Stealerium (1).zip
- SHA256 bbec7a6d4f3edf13e687545f8ae4709cf31b08d1feac57161598638c57f17f8e
Overview
overview
10Static
static
10Stealerium (1).zip
windows7-x64
1Stealerium (1).zip
windows10-2004-x64
1BuilderCon...s.json
windows7-x64
3BuilderCon...s.json
windows10-2004-x64
3BuilderConsole.exe
windows7-x64
1BuilderConsole.exe
windows10-2004-x64
1BuilderConsole.exe
windows7-x64
1BuilderConsole.exe
windows10-2004-x64
1BuilderConsole.pdb
windows7-x64
3BuilderConsole.pdb
windows10-2004-x64
3BuilderCon...g.json
windows7-x64
3BuilderCon...g.json
windows10-2004-x64
3BuilderGUI.deps.json
windows7-x64
3BuilderGUI.deps.json
windows10-2004-x64
3BuilderGUI.exe
windows7-x64
1BuilderGUI.exe
windows10-2004-x64
1BuilderGUI.dll.config
windows7-x64
3BuilderGUI.dll.config
windows10-2004-x64
3BuilderGUI.exe
windows7-x64
1BuilderGUI.exe
windows10-2004-x64
1BuilderGUI.pdb
windows7-x64
3BuilderGUI.pdb
windows10-2004-x64
3BuilderGUI...g.json
windows7-x64
3BuilderGUI...g.json
windows10-2004-x64
3Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Stealerium (1).zip
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Stealerium (1).zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BuilderConsole.deps.json
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
BuilderConsole.deps.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
BuilderConsole.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
BuilderConsole.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
BuilderConsole.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
BuilderConsole.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
BuilderConsole.pdb
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
BuilderConsole.pdb
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
BuilderConsole.runtimeconfig.json
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
BuilderConsole.runtimeconfig.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
BuilderGUI.deps.json
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
BuilderGUI.deps.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
BuilderGUI.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
BuilderGUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
BuilderGUI.dll.config
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
BuilderGUI.dll.config
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
BuilderGUI.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
BuilderGUI.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
BuilderGUI.pdb
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
BuilderGUI.pdb
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
BuilderGUI.runtimeconfig.json
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
BuilderGUI.runtimeconfig.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Mono.Cecil.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
Mono.Cecil.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Stealerium (1).zip
- Size 7.1MB
- Sample240927-1kvbba1dkq
- SHA256 bbec7a6d4f3edf13e687545f8ae4709cf31b08d1feac57161598638c57f17f8e
- MD5 eda07475c1b4783bc37da25cbe56ba71
- SHA1 dfb5674e532af9a206c9dab492078fd282ecc535
- SHA512 131f78db9073e4050e013a5a39ed263aeca60dbd17eb8837299311a201c19716e4cb25a72fb13159402c37aade7166e40e9f15eb96a869bd9efe16ac281fe7fa
- SSDEEP 196608:eHdx8Er/Gg7uGeTy3WX/haS2Qf2PACALsnCHEhZ6vI1WX:eXr/Ggqxyi/haQfeA7LaUEhZCX
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Stealerium family
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/BuilderConsole.dll unpack001/BuilderConsole.exe unpack001/BuilderGUI.dll unpack001/BuilderGUI.exe unpack001/Mono.Cecil.Mdb.dll unpack001/Mono.Cecil.Pdb.dll unpack001/Mono.Cecil.Rocks.dll unpack001/Mono.Cecil.dll unpack001/SixLabors.ImageSharp.dll unpack001/Spectre.Console.ImageSharp.dll unpack001/Spectre.Console.dll unpack001/Stub/stub.exe unpack001/Wpf.Ui.dll
File Explorer
-
Stealerium (1).zip.zip 7.1MB
-
BuilderConsole.deps.json5KB
-
BuilderConsole.dll.exe 216KB
-
BuilderConsole.exe.exe 135KB
-
BuilderConsole.pdb14KB
-
BuilderConsole.runtimeconfig.json340B
-
BuilderGUI.deps.json1KB
-
BuilderGUI.dll.exe 282KB
-
BuilderGUI.dll.config811B
-
BuilderGUI.exe.exe 135KB
-
BuilderGUI.pdb22KB
-
BuilderGUI.runtimeconfig.json458B
-
Mono.Cecil.Mdb.dll.dll 38KB
-
Mono.Cecil.Pdb.dll.dll 87KB
-
Mono.Cecil.Rocks.dll.dll 26KB
-
Mono.Cecil.dll.dll 351KB
-
SixLabors.ImageSharp.dll.dll 1.7MB
-
Spectre.Console.ImageSharp.dll.dll 16KB
-
Spectre.Console.dll.dll 692KB
-
Stub/stub.exe.exe 3.6MB
-
Stub/stub.exe.config759B
-
Wpf.Ui.dll.dll 5.2MB
BuilderConsole.deps.json
- SHA256 879473cb2ef89ed9213389783928f7ad681069d028551f41fca3b0f8bbcfae2c
- MD5 eb447eb6465b8016d2ae5f0b9056260c
- SHA1 8ee7126b8ba2745b36337b9bd255ec718385f8ec
- SHA512 c2582c30db01eb1b947eae2d27a99f563fd6ab50cc011a6e6452f2aef4215eb8c00f5dc1e658032f7d576912ad32cb33bb9072f69b2429638c0b37311a228e53
- SSDEEP 48:BC00f5qEsIXhpXhNXh3JX178nOmIOWhTI7H+qLSYHByD3cHIco3aHEg3HwHf1LHL:Cf0E7k7HLSYgD3cIKkQQcsB1vd
- MD5 SHA1 SHA512 SSDEEP
BuilderConsole.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f1835422764ff36a48d43125c91083fd787bb80d66e13896bde0ec080d4c17aa
- MD5 e0e9c2fc9b5912f2b3a0022cffa383d4
- SHA1 1f4dc75037e42a53c4433789b429b72047ad9dbd
- SHA512 e87086a3f60d738f6820db2bcf35ac7b067bee2573690e76e572e635664b769a809f46a6d534ddaa22a00b806a09d65e557200303e4bc73e449f9554e887ccc1
- SSDEEP 6144:Be03eDAIbr0K3xybL1tAj4PhFqFVfrRbP:U03mbr0P1tAj4P6r9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Stealerium\Stealerium\BuilderConsole\obj\Release\net8.0-windows\BuilderConsole.pdb
mscoree
_CorExeMain
Name
.text
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BuilderConsole.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 6cc7dcaf56f14df07026677dfeccb18dd46f5de0c8709881c7323938758696a2
- MD5 e3f48b8db629b9c0bd15465a08b22c81
- SHA1 848c2c6c4d375c48584ded7838f786092b6243b7
- SHA512 9c398619875957f4866901172051c4dff83e3e20b939ddb65df85837f168623274f26053d1689819fe66567174f2477ac451e4a8851aa2e1047cf742766a8914
- SSDEEP 3072:2jK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOOhBuv:2jK4TDUqgpqWDLZ5H+xuZ04JhA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=33731,
count=12, id=260, version=33731,
count=87, id=261, version=33731,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33808,
count=1, id=258, version=33808,
BuilderConsole.pdb
- SHA256 5860f968693d8455b32cbd38baae7f266e35c5ffb0b34a8bf4d2505f1d777288
- MD5 e10083bd148fd938c643848e917ac6fb
- SHA1 883ad1192be15ea837abc9fea712ad1ecd3b63d5
- SHA512 f38a836312ad20e3aa646284cbdc450f15d0fd29ff447de8797831316f0b751cf4680aaf9ad7b8d52421b40aa88c05bfdf4b342f577960288fe2cb958af5964f
- SSDEEP 384:Q5FM1yRdZc7otB10dapq/6PhR+6hBicgKa+2uHGV73HafyEVAn1whkucbZq:dO4G95dHfp
- MD5 SHA1 SHA512 SSDEEP
BuilderConsole.runtimeconfig.json
- SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
- MD5 253333997e82f7d44ea8072dfae6db39
- SHA1 03b9744e89327431a619505a7c72fd497783d884
- SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
- MD5 SHA1 SHA512
BuilderGUI.deps.json
- SHA256 7e3738cdc05c18a7f241073480cc84963ee182e5fcb1eb6484c74a82da86ff64
- MD5 f78bbb4eb3d79e8d60159b08f3cf54c5
- SHA1 9e6866e906c9fdffb35e67a259fbcea54673b091
- SHA512 80caac6f690637c116263cfd7b3736f01f5e7d7497be25493b87bcb07b3ae6b0f94b8655cdd145900ba34b4f0927621ad4d37061b10ef0bb3e562f44e63e1da9
- MD5 SHA1 SHA512
BuilderGUI.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7133cef4f332702d6e02ed519639c1a1539ec089b4010dad0bb3478d2fb6d6d9
- MD5 30b89f6f1b16ec0402c742c8ca290b36
- SHA1 22e273573b7af5a06d21256f52c72b3d70a8d20e
- SHA512 c1a494d510a796f3ae50234fe312076c0d4548c2a90dcf26b095c1bbae22f0b2dbfa894e47298a82781c4fa8a22515d8da9cb3da633fd6a3cf5241cc609f75ba
- SSDEEP 6144:gwxsdhwtVShVvH0c3DGwI3+IL/LgSXH8uTvq9mQf9zV3x+t/aIzJY:Tx+bVrawIOIrNHFOFh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Stealerium\Stealerium\BuilderGUI\obj\Release\net8.0-windows\BuilderGUI.pdb
mscoree
_CorExeMain
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BuilderGUI.dll.config
- SHA256 8b97c19381ff3a5972aa26dadefa1c7b72dccffd2ddf02ea3854fef252288175
- MD5 3164da8283e95932cbb68aef15181359
- SHA1 cf237d4e15f5104b3b62774510246971066679a5
- SHA512 5b008905ec261b8194c32b309a4caca529453e73130a41b1b76e38aad852e3ddfc74b3f8d3f7ade165b61613c93f4ff41a6f0a172e0575c5aa93783737eb451c
- MD5 SHA1 SHA512
BuilderGUI.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 e71e821dddadc72ed5f0c0fa1cd4484cc3d1221aa1c6b7c914f4dc94cf3a5328
- MD5 2d96326ccc87b526f23d81cdfd22e8cc
- SHA1 30d33f71bfc21e8b5543ed32c828d9b0aa9816c1
- SHA512 0a40fabdaedd932cb0e4b4f4ede3c870b8390f567eb5564a2dde7d56ffe930414d747e16d468d3cf6e5b7facea0e451bc9cc78644e3749faf45936aeeac01e23
- SSDEEP 3072:rjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfOUhBu7:rjK4TDUqgpqWDLZ5H+xuZ04DhA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70208
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=33731,
count=12, id=260, version=33731,
count=87, id=261, version=33731,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33808,
count=1, id=258, version=33808,
BuilderGUI.pdb
- SHA256 6e22b0e4883733f93bcb6498d15c32a8c3fed07889f9a8488932707b23ecf8f1
- MD5 df43dfb5e9626e9ab79770b157167995
- SHA1 b4a6731163d1b33759d3dccea771b5a31348ce34
- SHA512 750f662a3ff48c51513e1a25c485e58d8760f5da8d34a3dce54e2a7eff525f0b38989bc2eecb0e85b1abd31e6d14a9a6e79d3e4010914ec1d1ad1ce007d4e825
- SSDEEP 384:v8HfK0lqtAFKwvHNDJuACrtdtB10dapq/6PhR+6KhBicBE9a+20AuVo73HafyEVb:0/1quhvmACn923QAip7FYTw
- MD5 SHA1 SHA512 SSDEEP
BuilderGUI.runtimeconfig.json
- SHA256 c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
- MD5 07b9a30265ca4e69c7016a1b6e3ffc27
- SHA1 3a4af82a2695b1423aedd8b60a5c86793c011b02
- SHA512 efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
- MD5 SHA1 SHA512
Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bda97fc302904bf235d631e698a0c81324872dfad2a38e63ef66389155bfcf4
- MD5 0c2d7a3d146e193d7b8e50f0fe398568
- SHA1 bf0a6ab31388eab1ffd3cd87fae62b45e90cba24
- SHA512 5fdc45ae536955e6f66970b35008ce15c5c5624d0b31bd41c79d6548d0d1b950042f51fe7dbbbc33a6256f90f5db23bf0070abe24502a050505be66f086d6df0
- SSDEEP 768:ArF3HuZyOt78PeWSTkazhOOgfGNOV/pVxPRpaCCrHpTFuzL4oWB:ArFecOt78PeWC8OgfGkVh6pTcL4oWB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\netstandard2.0\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333397769114ffd13046a25b9cfffd41c44a3450ea9ea1fd13b76eec28e1a815
- MD5 625ce2e8be214194a161fe80e6eca7d0
- SHA1 58944e03ee249618e9440545623c4545777377f7
- SHA512 c324ea36e4a89a6052f685e4f96527323ab6f4eea4f4c70c71f08a84df2d46332d91c3f289463502887d9b098dc6e69036c322630b770531927d5329873b250f
- SSDEEP 1536:mffXkeOyX+6C5S6R7nQSALYKXNgJGsZaBcLevjCXeo:ao5S6R7nNArWJGPBEeveXeo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6d3e6eab8d89dbd6fcf34268a08a6544ea142b6bcc5f665bee62317786b7892
- MD5 6fc634673b94c7ddde6e2ba277f7e7c7
- SHA1 f29feb86a8595d104b3b1b4be809f6e9fbc8f042
- SHA512 51f4782d7a8e2b3ffbb8fedddcfe85379e5adc499a2fd55c29e29628ca9519c33a33daf806eb3b8d01cfc10c964c1cd2558152c000c7ed2a8584f36c58f31c51
- SSDEEP 768:tkU1iy+QMBCocUuk0ThROoUheLXG99gmIt:tkUCCo/KjOoUhpg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c2908709da6761e9b5b9d4d46102d65851145bac987787d6c5a05ffe5689487
- MD5 6d8d43c5d7dbe36ec01ff8b951cf1e0a
- SHA1 d6b8214419870770e1ce398ca06a6a9f0e9e62a3
- SHA512 221955b05d83513fadcb79721c96fd467ea871cfa401b279dc8ade426c88df4cadc884dae7a9c418c1012af202263f31ce8b63ca919e1f725eb7c7e8008c3a57
- SSDEEP 6144:eCDxMlG40kOSV1L6RWDv2F2AEJHwBI+aB:rG1J1LQFLE0I+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
363046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
349KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SixLabors.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d19e3bc90153b7d0360360422355daa569209180dd1e4337f2431148d1d7219
- MD5 523dced95fcb0120698fc194b159a5cd
- SHA1 9f6e4c7269caaf2e09b6961551102b1ec16e60a0
- SHA512 325c9c3a316852ea6156a07317a64e369048dc7cfea21e9ea87f8723cf37515f0dfc0a31ab3bf07155ea27938d426c9832c1fcba1ab6c96573cc44eacfa05255
- SSDEEP 24576:3ruzK1lGe+34AbXwX8WcaMX07Bpu39DhpsRalM9FHBjDkck3IegDkspo4fVz:3oo6WcaMX0zYUkY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1775990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/src/ImageSharp/Release/netcoreapp3.1/SixLabors.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bfd93580ee32cfff38f89c9feb26ce87a59b7066e1a2da24d34f963f5c6d659
- MD5 e5f78665105aedfbc56b309671b06abf
- SHA1 732ce3fbe0cbc80aca76211443f5020bad99e2ea
- SHA512 98f3edea553a68d1be9351859f303196dda988337fabcf56b5518108a7f1f80a8b9403728a10228c8333a4c5e3384521ba78b7d24d69a39b24ec3873aaa86a73
- SSDEEP 192:FYxWwXhIRCsqDD/YY8ti9aYDro9ClkoRwq9w1PsPANnfz/gSAtExnGe4WZATco3t:Fm6egq5RiqkP3DTCrWZ+co3ZHHDCG9X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d637ed96aa8f48a4adfbae800bd15fb7c31c267404b941ebc41875030a458fa1
- MD5 413439b3a6b864685cdb80fd274a2538
- SHA1 183ff2bfef55bd22fc30388946d04a89dab896ad
- SHA512 be14810e0ef652e5b7ef2cd0d762bc8b602b76f64f38a016dabd82b7677bbd86da5235d93cef4d8749f9bcfe32df7e35b8533148f2aca59c54d82452f557fdbc
- SSDEEP 12288:kt5gpkgB7axkwzcxpYzv+Yr0iRYOlVL+FQ:kTiTB7amwz4Y0iRXVqq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
672954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.pdb
mscoree
_CorDllMain
Name
.text
Size
690KB
Virtual Size
689KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 738bff49a7d0bf56466323ca5738e97829123984ed5097edbcef7bea308fdcd8
- MD5 692985c7b0ff2fef9bdc934a6e07a368
- SHA1 81aba4700e54284587048bb29a2f2810ff0ed68c
- SHA512 e96fda010c8df7434b0df93764ef41cffd8e922491719440e79fdcd3649530f48a6128bf06d4096ca0e744803726f9fe198aac0e9a992ba406d9aa3ff7adb660
- SSDEEP 98304:AEjdGSi3kqXf0FLYWCLbi6sfLxkuahjCOeX9YG9see5GnRyCAm0makxH13:S3kSILYWqZAkuujCPX9YG9he5GnQCAJS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3800446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe.config
- SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
- MD5 a40b70b19e717b2628d2662b61e69f99
- SHA1 c3d59349659cd82fb6b8c093a3df72846541573a
- SHA512 2dfca6af0d7daeafa4803fbf971843e70678eb2ecc73f8559d39a617721c3a9362eba9fd4d158a1227a50d96b6711a9bd9f694eb10532e7caa9694aefa81b794
- MD5 SHA1 SHA512
Wpf.Ui.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7cbc69f998f8c129f3cdf6ff5f636c18bf057acd173e939c4e9af1c5372434c0
- MD5 cc27609de5a51857ba8fbfb87980002e
- SHA1 cd9d5238c4ba69906d2ae3004bddd91f561d7eab
- SHA512 25dfe16f41cf8c25fcc92bfb64460373ff3ba8345d4d71ecd2d5815ef995a73df5dc7341d33eede3d324493343c0c6e4181c7067f8d92345438cf8e4366596c3
- SSDEEP 98304:vcHkR+L11p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:vcERa1HZNkq4p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5472726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Wpf.Ui/obj/Release/net8.0-windows/Wpf.Ui.pdb
mscoree
_CorDllMain
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ