archive_56.zip
- SHA256 5e807de88a43edb7b341ed17b4e218f35c3204bf5dc969c131792b0a23e9ddc1
Overview
overview
10Static
static
10e1dcb9ba72...29.exe
windows7-x64
3e1dcb9ba72...29.exe
windows10-2004-x64
3e2071b429e...5c.exe
windows7-x64
10e2071b429e...5c.exe
windows10-2004-x64
10e249dbf0ac...f4.exe
windows7-x64
8e249dbf0ac...f4.exe
windows10-2004-x64
8e277271cc7...e8.exe
windows7-x64
10e277271cc7...e8.exe
windows10-2004-x64
10e282def0d2...89.exe
windows7-x64
10e282def0d2...89.exe
windows10-2004-x64
10e29645b977...39.exe
windows7-x64
7e29645b977...39.exe
windows10-2004-x64
7e2bfb9c5da...0c.exe
windows7-x64
1e2bfb9c5da...0c.exe
windows10-2004-x64
1e316eea789...fa.exe
windows7-x64
1e316eea789...fa.exe
windows10-2004-x64
1e3250ba3e9...f9.exe
windows7-x64
10e3250ba3e9...f9.exe
windows10-2004-x64
10e34a914ca2...b1.exe
windows7-x64
10e34a914ca2...b1.exe
windows10-2004-x64
10e37b2913aa...c6.exe
windows7-x64
10e37b2913aa...c6.exe
windows10-2004-x64
10e37c63b72b...0d.exe
windows7-x64
10e37c63b72b...0d.exe
windows10-2004-x64
10e37cf80804...e0.exe
windows7-x64
10e37cf80804...e0.exe
windows10-2004-x64
10e3a2f6c598...82.exe
windows7-x64
1e3a2f6c598...82.exe
windows10-2004-x64
1e3a86fc42d...62.exe
windows7-x64
9e3a86fc42d...62.exe
windows10-2004-x64
9e3e3053d34...10.exe
windows7-x64
10e3e3053d34...10.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral4
Sample
e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral5
Sample
e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
e277271cc70bc12cb5a62950728025e8.exe
Resource
win7-20250207-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral8
Sample
e277271cc70bc12cb5a62950728025e8.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral9
Sample
e282def0d26b0a0ace50c80bd0d3e389.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral10
Sample
e282def0d26b0a0ace50c80bd0d3e389.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral11
Sample
e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
e3250ba3e962ddf90560e00c92659cf9.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
e3250ba3e962ddf90560e00c92659cf9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
e34a914ca2b4fd7d490bd7fa0893c9b1.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral20
Sample
e34a914ca2b4fd7d490bd7fa0893c9b1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral21
Sample
e37b2913aafb08ae275e16364b9916c6.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral22
Sample
e37b2913aafb08ae275e16364b9916c6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral23
Sample
e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral24
Sample
e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral25
Sample
e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral26
Sample
e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral27
Sample
e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe
Resource
win7-20250207-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral30
Sample
e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral32
Sample
e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target archive_56.zip
- Size 133.7MB
- Sample250322-g2fppstks9
- SHA256 5e807de88a43edb7b341ed17b4e218f35c3204bf5dc969c131792b0a23e9ddc1
- MD5 d57c7b6d56a558cbe5e038f4999e5fdb
- SHA1 51157454b68ba1503eff584cdc067e6dd2e00cd2
- SHA512 ad2b56550e52aff074cb4882713d7af99304a890dba6485ead3516aa1855882626663a0dd7fdccbaa884c34474d4168369026eb25260cc587df17971badbe618
- SSDEEP 3145728:bQDaXuNsQGRZkOReuKHXZZwAIFEZPRj3L/L2sUzGHQ3WHM/XYhQ:gaeNIrkOgXdJRXRUzGHQGHsXSQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Victim
C2
-
size-ingredients.gl.at.ply.gg:5407
Mutex
-
a1cb840a8f8b330a9629751db128f43f
Attributes
-
reg_key
a1cb840a8f8b330a9629751db128f43f
-
splitter
Y262SUCZ4UJJ
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
Mutex
-
xwtmpZSwsYCz
Attributes
-
delay
3
-
install
true
-
install_file
Image.exe
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
hakim32.ddns.net:2000
-
4.tcp.eu.ngrok.io:14131
Mutex
-
60a27120913d09dacf55889f507e54c2
Attributes
-
reg_key
60a27120913d09dacf55889f507e54c2
-
splitter
|'|'|
Extracted
Family
-
xworm
C2
-
floor-steam.gl.at.ply.gg:58684
Attributes
-
Install_directory
%AppData%
-
install_file
scvhost.exe
Extracted
Family
-
xworm
Version
-
5.0
C2
-
92.255.85.2:4372
Mutex
-
bFh8cGGVyBJ2hXxI
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/e37b2913aafb08ae275e16364b9916c6.exe family_asyncrat - Asyncrat family
-
resource yara_rule static1/unpack001/e40e55970cfd4226d107483d74357f22.exe dcrat static1/unpack001/e56e15cccc30424a485d984f395b5ed4.exe dcrat static1/unpack001/e5a0082c8d104a8b07e6fec79a9c7927.exe dcrat - Dcrat family
- Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/e5d2fa4b41120417f8c6da74926dbb45.exe family_xworm static1/unpack001/e60e0df025fdd424851a59e93a0cec4c.exe family_xworm - Njrat family
- Xworm family
- Unsigned PE 30 IoCs
Checks for missing Authenticode signature.
resource unpack001/e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe unpack001/e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe unpack001/e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe unpack001/e277271cc70bc12cb5a62950728025e8.exe unpack001/e282def0d26b0a0ace50c80bd0d3e389.exe unpack001/e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe unpack001/e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe unpack001/e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe unpack001/e3250ba3e962ddf90560e00c92659cf9.exe unpack001/e34a914ca2b4fd7d490bd7fa0893c9b1.exe unpack001/e37b2913aafb08ae275e16364b9916c6.exe unpack001/e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe unpack001/e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe unpack001/e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe unpack001/e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe unpack001/e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe unpack001/e40e55970cfd4226d107483d74357f22.exe unpack001/e437e3db19270f4e4cf43c20566a74cb.exe unpack001/e46e533dee3380f904d350f397e42e3cb28a66145fe414c5852f23f431ed19c1.exe unpack001/e4c0d21775a6eafb91b2e49530cbf40b1338814c3533e81c868f364e143f73bd.exe unpack001/e543712d633a88d95e17847e9c5e1314.exe unpack001/e54a8c559da46b723e0c8294bee7861a6e7c7a3edc096c929d4c17a60169bab1.exe unpack001/e56e15cccc30424a485d984f395b5ed4.exe unpack001/e59976837299a4a7323f1b18167f180023253697a1d372b47220dc8562bfb926.exe unpack001/e5a0082c8d104a8b07e6fec79a9c7927.exe unpack001/e5d2fa4b41120417f8c6da74926dbb45.exe unpack001/e5e0ac97297ecf18ca145f4025185090.exe unpack001/e5edd49c8dc8fab8327e75b86b771a0b.exe unpack001/e60e0df025fdd424851a59e93a0cec4c.exe unpack001/e613ec38c0bce317f196450f620d6c9605c9f7c97a68996db2872f4cc6f176e8.exe
File Explorer
-
archive_56.zip.zip 133.7MB
-
e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe.exe 1.8MB
-
e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe.exe 1.9MB
-
e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe.exe 288KB
-
e277271cc70bc12cb5a62950728025e8.exe.exe 5.9MB
-
e282def0d26b0a0ace50c80bd0d3e389.exe.exe 1.1MB
-
e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe.exe 10.3MB
-
e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe.exe 83KB
-
e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe.exe 505KB
-
e3250ba3e962ddf90560e00c92659cf9.exe.exe 54KB
-
e34a914ca2b4fd7d490bd7fa0893c9b1.exe.exe 222KB
-
e37b2913aafb08ae275e16364b9916c6.exe.exe 47KB
-
e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe.exe 1.9MB
-
e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe.exe 563KB
-
e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe.exe 383KB
-
e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe.exe 1.7MB
-
e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe.exe 3.2MB
-
e40a0fc1010346720053961c2e4d850ae1ab5aca000b1982f9a652d0c282acba.exe.exe 677KB
-
e40e55970cfd4226d107483d74357f22.exe.exe 1.1MB
-
e437e3db19270f4e4cf43c20566a74cb.exe.exe 2.4MB
-
e46e533dee3380f904d350f397e42e3cb28a66145fe414c5852f23f431ed19c1.exe.exe 317KB
-
e491ac1a1f109498e0ed11697414be88611300d2ec31ab449f5b1f90146128b6.exe.exe 785KB
-
e4c0d21775a6eafb91b2e49530cbf40b1338814c3533e81c868f364e143f73bd.exe.exe 484KB
-
e543712d633a88d95e17847e9c5e1314.exe.exe 93KB
-
e54a8c559da46b723e0c8294bee7861a6e7c7a3edc096c929d4c17a60169bab1.exe.exe 107.9MB
-
e56e15cccc30424a485d984f395b5ed4.exe.exe 2.0MB
-
e59976837299a4a7323f1b18167f180023253697a1d372b47220dc8562bfb926.exe.exe 5.2MB
-
e5a0082c8d104a8b07e6fec79a9c7927.exe.exe 885KB
-
e5d2fa4b41120417f8c6da74926dbb45.exe.exe 75KB
-
e5e0ac97297ecf18ca145f4025185090.exe.exe 50KB
-
e5edd49c8dc8fab8327e75b86b771a0b.exe.exe 585KB
-
e60e0df025fdd424851a59e93a0cec4c.exe.exe 32KB
-
e613ec38c0bce317f196450f620d6c9605c9f7c97a68996db2872f4cc6f176e8.exe.exe 10KB
e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e1dcb9ba72b5d530a7025537eed091187313975f51f1a4756d379129a1eaa629
- MD5 9e573a2ffc7e82c398e836aeca657685
- SHA1 9d058fc9ce31f7e7cdf67a5d874c624844bbd263
- SHA512 9975a8ccc2240d6113704f6f88fe36fd7c1cbafe2f973489fece70259d161b3c752da9a9338aa47ae331eced7151813789e4a7647995c07a5270e7526d35158e
- SSDEEP 24576:ZSkAQsxIxncfKtAXPqqXHZGPaHBZ23QhGDJjqE/z5ZIXOdHQvy3ge/ZX9uWfm2YU:8RKxcCmfV7Z23zZZ4vy3P/ZXfizZXyT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1834534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e2071b429ed0a109ba6ae98cc6bd94651c73805963058322d9ab5fc3ad8c385c
- MD5 8b90b02faca36074af1577d7195ee6a6
- SHA1 58a84f82276f92154be4271244a6bc0d1837c33f
- SHA512 2a38045191bfb8b2bdce869181ea1d4bd8745dbd87e6ea062ecbe4e9b04ab5aac96a8428790fde989b26c41137b830c7b76efddd4361c60cee2c9203d31ad8f1
- SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e249dbf0acda03b41cc7ffb9d3ffe996eb648e79ec5b514d819180faebef48f4
- MD5 040b6bc9b0e6555c619b0b6ac5c100c6
- SHA1 29658672a828a82cfb57f13332799e5c14af8ae4
- SHA512 e0dcee7db91991c26e9c0405435d59da2980b883a36ed4c6a38792f6af7d156979368e0a9be9ada036f8f3f537cc770b5174e27b361ea1839877f908f806b5b0
- SSDEEP 6144:KCqhNgYNRrD/tlWnuxWxVODw2v4ryAADzcL51rhAHA:KNhNgarD/tlWniqONx/6foA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
287982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
276KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e277271cc70bc12cb5a62950728025e8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cabbb23bfd4c9f0ee454f1c072f963b938281c38dc7d14cfe62629e23f96dfda
- MD5 e277271cc70bc12cb5a62950728025e8
- SHA1 f49e565e7e17473bf473727846744436622083eb
- SHA512 dcc1aff642ab495007d83906e3316cde8c0f36c1a902abf2c6bcd9991b1ee7fbecc3bb4e281ffc2f25d1e6c5531179deba529d177b757ab89e9a9872e2712feb
- SSDEEP 98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw47:RyeU11Rvqmu8TWKnF6N/1wi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e282def0d26b0a0ace50c80bd0d3e389.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e8fa1ef4d468a51c9aabb390609c63f549b8693592d23160d5459817d3fefe88
- MD5 e282def0d26b0a0ace50c80bd0d3e389
- SHA1 aad1e263222141dab481347dc60f033ffc3e86cb
- SHA512 8966a24026b973dfa147d697ef7d659ff3f1b8ec11ea3971593667cd637655edaad4370683069ea2ecea21c1b0863ef79cf46effb8736328c3db010b25299b33
- SSDEEP 12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1111230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e29645b97716a1a1d083e644500c71a7e2a3c20f8c6812785f6242461eccfe39
- MD5 6447a2bb53cd6db8b2fcb0f6d1f5c34b
- SHA1 024c9b68dffec0659cc301ac7123da414078504b
- SHA512 87bfc9fdaca50d6dc96a161cc46731bb2d311b0836e39114d5386c938e8022a3ae0fdca275e5cd91f0add24acf01f8da54e97b69e9cd00c01764d0911611a424
- SSDEEP 12288:/k3ZvH5K4AJROAltaCrueXY2Rto7m5XG5agF9iM:KtS5MFg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
344686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
329KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e2bfb9c5dab6674c2bd9eec1f66e4f0c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2dfe346587d3bcc2dfb437c3fca97fbb38d2ad6aebbae862e96ff8c4e78f1d28
- MD5 e2bfb9c5dab6674c2bd9eec1f66e4f0c
- SHA1 1ded7a38ee2a1401ba39a7b2641aa53cb1c85355
- SHA512 0b4990bd6277222a10ba62bd208fe08e5553566b2b765a5f32035c72454dd7b024aced533f28e0eb869e5699f8d53f591d174828f59c7ddab68f3eee37918fd1
- SSDEEP 1536:M/u1tcHm/adpsWxW3I095NRAX5EP1TSqtH14WhrftbIRT8QTN7jZ4dgRnF7boo1K:MW1tcHm/adpsWxW3I095NRAX5EP1TSqF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Test.pdb
mscoree
_CorExeMain
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e316eea78900620a3194bc604bab1d058ec60832baa6df78d0795ebee9ecd6fa
- MD5 fd2ae2610330403a81e297f3cd953e3e
- SHA1 df6f3c5e53beee8ed7a57d0cdf38f0ce15915018
- SHA512 cfe27ebb170d52213dc202e93d98939dddbdb3b61dd65a61068e13f5531dac20070f9119b6d49a8e76f92f5cdb76988fe9db2732c765d6278c1bdc1a2ac7d44a
- SSDEEP 6144:Lzc9kDINdxEdjqsC7owRZaWelsSyeAoIDJT02SfQmhCqkDaiA/zqEYgFbgmaY4W7:L4FNdQjhC7tz6noEoQHYgCY4R
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
523198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
503KB
Virtual Size
502KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e3250ba3e962ddf90560e00c92659cf9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 92123431a5d7c000dfa423656179055bc8b3e4c96ed94b90cd334b2feb8818b6
- MD5 e3250ba3e962ddf90560e00c92659cf9
- SHA1 f6904cfed503a1009923141b3028875bab2aa08c
- SHA512 8e78bf75eec8fc294fc11e5fc6eb69230b7e6d9a8676944cf9b1fe581b6f1fc5d931fd3efedd6ffe63b396ee69de34e18c07501fb7f3b2c8df3a5993c9eafd5d
- SSDEEP 768:CkoLg652Eslt/aNxND3O4JSNjxWQG35bmaePD5Pv+2XXJdxIEpm7g:CkSVGtiNjDTGdWQcGDxX3xIEpm7g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e34a914ca2b4fd7d490bd7fa0893c9b1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 047f813c24a57883f2c6b15706b6695dd0497bc51d8b13bf74f213fdb6772d30
- MD5 e34a914ca2b4fd7d490bd7fa0893c9b1
- SHA1 e55c2dcfb6dccf9e84664af5932e9ab2eff2f2c9
- SHA512 0a67a20afd1f5e03799d8e88a842998dace89cbcbce34b8cbc339c9fc73d9784c8dd2899ff416955f51e6eea9c4637eeef610e6b360bac57915e46a0777b9cab
- SSDEEP 3072:YsXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwRmLY:ZR5IuMQoseGk7RZBGxAycKpSPX2D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
227770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e37b2913aafb08ae275e16364b9916c6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 37a8613cdcd090ed1de2608fc32b10bf2f50f3cbd2915d45f5965709e037e7e0
- MD5 e37b2913aafb08ae275e16364b9916c6
- SHA1 cc840be551dcca5c271f5263df5d3953860c33ea
- SHA512 15792ae8103af2671b0cdbacfe98ae92eb869a9e8c1856e042a2cd602414e423d60544f1dad1f4338ba4ea7ca4b33b240c5aa8136dee6a22ea47f195cd6b25a3
- SSDEEP 768:12uI1tT/w70kWUquzumo2qzT20Ek+ZT4DPIE0kZw/kTJX0bie81f4GoCCQKHv3c1:12uI1tT/kW210h+ZT4ME0h/eCbie8mGb
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d
- MD5 88c85713b28206515423821dce1f0a0b
- SHA1 3b8372f2cdf9875b21e189634f50661cf4d40a2c
- SHA512 26e7cf21280bf49336462cfcf229ea6a8c72c3241c0398e85e9fb3f2fe50d174e3bb1f0215f784767034a4b1ecbe59d61e02bf4541014612bd0e30f67f5a6a07
- SSDEEP 24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e37cf808045aeb5b8ffe33d0e6a47444ac10956adad4d307c948a20dd8e53de0
- MD5 2b846d776f1a6fbe1ec811a245da8143
- SHA1 ecc293b1fc5be7e85f69f423817dbbcb090d76c2
- SHA512 ea5640d2abf98c22415b443ea1debb71bc218c8f02ae1f86444d57e0ca524b04158c6e91f0ea3b80b4fddc1687d77c954e4f6f7f6bf533774a17e1f642beaa56
- SSDEEP 6144:+mLrULcs2P7uZA3j41e6VlWT8b9EheZw/uzQ7Ozl449NYI0VxWRbX12Vvz:3+N8+1PVle8RZB4OY1Wr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
581870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
560KB
Virtual Size
560KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e3a2f6c598bc05769da36673f1f02c90f737d5293bf16ba0c839e92cf4258382
- MD5 72ab95541a7892d573af0dfb987640b7
- SHA1 487d6a7b3525c413b51b9bb79865d8b5ada16350
- SHA512 ddf4c3c09eae1715b782c69833491c72c5d3f6949e6068a5201df673c587d79e8bca1ba09470ff584eceea5a333869d78ecc05199b329e1067a9e8f8769cfdc6
- SSDEEP 6144:MxOxQkEI8Nl1EBJzJWpMAE0tGZ2yzsfvDFSMMzJGYkQRj5JGbv0oHBSyz2clvFm:Mx64WBJzJWq2aGvDFHMt7jJGlv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
393710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\wkx\Downloads\noPac-main\noPac\obj\Release\noPac.pdb
mscoree
_CorExeMain
Name
.text
Size
380KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e3a86fc42dbea243f01ab5183b1e1f0c1907b4b6d46428df1d055ceb3dc9f662
- MD5 45506195502850453db17be2edddf4f9
- SHA1 d855f331d09e07dae83e5419c15e886c19063782
- SHA512 4463c77ece9d370aa35a99157d8b80e01893839e02b68b95b4e777aded5485c9e98c9bf3e8df47b69eaabfa1ee6c3b85b3b0fd3369d6e047875c111e92817bfa
- SSDEEP 24576:euzyFoBkkAqm3NHx0t71N/otyCgfdt6oP4pPTxShHhsCMafaO1n:euWanoR0vNgtyhyj2vCO1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1404542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\lysvi\Downloads\Elusive Spoofer\Elusive Spoofer\ElusivePermSpoofer\obj\Release\Elliottzzz Temp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e3e3053d342cd6eb6834eca2d1c506b65d8e459b4e336fcee977e17f3fb6a910
- MD5 fdfe8313374cc5b208a194f2361d06b1
- SHA1 f9d3ca1caf3fdafc2ced50709345811110c5a8cc
- SHA512 01b650c9474e289f3dd3c891cee0093ec75806e33a5536e5fcc3202c1f5bf9e6a8fdd8b98b5788764a37c27111decef6fc814ce13cfbeb9ac66de577be823001
- SSDEEP 98304:eAgOjoXMv34ssQQFTyEw33qGEZZ5Eq6ea:V/wNTyEw3tEZXV6e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3353614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e40a0fc1010346720053961c2e4d850ae1ab5aca000b1982f9a652d0c282acba.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e40a0fc1010346720053961c2e4d850ae1ab5aca000b1982f9a652d0c282acba
- MD5 82675ce899ddb81b082809b1d9368e4e
- SHA1 a557614db7641411d0aedc4e975e1328a425a16b
- SHA512 5b0dbdc094961e7aa577dddb04ee94f0c650c5afb4dc4578114e3b9c7c3f23547cc6cb1285bfb3c86db306a5ee96cec05743cb80ba4543330bc16c5ea8f5ec18
- SSDEEP 6144:ztT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rCu:V6u7+487IFjvelQypyfy7Cu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:0a:d1:80:3b:26:88:6a:c7:b8:99:6b:5b:02:b0:04:6e:61:d5:81
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 8, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e40e55970cfd4226d107483d74357f22.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9b090ed89d27673362bc4b16eb3f8fce08ff8ee152f61f8bd6a9499b05822792
- MD5 e40e55970cfd4226d107483d74357f22
- SHA1 3afca029f6d672a457b706459f381fd17ea8a1e7
- SHA512 8c98be61ea785078c844dea01e81ad48fa9c7d355eeaa084b1f869b2f476b8584bf5e676e7493543640ab4cd2c04ea9a888db16a8f86fd4d518f3e684d4cfbb5
- SSDEEP 12288:p49I/nL8TnKZPVHR3E/bS2vkRNJLXseJQdErvNKj6SKm+eAIhu181d6rsPH:pngTKZ5RU/xG7zsEyEve6SZ+dIe8usv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1100782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e437e3db19270f4e4cf43c20566a74cb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4a790fab90ff9b4507ba67c9d9d576c9ea4ad527d47df61d321dd279733dd911
- MD5 e437e3db19270f4e4cf43c20566a74cb
- SHA1 89502975235cf1d14511372ef8af51fe5a3cb542
- SHA512 ad3e25ae7bf0c7223e0f37565090c1f533a1f26b42f9b7bf06db78bf968a0b886a39f80b6187eb051aad2cc94067527afb4b0b1c08ce892f49abb7d49bc86c33
- SSDEEP 49152:z8ArLQXF0+F0La7anKy1S9/aOHRnOz7LR9kqXfd+/9AedxQ3x0:Odea7im/aOOrkqXf0Fy3x0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2580490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
v
Size
220KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
v
Size
220KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
T7F84T0C
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e46e533dee3380f904d350f397e42e3cb28a66145fe414c5852f23f431ed19c1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e46e533dee3380f904d350f397e42e3cb28a66145fe414c5852f23f431ed19c1
- MD5 192d106e56e2f22edb4f6bd39ae4ecb5
- SHA1 479d14325237a71b543a8663fb63856e3dec5b71
- SHA512 9ec95db374e2343c4f198459412436958c498b5e974e8ce96ddb6456b9dfc5bbe42ff7a647bbfbddac18b27b9bf8dd1a5af0f5a86ff2981e67e5fafc9f4ce44d
- SSDEEP 6144:qTwFt0TbA5l4ykv5ToqHoUSJG2hN5b1g4J2z2iPYP+onjvCzL:dFEU5yykv5To4wbM4A22ik
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
330566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
315KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e491ac1a1f109498e0ed11697414be88611300d2ec31ab449f5b1f90146128b6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e491ac1a1f109498e0ed11697414be88611300d2ec31ab449f5b1f90146128b6
- MD5 239a4de45a8d9eec1358c18b9bde35f8
- SHA1 529e9799a0ca5a282fdbbd08ff1e10779fa9f61c
- SHA512 579bad4b5c12b0e7d4e941bfed19206a94aaddd32bd50ceee07fee57c35f16890cc0f24c0f7c6441b4360077d48c4badbc0157136dac748fc1e8c8dc7c4c4a7c
- SSDEEP 6144:xtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnKL:76u7+487IFjvelQypyfy7cnKL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
25:69:0d:f9:28:0e:d0:cd:8c:7a:a0:0e:e3:2d:c9:d6:87:3b:e7:2a
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e4c0d21775a6eafb91b2e49530cbf40b1338814c3533e81c868f364e143f73bd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e4c0d21775a6eafb91b2e49530cbf40b1338814c3533e81c868f364e143f73bd
- MD5 84780cb7d67f8231b17cd672c95f33ce
- SHA1 08920f2551b7769779292b2ab96375f49e2050ad
- SHA512 8bd986e1baf3c08cd4042355a5ddefcd828aed83830ba743e86f19ed2450026996a515e921a8838bf7ccf4005165722de398ab3c2d03bbf242bd0e01244adc08
- SSDEEP 12288:obvf/MHKA1EZP1WReunm/SMqGfSCnbxrHX:6/MHFGZ4ReunmqAfSGbt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
488238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\shit\Desktop\0.pdb
mscoree
_CorExeMain
Name
.text
Size
472KB
Virtual Size
468KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e543712d633a88d95e17847e9c5e1314.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f796fced977161dcb08f767b6c6b878c2d3dbbd2a52bf6fbd751828a025bebca
- MD5 e543712d633a88d95e17847e9c5e1314
- SHA1 2565b40e469bd21dde7a40501fb811ba6ff149be
- SHA512 932336ee92af890e8fe0ad9c568db652f629dc5e61dff7af4ed1a81f8b78b70b8358e441cb5787deeb5e974aad1e273d523f11da74bd2d0bb49c4534eaab2044
- SSDEEP 768:+Y31InD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk30sGs:nIxOx6baIa9ROj00ljEwzGi1dDsDWgS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e54a8c559da46b723e0c8294bee7861a6e7c7a3edc096c929d4c17a60169bab1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e54a8c559da46b723e0c8294bee7861a6e7c7a3edc096c929d4c17a60169bab1
- MD5 fec7c8e76dbb947c466d9a5a574fe070
- SHA1 f56505c9fb655c0c4f989f1e898a5e6456f63c80
- SHA512 a3de1ef1bafaf1535098f229ac68d96f4e5e3bf5d6a33938a737a5ed3785dd8737b195e1e4a29e9a99ab58c2c831f1734ad469462a3169b23f23d1f9393b9957
- SSDEEP 3145728:MoOZbeY9lPneuUfQzPx/35Jtwa4NbTi/mgMz:MoO1lz7xxf4NbTiegQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
113174638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
107.9MB
Virtual Size
107.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e56e15cccc30424a485d984f395b5ed4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fb7665d5cb16e1f903be0d7b7a856eb3fa45b2a1905a2fdcb712dfd753fb7ae2
- MD5 e56e15cccc30424a485d984f395b5ed4
- SHA1 055a4b2a38f326ae59fe2167f9671dc489304695
- SHA512 19be22d8889a41a2d999183979a1723246d9dae0cfda1141ac661caa61f076fb016075b6388798c9c00716e8d6104abc8bc7da6a15a4594eb3f79a18786508e3
- SSDEEP 49152:jrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:jdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e59976837299a4a7323f1b18167f180023253697a1d372b47220dc8562bfb926.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e59976837299a4a7323f1b18167f180023253697a1d372b47220dc8562bfb926
- MD5 8be1f6a82dc43432418d9d8ec0375d01
- SHA1 1255897876d94448c1fa29647a024ae0339d0b04
- SHA512 3e75753c1180806083630192111f0a1cc337716f48de1bb4fffcc63d78368458eeb9c33cfaba1365452cefeb2b0a2fc58c36885e322b8551daa32b069cb04151
- SSDEEP 98304:Xbv9aRmLWm2HfSra3ZTe03uDk9Zk6X8E4uBM8rXzFd9ggx:rVaoad/Jd/3c0ZXX8N67poa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5494798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e5a0082c8d104a8b07e6fec79a9c7927.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f5961c2b9adba325ba2b7c18519f8283d978c90101ab6a042eef4a9cf7208e9
- MD5 e5a0082c8d104a8b07e6fec79a9c7927
- SHA1 11aed3e98a2d8c91377ed096eda7b46f29704591
- SHA512 df3df35dd4a9ce688ce52e0970208dad162e1e0b1c86017919e852aad40f8fc7c7540f82585ebb2d332c3da05c737c850aa7070dcec5d889a0d4ff3034d33160
- SSDEEP 12288:ElNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:ElNCv6XJ5BClaXfD9vUha+u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
912286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
883KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e5d2fa4b41120417f8c6da74926dbb45.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad409fdb2f3e9171132572691090d22f67db193622bdc4a6953d119fbd88721d
- MD5 e5d2fa4b41120417f8c6da74926dbb45
- SHA1 0f43524e18db3b76a986514e7de4a3da1e917cdd
- SHA512 46c72aaf2842c9c4cfe9afa7ae3dca8c2b88e469d124c3082a60f44d65b9756aa3d816ef9ba894e282af479f0c7c4532490aa5cc23a601075be640e2b198178d
- SSDEEP 1536:WM70m5+hvd+2dycJ/uSZMNibdLtw3sq3969Y5gOfkn2j:R0mC1+2dYCbdYX5gOffj
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e5e0ac97297ecf18ca145f4025185090.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0d3a453e971a434ea78d50955c165e6a7b0a5935b401015ebedd5ea744379d54
- MD5 e5e0ac97297ecf18ca145f4025185090
- SHA1 73506a8036f5168175a87b8a78332aaba84377ff
- SHA512 683bd7c509614fdd79ee723f4069fa5f0689a3c6dbef57fc3230756c09903d2a7f1bcd6f9248587884c8401dc05a2b329fc5752ddc4163f3ef38c0f6ee877b86
- SSDEEP 768:f+50hQqq/UpCpqlwFmYNTxzepBW1nQszrpobXG15yGhVsH:f2BgwDzW6nQCpoq1Iv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56654
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Zakarka\source\repos\REPOCheatLoader\REPOCheatLoader\bin\Release\REPOCheatLoaderMerged.pdb
mscoree
_CorExeMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e5edd49c8dc8fab8327e75b86b771a0b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6a523eef46bbe11e5de431d49bbeee23e622e8bfb95757c5c2e7ba5598b93a4b
- MD5 e5edd49c8dc8fab8327e75b86b771a0b
- SHA1 719b205d02273a2951c79bcd142f4b38c374cf4d
- SHA512 c31d4d04031f3552e7f2ffd6269193b9c52bdc6b3a6185f755f6ff5cfca7885d564808043c0dbb2c20ad2f836a837d134123992432623ac71e210963009b231c
- SSDEEP 12288:nKXLCsp+Qe6WfJYrVgpawSDE6ZIi2+fyew/qUV0rcsc0KsWfgM8VIvIc:KXLCs7QggpahDNZL6RqUVs/WfayQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
604138
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
IPTC.pdb
mscoree
_CorExeMain
Name
.text
Size
582KB
Virtual Size
581KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e60e0df025fdd424851a59e93a0cec4c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3e07777e315c483cc11349729bece9710b14b4b46df8819bf51b46c69ef9f6c7
- MD5 e60e0df025fdd424851a59e93a0cec4c
- SHA1 c3186ce224aa1a81944768fac8bbaa8a4e3fdcf4
- SHA512 76667fa13a9888eb6fd1075fe5f6452d048e11a7fbf4afe60a28314f1b67f82429e36ebd6e12c1a4785a7914a75cb71cbda037cf68772516db8a2faa8100400a
- SSDEEP 768:WVa+vNtg+PB93Tw4+OzVFE9jLhOjhDbM:YvNtgw93U4+KFE9jLhOj54
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e613ec38c0bce317f196450f620d6c9605c9f7c97a68996db2872f4cc6f176e8.exe
- SHA256 e613ec38c0bce317f196450f620d6c9605c9f7c97a68996db2872f4cc6f176e8
- MD5 8fef8ec15c0cae0fecb46461184b421a
- SHA1 a0e57971666eda0c539c275ab0372ba6055554f8
- SHA512 6086184c56ccef387504b2b7b184493d11905c997017a221871b8bd51f014cbdc2098cd49546730ca5d4ede17374a6b2bee60c2422e83fb2d3dccca6dcc86bc4
- SSDEEP 192:/UkTI+EfOlg4HO6Cu6iHIRGOXztYYEivY3KGOcrzMNf1jWAlDA:/2+QKg1io0ODuY3w3KW/qf1jWAls
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
WindowsDmedias.pdb
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ