redlinestealler2020.rar
- SHA256 97c05247d54a2939e9744b71a2a937a66a279518455abb50989380558dbe94fb
Overview
overview
10Static
static
10Libraries/...52.dll
windows7-x64
1Libraries/...52.dll
windows10-2004-x64
1Libraries/GuiLib.dll
windows7-x64
1Libraries/GuiLib.dll
windows10-2004-x64
1Libraries/...UI.dll
windows7-x64
1Libraries/...UI.dll
windows10-2004-x64
1Libraries/...db.dll
windows7-x64
1Libraries/...db.dll
windows10-2004-x64
1Libraries/...db.dll
windows7-x64
1Libraries/...db.dll
windows10-2004-x64
1Libraries/...ks.dll
windows7-x64
1Libraries/...ks.dll
windows10-2004-x64
1Libraries/...il.dll
windows7-x64
1Libraries/...il.dll
windows10-2004-x64
1Libraries/...on.dll
windows7-x64
1Libraries/...on.dll
windows10-2004-x64
1Libraries/...ls.dll
windows7-x64
1Libraries/...ls.dll
windows10-2004-x64
1Libraries/...en.dll
windows7-x64
1Libraries/...en.dll
windows10-2004-x64
1Libraries/...ib.dll
windows7-x64
1Libraries/...ib.dll
windows10-2004-x64
1Libraries/builder.exe
windows7-x64
3Libraries/builder.exe
windows10-2004-x64
3Libraries/...et.dll
windows7-x64
1Libraries/...et.dll
windows10-2004-x64
1OpenPort.bat
windows7-x64
8OpenPort.bat
windows10-2004-x64
8RedLine.Ma...ed.exe
windows7-x64
3RedLine.Ma...ed.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Libraries/Bunifu_UI_v1.52.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Libraries/Bunifu_UI_v1.52.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Libraries/GuiLib.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Libraries/GuiLib.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Libraries/MetroSet UI.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Libraries/MetroSet UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Libraries/Mono.Cecil.Mdb.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Libraries/Mono.Cecil.Mdb.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Libraries/Mono.Cecil.Pdb.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Libraries/Mono.Cecil.Pdb.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Libraries/Mono.Cecil.Rocks.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Libraries/Mono.Cecil.Rocks.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Libraries/Mono.Cecil.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Libraries/Mono.Cecil.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Libraries/Newtonsoft.Json.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Libraries/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Libraries/RedLine.SharedModels.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Libraries/RedLine.SharedModels.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Libraries/System.Drawing.Pen.dll
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Libraries/System.Drawing.Pen.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Libraries/Vestris.ResourceLib.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Libraries/Vestris.ResourceLib.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Libraries/builder.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Libraries/builder.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Libraries/protobuf-net.dll
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Libraries/protobuf-net.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
OpenPort.bat
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
OpenPort.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
RedLine.MainPanel-cracked.exe
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
RedLine.MainPanel-cracked.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target redlinestealler2020.rar
- Size 2.1MB
- Sample241207-tbgwaswpew
- SHA256 97c05247d54a2939e9744b71a2a937a66a279518455abb50989380558dbe94fb
- MD5 65f91d3c7fe04822bcdf957b4bafd29c
- SHA1 5d13f4d7e7bc71616e0ca41008bf69b29da889d8
- SHA512 0eb9c488fd3214a287e49d1c190ba60107e7c1decb0671259366d9193f6ef10f4948b42c60b6d9bba908323337e73bfd543cd5320e28c023dd581aae6182912c
- SSDEEP 49152:xsfWQqO5YVqKSP13XKjzvv/5B+gehyl30ynqkwAUgs:xsfRqO5GSPdXKjb//+o31wAVs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- RedLine payload 1 IoCs
resource yara_rule static1/unpack001/Libraries/RedLine.SharedModels.dll family_redline - Redline family
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Libraries/Bunifu_UI_v1.52.dll unpack001/Libraries/GuiLib.dll unpack001/Libraries/MetroSet UI.dll unpack001/Libraries/Mono.Cecil.Mdb.dll unpack001/Libraries/Mono.Cecil.Pdb.dll unpack001/Libraries/Mono.Cecil.Rocks.dll unpack001/Libraries/Mono.Cecil.dll unpack001/Libraries/RedLine.SharedModels.dll unpack001/Libraries/System.Drawing.Pen.dll unpack001/Libraries/Vestris.ResourceLib.dll unpack001/Libraries/builder.exe unpack001/Libraries/protobuf-net.dll unpack001/RedLine.MainPanel-cracked.exe
File Explorer
-
redlinestealler2020.rar.rar 2.1MB
-
LICENSE1KB
-
Libraries/Bunifu_UI_v1.52.dll.dll 219KB
-
Libraries/GuiLib.dll.dll 50KB
-
Libraries/MetroSet UI.dll.dll 436KB
-
Libraries/Mono.Cecil.Mdb.dll.dll 42KB
-
Libraries/Mono.Cecil.Mdb.pdb18KB
-
Libraries/Mono.Cecil.Pdb.dll.dll 87KB
-
Libraries/Mono.Cecil.Pdb.pdb25KB
-
Libraries/Mono.Cecil.Rocks.dll.dll 27KB
-
Libraries/Mono.Cecil.Rocks.pdb8KB
-
Libraries/Mono.Cecil.dll.dll 337KB
-
Libraries/Mono.Cecil.pdb172KB
-
Libraries/Newtonsoft.Json.dll.dll 683KB
-
Libraries/README.md2B
-
Libraries/RedLine.SharedModels.dll.dll 29KB
-
Libraries/System.Drawing.Pen.dll.dll 2.7MB
-
Libraries/Vestris.ResourceLib.dll.dll 76KB
-
Libraries/builder.exe.exe 668KB
-
Libraries/builder.pdb33KB
-
Libraries/protobuf-net.dll.dll 274KB
-
MetroSet UI.dll.config.xml 891B
-
OpenPort.bat94B
-
README.md446B
-
RedLine.MainPanel-cracked.exe.exe 668KB
-
RedLine.MainPanel.exe.config.xml 4KB
-
RedLine.MainPanel.idb2.8MB
-
RedLine.MainPanel1.exe.config.xml 4KB
LICENSE
- SHA256 f70f862f10b5e832a87d98b159294b68ccf58d4188d7efb323c053eeced58d82
- MD5 624dabf940feb6357c70afb0e1769dd9
- SHA1 d49a1cd3c87e760aa0c91b99e8578e6fb2e81173
- SHA512 8197519b2109edb5d84853f0fc0beb3a59afa75a00d323992f49e9d7fad2c50f60a9550573e20b702881ed64819b89c2e974be64cc4fa6b1afbc5933114c0ba4
- MD5 SHA1 SHA512
Libraries/Bunifu_UI_v1.52.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de0e530d46c803d85b8aeb6d18816f1b09cb3dafefb5e19fdfa15c9f41e0f474
- MD5 5eca94d909f1ba4c5f3e35ac65a49076
- SHA1 3b9cb69510887117844464a2cc711c06f2c3bd19
- SHA512 257a33c748dfb617a7e2892310132fd4abf4384fb09c93a8ac3f609fd91353a4f3e326124ecc63b6041ac87cf4fcc17a8bdca312e0c851acd9c7a182247066ea
- SSDEEP 6144:o1uzZh5rYAuBjtnkbxuzZ7Mg3i3hJtm4Fw2hHQHcHKaPUb:Ku1higb4zZR+9mcHX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
229774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
216KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/GuiLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87cfc70bec2d2a37bcd5d46f9e6f0051f82e015ff96e8f2bc2d81b85f2632f15
- MD5 eaf9c55793cd26f133708714ed3a5397
- SHA1 1818aa718498f0810199eca2b91db300dc24f902
- SHA512 b793ae1155bd7be247b42c0fc1bc53e34cf69e802c0e365427322dac4b5cc68728d24255a717aaffa774b4551a6946c17106387cff4cfdb6ce638d8a4ecab4d9
- SSDEEP 768:CXBWBHqfkC/Wcd1V4+8dUQeEqUNVugMP26lunzWWeddVV:CXiWJ16+8dxeAVuAWWed9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\ASUS\Desktop\Develop\Projects\TwiceSlice\GuiLib\obj\Release\GuiLib.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/MetroSet UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d490c04e6e89462fd46099d3454985f319f57032176c67403b3b92c86ca58bcb
- MD5 f13dc3cffef729d26c4da102674561cf
- SHA1 5f9abff0bdf305e33b578c22dada5c87b2f6f39c
- SHA512 aa8699c5f608a10a577cb23715f761ee28922c4778f5ea8a5ec0a184e1143689fba5a08003fd5cbf3c7dd516eac1fddc8c3f9efa1d993ba1888e87b70190c08f
- SSDEEP 12288:oE4n7EmAqNv8MkCvzMTlCPRSoWzz7QYaIHtMhPrYDK:oE4n7xAqN0MkCvzMTlCEoDYFH2eDK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
443718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
425KB
Virtual Size
425KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90cfc73befd43fc3fd876e23dcc3f5ce6e9d21d396bbb346513302e2215db8c9
- MD5 dc80f588f513d998a5df1ca415edb700
- SHA1 e2f0032798129e461f0d2494ae14ea7a4f106467
- SHA512 1b3e57fbc10f109a43e229b5010d348e2786e12ddf48a757da771c97508f8f3891be3118ff3bb84c3fd6bfa1723c670541667cdbf2d14ea63243f6def8f038cc
- SSDEEP 768:Cr5EYZep98C87KHeBUZwrEF7b+gxfM3AkMus4iWJq9F4CRIcZwMRTIzyAt9U2:Cr59g98C87KHeBUbwgKirbdwMRTzAt9l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Mono.Cecil.Mdb.pdb
- SHA256 d18eb89421d50f079291b78783408cee4bab6810e4c5a4b191849265bdd5ba7c
- MD5 0ba762b6b5fbda000e51d66722a3bb2c
- SHA1 260f9c873831096e92128162cc4dfcc5c2ba9785
- SHA512 03496dce05c0841888802005c75d5b94ac5ca3aa88d754230b6f4619861e58c0492c814805cde104dc7071e2860ebc90a7fba402c65a0397fb519c57fca982f7
- SSDEEP 384:kIe2ydBvkE/zECNLuBv5oAss+yjvz06uaK2tmrNvnmBXizuXrCCkUqBAxukOVODX:LmBvkE/znuBvPjvA+FeBAxuYK89
- MD5 SHA1 SHA512 SSDEEP
Libraries/Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d67ebd49241041e6b6191703a90d89e68d4465adce02c595218b867df34581a3
- MD5 6cd3ed3db95d4671b866411db4950853
- SHA1 528b69c35a5e36cc8d747965c9e5ea0dc40323b8
- SHA512 e8ae4caf214997cc440e684a963727934741fd616a073365fa1fc213c5ca336c12e117d7fa0d6643600a820297fc11a21e4ac3c11613fba612b90ebd5fc4c07e
- SSDEEP 1536:fU2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9r:s2MRtrfrR+Pe/xAiAzpQ7y1C9r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Mono.Cecil.Pdb.pdb
- SHA256 aa6469974d04cba872f86e6598771663bb8721d43a4a0a2a44cf3e2cd2f1e646
- MD5 8e07476db3813903e596b669d3744855
- SHA1 964a244772ee23c31f9e79477fbccfd8ed9437e6
- SHA512 715e7f4979142a96b04f8cb2ffa4a1547cd509eb05cf73f0885de533d60fd43d0c5bba9c051871fd38d503cb61fe1a0ee24350f25d89476fbc3b794f0ff9998f
- SSDEEP 384:VQsG/xKLGaNrXoJL8xGWY+1NIqpuxTyg6aA23avOkHf5slIszVoLrbRk9MJl:OsGGnWgxG3CIsmxA2Kd9sz+KM
- MD5 SHA1 SHA512 SSDEEP
Libraries/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a08c040912df2a3c823ade85d62239d56abaa8f788a2684fb9d33961922687c7
- MD5 c8f36848ce8f13084b355c934fc91746
- SHA1 8f60c2fd1f6f5b5f365500b2749dca8c845f827a
- SHA512 7c47f96e0e7dfaebb4dccf99fa0dda64c608634e2521798fd0d4c74eb2641c848fadad29c2cd26eb9b45acdfef791752959117a59e1f0913f9092e4662075115
- SSDEEP 384:E0ve8JOuJTiC7n2NwxEXCnjB+RXcMeDz8PmR1ugLoaeuLMBG9UphJAprjEduFLHJ:E+meiCyrXOwS8uRssveum1peFLHFBbO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Mono.Cecil.Rocks.pdb
- SHA256 ca54d2395697efc3163016bbc2bb1e91b13d454b9a5a3ee9a4304012f012e5eb
- MD5 17e3ccb3a96be6d93ca3c286ca3b93dc
- SHA1 d6e2f1edc52bbef4d6d2c63c837a024d6483bbb3
- SHA512 08c4fc7b9a7609aca8d1f7c7cd1b8c859c198d3d4e7cad012a6f9b5490afff04a330c46f3429d61e3a5570c82855deda64a0308b899f8e2f93f66ed50f7fad3b
- SSDEEP 192:sRJbOLBiMBpqxauhIgJiwCQyKKJrB6bLk7:6cAqpqxnhIgkwnSrIbLu
- MD5 SHA1 SHA512 SSDEEP
Libraries/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7744c9c84c28033bc3606f4dfce2adcd6f632e2be7827893c3e2257100f1cf9e
- MD5 7546acebc5a5213dee2a5ed18d7ebc6c
- SHA1 b964d242c0778485322ccb3a3b7c25569c0718b7
- SHA512 30b3a001550dca88c8effc9e8107442560ee1f42e3d2f354cc2813ae9030bf872c76dc211fd12778385387be5937e9bf172ea00c151cab0bca77c8aafdd11f7d
- SSDEEP 6144:jFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyus:BdfiKI4RzWSyu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
348638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\Release\net40\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
335KB
Virtual Size
334KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Mono.Cecil.pdb
- SHA256 a4f79c99d8923bd6c30efafa39363c18babe95f6609bbad242bca44342ccc7bb
- MD5 c0a69f1b0c50d4f133cd0b278ac2a531
- SHA1 bcefbe60c18318f21ba53377a386733e9266c37d
- SHA512 c38b0b08e7d37f31ab4331fcc54033ec181dc399e39df602869846f53e3dc006425a81b7b08f352c5e54501e247657364dfc288085a7c1c552737d4db4f33406
- SSDEEP 3072:0wQmsRPW/VWePGnhEKIqiLcR018KJ8I5W3cI:VvSO/DGFIdzb7WN
- MD5 SHA1 SHA512 SSDEEP
Libraries/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- MD5 SHA1 SHA512 SSDEEP
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/README.md
- SHA256 eb4bd64f7014f7d42e9d358035802242741b974e8dfcd37c59f9c21ce29d781e
- MD5 8cf8463b34caa8ac871a52d5dd7ad1ef
- SHA1 a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa
- SHA512 dd4f520768dafe6990081e74c73c7adff8bdde7f831aa9ea6b8de15d3ed53c7b04eaf15cb332f4ff3b55966b75612bd5c2dd5ca62139eee58470a7f5d59bb62f
- MD5 SHA1 SHA512
Libraries/RedLine.SharedModels.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f92db78e43986f063632fb2cfafdce73e5e7e64979900783ca9a00016933375
- MD5 bee2969583715bfa584d073ac8d98c42
- SHA1 37d1221ce6bb82e7ad08fd22bd13592815a23468
- SHA512 5c139b81a51477d8362be2bf72b9f2425d54ef67b4ad715fbe8aa11f8a57435abb7f23a7ecaee18611e559d1006c0df5dd3427b6e7c3caed38d8cffd79e4bb1c
- SSDEEP 768:OqYS91uYM7KwU+QJDqnCz2iiMkM16dTS:OqYSqfOwTgDqnLZMn16NS
- MD5 SHA1 SHA512 SSDEEP
-
RedLine payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\ASUS\Desktop\Develop\Projects\TwiceSlice\TwiceSlice.Models\obj\Release\RedLine.SharedModels.pdb
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/System.Drawing.Pen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d820d1c1e9d661603cd32177fb128c9a6844fe2492b6fbb3120bd37553663b0
- MD5 1d4e91345a76c90e0849c9389e66fe8c
- SHA1 744393f64d9f95a987605ac14b721dbbc985901c
- SHA512 e0c5fa5c9141e139d529b80058c1ff8fb252116076c57fbea106ee2500cb23d3a91b76f6348bc0bcf465acde510463352a960eefd29198f4068661342cbd28b8
- SSDEEP 3072:tblKLY+hugA/JMGI+3TBb3K65tKMFL6uOqKXyeHD3Q6b7cvWUevzml01xvS0yiEt:t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2801534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Libraries/builder.exe
- IMPHASH 382a4d7b99200ee7e9686d1f1cde0258
- SHA256 6fb8a784ea49e2dfedad52a6f381c5936107cbafaef16d92361fb50ad7e13295
- MD5 628f7b5ea6bdab4fce2f684e925a6c58
- SHA1 af4f1efc095641ca6aa1b104346364c95c454dd0
- SHA512 45b2accb11b1da8337a88a1546043405a02599220d4731e15641f5c18ba622ddf5e306a8eaa286d429d1d7baa79e0af9f5fba50f65f0fa31266f518e241ec595
- SSDEEP 12288:MXes/7Zk2HDnVn6eexZggOZDwV9KOZxOy+h5KBsMRkM4zXywybl95P:022HUbOZtpKJt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
GetProcAddress
VirtualAlloc
LoadLibraryA
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.RfiOS
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
594KB
Virtual Size
593KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Libraries/builder.pdb
- SHA256 8c7e21b37540211d56c5fdbb7e731655a96945aa83f2988e33d5adb8aa7c8df1
- MD5 418dc008ef956465e179ec29d3c3c245
- SHA1 4960b2952c6cc8de2295f145c3a4526bf6d1a391
- SHA512 ad386b6cf99682d117dce3a38c37f45843ac87d9ad17608453c0dfe8dd2b74c0c19c46a35da8140dc3ffc61d2333d78ab1438723cfd74aac585c39f0f59542f2
- SSDEEP 384:pOUiUb5MF8kUIvECa85WM3AD9Jp5MF8tIPxDO:pOUiUb2F8Smowp2F8u0
- MD5 SHA1 SHA512 SSDEEP
Libraries/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 141b235af8ebf25d5841edee29e2dcf6297b8292a869b3966c282da960cbd14d
- MD5 d16fffeb71891071c1c5d9096ba03971
- SHA1 24c2c7a0d6c9918f037393c2a17e28a49d340df1
- SHA512 27fb5b77fcadbe7bd1af51f7f40d333cd12de65de12e67aaea4e5f6c0ac2a62ee65bdafb1dbc4e3c0a0b9a667b056c4c7d984b4eb1bf4b60d088848b2818d87a
- SSDEEP 6144:M+mGOqp3p9xOhav/ZcaiysIN5UGr8fnd0OJNGyo:JOqp3bkhUZcbyP51rACGNGyo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
286474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
272KB
Virtual Size
271KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MetroSet UI.dll.config
- SHA256 a407b110c78c0077b651fcbd05cce073541b61e3e8b4747608069ac5ce686a8c
- MD5 9a25ae6e4fbe956cc33a232ac97d3b16
- SHA1 d606ddf863f57d2676a7041b9fe6aab2a2bc6e51
- SHA512 e8c4636e5c596f75acd32c1875fa620899b65a27a825e07f3dc17b252db45ede97199967a74abe7ba08841607d1d172862832f5974fd72fa0d7ef43ac84c4833
- MD5 SHA1 SHA512
OpenPort.bat
- SHA256 84399f8bccefa404e156a5351b1de75a2d5290b4fddd1754efb16401ed7218ef
- MD5 cf1cc90281e28cee22dce7ed013c2678
- SHA1 2f213a71b76db3e51ad2d659f84dc1f3f90725fb
- SHA512 2b61c1da7cc66506537719cedab82f172d2ac1af4df69513ba64507a5ed67989974f81791faf08c5855580df53f564600381be34c340b825f1f01919948921e1
- MD5 SHA1 SHA512
README.md
- SHA256 41ded26595b824bd680e0b2e895a6b1ca3ae6d0d2260653175dca35a6a56b54a
- MD5 e2db1441b03414ccd5627075a7f567cf
- SHA1 205c19284cd4392dc5883fedadd4a13cdd84627e
- SHA512 e4f5d9212d89bc26b48c167d0f58fe88f6cc680eaac2211c7cc87a7944ccd8cfcbdad898040cb0fc77ac6fb06523ea7c3db7d3214030febde27e79403498058c
- MD5 SHA1 SHA512
RedLine.MainPanel-cracked.exe
- IMPHASH 382a4d7b99200ee7e9686d1f1cde0258
- SHA256 6fb8a784ea49e2dfedad52a6f381c5936107cbafaef16d92361fb50ad7e13295
- MD5 628f7b5ea6bdab4fce2f684e925a6c58
- SHA1 af4f1efc095641ca6aa1b104346364c95c454dd0
- SHA512 45b2accb11b1da8337a88a1546043405a02599220d4731e15641f5c18ba622ddf5e306a8eaa286d429d1d7baa79e0af9f5fba50f65f0fa31266f518e241ec595
- SSDEEP 12288:MXes/7Zk2HDnVn6eexZggOZDwV9KOZxOy+h5KBsMRkM4zXywybl95P:022HUbOZtpKJt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
17224
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
GetProcAddress
VirtualAlloc
LoadLibraryA
lstrlenW
CreateThread
Sleep
WaitForSingleObject
FreeConsole
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
RaiseException
RtlUnwind
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.RfiOS
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
594KB
Virtual Size
593KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
RedLine.MainPanel.exe.config
- SHA256 ef9352989527d16cf5be708b0d8e6d384618746a3999230f477cf50f34ff67c9
- MD5 6ebc9b76090c8c4bf6b65c02503c6cd6
- SHA1 24d5e2e6f27e3e0de8595908bdb67bbd59d42e85
- SHA512 2d8bc9c82dd7f6644780253d67b18cb43c34821afb570b3acaf69868249cf23875523f451241b9407c03839e8f82b56d6448759d7db9a53ba03b8dbc5ef657cf
- SSDEEP 96:ur7137KS7KJ7K1CBE1rNOprD8mSBW3An9AnKAniAnpAnmKKptUprED:ur7x7x7e7aCOCrDV
- MD5 SHA1 SHA512 SSDEEP
RedLine.MainPanel.idb
- SHA256 16feef35e1c0b52a51e898a04d98034abbc413e483deb9c410469427035778c8
- MD5 3da6c975e08bf1a134b25ee33d0288b1
- SHA1 b28d73f35d7cee839927c54cf7f0c3304c86f711
- SHA512 4ce00dccc500825999df9fa1344e61738cc59f52dece4c4d459caee2b17f9a963dd4f2e06ed350a26492d5426f5de761cd869f38da0be689bbcc9438050aafed
- SSDEEP 24576:OhajHYdSX6N5xZJvzAURk1qSwf/ChTwPxeXe:xKxZJvzAURk1qSwf/ChTwPxeXe
- MD5 SHA1 SHA512 SSDEEP
RedLine.MainPanel1.exe.config
- SHA256 ef9352989527d16cf5be708b0d8e6d384618746a3999230f477cf50f34ff67c9
- MD5 6ebc9b76090c8c4bf6b65c02503c6cd6
- SHA1 24d5e2e6f27e3e0de8595908bdb67bbd59d42e85
- SHA512 2d8bc9c82dd7f6644780253d67b18cb43c34821afb570b3acaf69868249cf23875523f451241b9407c03839e8f82b56d6448759d7db9a53ba03b8dbc5ef657cf
- SSDEEP 96:ur7137KS7KJ7K1CBE1rNOprD8mSBW3An9AnKAniAnpAnmKKptUprED:ur7x7x7e7aCOCrDV
- MD5 SHA1 SHA512 SSDEEP