
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
5844
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2015\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameTokenFromAssembly
StrongNameFreeBuffer
CorBindToRuntimeEx
StrongNameErrorInfo
wintrust
WinVerifyTrust
kernel32
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
lstrlenW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
GetModuleFileNameW
SetEnvironmentVariableW
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
GetEnvironmentVariableW
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
ReadFile
CreateFileA
LoadLibraryA
lstrcatW
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
WriteConsoleW
lstrcmpiW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableA
AreFileApisANSI
DecodePointer
SetStdHandle
RaiseException
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushViewOfFile
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
advapi32
CryptAcquireContextW
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptDestroyKey
SI00b5de0dbe05adc8
SI00f2097672333949
SI03ee1370ff2172fd
SI066df4a47deb7b95
SI07646c0ac405baf1
SI0a8f1a0337a9feb7
SI0e7c9abcb195c68c
SI12409cae6ddf2f1e
SI12a7c0808f3f99f2
SI150953dc62f0a879
SI1527d54f96ad891e
SI19b2677a019ab7ab
SI1ae480d1861ed022
SI1bc1bc471c8cd143
SI1c7a7970970b9619
SI21d24eac30bb9014
SI23e7cf9c8e559e93
SI2409c7e1eb500ce9
SI24bb313f312e2857
SI252aeb4a9d3dc2ff
SI2b5f6f3d24eb7ba3
SI2bc16556d60ccfcd
SI2c7820fd77bf7594
SI31a566678d8c54ab
SI327cfc7a6b1fd1fb
SI32b0162a49ae8729
SI36ddf861177da59c
SI36e67160052f7f69
SI3723ba2973e3b57b
SI3d45b939740dff51
SI3d527d6e902c8427
SI3efc17e9bbe52434
SI3f596ca698b243fc
SI3f8b1cdb4dc92eff
SI45d842f2d2322061
SI462a496f3247faf2
SI46481015c7f49c68
SI4983499b64278231
SI4987aea8bdedf163
SI4abff63f9a080046
SI4bf5a93645714882
SI4ceb9ee614df7639
SI4fb6877896ef7303
SI50a9b553ac0b2e2a
SI52058dea2268cd04
SI546abd8b90c0f48d
SI568a7d0a1f4d0ff4
SI588da80b6a264802
SI5b2b3e8bff031a75
SI5b7374ef2d63d8eb
SI5c7fb49466251e7d
SI609efcf96ea8408a
SI61a330d2e855b61b
SI633e1c91fb9a8aa1
SI674c3bc07fc17979
SI6901b186cfd089f2
SI69d8a1d378771295
SI6cfa851319f410c1
SI6d14611bb8b2c8bc
SI6e539204336d5b4b
SI70e4ec628dd7e188
SI7164645d0504ae24
SI72621cc08869a205
SI75fe921d50a95fe0
SI768767362ea03a94
SI783104ea11038afc
SI79f6c64948ab63d2
SI7f41c842e0d89557
SI8162bd921f89d839
SI824276b89178ecbe
SI83d1cf4976f57337
SI863e1ae0679961f5
SI87a11c29fe1dc17b
SI88974d2e6bd51eff
SI8a3a9f59ab5f24ee
SI8d447a033d183aaf
SI8d676d5954c732bc
SI8e33e5864c547f3f
SI9196a02c851acbfb
SI919f742193b92a4b
SI943321d364f02e5d
SI94d8f51c6c1db577
SI950480ab972e108d
SI9517b76a4f0b657e
SI9662fa92cee70cf1
SI979d7afd84d6f0ca
SI989b06a5a9b937fe
SI989b754accd7cddf
SI9c6d7cd7b7d38055
SI9cb7692f61998485
SIa069da76968b7553
SIa0f9dd1158cbfb0c
SIa26b8e5116b7d93b
SIa2a6050a8dbd3b7a
SIa3401e98cbad673e
SIa3f7b31190ce0815
SIa618e7f1e95b5c32
SIa62692883d0c456a
SIae9562605f0b7c06
SIb3f045f05d2d1b0e
SIb4089165600bb7f5
SIb4e97c410be9a2cf
SIb6d52d8cb2f1045a
SIb739af05c351a5b0
SIbc9b0b73a965892b
SIbff6307869d58daf
SIc001296960f3e921
SIc26100c97b176329
SIc28b5d2d1f102994
SIc38599462746964c
SIc3b0ae4f7a27b7a8
SIca6f27da046939cc
SIcbf931747ce28d75
SIcc134e65c80c0c61
SIcd6b4ac0aeff7202
SId6deafdcc0c75049
SId99ac2a61d035e11
SIdba35b6dcb77d463
SIdc2e4e1ccfa9a043
SIdc6920f226dceb74
SIde347320a2d725fa
SIdfd4d81e1791b463
SIe25e8f29ef2a78eb
SIe57aa77c8884d3f9
SIe6405dfd7b63ead9
SIe68a75d48671c8a5
SIe7632ce587b97772
SIea4313bfab0cfe57
SIea8388f7613ed158
SIec91f505db92f298
SIecd4a7ef4a5968a1
SIef12447577961bdf
SIf060fffd3e5c94b5
SIf21356bf3fa1a8ef
SIf216ef3874529d42
SIf356c1132676af25
SIf4199c70bfb81a15
SIf499bb5c421377e7
SIf71b64d343ddea8b
SIf8364af380546f2d
SIf86df75514f4442f
SIf8a71e249d9c661f
SIf8b1716e85b0e192
SIf8ee6276be88ce12
SIfc350ae509dc2b53
SIfca3960780d005fa
SIfd52d1389825aac4
SIfdb97bb7d9d0d622
_SI013768ea228eaf06@8
_SI050169b0f137dcac@12
_SI061f9351f6b79d40@8
_SI075258fe7332f5c9@0
_SI0b65268e19d3b81d@12
_SI0f556a49067bf550@8
_SI0fe7fecb92f1b44b@12
_SI15d5f41c81892f13@8
_SI24f5c83eaddd65e8@4
_SI2b074e8cf29cb472@16
_SI349980d776ee39ac@12
_SI3974af1f94b94613@12
_SI57335d3e329eea8d@12
_SI5887bf867911838d@12
_SI64119fb980b7e962@12
_SI6479b9cf07b87f67@8
_SI690ffdcfd9cda629@8
_SI6e6c544c028b2de9@4
_SI72b05b1ad5f34d61@12
_SI77ffe3fede90bfbb@32
_SI7a4943591207dd14@4
_SI7b97ee05aa1e64c7@12
_SI7c373366af3ee2f7@4
_SI7cd7250399b1ea60@4
_SI7da3b9691a73b4a2@12
_SI8dd2c969f2a6a31e@12
_SI9bf461db9bf83c22@8
_SI9ea49276dcf9849f@12
_SIa1d7e21a548b910c@4
_SIa8e1a742a358dc07@8
_SIa9b758d3ae2e9aea@12
_SIab3ed5feb3c43f0c@0
_SIada7f27769d7f95b@4
_SIb391996b7b633820@36
_SIb84ee16d149e7562@12
_SIb94a6bc97d77e69f@8
_SIc0bb4eab77f5a999@20
_SIc21d402df09e0c69@8
_SIc2d8715ee8c9e908@4
_SIc5d5610a73781fac@12
_SIc8c63d94dd03040b@44
_SIcd2334250b08e199@112
_SId00f524badf4f5cf@20
_SIdbbe1b52f304f379@4
_SIdca7c218fe9393fb@24
_SIdeb28053ce71d5b4@12
_SIe2cb515ade8c0235@12
_SIeea5cda6d9846aa5@12
_SIf8090240c1414098@4
_SIfcfad09d1b0a60ec@20
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_json_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=49, id=241, version=40116,
count=128, id=243, version=40116,
count=39, id=242, version=40116,
count=23, id=259, version=24123,
count=22, id=261, version=24123,
count=15, id=260, version=24123,
count=8, id=203, version=65501,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=152, id=1, productName=Unmarked objects,
count=1, id=264, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,