Orcus RAT.rar
- SHA256 5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3
Overview
overview
10Static
static
10Orcus RAT.rar
windows7-x64
7Orcus RAT.rar
windows10-2004-x64
1Release/Ex...ed.pdb
windows7-x64
3Release/Ex...ed.pdb
windows10-2004-x64
3Release/Ex...ed.xml
windows7-x64
3Release/Ex...ed.xml
windows10-2004-x64
1Release/Ex...ed.xml
windows7-x64
3Release/Ex...ed.xml
windows10-2004-x64
1Release/Fl...er.pdb
windows7-x64
3Release/Fl...er.pdb
windows10-2004-x64
3Release/Fl...er.xml
windows7-x64
3Release/Fl...er.xml
windows10-2004-x64
1Release/Go...op.pdb
windows7-x64
3Release/Go...op.pdb
windows10-2004-x64
3Release/Go...op.xml
windows7-x64
3Release/Go...op.xml
windows10-2004-x64
1Release/IC...it.xml
windows7-x64
3Release/IC...it.xml
windows10-2004-x64
1Release/Ma...al.xml
windows7-x64
3Release/Ma...al.xml
windows10-2004-x64
1Release/Ma...ro.xml
windows7-x64
3Release/Ma...ro.xml
windows10-2004-x64
1Release/Mi...ks.xml
windows7-x64
3Release/Mi...ks.xml
windows10-2004-x64
1Release/NLog.js
windows7-x64
3Release/NLog.js
windows10-2004-x64
3Release/Ne...on.xml
windows7-x64
3Release/Ne...on.xml
windows10-2004-x64
1Release/Oo...pf.pdb
windows7-x64
3Release/Oo...pf.pdb
windows10-2004-x64
3Release/Oo...pf.xml
windows7-x64
3Release/Oo...pf.xml
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Orcus RAT.rar
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Orcus RAT.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/Exceptionless.Signed.pdb
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/Exceptionless.Signed.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/Exceptionless.Signed.xml
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/Exceptionless.Signed.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release/Exceptionless.Wpf.Signed.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release/Exceptionless.Wpf.Signed.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Release/FluentCommandLineParser.pdb
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
Release/FluentCommandLineParser.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Release/FluentCommandLineParser.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Release/FluentCommandLineParser.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Release/GongSolutions.WPF.DragDrop.pdb
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
Release/GongSolutions.WPF.DragDrop.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Release/GongSolutions.WPF.DragDrop.xml
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
Release/GongSolutions.WPF.DragDrop.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Release/ICSharpCode.AvalonEdit.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
Release/ICSharpCode.AvalonEdit.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Release/MahApps.Metro.IconPacks.Material.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
Release/MahApps.Metro.IconPacks.Material.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Release/MahApps.Metro.xml
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
Release/MahApps.Metro.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Release/Microsoft.Threading.Tasks.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
Release/Microsoft.Threading.Tasks.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Release/NLog.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
Release/NLog.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
Release/Newtonsoft.Json.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
Release/Newtonsoft.Json.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Release/Ookii.Dialogs.Wpf.pdb
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
Release/Ookii.Dialogs.Wpf.pdb
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
Release/Ookii.Dialogs.Wpf.xml
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral32
Sample
Release/Ookii.Dialogs.Wpf.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Orcus RAT.rar
- Size 19.0MB
- Sample241216-2gnj2askaz
- SHA256 5328d5f480f89cf93fe4f578facaa9622f36e802c436ed20b9d83e11b98700d3
- MD5 95a7746090144dc426034bad7607b0cb
- SHA1 ca2657264f6a151fc5c8f3a1855850a03fbf19b8
- SHA512 1e235c9a15aefb7ddc392c2836d3b7654723f602ff6ba4e98df16057a212813517733d32af43da07fb9d1f5af4d21c987efed6391e51413a83e6553e6ece5749
- SSDEEP 393216:e22NGiEPwMcIurI/hL2O9tMiP9WkmsdK+yW6yPbiFc2xF4c08jkbb:V2o34tI5q520mn6yV+4c0bbb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
netwire
C2
-
hazbot.duckdns.org:3360
Attributes
-
activex_autorun
false
-
copy_executable
true
-
delete_original
true
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
mutex
fYGiNfhu
-
offline_keylogger
true
-
password
Hazza2021!
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
true
Signatures
- NetWire RAT payload 1 IoCs
resource yara_rule static1/unpack001/Release/ru/TcpClient.exe netwire - Netwire family
- Orcurs Rat Executable 1 IoCs
resource yara_rule static1/unpack001/Release/Orcus.Administration.Resources.dll orcus - Orcus family
- Orcus main payload 1 IoCs
resource yara_rule static1/unpack001/Release/Orcus.Administration.Resources.dll family_orcus - Unsigned PE 67 IoCs
Checks for missing Authenticode signature.
resource unpack001/Orcus.Administration.dll unpack001/Orcus.Administration.exe unpack001/Release/AForge.Video.DirectShow.dll unpack001/Release/AForge.Video.dll unpack001/Release/Be.Windows.Forms.HexBox.dll unpack001/Release/CSCore.dll unpack001/Release/DirectoryInfoEx.dll unpack001/Release/Exceptionless.Signed.dll unpack001/Release/Exceptionless.Wpf.Signed.dll unpack001/Release/FluentCommandLineParser.dll unpack001/Release/ICSharpCode.AvalonEdit.dll unpack001/Release/ICSharpCode.SharpZipLib.dll unpack001/Release/Lidgren.Network.dll unpack001/Release/MahApps.Metro.IconPacks.Material.dll unpack001/Release/MahApps.Metro.dll unpack001/Release/Mono.Cecil.dll unpack001/Release/NLog.dll unpack001/Release/Ookii.Dialogs.Wpf.dll unpack001/Release/OpusWrapper.dll unpack001/Release/Orcus.Administration.Commands.dll unpack001/Release/Orcus.Administration.Core.dll unpack001/Release/Orcus.Administration.FileExplorer.dll unpack001/Release/Orcus.Administration.Plugins.dll unpack001/Release/Orcus.Administration.Resources.dll unpack001/Release/Orcus.Administration.ViewModels.dll unpack001/Release/Orcus.Administration.exe unpack001/Release/Orcus.Plugins.dll unpack001/Release/Orcus.Shared.Utilities.dll unpack001/Release/Orcus.Shared.dll unpack001/Release/Orcus.StaticCommands.dll unpack001/Release/OxyPlot.Wpf.dll unpack001/Release/OxyPlot.dll unpack001/Release/SharpDX.DXGI.dll unpack001/Release/SharpDX.Direct3D11.dll unpack001/Release/SharpDX.Direct3D9.dll unpack001/Release/SharpDX.dll unpack001/Release/ShellLibrary.dll unpack001/Release/Sorzus.Wpf.Toolkit.dll unpack001/Release/Sparrow.Chart.Wpf.40.dll unpack001/Release/TurboJpegWrapper.dll unpack001/Release/Vestris.ResourceLib.dll unpack001/Release/WriteableBitmapEx.Wpf.dll unpack001/Release/Xceed.Wpf.AvalonDock.Themes.Aero.dll unpack001/Release/Xceed.Wpf.AvalonDock.Themes.Metro.dll unpack001/Release/Xceed.Wpf.AvalonDock.Themes.VS2010.dll unpack001/Release/Xceed.Wpf.AvalonDock.dll unpack001/Release/Xceed.Wpf.Toolkit.dll unpack001/Release/cs-CZ/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/de/Orcus.Plugins.resources.dll unpack001/Release/de/Orcus.StaticCommands.resources.dll unpack001/Release/de/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/es/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/fr/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/hu/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/it/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/ja-JP/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/nUpdate.dll unpack001/Release/pt-BR/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/ro/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/ru/TcpClient.exe unpack001/Release/ru/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/starksoft.aspen.dll unpack001/Release/sv/Xceed.Wpf.AvalonDock.resources.dll unpack001/Release/x86/opus.dll unpack001/Release/x86/turbojpeg.dll unpack001/Release/zh-Hans/Xceed.Wpf.AvalonDock.resources.dll unpack001/ref/Orcus.Administration.dll
File Explorer
-
Orcus RAT.rar.rar 19.0MB
-
Orcus.Administration.deps.json452B
-
Orcus.Administration.dll.exe 145KB
-
Orcus.Administration.exe.exe 265KB
-
Orcus.Administration.pdb9KB
-
Orcus.Administration.runtimeconfig.dev.json317B
-
Orcus.Administration.runtimeconfig.json147B
-
Release/AForge.Video.DirectShow.dll.dll 60KB
-
Release/AForge.Video.dll.dll 20KB
-
Release/Be.Windows.Forms.HexBox.dll.dll 84KB
-
Release/Be.Windows.Forms.HexBox.xml.xml 74KB
-
Release/CSCore.dll.dll 519KB
-
Release/CSCore.xml.xml 1.4MB
-
Release/DirectoryInfoEx.dll.dll 224KB
-
Release/Exceptionless.Signed.dll.dll 734KB
-
Release/Exceptionless.Signed.pdb828KB
-
Release/Exceptionless.Signed.xml.xml 662KB
-
Release/Exceptionless.Wpf.Signed.dll.dll 26KB
-
Release/Exceptionless.Wpf.Signed.xml.xml 1KB
-
Release/FluentCommandLineParser.dll.dll 43KB
-
Release/FluentCommandLineParser.pdb137KB
-
Release/FluentCommandLineParser.xml.xml 116KB
-
Release/GongSolutions.WPF.DragDrop.dll.dll 84KB
-
Release/GongSolutions.WPF.DragDrop.pdb207KB
-
Release/GongSolutions.WPF.DragDrop.xml.xml 72KB
-
Release/ICSharpCode.AvalonEdit.dll.dll 604KB
-
Release/ICSharpCode.AvalonEdit.xml.xml 582KB
-
Release/ICSharpCode.SharpZipLib.dll.dll 196KB
-
Release/Lidgren.Network.dll.dll 117KB
-
Release/MahApps.Metro.IconPacks.Material.dll.dll 1.1MB
-
Release/MahApps.Metro.IconPacks.Material.xml.xml 9KB
-
Release/MahApps.Metro.dll.dll 1020KB
-
Release/MahApps.Metro.xml.xml 373KB
-
Release/Microsoft.Threading.Tasks.dll.dll 36KB
-
Release/Microsoft.Threading.Tasks.xml.xml 49KB
-
Release/Mono.Cecil.dll.dll 263KB
-
Release/NLog.dll.dll 857KB
-
Release/NLog.xml.js .xml 1.6MB
-
Release/Newtonsoft.Json.dll.dll 685KB
-
Release/Newtonsoft.Json.xml.xml 693KB
-
Release/Ookii.Dialogs.Wpf.dll.dll 100KB
-
Release/Ookii.Dialogs.Wpf.pdb27KB
-
Release/Ookii.Dialogs.Wpf.xml.xml 175KB
-
Release/OpusWrapper.dll.dll 843KB
-
Release/OpusWrapper.pdb33KB
-
Release/Orcus.Administration.Commands.dll.dll 173KB
-
Release/Orcus.Administration.Commands.pdb425KB
-
Release/Orcus.Administration.Core.dll.dll 178KB
-
Release/Orcus.Administration.Core.dll.config604B
-
Release/Orcus.Administration.Core.pdb453KB
-
Release/Orcus.Administration.FileExplorer.dll.dll 108KB
-
Release/Orcus.Administration.FileExplorer.pdb221KB
-
Release/Orcus.Administration.Plugins.dll.dll 36KB
-
Release/Orcus.Administration.Plugins.pdb139KB
-
Release/Orcus.Administration.Resources.dll.dll 19.8MB
-
Release/Orcus.Administration.Resources.pdb25KB
-
Release/Orcus.Administration.ViewModels.dll.dll 514KB
-
Release/Orcus.Administration.ViewModels.dll.config850B
-
Release/Orcus.Administration.ViewModels.pdb1.3MB
-
Release/Orcus.Administration.exe.exe 3.9MB
-
Release/Orcus.Administration.exe.config.xml 1KB
-
Release/Orcus.Administration.pdb1.5MB
-
Release/Orcus.Plugins.dll.dll 31KB
-
Release/Orcus.Plugins.pdb117KB
-
Release/Orcus.Shared.Utilities.dll.dll 48KB
-
Release/Orcus.Shared.Utilities.pdb137KB
-
Release/Orcus.Shared.dll.dll 343KB
-
Release/Orcus.Shared.pdb805KB
-
Release/Orcus.StaticCommands.dll.dll 71KB
-
Release/Orcus.StaticCommands.pdb137KB
-
Release/OxyPlot.Wpf.dll.dll 157KB
-
Release/OxyPlot.Wpf.xml.xml 288KB
-
Release/OxyPlot.dll.dll 536KB
-
Release/OxyPlot.xml.xml 1012KB
-
Release/SharpDX.DXGI.dll.dll 125KB
-
Release/SharpDX.Direct3D11.dll.dll 271KB
-
Release/SharpDX.Direct3D9.dll.dll 338KB
-
Release/SharpDX.dll.dll 247KB
-
Release/ShellLibrary.dll.dll 64KB
-
Release/Sorzus.Wpf.Toolkit.dll.dll 54KB
-
Release/Sorzus.Wpf.Toolkit.pdb161KB
-
Release/Sparrow.Chart.Wpf.40.dll.dll 132KB
-
Release/Sparrow.Chart.Wpf.40.xml.xml 148KB
-
Release/System.Windows.Interactivity.dll.dll 54KB
-
Release/TurboJpegWrapper.dll.dll 1.3MB
-
Release/TurboJpegWrapper.xml.xml 75KB
-
Release/Vestris.ResourceLib.dll.dll 76KB
-
Release/Vestris.ResourceLib.xml.xml 293KB
-
Release/WriteableBitmapEx.Wpf.dll.dll 55KB
-
Release/WriteableBitmapEx.Wpf.pdb32KB
-
Release/WriteableBitmapEx.Wpf.xml.xml 114KB
-
Release/Xceed.Wpf.AvalonDock.Themes.Aero.dll.dll 84KB
-
Release/Xceed.Wpf.AvalonDock.Themes.Metro.dll.dll 77KB
-
Release/Xceed.Wpf.AvalonDock.Themes.VS2010.dll.dll 82KB
-
Release/Xceed.Wpf.AvalonDock.dll.dll 433KB
-
Release/Xceed.Wpf.Toolkit.dll.dll 1.1MB
-
Release/cs-CZ/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/de/Orcus.Plugins.resources.dll.dll 4KB
-
Release/de/Orcus.StaticCommands.resources.dll.dll 32KB
-
Release/de/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/es/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/fr/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/hu/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/it/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/ja-JP/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/nUpdate.dll.dll 2.6MB
-
Release/nUpdate.dll.config1KB
-
Release/pt-BR/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/ro/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/ru/TcpClient.exe.exe 160KB
-
Release/ru/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/settings.json1022B
-
Release/starksoft.aspen.dll.dll 48KB
-
Release/starksoft.aspen.xml.xml 53KB
-
Release/sv/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
Release/x86/opus.dll.dll 372KB
-
Release/x86/turbojpeg.dll.dll 646KB
-
Release/zh-Hans/Xceed.Wpf.AvalonDock.resources.dll.dll 6KB
-
ref/Orcus.Administration.dll.exe 146KB
Orcus.Administration.deps.json
- SHA256 e4d5279fb165b74d3322910a558b6a0fcb8499c8db9b91792f6a6c53003ade8b
- MD5 d667de7e3b17bc6f83c4e4c2fb9e2a31
- SHA1 e93e731cfe6370a5491ae596e33ce5e7455323ab
- SHA512 3d5c7b97a288d547854f86e1f7c7180e72ab5b43919b0bf6255bd9d4204119025fafaed7e4152120454ba8d5d158b695f87cac9dcc8ee1ab50982d865936096d
- MD5 SHA1 SHA512
Orcus.Administration.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a99524a3f143c425592f7b617a58430cc1e943c1b637fbf7e1c58082d1d2aff5
- MD5 58e8475faafa53a80e2c15e86bf52985
- SHA1 978379e348ca45784aec7c5792b9b98603eb65d5
- SHA512 2cdfa0235a91d9fa48589303243b541b1a4270d94c72382dea45a47c04908433a4da17c2c5faba4cfacf3bf3ca880bb637d8c1eead9ee60d64d33ba546e57a64
- SSDEEP 1536:BAl4lSBe2u76/bVXUkIR2WN4lxtqZuj4AGXpZzaVyllRHp:BAl4Y/b1UNNzf+aTp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\harry\OneDrive\Desktop\Start Orcus\Start Orcus\obj\Release\net5.0\Orcus.Administration.pdb
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Orcus.Administration.exe
- IMPHASH e136c78efac5157bdb78b75c07967d98
- SHA256 0d5a4541da4b8a9613fea8c160596ad697580c8f5f72e4e2a5245f58e67e7803
- MD5 1f47b14658e28812b452ba2059df1610
- SHA1 5cd43eb9f52093b3d27f6d41d016bb9bddd9bdf9
- SHA512 2a26eaf4757a938a5335f5a5164a30aba3eae10d682ba2d6c5df934288ecfa5ca20672205c86093c33aab7288e0ca40d18606761237ab9178bdc65e13165b807
- SSDEEP 3072:w6DhOHYMjlkvuk/1AdNR6LWuoQztlPnnAl4i/b1UNNLf+a79:wBKqf6LJTrAl4i/pUNNLf+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
64064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_errno
_register_onexit_function
_initialize_onexit_table
_exit
abort
__p___argc
__p___wargv
_c_exit
terminate
_register_thread_local_exe_atexit_callback
exit
api-ms-win-crt-stdio-l1-1-0
fputwc
__p__commode
_set_fmode
fflush
__stdio_common_vfwprintf
fputws
__acrt_iob_func
__stdio_common_vswprintf
_wfopen
__stdio_common_vsprintf_s
setvbuf
api-ms-win-crt-heap-l1-1-0
free
calloc
_set_new_mode
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsdup
strcspn
strcpy_s
wcsnlen
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-locale-l1-1-0
localeconv
___mb_cur_max_func
_lock_locales
___lc_codepage_func
___lc_locale_name_func
__pctype_func
setlocale
_configthreadlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
wcsftime
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=29804,
count=10, id=259, version=29804,
count=77, id=261, version=29804,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=27412,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=29913,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
Orcus.Administration.pdb
- SHA256 635237f6e81bfa6433d694c7ddbd7c7c25fd375aa41e6a4c3c9a9a5553f48b73
- MD5 8ddef66078b980cbbcfff8f0d3009cd2
- SHA1 4767d984df0cf8a661b7f154c451821550d96cf2
- SHA512 d23dbec2767c184768feb57896d7d670a0bea7e46bb2cf52fa2ab16594ea609a87b7962ddb031d3cd3b356a3c09b18b3a0c06074dbd8ebbde19ea885a75fae7b
- SSDEEP 192:feMfBcX+lQlhav4rZ0k/8QZS1ez16Z55uw3ntFLMNwxIfVapH2fCcI+H3htGxxx:mWjlQlhav4rZ0k/8QZS+EZ5vLMNdapHN
- MD5 SHA1 SHA512 SSDEEP
Orcus.Administration.runtimeconfig.dev.json
- SHA256 b1e53b623af2ba6534c0ff5d479ba63139f666d9adbeea149676426ae07f7424
- MD5 59e86ee443d8699267418232415715af
- SHA1 be402e3a4e3ebfe6ffac7a7d9e5e37addd81d832
- SHA512 6d8ff63f0456422bce51bc0e819cd14f68b3c3fe1ecd73803764e4bdbe0fe0d2f086f88d0aa01f734734957e5f16cef23f9b96b19b9cc8c46e2aceb650f253a9
- MD5 SHA1 SHA512
Orcus.Administration.runtimeconfig.json
- SHA256 888ebf3b86aed002c04bcf406e2dadf656f5b004b9f7e530f71f745d3fb308d4
- MD5 bc78bb406ef89bbc9c1c9387debfc0f5
- SHA1 e3a03071de1b809fca2b48264c61200f6dfa9626
- SHA512 ce02082ffb779d01295861e4afb828a21700271f1150a95a004ec4a8107c1a562fbe911417fb2bbfd38584da84fefcd04d5aa8d8043661748e957411063452ab
- MD5 SHA1 SHA512
Release/AForge.Video.DirectShow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
- MD5 17ed442e8485ac3f7dc5b3c089654a61
- SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
- SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
- SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
67246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/AForge.Video.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
- MD5 0bd34aa29c7ea4181900797395a6da78
- SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
- SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
- SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Be.Windows.Forms.HexBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 01ca8976d287380d281552ffc31adef4544def22410fd55bc594783f252f80dc
- MD5 0f20acb4c438892ff7ea03cc2cc15c52
- SHA1 075eeecedb3174b9c771964b03e93b1a0e18a2a8
- SHA512 a0115ca19521d2020e9e916520e96092882e72979e04a42f9add23879f0f9c151af9511c16dc44c08eaf7e06438c5906cfdf95efc0f82210f80fa65c075f00a9
- SSDEEP 1536:2hQF9hxG3t+n3RGSmxJpp5B/dvX5lwQu3rEGM6DhplzWZ47kn7kTXkF5Gj5qRt/8:nFpY+Gm/3lz4Vt/0Z8RG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
80590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Be.Windows.Forms.HexBox.xml
- SHA256 415ea2d9a22ab58e5f89ece1caf45fd61f2579ef0c700c990a997841f284e4e3
- MD5 b534569d28458990c1b2f68eafa60bc3
- SHA1 cc28855c84f0eea97df1feacec2e1d2499653256
- SHA512 11e9aec756df477bc81b53291536609989aa6f770554f30a574e308347a40a77ae055e528bcbb049b0306e3c5833eebf39fbda37d182d7511f8d82aeaa640f37
- SSDEEP 768:qUG5TO5WnVBFKHu3hqx1RFnEJEA1Dlvrb05t4n:q15TXhhqx1RFnEJEA1Dlvrb05t4n
- MD5 SHA1 SHA512 SSDEEP
Release/CSCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e835139171eb0d63b6b4e02b0997cac040c02d295648a275d4c8d28b234c8e94
- MD5 94a312a6fcec0e78808bcea3d8ff67f5
- SHA1 fe760487d13f9a6f5f359036561105d4aca88a1f
- SHA512 ecdedeee1ee4e35e4fbd2dea3a4dd8b0805166a9610a63affbfb673f2644588eacecba6b3a5a0052c202ab14c321800997512abc318d36a50b00cc86dc83ec1c
- SSDEEP 6144:qTOLDSWi9it6YQSJpAJNSgwB4dIiZsxFrRz0JfBT8hVNuNdrmh4K:oa2WR/YOBIORIJf84K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
538286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
518KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/CSCore.xml
- SHA256 0fc31302fc32cc423e89da3220959bf23317cce3e2cc545c3ea75c4b715cc656
- MD5 5fd7fe920f0ef54c300292b22dcc4782
- SHA1 6154b4280d164948b386c20589f39963fca1aae8
- SHA512 83368414612f95f265c39206a5c457f80437c2c50f592509cefbf991eea8d8cf54da915dc4d96ab94ce41f659b9d2573489048f607c88ddcd7e0b6288cdee6be
- SSDEEP 6144:Mqqgl5IZsmQhgRadLWHBSDCc5q4ynH5XcxmdvS0Wp1fh3bBwmk3DUwqErDVDw1SS:Mq5CLnH5FW9bBwmk9qEg
- MD5 SHA1 SHA512 SSDEEP
Release/DirectoryInfoEx.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6078383ce879071a317f0e3658d3938a86874f574be28797ad1cc612588468cc
- MD5 c515dca85bd4f84875e91abaae1d25ca
- SHA1 46a75f77a2c3f783d9288cfd5bb37abc653ae41d
- SHA512 3a7ad24e848e91a457fcf6147e817fee10512a19ad08eeb557ab66403e970f085890a97322f334545665e45a0bda0284a66c0223f0766268ce7549f8fa081b19
- SSDEEP 3072:KYANXahUroTgSXn0+DQ/IYfUlFkPPvWFXBARDXsBNvO+hHOuGCV36l/R5XKdJG6w:KYANXahzxtDsIYfULoPvp4V3wRViL0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
233294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Libraries\DirectoryInfoEx\obj\Release\DirectoryInfoEx.pdb
mscoree
_CorDllMain
Name
.text
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Exceptionless.Signed.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57b7be985c0b4630b8ca581e978e88671ae5912d06807891edd1d10e552d3765
- MD5 4787a519cfd30d7a7687ee62de7d8a47
- SHA1 9f9213692517aaa331ab0622e24b9458f483e95e
- SHA512 c74f7f4396082ab6f245ac7fcc61161cbc5582464bc78b3cf42deb08f9e44304568f462753b5c25122bcac4f58e766594426f7ff044d14c7b17f24825d3109d0
- SSDEEP 12288:SIKYlJjYbqxA6eWYHSpim8bVNVJIdUMhik5Kp5dBHLrVr4JOQ:l9a6erSpim8ZNVJI6x5dBHLrVr4JOQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
756494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\exceptionless-net\src\Exceptionless.Signed\obj\Release\net45\Exceptionless.Signed.pdb
mscoree
_CorDllMain
Name
.text
Size
731KB
Virtual Size
731KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Exceptionless.Signed.pdb
- SHA256 dd797c1bb0d3ef0027c7b1c4b39b1ee3fdf307d59ce3f0c62ce97caa27fc2d8a
- MD5 86f540c812a6bed193326c77bb5942f1
- SHA1 dee328bf660443ff9579ce678fa0ba8c7a72a8cb
- SHA512 2f2a19ff28c540cbbb9b059efe964ab42923578d688c1ccca5d901592cc85cf78d50c87683e50c7269ba2f7e793cfe8eab0fe0fe161a7b647ce0a22bfda3b5b1
- SSDEEP 12288:+XlVPlmdqWo1j2KIJEPnzvX9ev9Z74c3exDeTQGHxM8s:R4WC2TS/bXwvTsSTQmxE
- MD5 SHA1 SHA512 SSDEEP
Release/Exceptionless.Signed.xml
- SHA256 88b6a28e7be89258bbf18a82dc30ec15807b8202bdf83085b300c4f6da6626ef
- MD5 853d1ddb96998454cdcb44f4d55cf78d
- SHA1 46294053a1ae0451cdc783757d64f60b40585d63
- SHA512 52d3b9cfe64ecd773bbc2ff4779665fcfd0baee54a7f34be82f2ef94affb1bd0590561bbc0ad1e094e2316b168555f48ef7aef50633e89d3dd0df0239cb2c62d
- SSDEEP 6144:5bvQ/le8+NyYPrnX75jH2AZypAS9FQRHVpaFMTd7JASERIFu86uIlC9qOgLuyvLn:5/6
- MD5 SHA1 SHA512 SSDEEP
Release/Exceptionless.Wpf.Signed.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60cc0b13a13be7b36f2e1637b4d8f7f64ccef198bb258b318fde9c2810ac2447
- MD5 1b3a319b40f7cf78253d79ce3b8c0d42
- SHA1 23b6d076946967e4921f97e024ed68b72cbfbe3b
- SHA512 48ab69135c9f8c54eaf2c7b561ebf475d2a61e5911bcdf469b777f3bdea3d04697805fe09de7f81d57466e0904d2b625c7a1fd35e07f574c70ac70a6d486faf2
- SSDEEP 384:4foIgJjjnB13YuPwfkaNOAsL6L5vGLxrZfvTOtDTjzImcOFz/Ym1T9yQT0B0Am9B:4foZjjBJiLxkOtDbcsz/9NVGZBw7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\exceptionless-net\src\Platforms\Exceptionless.Wpf\obj\Release\Exceptionless.Wpf.Signed.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Exceptionless.Wpf.Signed.xml
- SHA256 2175df5b1bbd41ec159e5b51cbccf03b8d9a09bccab527182072dd01a2705ac7
- MD5 37125212f6c1a854285080c32a21aea8
- SHA1 ab58c4e0fa53f93fe23f17f132a794ccf296f3fa
- SHA512 60996ea9a70a961cd3fa93b89c8b7b2fb56a3a923291744f4d4a9ec6863630fb06c95ea365011ede389a73abb4454a0cc5f704fbc16399d3600904fcb16c4cb0
- MD5 SHA1 SHA512
Release/FluentCommandLineParser.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6124423367a9ec411176e2714c16a041c1a8b3e1691845040b57b0d779bef14
- MD5 d0220eb32a8a631ca29f55929c7046cb
- SHA1 553ec4ecc90676c7bb1de9f75a6b1226f39677aa
- SHA512 63c2d7ac019d511751c57153bde64c5c57819a74ffbd1a893ea980211185296f018bc09980537394bb33e92508b4e14d87da8a6fba2ca87b820b9276d07a3445
- SSDEEP 768:/WDesbk1hc+zloHIC/+9LXPnnx+N8iRnFidzsREmm:eDejkc9LnAzaIRS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
z:\Builds\work\23f7f5f0221f789c\FluentCommandLineParser\obj\release\FluentCommandLineParser.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/FluentCommandLineParser.pdb
- SHA256 2d812996cbdc1fdeddc1a9a9807e7dccae1708cc11def2c950fdb77261a0f21f
- MD5 53c0253afa7cf1c2a0c13a4d01869504
- SHA1 5753997682c6b57b8f8a946382220492d45665bd
- SHA512 54d7d3da8fcc17ceb4446bb0a682dac1f85d68330ee5efe96b527d75a5b2a49a436e70a9272fc453738af7dc9111232b7bbee38468cbde74cb11ebde40090be8
- SSDEEP 768:kvhMjucRacU9+lQUk7FWAEqeZjQv0tpn26Ks5VYrHxp:/ucRacRi7reZjqw2Z
- MD5 SHA1 SHA512 SSDEEP
Release/FluentCommandLineParser.xml
- SHA256 0cf7bc714b9a0e327723fd9728ef3b839e2f4f19eec7a2868127c88e810c7aea
- MD5 e479f4c914c9c0fab2ecc86e31cd1d93
- SHA1 386bfea40ba5ba1b78cb210cb8de5ef227067d0d
- SHA512 cfc1729531241742aa36cf11479716a3115bd82cc8b9d8624adf5cad88551fd9f60f594f942ff5b662e5061bec3177fc15ddbe0d831ab424e2a96e2e5570accc
- SSDEEP 768:KkkM87lE8lT51nmVc35ZfQfvoa4jm8DYidrq:5Tc35ckl0ixq
- MD5 SHA1 SHA512 SSDEEP
Release/GongSolutions.WPF.DragDrop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 61356da44ed466e5da58623af25a0abe812ee69dea1d017b40b4291c08041cbe
- MD5 c99a3eb6cab008e4e098399c20325570
- SHA1 2308f9e8611b18ad6146c2c136f9528898b687da
- SHA512 8b48dd9fa6c9d6b65e3671397c929f7e696abca5f44593148adc513cce733be80f76d72fa998839cc93fdd12bb8f8dfe7cb6370412549a03ccf6970bf26b3adb
- SSDEEP 1536:ca4fR6+ye4nlm5yQTeTDTmTmTUuhECZ9wSMezmjFu1KfnATPMumRUfv:v4fRJyeklm5y1fZ9wSVmjFu12ATPMXE
- MD5 SHA1 SHA512 SSDEEP
Digest
ac:13:ab:c1:78:a7:23:9d:fe:c3:b4:f5:37:c2:57:a3:f7:f5:88:09:53:19:ed:84:34:0d:27:bb:75:21:f3:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
Chains
Oct 29, 2020
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE
Serial Number
08:da:f6:5b:c1:f7:8e:bf:fe:27:3b:ec:2e:2e:39:7f
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 8, 2019 - Feb 10, 2021
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
83298
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/GongSolutions.WPF.DragDrop/obj/Release/net46/GongSolutions.WPF.DragDrop.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/GongSolutions.WPF.DragDrop.pdb
- SHA256 2b4c2e2bbca8f975f6edc2f1031dcf72bca3b0cab7ebc7ac180e09ef78ee4695
- MD5 fe261eb5106b977e776d55a75e34350e
- SHA1 c9a0928bcf3c5f774cda99441a6eca517c476c12
- SHA512 5db914487de4af2b859b535e9484a4c38bc13d7ec46b2b0be496dfb074720c61434a2ef8cd9dd080c3708c03151c26e072da24a4eb8363fd29701c6607dd6489
- SSDEEP 1536:wVk5Jfp3FxhFrRVxQaWiaaiSwZbZRTm62l9uuu/NcHZ756GqYTT0s+u7okB1SQK2:BnsYT7dDSQTlRG1dBrXNiQ4dBrX
- MD5 SHA1 SHA512 SSDEEP
Release/GongSolutions.WPF.DragDrop.xml
- SHA256 bdda71a532d81e93f5713fc096d4b0b423d38272674799c5cd26ce4b26d4ca02
- MD5 acfd3c87541898ddbe58ac661155cf23
- SHA1 1699d1d9be61144085f16996698c52b51eb4215c
- SHA512 64cc79c2f8c62da97c90b9bf9484f8bcf0e586d470aefeed49976c04da07a1601b5abbc34939180568b72a055032a7a6293c3bdbb75825cd936e342da8a479eb
- SSDEEP 768:hKE6JuJJ+7d7BfmXB9DtbI8OAM/6OhDfkn/fZII9n+Y4t/gtzMHKk:hr6HZoB9Dt+6ZfZII9n+Y4t/gtzMHt
- MD5 SHA1 SHA512 SSDEEP
Release/ICSharpCode.AvalonEdit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 86ff97015da0c2802b1c1c35d4e9c3c21cb024258557eff9cade16a9d58bd34b
- MD5 ecd9c594b35bead0588818206428ab49
- SHA1 65694ab8bfda267bf3a066e1823d837dcca10f95
- SHA512 c9740b397ab68406a0a8f6a334631484c4daf61968bb9a1ececb9f797d63d0da5a32956fc9186cad3474d6543171dee01cdd93c077d2563ae99b836b3a44bf3e
- SSDEEP 6144:GYFY292KUWr4025LGh+XlKWE6yPLNE2CXBfM+kVsjXs+glR0jqmV95joM:Nm70E2JJE2CXyFlfA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
623770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\AvalonEdit\AvalonEdit\ICSharpCode.AvalonEdit\obj\Release\net45\ICSharpCode.AvalonEdit.pdb
mscoree
_CorDllMain
Name
.text
Size
601KB
Virtual Size
601KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/ICSharpCode.AvalonEdit.xml
- SHA256 a8de4e43ec6747781a7e01a7e5d51c92cffff32879e6bc3795c75c9ac90fd9cf
- MD5 5bd494ea6ab9ed3a0dd5f4736a6c1f8d
- SHA1 9ffb4fa061171eeba0714cad028c4655aa2d241c
- SHA512 60eb5a1a8b253e680bfe4340c2ef4810ef3089124959804436a1a910a8750208972623923e7613a03a41db0d08a93c568c7b424a5406bb5ea40453f2c617a71c
- SSDEEP 6144:sFilxsTCj3BkjMG8AitANoPNzLINIFlhgTS9ycdxyhxYYbqEt:9g2Yc4
- MD5 SHA1 SHA512 SSDEEP
Release/ICSharpCode.SharpZipLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
- MD5 c8164876b6f66616d68387443621510c
- SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
- SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
- SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
196446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Lidgren.Network.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf9948c27bd2947a42ea51ccc63b93f2b9030bd117393e1d7637a5770b9b0776
- MD5 a6fdc03e2cbdfa9d393512606097a1ff
- SHA1 c63933c082d282a284250deceb51d0d300647fe7
- SHA512 2ec59fd17cd34741ab8d0ef0d8ef3533ef38b03e98d65bb1a19940349b16e47142b0d407946cb05bfc63d7859c1472c0906a72be0e1dcee0c170b80270ad6ca2
- SSDEEP 3072:vmwfq+PlFS1gh72NkCM9eu3JcCDMFfXZkHhKQ6u80y8/ko1r8ApI9G:uaVh7CTu3iI/NJe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
125602
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\lidgren-network-gen3\Lidgren.Network\obj\Release\Lidgren.Network.pdb
mscoree
_CorDllMain
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/MahApps.Metro.IconPacks.Material.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97f4ca8c89ee13b8c249ca6f929d067ba3e87be07b4afa372fdc0a7e9e6e78e1
- MD5 d8e627aadfb6dfed292be0672faa9f15
- SHA1 2a7f51711bffd75ecb2d7ff2f510c89eecd16366
- SHA512 d5139830d367a29e76ca260d9b17955cff80f1779c157551642f7e13d9abd265335ba0bbda433e8898042d482f29d79c48683fede4b8af746b69a7dfcd02098c
- SSDEEP 6144:z40kYmQYwygR8Vi3vTZ20kuCcrY5eakqF09HfnmnygreJrextoqQpddv0dxHde:MpYm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1209194
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Downloads\MahApps.Metro.IconPacks-dev\MahApps.Metro.IconPacks-dev\src\MahApps.Metro.IconPacks.Material\obj\Release_NET46\MahApps.Metro.IconPacks.Material.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/MahApps.Metro.IconPacks.Material.xml
- SHA256 678ea9afbe0406875f3182b6654743200c5f1297ab4b9ac07de1b4eaa09e4b27
- MD5 01439430243696f2ac9eae521649f4db
- SHA1 03453f8ee3ef81a4c2f43f49d8affa07a4d62873
- SHA512 ebcbf88dd370f4356bd964bb5c6ec495c3aa1484460d7d1a3a821b49ebbda9aaa128948b6ec98ff4bda1e553759aa1bce533fa6bd10d52e03b508139811f2a49
- SSDEEP 192:xiCcRF9RSJrnMqwYHW8YUrFTz0A8oYw6c6wAI7ivS43u0X6LiV4AHF8Q:xiCcRF9RSJrnMqwYHW8drFToA8oYw6cW
- MD5 SHA1 SHA512 SSDEEP
Release/MahApps.Metro.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fb5fae42fcc19f3fe3ed2d9b1fdf0594a4c442148b58ac4d2a9dafdda847e673
- MD5 63a79e31b7bc52bb9aec3a747cbb63fe
- SHA1 dc62080001c75242dee8686b6d8078efcb37e2a7
- SHA512 3af468554238df0807e25446fe028e9de381d3b0086edd8d9ff1aab52bb8986a9dddb5618d2a4f6d1aa6011187bcda4cd1858bf72d4a8bdf253c350bd0292b32
- SSDEEP 24576:67VgpmKf/Yuhd57OytB4052NWxV/5Tk1:y+DB40RxV/O1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1050150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\MahApps.Metro-1.3.0\MahApps.Metro-1.3.0\MahApps.Metro\obj\NET45\Release\MahApps.Metro.pdb
mscoree
_CorDllMain
Name
.text
Size
1018KB
Virtual Size
1017KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/MahApps.Metro.xml
- SHA256 5e95cbccf4d2132109d55bef3bb49c6c83920a20fa99cc1a3c5e26234a58052e
- MD5 0c8bce16598497ef3057e11ec1993707
- SHA1 ce3695594d2ac344630c4486761770b89221522e
- SHA512 7080facff2734d2c24fa1948dd60aec8a6ec70f6a252e8aee672b5532ee0431a7699a2371ea390af71893ae7b3c4843a57ed50fc4407b2632763ede713a91aab
- SSDEEP 6144:Bm9j36hRyWTBKcqsjYCGGEauE72mJjAD51GA:Bm9jLGA
- MD5 SHA1 SHA512 SSDEEP
Release/Microsoft.Threading.Tasks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- MD5 d01819bfe03222dfa9e35a36555b6b6c
- SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b1:13:00:5b:36:13:ce:2f:23:c6:0d:0b:cf:75:20:94:18:94:2e:63:26:8a:ed:9d:e5:a9:f6:b2:54:92:bf:6a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 12, 2024
PE Signature issue
Digest
8a:50:28:53:0d:ab:5d:2d:e6:72:c7:e9:b0:73:fe:e5:94:2c:a4:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 7, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
26462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.csproj_97b2926c\Release\Microsoft.Threading.Tasks.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Microsoft.Threading.Tasks.xml
- SHA256 1b88c8dcbc2b8f05571ff63af36e10ddf6f4e348ae51d54565dc8a7b3bb487e3
- MD5 fa83e973ba2842c66deee48be6bd5167
- SHA1 7e5e5d1fd31400b24ca4a6bebf818eaa63c2515a
- SHA512 dfb3ded8a0faebbafe2ed1add4bc6b2958de833a4a6cd4b405d6a6967ab8a34d0d9680717d615745a8a516d80b78739ca37e1fc78212675f4ef70bba008fa02f
- SSDEEP 1536:9FjksQsKC8U53CNkgZ3a+HrOC0fxvHUiQJYvBvck2PkmcDQ2Cb9E28:9FjksQsKC8U53CNkgZ3a+HrOC0fxvHUm
- MD5 SHA1 SHA512 SSDEEP
Release/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea592e7ba43cb057966778b0027c0d6e7ce9672741b5d3c8c927d48918366183
- MD5 cc0bc97cb18ac4e7c6f4decf0218a127
- SHA1 8901c4a54995aed5e786dda0928905bcb98242e2
- SHA512 e5865188de26c7e8d71c000224626d7dd0b26a5542acc9bf8f7974f5cb595386fd25e6e425ecaf57550e12600c6f37670a19a3a361381c10b97f9a26d1cfd856
- SSDEEP 3072:Ko8MptdteyB+kknlDeYJgM67aBsPvVIoPbAFhA+9+qk7o++++9+OddQIZ9c1nquO:Ko8Icybkl6YJgMHgdnqujDbDW4i8XS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\net_4_5_Release\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
261KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/NLog.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2ebc7fc225ffc9eca11b40c140a3e76867d9c0f87d4240c2a4336a20ea5ce50c
- MD5 faa57eeec670867f3de4429ab8cb8d27
- SHA1 1f9c97e2d56abd6540861a17ef0ee8aa8ab35b0a
- SHA512 423d82189272499917ac7daa53e74770dc8fbca7fe9931abfe8c62985c2409424764b3ecfc5cf071485e9d836dcdae6c35fcc6f0f37cc0ebffb9afde1022dcdc
- SSDEEP 12288:v1g1a9wdGNA9qQmDocTrP5rs3ekNuquwKUYaDyUsQ:v1g1a9wdGNA9qQco+rh0uqvKUYamUsQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
882318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\nlog\src\NLog\obj\Release\net45\NLog.pdb
mscoree
_CorDllMain
Name
.text
Size
854KB
Virtual Size
853KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/NLog.xml
- SHA256 0840395f0ef1bff0746895255c19af38e7775d3c316892e94c6514e834e3bfb5
- MD5 ca532230ede750dc11c7e26c521f382f
- SHA1 f8db7f7bf3c5a7b68caa072d79064efc52f66abc
- SHA512 5025b6ee3e9c56d902435d209c75a3a6a873b489656b0e42bdbcceee8f3b083a1f06b74ae436552e00ccee0c1d0d6726408fecf2a68091b442e44ebc79b80929
- SSDEEP 6144:3bDXjSkDsv6ZrgFOG3We13QixCx8ZaRIHp8TEKcQonqDhIrMBc+6z+beoX:PH15e8EKH
- MD5 SHA1 SHA512 SSDEEP
Release/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- MD5 SHA1 SHA512 SSDEEP
Digest
2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Mar 17, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
698886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
675KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Newtonsoft.Json.xml
- SHA256 2d46b37b086d6848af5f021d2d7a40581ce78aadd8ee39d309aee4771a0eeccf
- MD5 f414b3f68fe7c4f094b8fe8382f858c9
- SHA1 66ee1b3266fcedde433b392156ab4a24262b2f34
- SHA512 19b2feb40c2e9d4d20d9a21f88f6ecea773060c056b8cbbd21a6eec41486dc5fc101e6c31129b0d53466d04709bcd4ed777058ddfb02532242b43e253a7b24bd
- SSDEEP 6144:XqqUmk/RikeaG0rH3jGHdl0/InHHpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUq
- MD5 SHA1 SHA512 SSDEEP
Release/Ookii.Dialogs.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afb70c199f3835386a86806bce62a730a65b88e57c2dc1a05793e0c21b9528bb
- MD5 4e97341a02937d44541aba4a7bd14752
- SHA1 48195c1e8b2cdd6168c13cd7c979167ca90b6fc1
- SHA512 12c2d1240f1563ee4ac21f42e0176bf6d7eaa57711a39e2978df4040ee10cf3897874f8210d3b8aa57079a6a9d53ab335ed179ce6c1e91512f1569d2618a759d
- SSDEEP 1536:Gpjf1JGitoDFYb4jIP/sx+ffRR0jB/XliCyawyOApFh8sm6b0V2K:KjSiuDcjvR6xXliK5k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
108166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/Ookii.Dialogs.Wpf/obj/Release/net45/Ookii.Dialogs.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Ookii.Dialogs.Wpf.pdb
- SHA256 97c348afc7e56e7316b13aeb94b4ee5e6fd2164dd3033a94c37da5aa1a15f744
- MD5 e9b456e2db3949a55841e5648a01525b
- SHA1 d049df5b7773479aa30a0e6f067faa35bce26a85
- SHA512 e61943dad87f5669badd931d0a6be84582c308cf8881bc12ee4ceaf515dadf5bac88b50fc1f48e21b1a49854b1c9e3a65752adad97c1822a2b9250d8a94a5bbb
- SSDEEP 384:edH+cRrFSmgWFIFuS0NS4L0qcaT+I5/WosGOFTdJBU2nxvRUucXzQzv87DxJYO3V:WeSrcFV0E4LTcCroF9v6RDQzSdaNXG
- MD5 SHA1 SHA512 SSDEEP
Release/Ookii.Dialogs.Wpf.xml
- SHA256 7b518ab6d5f879f63b1d2f0dd5e0859f7b93fbbd77914713c9f4d43079ff906d
- MD5 d74d6de4cfd3f9d8793c83fa20031a8a
- SHA1 645092cbbec4fc9194a13074de516e9d47913927
- SHA512 9d7aed29bdf0cd04424b82e44b8925d6cd5a36e52b6b82cdedda156ff211ee78550d87966036cfe3c1c3b40740a2547b3d009e56ae236b8dee02acc47596b38e
- SSDEEP 768:XXPUqdZgrZO7ZbkZKSZzY4gAPZooHDiDbDfDNSDcDLjDZgSZGw18WZdKBNGqBF1E:uZbDiDbDfDcDcD/DZgSiWnIF/H0Tx
- MD5 SHA1 SHA512 SSDEEP
Release/OpusWrapper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 829ad0873c7c39899245202b81689c16ff50bf414876b8a99db8ba6c8e379807
- MD5 928d7fa264c96ad1140faeaf63dc01ee
- SHA1 381cdcf0793886bb22b6f4afa39ce200a24dc0a6
- SHA512 d347ac3fa6f950b1bf17e2c6bb2036cc4644fbd5702e5a73590d972d44403256f94bf83585745701a468751ed684eda59f9dadaeb5e75a2d60f4c9b1370b1cbd
- SSDEEP 12288:VJwskteKPwaLStzL8tkjzUwsksX7GSWYMl7oeQOSYIDbjclvQMrox:3IteKc58aQ7GSW9NHVOPjcl7r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
869794
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Libraries\OpusWrapper\obj\Release\OpusWrapper.pdb
mscoree
_CorDllMain
Name
.text
Size
841KB
Virtual Size
841KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/OpusWrapper.pdb
- SHA256 0050bcd6e9a025198876ebec4bec3a4dcf55a141166103800262bf8352040e3a
- MD5 a2e3390e73e572cf1bcaa49e5847b6cc
- SHA1 c71b454135fb8dd79f24d7ca0d18d6d612a07d4d
- SHA512 44d8c398795645967b90917f22e85ed2ed1d986590b9d198a5560091f09e3183838b28dc8781e452aad9519fc9bcba797e3233b82a48f29d4afebd8428c7029f
- SSDEEP 384:OKmEWiqbWsDB4lH9XbOB+sdhL3d1A1qoEnq2:OKmEWiqb3DB4lH9Xy4sdnyqoEnq2
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.Commands.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3096123e36c68ff71c5f3f933d0c47b80e38e655c51e86b334c01c5652ed6c79
- MD5 1f07365f8afdc1f6b1ea813717147c84
- SHA1 9b43b7d34028532a5cf8874325c0657108fc3658
- SHA512 ae2ea9053946f80ec8733babfa01e275008fd61de8f370e1f2a436698eda547f7f43b72ceca6d8aa2df752c10bc7596027d29e406ed2263086cbe69b024b75bb
- SSDEEP 1536:44FzzdmCoW+6dfMkE9Xsaj6l1vWEQNeZTbHZXTjL+k9AeOPJy5M7A0y6/ml0Fd9p:a2MkC+1WNeZTbNL197x0HU8Vx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration.Commands\obj\Release\Orcus.Administration.Commands.pdb
mscoree
_CorDllMain
Name
.text
Size
171KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.Commands.pdb
- SHA256 f86ae1df39ae09d2e18425d7273cae16a9342ed96d6741e8912820c8b809bdee
- MD5 b34ea39143136fd5a0e2eeb79dca5266
- SHA1 bde01e20cf26a964e49559f1aa6a42ca1d0d0a06
- SHA512 2e64a10cc589124636a21a15dfb7cfdb75fbff7fb8fe8dd5d37896589f28c826af5bee3976d2bfd8ad0b99e81476541d416bce46edb2416bfa2b1781155d952b
- SSDEEP 3072:o6EBWis09s/75b3A1o1fLDnoliQnm+Kajzb3uB1lJ03eSSVWIWxA0b:PUscOjpDol9m+KuzElJ/SeWIWxAm
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f64381b5d65574bfd37828a02d2817e08d0073c3540529a0521d144d2798fa4f
- MD5 693ce18f40cb1411161cab0b119da360
- SHA1 b95f56636b8e5f3fdff20dc32d9b397738385fec
- SHA512 9f9fc552bbb4819267295eed1e403395c91245a2aae4c3c902987792e7eacd9a46f46dea4d99f035266db2a5f8d50923eae245ef64fedabe9408d1403c9519a2
- SSDEEP 3072:x5SvX9uxVZm0+bnXefk4VYuX8lu3d6hFZ9trF7QraQRqhyn2FPNAprN:6P9uZm0SufkfbluN67Z9trBQrawqLPNI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
188046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration.Core\obj\Release\Orcus.Administration.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
176KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.Core.dll.config
- SHA256 38bef4d1d95613df219bd90018c7d40f4cffca1c62ad3e1e48b6fc3c887c580a
- MD5 ea68d9b80af1ff330746797269f1f2cb
- SHA1 b74ebbe9f4153e74a91eea293edff5d0ff65e39d
- SHA512 eedd077825787c673fda2cae9b3eb31b8e367e9cffb860b55d36a68dea24c047c731d1ea5c833dccaaa934c5a06847da9b3c6bd5722bece3f513b1e5c0c0c22f
- MD5 SHA1 SHA512
Release/Orcus.Administration.Core.pdb
- SHA256 6d86fac73819b66ce97ef8e45c3db6f77cd90e3947f0fa6cd80a399e29ad840d
- MD5 637ec5f51d9b439d0021a05e1fb930ac
- SHA1 a3b7d618d840dbc78a868c9ede1198bac411f73f
- SHA512 f3114b2416bb0df044f9131f5aebcb9bb566eb1ca6044d8a63c6b25ed4fee3fe1440ed0273e5075b3f805ba3f51ba8d9de147d0dac2bfea15cc45aae844f35b8
- SSDEEP 3072:Bm43FgMmb9upl9FogSlYSoBi49IeoQmOqHG1C+vCIvDxYZYaTDNOMMSJvF9f4H:s43Fg5huLno/lmF6QpvCINY2xAvF94H
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.FileExplorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bfd646f16ffcbd3465629d51ada3af4f6328276bf9e6bd6275d00b143238166b
- MD5 f467b2d306e8f441c04e91b4388a73ae
- SHA1 8fa3c34ce258c484843a1c711e3597a045034648
- SHA512 081c893c692ba0b8ff627a54e99bef8b4043b0035ae2854013dd77a674dbcd7c0cf59f9e2846e752c40b7195b2b88379443b4f65d77b7182645787bd9d87aafa
- SSDEEP 1536:9bRr/v2tt9q91egf//R7V/mZcyod/kf1W9pHXT2/jvRTk1NLWp35TJm7lBJO7Zx+:9bK9S1/Xwcyo+Yhj2hkzkJt7Zxn7FzI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
116702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Libraries\Orcus.Administration.FileExplorer\obj\Release\Orcus.Administration.FileExplorer.pdb
mscoree
_CorDllMain
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.FileExplorer.pdb
- SHA256 f900e724ab1999b0c2eeb50b35515f5806fb0e8428d392077ad5b707be2ef401
- MD5 84313bca8ac3b192faa2ac77d94b6b65
- SHA1 c3d47fd1d59e7ece474dfe80c8850d815d89b87d
- SHA512 96f8be3d3da5de82464f0e24127291d365bc6bc351e3ef4ae23363c1f004446ae58fee4da75f83db8b22d421a274456eb37d5eca26fe3e66e967f5a9d963c6de
- SSDEEP 1536:bOPmPByfjv9dfOq+7WzFHFTa2q8+bkTX/mAs753Y6m0:jPMLHWq+7WzB+sX/gSR
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.Plugins.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08c5dd1901231444c58133210a091da974ac4901fa9ce8c632718f82c6d8fc6b
- MD5 5d5f5e32d85fabb2edc0e65dc6dd4e3a
- SHA1 e926cef79651f853aa4ad74e12a4202e1298daf8
- SHA512 adcf20e030b269efdc4f5f114cc7458d11ca02d6668363d729459f00f712df7d0233ce12fe094016f4b1baa50486199294b208cd2d6357eac715c07eb737039c
- SSDEEP 768:pex7Uk+2OtxAbEX74rY9H5KCct7qix1w:uUz2OrEEL4Md5HREw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration.Plugins\obj\Release\Orcus.Administration.Plugins.pdb
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.Plugins.pdb
- SHA256 da1a727be33c772c62670ab67ff50d83973e2c86f5028bbe33cc7d62a13b3c56
- MD5 80c20bda7679716a94a9d1c87fe4ea19
- SHA1 335fec6132c476435a1c8ce623637affa8367d78
- SHA512 5965ec1b03275ce59569f8e326edef94350334e97e43a1e61471ed2e12c8ae49bf4ce6ac32c58b9ed6e3adb6f89dc1b450ae3553d4adbce7b1864a113ace095d
- SSDEEP 768:4UsXrk/CVCiXFJrSNwVvpeiUkdWmV8M51yf4ySLUteAH+hoCqjdyZZ+sgZjzQ59L:694KSOJIaZyCJ2bRRo+zrE
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.Resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bb178e602b9181520811d1b5e194b1e8ce6db510de2dc70914638bdb384e2910
- MD5 b8fb678ce146f9f5d634d62e01b6b0cc
- SHA1 4e88414b32c3492272443d9f10a1725879671b49
- SHA512 f113aa63b3b1059d67454809df6f6c1477ef760833ad01a5978d3d0063f40e4c5fc63a2d82e9ed9381cfebb423f748dc19107812a4c4c5988804250f7d73481b
- SSDEEP 393216:lB8vLUoEEJPyeJC+UoEEJPyeJCTxUoEEJPyeJCtpCFfZ9j7fZ9:POopEJPyzpEJPy1GpEJPywpP/P
- MD5 SHA1 SHA512 SSDEEP
-
Orcurs Rat Executable
-
Orcus main payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20800950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration.Resources\obj\Release\Orcus.Administration.Resources.pdb
mscoree
_CorDllMain
Name
.text
Size
19.8MB
Virtual Size
19.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.Resources.pdb
- SHA256 6133419dab835fdd07fda3724719318274b09ea2e2310435f64dc223eb4a024e
- MD5 47d0ac13a6dc5a8e082192c8ad56377e
- SHA1 172b34d71ae52c9135acec9926152348725d0aff
- SHA512 bf80ab64ab6cb2bc4289f45725ac8e60838913c310c1b8ac1c5f3dc2e9d087296c1bf1093c3001a2538e05f31f05bb804436bfe1f9656e8ab3dde1b1197babca
- SSDEEP 192:jAPUAPPAPyAPpAPa4mBFAAl8C0qerxsKbc/i2nRV2jyAOjgF9+XR0Ckn2NWBVVFE:A7ENKmvAArgZDcF8
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.ViewModels.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b93111843934019350962c0366f0cdc3f6294006a9328afd5be3a15a536360e5
- MD5 726658dc17a86736e5cb0fcbf10849be
- SHA1 05ef8079f0ec0a4f25bfbc8866e7feebd71c26fb
- SHA512 e3cd1b3d1cb690de01d7137b79b059a8b676d9212ceae644d178ea11c4772932bb6813da10816683facdfa4c52ffee9c9b593e70502d7439204bc1dced355f8e
- SSDEEP 6144:oL0lfiAmzIdHvlTAubSUsRnkNY4TzTzf1poicr8NKyWukGWldcR1L:pl3yIJxForrGWHEL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
532438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration.ViewModels\obj\Release\Orcus.Administration.ViewModels.pdb
mscoree
_CorDllMain
Name
.text
Size
512KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.ViewModels.dll.config
- SHA256 d929f4fd02b17ec5bc0cb7f6a1ba71f8ce316542a5db0a58de824bd30d24ca99
- MD5 5429476ca0039651ea19d02cee29d04d
- SHA1 367b5c1bfeb16a393d2c3650c93dc79962ece140
- SHA512 957714a45bba763bf16a0d26b8596d69c880eb8db92653af7cd59fde38f567647cf893fe1dbc7d10171853565e5d13e5af5fc2ea30b0c970831356849427d17f
- MD5 SHA1 SHA512
Release/Orcus.Administration.ViewModels.pdb
- SHA256 c72b35a7937dc9f70a7fb5da5b5bd763f0c85b1f4ea99c1cc8f17ddf6d2dde90
- MD5 0c3adc255bbbb681536e25d6a8b86551
- SHA1 9ea7222bef0f270df7f7f6f6e12f9efbcc488853
- SHA512 b33b85e17adc1ffd0a288e91b4a360625371a9ff8809167c8211c0de6570f870ee20db804082355cd64997fc6b1812e556cf0f2a38596a38c76d39e56fb904bc
- SSDEEP 6144:vGYtt7OkcCf3eWnIL3oti1VGaK4aKC/inBmnPtR7W0mTPn/qZ11igdFt3KVvSfo1:0RsvnooxT1RLig1LFivSAkdk3py
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Administration.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 121bcd1c5ba0c44404247ca290c32ff52aa60e2a10a441bf5ebc45d4bd48a4c5
- MD5 8bcfa3fc8b4dce8524d55aad0763c70a
- SHA1 9812cfc3322f0ac7fd731c9af880739f35080953
- SHA512 b71fb55d538c386bde0e1c6279e8dee67eb6ec8a2b7c484eda111539c640679ff2306e675bf30222dc4ca25d3b7f3104934a1ef8931adae5f826581ba7ee1d99
- SSDEEP 49152:hEcQLtoVoAl40NVANW8cyTgTG1F+bPTeWne2Al4:dVoAl40NG48cyTN6PTeWne2Al4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3988734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Administration\obj\Release\Orcus.Administration.pdb
mscoree
_CorExeMain
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Administration.exe.config
- SHA256 43f7d22fb4ca6134e3aa776452941856b8cc1efb0bb8082de0f22447b6daf926
- MD5 a0521d282f834242fbdeab978202bc82
- SHA1 16a9488d62716d714da27f9dabeb3914f5149012
- SHA512 849c6dd7d382e8a8957ae332c2e8567827adf610c7c457007047dd50f4bc160dd633d64f562f30653c1e3b803df241e0883b3da81e91ff98de4225ea9fe040c0
- MD5 SHA1 SHA512
Release/Orcus.Administration.pdb
- SHA256 7dd4264da5db6cb0c57ce26fd01eb093b125d0ca53189f7c9b444aa4c9bb0d31
- MD5 e3b1ea845b176dace5dcca7ee6f7eaf2
- SHA1 24464515cf601c0325677faf59452ea338439fec
- SHA512 acb9619347db86e1af4bb066c1a3721595eeefdda6f632434cc489ebfaef1e2d9d08597c35b1ffded7d1351da8b063b130e3a0023eb00122d80c64f39fffea18
- SSDEEP 6144:pEPwGshzBnn0brrf5QfVo+RmXurlxVkC2F3wdLkPIaWOEvkzZYMo:pEPYzcfBs+UlYVI2AM
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Plugins.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9def36f385e36d8ae0d03d5fc023c427be8319e28aad2d514ad7291ad9ede439
- MD5 995b60fbb743254660cf860994862f34
- SHA1 18cade38da1537755034951699cd379298f63764
- SHA512 839c0d03daee124c763c87b9afe26720e76b77e464e6cb319fb5ebe535a45b4c381a32eece95d9ca70aa3b0a7c7af283b4de084b2644cd0506b058081f2f895f
- SSDEEP 768:plYKoub1Q8zG12PmViczl3+vKu3cC2wl:wfsG1jdzl3AKu3cC2wl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Plugins.pdb
- SHA256 b3f4ab340e87469922545b7259f220fcec518d4843ec2c9b45656258033a047a
- MD5 833408765b2703dd919223cbdc10b5ca
- SHA1 ba0dda70a1af73585f5d47fde888f28521b37a07
- SHA512 164df1fe446c53fb70c63c91b9adf56b23e106df0e4695f762912a0e35b85b6849f6d1895cd56553652dde9364fca0d84ea4eba41f1a98b97f51d47567e8b302
- SSDEEP 768:EdOVjKWnCvFWO2kXHFmVr+XjDzaWZ/2vKJat2wqHCm27fTroSPcOD4QX6t4g/bno:nqSKDrG6pVCKIvpKZSP94uTBpe9Lp
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Shared.Utilities.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bb3ce929d883df70d0724a7670d2e7eb851e84f287e9afe27e23944434aa5b08
- MD5 d1534a1dbcac3b1ffcc8af4445057704
- SHA1 82ed75ac984e30563db14a421ba538679d147821
- SHA512 ad497e518cb35d6771196c1dbf8e04cf11e7b80b464345ffdb223daa7967e3d522713096529b5cb22ccc4e718e8a1cc48059c75e5293694eb2d82f076128e770
- SSDEEP 768:7VKKVj5UuIdAbYcl7Dyl3RF+m9oqgBrN9YtX/bH1vVZo8AtO+huxMs4+huw4:7VFVDbr74RkqgB2HqvQ+huxMs4+huB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Shared.Utilities\obj\Release\Orcus.Shared.Utilities.pdb
mscoree
_CorDllMain
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Shared.Utilities.pdb
- SHA256 80f6ac8a4a3baacf4fad3e02e589a0bd277056654e4664b64ee00e54589f081a
- MD5 276264b1c7471e3886730fea52a6ecbd
- SHA1 b6fe9738a6d23934a989a79282c8400ba626762e
- SHA512 3b114fd49ecf5fc63ccaf2b0ce69c0d071b96e060759f0764cda278c4441923d874b485f548be26b31dce534ead85fd3ae802148e6b7ce6faddec60086c03f11
- SSDEEP 1536:RiLRSuydRC5ezRSuBpWdAxBwKxy3aGsf+:RiQdmbdAxBwKxoI+
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.Shared.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 017bb705295d5222b70fdd6d43cbdb5dfbd128a6cee10a30d511a804b7761144
- MD5 925252841a98748b804b076659b768ab
- SHA1 29fcb3669421a54215e0c5b1e2f67b945055e179
- SHA512 fef75e3698acca39def7f0571ae14ee4fe122fe965f1fdb30fafbc42d5a2eab9ec566295e9accb67743c26c22037b16ef4ea7380ef7b010bc506a68d354696b8
- SSDEEP 6144:d4Xyn9EtXq11q7I05SMEZTI6nOpV0xCEFRFAtQDfDNKJb8PyUblrt:d4ltjVSdVlW0xCECtQDfoJbg3blJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
356666
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.Shared\obj\Release\Orcus.Shared.pdb
mscoree
_CorDllMain
Name
.text
Size
340KB
Virtual Size
340KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.Shared.pdb
- SHA256 cd87b2bb145be5fadb7a892a5d79aa6945777ae321a11bf847e81c7226d69854
- MD5 b93cb7ead5f438eeea2c92d2d1625cd8
- SHA1 b187079475504b7b0ed3e26c33b5a142abdf5d5a
- SHA512 2899faee116b1e96dfaa36cfb2654f1f083572a227c7ce5488b2831f34419545790cc422e38a64a6cb83432c28d57929589c9a0de027e00b060b59b64447ac05
- SSDEEP 6144:ZI3g1FV2eP+V5kSyLA9yM2H/Dkbjhp9+L5hilrG7SDYWjA/SQTtc1te:uwVXP+USyLky6bjhp2iJhV1
- MD5 SHA1 SHA512 SSDEEP
Release/Orcus.StaticCommands.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 949149062f194eeaf8f9a443befe93017dd99a9627be0b44fcfcbe6691e76add
- MD5 0358ff49e8b2ccff6d7fe190bd6f8b51
- SHA1 88186cd101e2c68dc6c59bb7e4db0ae8895967e2
- SHA512 b9047032896c5911e9bdbbbe463f28d077f764c09bb33008df68a793217652277c2fcae03191dea1f1217fef696f11e0a14fdc19adc2bc4fb0a9ef09f63afe66
- SSDEEP 1536:3zd92ixTTJHp9bmWYNviipLbuL1TcSUQ3k:jikHp9b2NqipXuL1TcSUQ0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
77946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Orcus.StaticCommands\obj\Release\Orcus.StaticCommands.pdb
mscoree
_CorDllMain
Name
.text
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Orcus.StaticCommands.pdb
- SHA256 01b284ad9241709bd231e659cb746fc5be5bc7d3ea768ad6987911ceb98c101d
- MD5 49a2648240e28f3f66604457f5ed10fb
- SHA1 f49eab1fd9885c5dab8f9365151a36f35ae3dbad
- SHA512 eb1254d31f9e6e2a9758b6ce07b8a840431a548e8a8d29918bd7650cf0f0c17d7034129c165e5516f9c387218f24af50de76154c853994d054c4e58e13f9f160
- SSDEEP 1536:qIUVGFOSRXCM001AVoWhUDcxLlmPmX8FWT558vIqW3:dRXCcAVXhUDElmPmXzT558vIz3
- MD5 SHA1 SHA512 SSDEEP
Release/OxyPlot.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 212b0dcf8688c2a2092c7b605e973c98c5f67527832adad0aee459c79d182d2b
- MD5 9f8b251f09a2c14c18b52be6359b3bf6
- SHA1 1a498d7467a05aac25bbb2333b0730375a8ba8db
- SHA512 ab4efd8b56059870c4ae099e79782f3db7592f453d03ab1db6b6c2df52bbf2c4d04e2f0d2eb81604582bcbac433e700ea1345c9181455f8378db512bfa489bd6
- SSDEEP 3072:zO0czhby1/BLnIIUuAiF0onk8i8YXY5wdf9ZU5JZ55UxN4++E5D/FNcPyy7GK:Ce1/BDpUu7F0okmYXY5wdf9ZU5JZ55Ua
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
166370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\oxyplot\Source\OxyPlot.Wpf\obj\Release\net45\OxyPlot.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/OxyPlot.Wpf.xml
- SHA256 97dc61b0c6e605e9b72a88a4e43e139719acebc6b7c23ddcb8251a807071ef9b
- MD5 c161ddca73c9df53528cadcaa1741526
- SHA1 4a0b06f519dfb9f3755b99137fb1b5bd67ce9ef9
- SHA512 7b8450e7d9759d0863e2829eaa3613ba7ba851bde729e077e13e39b07b579b3420b40e939e33c1299e3f90dff489033cdd7a6cd7f5eb300c9044f83dc6be6e23
- SSDEEP 768:HtEoaMkQ8k+UCBBORdUlss543winRaedVi+qWquIIVGt3KJ5JJy3ksMlFFEhFYnn:HtsMqHORdUlTenVvJ5JJy3bP+QTXzu
- MD5 SHA1 SHA512 SSDEEP
Release/OxyPlot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcad0cfecc043843008b4af27d74e4cf46638a06e5d9d8a7b09ffab6e5829a98
- MD5 b5c0f9ea6d4d4c44172dc9d8770edd30
- SHA1 6f7c1a7175e3ebd1800fc6ced7fd03486434cb9e
- SHA512 83d199cc7cf1e4cd7167a6b11a045ce04d20b0f582008cde5344278651c5311dcb05a873dfd324c9601c13a0c2babd02f2f290df83445eb96ce869052083bc64
- SSDEEP 12288:SChVpNEAvA+FNFjnYSebof/sT8iG4shCbCgNP:SChVpNr2Sebof/s/G4eMCgN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
546902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\oxyplot\Source\OxyPlot\obj\Release\net45\OxyPlot.pdb
mscoree
_CorDllMain
Name
.text
Size
534KB
Virtual Size
533KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/OxyPlot.xml
- SHA256 2cc045810b2fb6efa77dc543e504c09c57d049642a04477fb66db9896b30d3f2
- MD5 0eb9785801e7cb8d2a6e697d7989f011
- SHA1 ef666927d0c94f8a3b5984f638c433a04c2b2443
- SHA512 dbebeb612b28b0d13f153e973bf4d40ad2f884902d839bae719b2c0cefd273108d5cec481367eb7f5900662fabdf190becabb91bb031f793d53e5e0c27b3d1d4
- SSDEEP 3072:SsPzBB+6rCrSTTvoSsO8a74ixk32Yu/4DPH0FmPgXrv5DFrzJXhFrHjMmGwyuDHm:XBfTTvohc9jBGvcYmtkGoI5+
- MD5 SHA1 SHA512 SSDEEP
Release/SharpDX.DXGI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
- MD5 2b44c70c49b70d797fbb748158b5d9bb
- SHA1 93e00e6527e461c45c7868d14cf05c007e478081
- SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
- SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
134238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb
mscoree
_CorDllMain
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/SharpDX.Direct3D11.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
- MD5 98eb5ba5871acdeaebf3a3b0f64be449
- SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
- SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
- SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
283726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\desktop-duplication-net-master\desktop-duplication-net-master\libs\SharpDX.Direct3D11.pdb
mscoree
_CorDllMain
Name
.text
Size
269KB
Virtual Size
269KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/SharpDX.Direct3D9.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
- MD5 934da0e49208d0881c44fe19d5033840
- SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
- SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
- SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
352142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.Direct3D9\bin\Release\SharpDX.Direct3D9.pdb
mscoree
_CorDllMain
Name
.text
Size
336KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/SharpDX.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
- MD5 ffb4b61cc11bec6d48226027c2c26704
- SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
- SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
- SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX\bin\Release\SharpDX.pdb
mscoree
_CorDllMain
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/ShellLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b77ee79499735288d16d5efd92ba13f87bcc3442e0141985ffc815b2c514630c
- MD5 5e174dd193799adfeafb9688c62fde07
- SHA1 2667bd01dcafc3edc532375daa585c9f1f3a8a0a
- SHA512 d692c71bd74a3c743b0d85977796205ea7d0dddc2d1ea8463185b5cdda80e89c16f64fcba1945a64d28bb18f307b74c34ad764b4f232ff81a929deab6cdc8e1d
- SSDEEP 1536:os/BxBZoiytOC6fA0yIS4NG+V3MqEnIR/B1crG:oOBqXuA+V3MnnAo6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Libraries\ShellLibrary\obj\Release\ShellLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Sorzus.Wpf.Toolkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57d3c14d58a78cb146ff7f1cd610164091f8adbc855bcd554f389aed35f0bfc4
- MD5 305f1b9689fba6a64de757e920f74fcc
- SHA1 c605517f4ef6f80792782ef0be2e663aabd53195
- SHA512 6beec518ac823a8a56a15981ac62b5fd99c73714d8ef96b198aaf208f0eb92e199195b5ac5ef5c82592623470aa676000b5523a53086467cf37cc04d24c03e27
- SSDEEP 1536:jrb6pm5GL6HE9xZsvYNl1CvfTTTTTTn3TTTTTTnnSpCtJiisLyjg3:jrFGCdklsvtDsLD3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\harry\OneDrive\Desktop\Orcus-1.9.1-src-main\Sorzus.Wpf.Toolkit\obj\Release\Sorzus.Wpf.Toolkit.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Sorzus.Wpf.Toolkit.pdb
- SHA256 d2c2596d50addc78019bf560511996d9e00cb25e7777517f683e03ccaebaea8a
- MD5 9bdf7e1087fb48799aed263ae3784bad
- SHA1 534f4133a971ff7891412b2fec53096598d40635
- SHA512 18e5050d68dc08649546334c950e6eda139c5a076e94c528458817cff640c5975946c25d277d99948eef1774ad5821062f000b96ff51f4e16b2ceee03faee2d4
- SSDEEP 3072:3gfrNK/ZjXzohCesVJyRw5aubyuz3/1CX2gkojLK:ohCX/aFuzd
- MD5 SHA1 SHA512 SSDEEP
Release/Sparrow.Chart.Wpf.40.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9f1d9ccc551e4befb208492b85231358c6bef50a5ad2ec1ab8d38a954873725
- MD5 218df16f7f5514e7f9350cb7949b2754
- SHA1 40b2c1d31473bca22bee2fc62dd1a1e8d54cf09b
- SHA512 7d83e3385ef4a2accaf8a5ace96e71ed739a9e1a8e73ae83b56ff2bb2f24252f95ce974fb49de4dde0fda7985ffd2db9512f2f1a292d7fbb88741508376eae08
- SSDEEP 3072:iMIZPtiKiPvtf8uHAV2uL1l3/9c3v3PstADQyHDhv0ZrETR/V:N02B3EtyQKNv0ZETR/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
z:\Builds\work\bc49e9cff32877ae\Work\Source\Sparrow.Chart\WPF\obj\Release\Sparrow.Chart.Wpf.40.pdb
mscoree
_CorDllMain
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Sparrow.Chart.Wpf.40.xml
- SHA256 d94ea55b743be06b016877cd1537621d9ebbef8b8d73fa382964ffa0c3cd047e
- MD5 f12ffaa48949f0feafd741cb95f33d0d
- SHA1 c1f627615373539d880e45729f86eb738d234cb9
- SHA512 73f0c00a88bbf06535e7e433255f15a7c0053066abb88a5e039f1dda9176cc6d9d6ad95b5a5cea3567f21fb7b16e77939d400acbadfa1d16d0314e04311cd04e
- SSDEEP 768:wQr29KGYbVWCedbTzFBSariaa0YQ6Y/VZ19zNGi9AT8DT/6K66qQiHcr3t8+WatP:wQr29oZKJFT/FrNWKtion5/gFD6j
- MD5 SHA1 SHA512 SSDEEP
Release/System.Windows.Interactivity.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 93fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
- MD5 580244bc805220253a87196913eb3e5e
- SHA1 ce6c4c18cf638f980905b9cb6710ee1fa73bb397
- SHA512 2666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
- SSDEEP 1536:BYQaIZaEmaOQxn6JxKjtlMZAnuETAV+w4:aIhOQcSLAj4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3e:ee:d8:f6:58:e3:82:0a:29:a6:0d:4d:da:4f:ed:6b:c4:34:50:1b:a8:8c:42:82:1a:79:91:a0:3a:90:87:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 12, 2024
PE Signature issue
Digest
12:e5:b0:a2:ba:03:46:7f:56:92:05:89:ed:0e:65:b2:33:e9:07:1f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 18, 2013
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 4, 2012 - Mar 4, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
45262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\ExprUpdate2\Blend\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\System.Windows.Interactivity.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/TurboJpegWrapper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
- MD5 ac6acc235ebef6374bed71b37e322874
- SHA1 a267baad59cd7352167636836bad4b971fcd6b6b
- SHA512 72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
- SSDEEP 24576:UgKP0yiaiCSZMaW+bChn+ibsE/SZvp46xJ62bgYTqr:NbI+iapR/Tqr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1368534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\AS.TurboJpegWrapper\LibJpegWrapper\obj\Release\TurboJpegWrapper.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/TurboJpegWrapper.xml
- SHA256 3cb86bc04fcd6e760a7117eda1a9085ad28005ede2195b34d751312930a036b0
- MD5 35776ff7ca41265c274570ff0dad5f70
- SHA1 d8646302fce73fe8f1152c44b29451a8f20ec438
- SHA512 dc4a1e2e426edb22ee359d0aaf9194eb9100f9c543238208cde9119ffbad14c41f46cca811205d594e244c782c5b1037f03982b67a5568fd32e767e1dcec255a
- SSDEEP 1536:nkoyLfEkz2wELFHQcGr4PBP1rgrQdm8bqmamYmgODqkGDuxo:kSQ0tl2QRmdmYmgdko
- MD5 SHA1 SHA512 SSDEEP
Release/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Vestris.ResourceLib.xml
- SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
- MD5 a0152babc033f3c62eadb7c4baa75cab
- SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
- SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
- SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
- MD5 SHA1 SHA512 SSDEEP
Release/WriteableBitmapEx.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 eacd385cc6bc146396b6b8109fbe9bed28b6287c5fb1fa0de39a0858f94d361e
- MD5 536bf238f870898a8f8891dc9e3bba0a
- SHA1 87ecbb9b1054c9e6ad393285eb8f18197c267257
- SHA512 15500e761feea77fb9c62accb3de7b6b13a46f5ab4b808d7102c5c728e53a022f4e2f2ae3be2d87cce0eea47880b13b94b1c9f967a0e00e500f94c98d70115b8
- SSDEEP 768:beAJqr6GHSiE3yvReuIuHOTeqZyQWsJ1D+pZN/:beAJy6SKivRjIuuTeqUQWsHDk/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Git\Private\WriteableBitmapEx\Source\WriteableBitmapEx.Wpf\obj\Release\net40\WriteableBitmapEx.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/WriteableBitmapEx.Wpf.pdb
- SHA256 a98644970309e56e99945a4794db6c45bef0e5385c5d85621e2aed4d6bcab9d4
- MD5 015b5e934fb01cac9e3b962d68a65071
- SHA1 3ceac06014b0f89ff94443fddc9341896b5582d8
- SHA512 456a3d6f479c3c65548657ae4ee25308571b9ed2d9891a1e3db4ba13b9b96fbd89a2bbb8e6ac1013e191204396fe99743165bc10299319aec38a6c9fa13a1ac1
- SSDEEP 768:YIG3H/J+9sdZAZ7ltORC2NqdLlfMUH4QcD5QBdP6P1kPgyEEgV9jq:YIWdZSHzf4RD5QBdP6PIEEgHG
- MD5 SHA1 SHA512 SSDEEP
Release/WriteableBitmapEx.Wpf.xml
- SHA256 44cb4347376d4b4847193ea94d1f97a1a187433cb0c7dfeeb550691c34a8b97b
- MD5 14b4c69d6248cbcbf4d7e8766c475686
- SHA1 8ad6f6c20d0d67b136fb0650988b672d3ef5f11b
- SHA512 40b04b64b139aecd394f3304fb6ea522da39a90e4671e0f89cf1882a1b105ab294ebc022f814a64a11f43b8ddfec6656515f97d4158e016d4dc6a0edebe8783c
- SSDEEP 3072:qoqpzW5nr8qZBf4xZLsNiziRiCiianatBae:qoqQ4mkR/aae
- MD5 SHA1 SHA512 SSDEEP
Release/Xceed.Wpf.AvalonDock.Themes.Aero.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6345bad7dc8b5fd74e6d2d80952008441203f5a23ee90fb2fbfad361b5cfc31d
- MD5 c8517049b6ecf2a571e4bc56cecde070
- SHA1 1bfc58806b2b51af1b28ffbec4993fcadbb8c990
- SHA512 b92e2183c30c3b4e7ab8526548200f19560c4f8b0947e004ca7970cb0f4304add2ee8b590566f2d37585aa0937c7e9e5da26181cb5f56400cfa4455db26b3a4f
- SSDEEP 1536:GrYGJ/yox7dMEmjVWm+NdXYoAv/yCJ3S0ZthvlQiQaNtPTATK5wsx8NTNf8McZOu:GzJ/yox7dMEmjVWm+NdXYoAv/yCJi0Zp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
92018
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\4.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Aero\obj\Release\Xceed.Wpf.AvalonDock.Themes.Aero.pdb
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Xceed.Wpf.AvalonDock.Themes.Metro.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1f82b006660291669120962239dffadaeaeca1b32d8dc47a5770682fbe50e6f
- MD5 e4b0776a48285f3180ad6829a6f6acc4
- SHA1 3738ccfb8bf9dfa36e381f46de3e76c2af3c726e
- SHA512 6f8fd133800e36d249c483d8672546f92acede5b2937f9b41f67b1e4c7171f2df9504587d83acf15e2dfa5c6b00ccde439f112ca0ce26ed9d0f0cb421e8924f7
- SSDEEP 1536:EfLt2HNz9vFPPjJo0bsjlq3vmid9d/YSjn2k:Ex2HNz9vFPPjy0bCq3vmidrN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\4.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.Metro\obj\Release\Xceed.Wpf.AvalonDock.Themes.Metro.pdb
mscoree
_CorDllMain
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Xceed.Wpf.AvalonDock.Themes.VS2010.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a83584bef1762992d622b83dd999a9761b9b4d801328318ece1c4d4049959a74
- MD5 87ca9e155b23ebcfc16afb661729cb74
- SHA1 9e48ad0099d6508e720ff791b8539ecebe276974
- SHA512 112793e17b4230454bf2da0790bfbfbf34c2d14bb3eea4263efe01abc819a609b25f6d17c5b810d45e9755d815310f1672172eee4647c809af2fc30681952d25
- SSDEEP 1536:5wismzcesTEWSRnqS++gGeqGqPjJo0bsze5Z5JyYKsz7hLyAsC1tar2/zJlWVgGQ:5VsmzcesTEWSRnqS++gGeqGqPjy0bCeb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\4.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock.Themes.VS2010\obj\Release\Xceed.Wpf.AvalonDock.Themes.VS2010.pdb
mscoree
_CorDllMain
Name
.text
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Xceed.Wpf.AvalonDock.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7d31ba092c6fc1df80e518c7367d354548d732ba1a1b5705ee1727f74835759
- MD5 16da25a9d3c019d935ca6d5ac7a4f84e
- SHA1 f16f13be2202ab1684f498cf33a21cca968353d9
- SHA512 c587b0fad82169641a0f4639d4e98fe6f894d5e82736fd76df902861cddb3992308f5d26eeb71ddb3182096eab62f20c6cbcb17d91be2698c63c632de74c4661
- SSDEEP 6144:5cbs9dvpAwcFiSEIr6pR2F6AUfxLkMg6E9Ffsa6BBrdLXyESjzqsCTTZLh7x3pYj:qI9HSHr6p0zQlzvWcsf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
448870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\4.0\OpenSource\Generated\Src\Xceed.Wpf.AvalonDock\obj\Release\Xceed.Wpf.AvalonDock.pdb
mscoree
_CorDllMain
Name
.text
Size
430KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Xceed.Wpf.Toolkit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1655adfddc2fe05c248ba439e34cf86a28fe3f99885785f9e3bf15af25ff93bb
- MD5 d7a0e1db1283515736e689588129d1db
- SHA1 e535eec8f81c0bc80b3dfa50b7241931c8440241
- SHA512 88749b0441e5abb3419c1280d0f300a09adec3bd4ef673a4bc239830ba0f2696fd441071f4bb620d633884acc9b8b74ced1bd8a436edbb4e02f0e40be61e48a6
- SSDEEP 24576:cxJJCydlDrMZaqEOkMKl1n2z6bn1lvrbalv3lvGiOshve8IxwaRmVk8G6A4:CJJCuCYqEOkMKl1n2z6DjvKlv3lvxlcQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1180130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\ExtendedWPFToolkit\Release\4.0\OpenSource\Generated\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/cs-CZ/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8aee389fe399354f87e6c9e46abdef61aeb008382846c65b6f56d821aea2c456
- MD5 03cc87938fb6dd94ad012d36f0b1c22e
- SHA1 a10b632db4f324c094053a9b41768c83a1330430
- SHA512 0d0f4a17df045569e8f988818bfa4fda547a692756ba9954dcc8f85bc23d9b0b61289e3e85c7883dde78319896605c488d41c358113acc7d6dbd3d0a47baa5d3
- SSDEEP 96:Perpb7yah4EFAuh559ibtwMDfBVy/qvlf8foSOACxvQ1D/hCCQ1:mrl4EFrh554BVqqvafotbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/de/Orcus.Plugins.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd3abb8ff50be6f3e4e8961fcf79879b94f58501f06fb5878957abb74e3dde8a
- MD5 266dbb3222f60d4dd6bb03634ce8d73c
- SHA1 d2a5b50792b40684477784ffeeed513e9641a920
- SHA512 027627da7a4be4b9f450768b6f9a99773a42812113d37fa1956202d60bf32ea30ded67f39c82156f0663d6584fc016c4ed641cc18c44f41883bba1ae63f1ba94
- SSDEEP 48:6s4n2Z+7QcsfjGop308x0lR4cDoAIEAsAGjN9ud1hKeEY9eHrML/UqD6nXKgYs:C2yA0lRAAIEAsAWud1kTHwLsLXK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/de/Orcus.StaticCommands.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c6754e13adf45867d24ed31f2f4687e184f59ff1a672f761b01d0f9bdc10a21
- MD5 cef54be6fcdb0291f3981b7510090e36
- SHA1 536b0e7b0fbb218b5743784fb66c66778b663774
- SHA512 1cc67f3441d8968824f295f6a9e554238bb93e7dc087340e8786d056cd5dde30367f394a6b7b09f7a6ffd936439fa6d10c9e29faef5a9f90bc84bc9b852bc09f
- SSDEEP 384:Aj2OMqe/LVP77tWfcU36GAGwfMokgMzxoxEZQYUSFjONFmQ:8ajXMfyYUSFONFd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/de/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0897bf1f26f480df5ba450a0464a0ca0ee1218dedb0dd4b545163c31a3b3dfb5
- MD5 ab80b9678fa3d64a8ad1b8ebf5aa7a91
- SHA1 98516774a385ea01c35c44a3134cf05632545781
- SHA512 95a3f6d1c4d7d2f1a47f0ad2101264a2eb6164151df9fa0754ab1820ff9d4c2ba420177ce6352ab1066a709c21d790c187b05078f55413558e5985d3849ef280
- SSDEEP 96:B3Rpb7yah4UnBAkbU/nFviz/qeK2cvnh+O3pmFS9ylf8aomOACxvQ1D/hCCQ1:ZRl4UnB9bU/ncm2inh+O3pmFS8aaopbj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/es/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f0e3c62e0b2d8de9d637a4ea657d1cce2d0180bf7c905f85de02be957ba30941
- MD5 2138c5b1dccb230b0cde9e1eacb81aeb
- SHA1 865c549ab1d100847e512e21613cf1943fa06051
- SHA512 54af7f8f7952fb53a778a78faa162eb24858ae22c2278a0b0a9f3d0d2effb78bd32de13c5237a361efc28f5e3540c886e284c8b367e828f3f995a4f9f74a8286
- SSDEEP 96:Gqpb7yah4zrAwwEUsGftfZChmcMylf8FComOACxvQ1D/hCCQ1:jl4zrx9UsglmBaFCopbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/fr/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0768a2e1970a87ac4fc1a78085fab0f26d457332953706991c3d57331a490d60
- MD5 9ed539ec5492780b47714ea3e39f7489
- SHA1 4f7c87ede588dbb9535b19eddd9df8cb235bbfab
- SHA512 ee62a62e340214f07e191bcbb677388623536cb8bcd24333bc25e4da7a7555b2090193d6961f3f372154c989bfcac6019672fb1d6bb427eca05bb2cf229f77c0
- SSDEEP 96:v6GjhCl3cpb7yah4qZAbWz4rx+Dt00Nhylf8DuoCOACxvQ1D/hCCQ1:v6CC+l4qZ+Wz4gea6odbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/hu/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 61e11c6e628dd205342d1ce311c1703c2511825bcac661b9c0b762eb6f3eea5c
- MD5 0d8293745cdbfd5f071fb0104026df4f
- SHA1 16be960204d9fd1493669fe67dc9ed7c229efb51
- SHA512 664297f27291945bfc7cf79e28b7bc87c15f5dacb71f22d1296821af777c280be078b4c304742be871df1d83ff9a9d7bcba1b77741bfc18ee8c0d55c327d94b2
- SSDEEP 96:xRepb7yah4njA3tL6nrc0uqmEsW0hQLOylf8j6o+OACxvQ1D/hCCQ1:Lel4njCtL6Ft7baGohbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/it/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 29d9a615e8380ec150670fd47e5fe97d84b4d9bc1f993932db9d22360c0b51b4
- MD5 4d180c0da606185df2847fdaf4ebce6a
- SHA1 079f8dc4508e4ed073053c63e8c1f5919ed843aa
- SHA512 5e0f3aa5950a26b05a5a0a1b5104b71e44f2058f345f7bb9d730b82c248c19402bfe6dc771dd627cffd8ec88f4baf313885bdf51827b926c78b677bd386d1b3a
- SSDEEP 96:npb7yah4QNAwu7y3emYTy8fyylf8xoeOACxvQ1D/hCCQ1:nl4QNxu7yD+axoBbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/ja-JP/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6f6c39fa4dafa9ca5a4368e3a72eef73b2dfbd25a3bb8c1298725013ad811f6
- MD5 4ab49ee09880ee848536d22cf1eb6078
- SHA1 cdcad58e365b13bc8324a5f9eeb1aeb00381b581
- SHA512 c23ee0938459426ad67f9789524c12a1348b53b2c8e284cdd9edb383dec64a0ccb6bf731749e15e2a944541a96da17fbdaafff490413ff357cd529367a3a6ea6
- SSDEEP 96:umpb7yah4eRA4WrkY/NBQy0lYIU9lf8tomOACxvQ1D/hCCQ1:zl4eRZW4Y39atopbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/nUpdate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 814eb85113211fa90efe952f35d06e537f01bf38febca48e2c0cef02ebdb1877
- MD5 253ba7f0427e3f8e032b97496a019a24
- SHA1 62793783943b04d8836746bb452145722cf63001
- SHA512 29f848f4293454a0103197cd3bb59e364df099b7a26f926673b30132ffe3d15b505fbfc3e0391482d9cd9ed53efd0f3193d0cdf83e0fb59ce3e27de878b83585
- SSDEEP 24576:EmgBM4YvYmukl6XXZlBRVB7bqQJZ8+gkJmUecxkGWrEsXGdHCbXq:Ec4YvRf6ZlBRV0sZ5tmWCb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2691934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/nUpdate.dll.config
- SHA256 541ab9f18dfe0d58e0a0e053315960671c15e2074686b29316f4186ae5836372
- MD5 9ffc6ae31aa0e81c5d233afb145cf211
- SHA1 2ab652fa8e59851ce861d51180a8431e5d96426d
- SHA512 cf6aeed2c22d78564301d9d261f262ed3c8f5a34e6e890b3a0ebdfdaa37338255320b36715dcf4f2986a73cbac5b8d290e5d4ae0cbd033cb89e89e32dc012d0c
- MD5 SHA1 SHA512
Release/pt-BR/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 581d9a07e4e02cfa4f222fea8dc6211028c19e7223e77f5a7af40f68ae15c479
- MD5 5bee607f616f2b74c0cb26a15e730c7a
- SHA1 ea5e7bdd7adab29a62aeaa39efcda02d3b449964
- SHA512 d9761a7ce2029fd7cd22f9096bbc2bcda4889ec706979e79dcb553a58b5dbaef8f34e88ff693abd42a9edbe89a10b15903a090a1b25c3f9d21530009ad3171f0
- SSDEEP 96:IyyrUMD79h4QNAmxp4zxqkKq1lLlf8coaOACxvQ1D/hCCQ1:IyAUA4QNDxp46q1lLacoVbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/ro/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cb9eadd9802af1c143c16b4e5fbe48d35c122d40673839bcc423afd6fc96e9cb
- MD5 e57c57bef5538063eaf137256a6d18f7
- SHA1 2957fe660cd8e966d8d7b4295a2a25921277030e
- SHA512 1a85c7ce4dcbe0f069920e5955b12bea0d57f0055b9d286e1be86232f679deba6679390b014c4785dc71f709dc1951166474079e9a273b6b41464217d71b4bf1
- SSDEEP 96:RX3wvpb7yah4tXAtVDeZ2HOkgki6yylf8LoiOACxvQ1D/hCCQ1:9Gl4tX0VDekQ67aLo9bxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/ru/TcpClient.exe
- IMPHASH 4563c74acbd357d386b177e402b96ce4
- SHA256 3eb685dfb2506c3ec019ea69b788b771676d6a8d1eedf9ba08db8175966784fc
- MD5 2df0cc45516057896f2aa7cbb090ba48
- SHA1 89d0dd4af7d86333db104470ce22bd25b0c1f8d1
- SHA512 458b6e2a724bd191383ff37078bb9b8df181da7c2801decafd5c7cdf7c52df6cc93b665f275b24e9bb7fdaa56cb0cd93df9c7227ee3d2865e84072a650abd43e
- SSDEEP 3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv2NYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/2NzQqqDvFf
- MD5 SHA1 SHA512 SSDEEP
-
NetWire RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9261
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
GetUserNameW
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
crypt32
CryptUnprotectData
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetDIBits
SelectObject
kernel32
CloseHandle
CreateDirectoryW
CreateFileW
CreateMutexA
CreatePipe
CreateProcessA
CreateToolhelp32Snapshot
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FreeLibrary
GetCommandLineA
GetComputerNameW
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesExW
GetFileAttributesW
GetLastError
GetLocalTime
GetLogicalDriveStringsA
GetModuleFileNameW
GetProcAddress
GetProcessTimes
GetStartupInfoA
GetSystemInfo
GetSystemTime
GetTickCount
GetVersionExA
GetVolumeInformationA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
MoveFileW
MultiByteToWideChar
OpenProcess
PeekNamedPipe
Process32First
Process32Next
ReadFile
ReleaseMutex
ResumeThread
SetErrorMode
SetFileAttributesW
SetFilePointer
Sleep
TerminateProcess
WideCharToMultiByte
WriteFile
msvcrt
_assert
_beginthreadex
_errno
_filelengthi64
_mkdir
_snwprintf
_stat
_vscprintf
_vsnprintf
_wfopen
calloc
fclose
fflush
fgetpos
fgets
fopen
fread
free
freopen
fseek
fsetpos
ftell
fwprintf
fwrite
getenv
localtime
malloc
memcmp
mktime
realloc
remove
sprintf
strcat
strchr
strcmp
strcpy
strncpy
time
utime
wcscat
netapi32
NetApiBufferFree
NetWkstaGetInfo
shell32
SHFileOperationW
ShellExecuteA
ShellExecuteW
user32
CreateWindowExW
DefWindowProcW
DispatchMessageA
EnumWindows
GetDC
GetDesktopWindow
GetForegroundWindow
GetKeyNameTextW
GetKeyState
GetKeyboardState
GetLastInputInfo
GetMessageW
GetSystemMetrics
GetWindowTextW
IsWindowVisible
MapVirtualKeyW
PostQuitMessage
RegisterClassExW
ReleaseDC
SendMessageA
SendMessageW
SetCursorPos
SetWindowTextW
ShowWindow
ToUnicode
TranslateMessage
keybd_event
mouse_event
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSAStartup
__WSAFDIsSet
closesocket
connect
gethostbyname
htons
inet_ntoa
ioctlsocket
ntohs
recv
select
send
setsockopt
shutdown
socket
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.eh_fram
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
49B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Release/ru/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02411da4027dbef65b3b1cde0fad13717a1e79e8ef0145553adbbbed40e95acd
- MD5 5d887fcb641abd45389164f2b8f9d95c
- SHA1 ceaf4ee1fd8eeeacdf349ac7919635df28cce4f3
- SHA512 6da438c338de6e27b4a83632e040ee85a7af0ee9050429c06c1a4cc7a9192d733f0b9541b7733a69f494959a4325f136c8a7412fce2b5fd6133df3d012bc4146
- SSDEEP 96:FX8Wpb7yah4RvAtE7pt6bp7j7UcEaSckf1Bylf8Aqao7OACxvQ1D/hCCQ1:Fjl4Rv0E7pg7UcAcxaAhoKbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/settings.json
- SHA256 e329d248ae271a1ed9d5bead0295188ccc90da60643969cdc3eac2c0a2c0ac3e
- MD5 aedd5ae5adaf214b8d0d9a988f8ec669
- SHA1 5bb974fe4460f02cf8a4ab9ef4e7f8bd257679a0
- SHA512 93f3fc7affed67f2885a1b0219fe5cbf133f27f7ca22cc2ceac4aeeab425e25eb3c2e2b3c1f0ca6e8e479edddb30573223ec4169a39d333dbb460520aa4e0fca
- MD5 SHA1 SHA512
Release/starksoft.aspen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c52d8a203ba92de6f937a7d458c24854951761ccbbc8d3961bc2b7923239c7c
- MD5 c2a974c1e5972d8772207ef8f9c5e39c
- SHA1 11e2bcc91e20b982e7967c164053f57a2840fcb6
- SHA512 b3250abaf92a2cd81b4eb0e2a0672532165547de90f389c52df61d4f518b8f58569b3d2e0c891dd6f04a6d96f078ba89ddf397d4f486982741bcfcdf4b19fb80
- SSDEEP 768:QoCtkkseuWbDeK2dOBu9ISzsTPzHVZ6EMhI:HfkxfMoo98jzzShI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/starksoft.aspen.xml
- SHA256 95b88ce988dc5de80a1e44b148cd548149062cde350e23564825e4a8a5c19a90
- MD5 946ec922a795ea27f50227a4b940230b
- SHA1 b1b45421a3a707d6761c90bba9b8065b76b7b578
- SHA512 f850a78701301980a8e0673d8b5615fb700932d0609fd7a7f45004fae261d3f99e455ac9cc7860123acf192c0524b584fa1179c47003e2d682d3340ff05033cc
- SSDEEP 192:9H11kd01o2lJogUnV6iyXlfeCHFGhWc9Gul/S1n8v6F4U40SgX60Sgc2j261yK7j:vumE4VWCHGH9Ge1ExDX9cGSK7yWCjG
- MD5 SHA1 SHA512 SSDEEP
Release/sv/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a071bfef6ae327716e3d54aca88d8a8157adef875069baad3aabca28f6fcb41
- MD5 9197981bd62ea60f543d669702c9ddf7
- SHA1 d7dd1597f63d88298ff11f6348a90e727b691340
- SHA512 77b6ae67c570db80b548130b6e0f70ecc1117add3bf522882ed87648e72537495d3fba8acb47bbdbf28a7d7d1e5064e0cd5bf897ed8ab42b45fa47ef637daff0
- SSDEEP 96:2pb7yah4L7A/V/qTHkqHGWIEkyylf81oFOACxvQ1D/hCCQ1:2l4L7KV/qeWu7a1o0bxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/x86/opus.dll
- IMPHASH 2fde91a51df6faa462b3af7ca5ccde80
- SHA256 8036777469861e3e6bab9c2ef1c13346d132ef86b072d021faef217ad744f439
- MD5 fcf65ceb4fad09cccbab665d35eeccff
- SHA1 5f23d3546d5e706fd52cdbdd5831e651f04fdf95
- SHA512 bce62eedc2745c352c33a3e4b543ae63b098d97cb030e3419fba50d0fe21d827cac205f859fdd31c4e3447b3bd03fb6b5fc86c56d97217c8c2f4d947fd04ff2a
- SSDEEP 6144:FZslskteKPyLxnF2e0sTtPz/OxhuRHc0Gb6ljzZuM7sAO5AsAOO9:LwskteKPwaLStzL8tkjzUwsks
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
224506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
HeapFree
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
RtlUnwind
GetConsoleMode
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
LoadLibraryExW
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
OutputDebugStringW
LoadLibraryW
FlushFileBuffers
GetConsoleCP
SetStdHandle
SetFilePointerEx
HeapSize
LCMapStringEx
GetStringTypeW
WriteConsoleW
CreateFileW
RaiseException
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_encode
opus_multistream_encode_float
opus_multistream_encoder_create
opus_multistream_encoder_ctl
opus_multistream_encoder_destroy
opus_multistream_encoder_get_size
opus_multistream_encoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_multistream_surround_encoder_create
opus_multistream_surround_encoder_get_size
opus_multistream_surround_encoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror
Name
.text
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=207, version=50628,
count=43, id=205, version=50628,
count=130, id=206, version=50628,
count=81, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=135, id=210, version=50727,
count=1, id=202, productName=VS2012 build 50727, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
Release/x86/turbojpeg.dll
- IMPHASH d5bb8198fdeab382257c42c63771511d
- SHA256 5f4b9f8360764d75c9faaecd94f6d200c54611b33064cd216e363d973dae7c29
- MD5 82898ed19da89d7d44e280a3ced95e9b
- SHA1 eec0af5733c642eac8c5e08479f462d1ec1ed4db
- SHA512 ee7b884ce7d7366ee28fb17721b6c89bd4eba8fb373cdbb483e26a4ed7a74ab5db847513c54704d753d77a7e18b1fb9fee90ed6bbc0540bff702273fda36b682
- SSDEEP 12288:PgKP07eDiaiCSZMaWYmAbfKZm0nExibsc129:PgKP0yiaiCSZMaW+bChn+ibsE8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5232
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
InterlockedCompareExchange
InterlockedExchange
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_putenv
_putenv_s
_setjmp3
_unlock
_vsnprintf
abort
calloc
exit
fprintf
free
fwrite
getenv
longjmp
malloc
memcpy
memset
sprintf
sscanf
strlen
strncmp
toupper
vfprintf
Java_org_libjpegturbo_turbojpeg_TJCompressor_compressFromYUV___3_3B_3II_3III_3BII
Java_org_libjpegturbo_turbojpeg_TJCompressor_compress___3BIIIIII_3BIII
Java_org_libjpegturbo_turbojpeg_TJCompressor_compress___3BIIII_3BIII
Java_org_libjpegturbo_turbojpeg_TJCompressor_compress___3IIIIIII_3BIII
Java_org_libjpegturbo_turbojpeg_TJCompressor_compress___3IIIII_3BIII
Java_org_libjpegturbo_turbojpeg_TJCompressor_destroy
Java_org_libjpegturbo_turbojpeg_TJCompressor_encodeYUV___3BIIIIII_3_3B_3I_3III
Java_org_libjpegturbo_turbojpeg_TJCompressor_encodeYUV___3BIIII_3BII
Java_org_libjpegturbo_turbojpeg_TJCompressor_encodeYUV___3IIIIIII_3_3B_3I_3III
Java_org_libjpegturbo_turbojpeg_TJCompressor_encodeYUV___3IIIII_3BII
Java_org_libjpegturbo_turbojpeg_TJCompressor_init
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decodeYUV___3_3B_3I_3II_3BIIIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decodeYUV___3_3B_3I_3II_3IIIIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompressHeader
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompressToYUV___3BI_3BI
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompressToYUV___3BI_3_3B_3II_3III
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompress___3BI_3BIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompress___3BI_3BIIIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompress___3BI_3IIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_decompress___3BI_3IIIIIIII
Java_org_libjpegturbo_turbojpeg_TJDecompressor_destroy
Java_org_libjpegturbo_turbojpeg_TJDecompressor_init
Java_org_libjpegturbo_turbojpeg_TJTransformer_init
Java_org_libjpegturbo_turbojpeg_TJTransformer_transform
Java_org_libjpegturbo_turbojpeg_TJ_bufSize
Java_org_libjpegturbo_turbojpeg_TJ_bufSizeYUV__III
Java_org_libjpegturbo_turbojpeg_TJ_bufSizeYUV__IIII
Java_org_libjpegturbo_turbojpeg_TJ_getScalingFactors
Java_org_libjpegturbo_turbojpeg_TJ_planeHeight__III
Java_org_libjpegturbo_turbojpeg_TJ_planeSizeYUV__IIIII
Java_org_libjpegturbo_turbojpeg_TJ_planeWidth__III
TJBUFSIZE
TJBUFSIZEYUV
TJCompressor_encodeYUV_12
tjAlloc
tjBufSize
tjBufSizeYUV
tjBufSizeYUV2
tjCompress
tjCompress2
tjCompressFromYUV
tjCompressFromYUVPlanes
tjDecodeYUV
tjDecodeYUVPlanes
tjDecompress
tjDecompress2
tjDecompressHeader
tjDecompressHeader2
tjDecompressHeader3
tjDecompressToYUV
tjDecompressToYUV2
tjDecompressToYUVPlanes
tjDestroy
tjEncodeYUV
tjEncodeYUV2
tjEncodeYUV3
tjEncodeYUVPlanes
tjFree
tjGetErrorStr
tjGetScalingFactors
tjInitCompress
tjInitDecompress
tjInitTransform
tjPlaneHeight
tjPlaneSizeYUV
tjPlaneWidth
tjTransform
Name
.text
Size
336KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
260B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
135B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
277B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Release/zh-Hans/Xceed.Wpf.AvalonDock.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d54e05391751dc01c83f85ce6a2385836933ed058cf6c6f204182f3a7dad686e
- MD5 dc9f705286fd4c7027a5a648d96c8e60
- SHA1 c62a220a5104495a5d05487d5e6e73e50194b630
- SHA512 0c76e73e05a624ac9481c20579bc946bfe2e6c5227d035e661382aef0b9adfe1ee212d294878ee297d114e680b31ec70b18ad426cae0360bec9435fb7d7e9ff0
- SSDEEP 96:rqmpb7yah4cVALQE0SW/u3zsqVlf8Ho9OACxvQ1D/hCCQ1:rFl4cVOQE0SKGaHoMbxv2ThCC2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ref/Orcus.Administration.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6e3340dd906e96d22cce5f65e9aab6749de25eee7dc39948e1f2684cd96b5dec
- MD5 f3d0c1425542cfea2925941676ba6dd4
- SHA1 566f21812720ee57d0bee3a7bd8b83a16f9a9710
- SHA512 33054e62eab9d05183d7a058be14cd6622fd9536cd35b9d1b37c710ec13c0b94c4ccdfcfebf394efa775bbaa499594afcb4a48155e8593316e2bfbb40a98d639
- SSDEEP 1536:nAl4lSBe2u76/bVXUkIR2WNYwxtqZuj4AGXpZzaVyllRnp:nAl4Y/b1UNNef+azp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.mvid
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ