PhotonConnect-V1.zip
- SHA256 7251ba126b4a8dde03ee466a27966b7d07a2dacbfc654a6e6c1585463c6596da
Static task
static1
1 signatures
General
- Target PhotonConnect-V1.zip
- Size 460KB
- Sample260620-3p99faat5r
- SHA256 7251ba126b4a8dde03ee466a27966b7d07a2dacbfc654a6e6c1585463c6596da
- MD5 b0ccf90458e39e22ef4d666960bc1c97
- SHA1 54117542b115f38ee35d165f1ea606404bba3c97
- SHA512 9f46fe3c5d37b079bf9fde26864c344153f18151385570764f43637b0ff58362307a50b067c52c455cf0681378e079868fd7aa05cec1d67227338cddea9aca67
- SSDEEP 12288:Keyz0xcVh8+q9IA77aGjrWUlqeyz0xFVM8+q9IA778/jrWUlK:0HVq9Z77aGjJSVq9Z778/jW
- TLSH T1C8A42374BA9521E1FF0700704EA2FB92E4C9676144E26E5A1459E2E0357ECFEEC12ECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/PhotonConnect-V1/PhotonClient.dll unpack001/PhotonConnect-V1/PhotonConnect.dll unpack001/PhotonConnect-V1/PhotonConnect.exe unpack001/PhotonConnect-V1/PhotonRealtime.dll unpack001/PhotonConnect-V1/net9.0-windows/PhotonClient.dll unpack001/PhotonConnect-V1/net9.0-windows/PhotonConnect.dll unpack001/PhotonConnect-V1/net9.0-windows/PhotonConnect.exe unpack001/PhotonConnect-V1/net9.0-windows/PhotonRealtime.dll
File Explorer
-
PhotonConnect-V1.zip.zip 460KB
-
PhotonConnect-V1/PhotonClient.dll.dll 185KB
-
PhotonConnect-V1/PhotonConnect.deps.json1KB
-
PhotonConnect-V1/PhotonConnect.dll.exe 48KB
-
PhotonConnect-V1/PhotonConnect.exe.exe 151KB
-
PhotonConnect-V1/PhotonConnect.pdb20KB
-
PhotonConnect-V1/PhotonConnect.runtimeconfig.json516B
-
PhotonConnect-V1/PhotonRealtime.dll.dll 134KB
-
PhotonConnect-V1/net9.0-windows/PhotonClient.dll.dll 185KB
-
PhotonConnect-V1/net9.0-windows/PhotonConnect.deps.json1KB
-
PhotonConnect-V1/net9.0-windows/PhotonConnect.dll.exe 48KB
-
PhotonConnect-V1/net9.0-windows/PhotonConnect.exe.exe 151KB
-
PhotonConnect-V1/net9.0-windows/PhotonConnect.pdb20KB
-
PhotonConnect-V1/net9.0-windows/PhotonConnect.runtimeconfig.json516B
-
PhotonConnect-V1/net9.0-windows/PhotonRealtime.dll.dll 134KB
PhotonConnect-V1/PhotonClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4591062e25ab7d0f64a2de55267105be22fb19a1edcb954b20596abd24668f5d
- MD5 52fc4ae9c7c29bf786fad5847e2a4724
- SHA1 0a5d7faca0f9cc56610897ab77bd317497064800
- SHA512 653b724fa5311ce69f832a1d63bb96ec1c7486c4649b06e5697f97e5248d0df891f0e1ab665c5f8c4ca0cec4427d03ce701e4680a58944db88f891062fe804df
- SSDEEP 3072:3w8NMF06wuKdnXT+4ldKxO1b4fdtSudUTIGZv5REzhg:3PMF0XTLkO1SMt5R8
- TLSH T1D7045B1C13FC8A0AE3FF2B79E47201564BB1B9277A76DB6E184068FE5C427829C91357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
194918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\photon-sdk-dotnet\PhotonDotNet\obj\Release\netstandard2.0\PhotonClient.pdb
mscoree
_CorDllMain
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotonConnect-V1/PhotonConnect.deps.json
- SHA256 7501217d6500749876d6a7c088bda458fd1940218613297f3f3df874a86e7628
- MD5 46a91a1a363bb8be151ffcdbb45df2c4
- SHA1 7ebde3a025acb3d57dfedd95c1a37ac4f145fcc6
- SHA512 3c38d6548d5e8382932d6b425615d71c456c323e7f03370da881702e4723641a393277f9ddbed668364893e7a29a6a2f07d3ddf06ea5d5608b3fff16adf766d1
- TLSH T1B2214C19D798AD6701B3A3F55A378382F732573B7049040A7ABC509C8FB39AB9051FA9
- MD5 SHA1 SHA512 TLSH
PhotonConnect-V1/PhotonConnect.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8839f572990b62e92c3a2683c6eb34bbc2981bab14f220bce2a08be1325ec556
- MD5 2b3edfcbbe22a5d0eb29a1ff55f1c61a
- SHA1 be92f8db63573cd795fbc93f1f8e79efc5fbe15d
- SHA512 7e8b79983016ee87e7b35b95f1df3ae5d039d59bcf1f1c700817edce078ac9d6ecde30e7f8c85090bffb3cd87c30d4bc17f3b55c9e122a5ec320d5b2b045153b
- SSDEEP 768:lAtK+4sJOvb8DI6TynDFmA1HSBh0apxoBJ5QS9:lAor6TyDFmA1yxoX
- TLSH T1CD23EA0033F88623E6FF5B79297050400B797D63AD31E39C5D9B60DE45A2780B9A6BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\brand\OneDrive\Desktop\PhotonConnect\obj\Release\net9.0-windows\PhotonConnect.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotonConnect-V1/PhotonConnect.exe
- IMPHASH 2a107501f27598ff0d70069e1b11b394
- SHA256 6b25e484e5b3496e930f1f31f68edbd73ed6a765bd127a149798581d0f0e4f1c
- MD5 bebf48173faba31d514c90d57c36d6c8
- SHA1 b71e81a00aad97b7ae48af6b01e4408738af81f7
- SHA512 55aaf4d7132abf84ff2fd391aedb59071685c33233982b5ef51d7c856a6bcfd11efd4acf36c1bcc668be4ccdf8e81ae8f3d6dd1d84aea53e971303da66510957
- SSDEEP 3072:kcr3yCS8dVF4Zj6w+6O9J+yeQLZ5eMd1lZewqKgtg/aaZD2:pVF4ZuJReQV5HDgG
- TLSH T161E31906A6AD50FEE2BBA67889520902F7727C564771A6CF03504DBA0F76BD0AF3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
74160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_cexit
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___argc
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
fputwc
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
setvbuf
_wfsopen
fflush
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=34810,
count=1, id=258, version=34810,
PhotonConnect-V1/PhotonConnect.pdb
- SHA256 6073178115ca893d138ce3d0ffe85270fd162da920d4ff3840675d42ce0ab9d7
- MD5 14bb4f4db584b0188bb9a0d676af9efa
- SHA1 8c518881f73b16b43ce88e1548360257d3c2ba89
- SHA512 125620e436d58f8319c0d66a60f95e27011bb94259a6679500da665bb3a6321ddcbff813bb96f09a0422c3bf161b12b0f27db0d58df2e1272e1fa639067a6b97
- SSDEEP 384:8IEcF5kBLxnLSdLrj710JaHpaBWMqdjEsC0H17s7rXf6HfW/H5fYaRq2j6tEHJDT:RncnLSdzH1KwEHJNXU0bTyE
- TLSH T1CCA27123A348DE61C1459B3789A5C54E3634C310A703EF76F1D8A639D9AFBC847B32A5
- MD5 SHA1 SHA512 SSDEEP TLSH
PhotonConnect-V1/PhotonConnect.runtimeconfig.json
- SHA256 05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c
- MD5 6cc5992b5f24e3ff259ff61441f0bce9
- SHA1 98e9fecdc80c90f6d250b9afca50eab4c4c0151b
- SHA512 64b9612846b342fd254c439be1833b4fde0e7bcea5979879d333b54a7633a9936df65639101ddb28023a3877f9a4dd1cbde29b2dfe79538bec48cc4a8aecb377
- TLSH T150F02069CA106DA704B937BAC63AC182FB30573B00041D92B9FC080C2F77DB22212F89
- MD5 SHA1 SHA512 TLSH
PhotonConnect-V1/PhotonRealtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6961f8ac9ac7d9bc400a593978c95678fde970d1a0e81b48f86a73f26d39adb8
- MD5 383028a06f2f560d6ea1edfc9c04d162
- SHA1 33dea68c1ee9a5227653994b5378f94086b69ccc
- SHA512 febd2256c242d235b58a4828713a87a5463289a26bd3d4a350ab94d38fceebd32065870ca1a1833420c4e0424b5659464ee9a00e2f5ad31df97df619225bb7b7
- SSDEEP 3072:lmfUPKSvFJ1x/P7/PTqb+DifgEdAcb541mDFLF/uZSoKtUnms:esTr/P7/PTOtQcD//uQ9
- TLSH T19AD3287C53FC0E99F6EF1778E4B802118BF2B901752EE72E9E44A8DE48A27848511777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
142802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\brand\OneDrive\Desktop\StaticLoss\photon-dotnet-sdk_v5-1-15\PhotonRealtimeApi\obj\Release\netstandard2.0\PhotonRealtime.pdb
mscoree
_CorDllMain
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotonConnect-V1/net9.0-windows/PhotonClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4591062e25ab7d0f64a2de55267105be22fb19a1edcb954b20596abd24668f5d
- MD5 52fc4ae9c7c29bf786fad5847e2a4724
- SHA1 0a5d7faca0f9cc56610897ab77bd317497064800
- SHA512 653b724fa5311ce69f832a1d63bb96ec1c7486c4649b06e5697f97e5248d0df891f0e1ab665c5f8c4ca0cec4427d03ce701e4680a58944db88f891062fe804df
- SSDEEP 3072:3w8NMF06wuKdnXT+4ldKxO1b4fdtSudUTIGZv5REzhg:3PMF0XTLkO1SMt5R8
- TLSH T1D7045B1C13FC8A0AE3FF2B79E47201564BB1B9277A76DB6E184068FE5C427829C91357
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
194918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\photon-sdk-dotnet\PhotonDotNet\obj\Release\netstandard2.0\PhotonClient.pdb
mscoree
_CorDllMain
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotonConnect-V1/net9.0-windows/PhotonConnect.deps.json
- SHA256 7501217d6500749876d6a7c088bda458fd1940218613297f3f3df874a86e7628
- MD5 46a91a1a363bb8be151ffcdbb45df2c4
- SHA1 7ebde3a025acb3d57dfedd95c1a37ac4f145fcc6
- SHA512 3c38d6548d5e8382932d6b425615d71c456c323e7f03370da881702e4723641a393277f9ddbed668364893e7a29a6a2f07d3ddf06ea5d5608b3fff16adf766d1
- TLSH T1B2214C19D798AD6701B3A3F55A378382F732573B7049040A7ABC509C8FB39AB9051FA9
- MD5 SHA1 SHA512 TLSH
PhotonConnect-V1/net9.0-windows/PhotonConnect.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8839f572990b62e92c3a2683c6eb34bbc2981bab14f220bce2a08be1325ec556
- MD5 2b3edfcbbe22a5d0eb29a1ff55f1c61a
- SHA1 be92f8db63573cd795fbc93f1f8e79efc5fbe15d
- SHA512 7e8b79983016ee87e7b35b95f1df3ae5d039d59bcf1f1c700817edce078ac9d6ecde30e7f8c85090bffb3cd87c30d4bc17f3b55c9e122a5ec320d5b2b045153b
- SSDEEP 768:lAtK+4sJOvb8DI6TynDFmA1HSBh0apxoBJ5QS9:lAor6TyDFmA1yxoX
- TLSH T1CD23EA0033F88623E6FF5B79297050400B797D63AD31E39C5D9B60DE45A2780B9A6BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\brand\OneDrive\Desktop\PhotonConnect\obj\Release\net9.0-windows\PhotonConnect.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotonConnect-V1/net9.0-windows/PhotonConnect.exe
- IMPHASH 2a107501f27598ff0d70069e1b11b394
- SHA256 6b25e484e5b3496e930f1f31f68edbd73ed6a765bd127a149798581d0f0e4f1c
- MD5 bebf48173faba31d514c90d57c36d6c8
- SHA1 b71e81a00aad97b7ae48af6b01e4408738af81f7
- SHA512 55aaf4d7132abf84ff2fd391aedb59071685c33233982b5ef51d7c856a6bcfd11efd4acf36c1bcc668be4ccdf8e81ae8f3d6dd1d84aea53e971303da66510957
- SSDEEP 3072:kcr3yCS8dVF4Zj6w+6O9J+yeQLZ5eMd1lZewqKgtg/aaZD2:pVF4ZuJReQV5HDgG
- TLSH T161E31906A6AD50FEE2BBA67889520902F7727C564771A6CF03504DBA0F76BD0AF3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
74160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_cexit
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___argc
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
fputwc
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
setvbuf
_wfsopen
fflush
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=34810,
count=1, id=258, version=34810,
PhotonConnect-V1/net9.0-windows/PhotonConnect.pdb
- SHA256 6073178115ca893d138ce3d0ffe85270fd162da920d4ff3840675d42ce0ab9d7
- MD5 14bb4f4db584b0188bb9a0d676af9efa
- SHA1 8c518881f73b16b43ce88e1548360257d3c2ba89
- SHA512 125620e436d58f8319c0d66a60f95e27011bb94259a6679500da665bb3a6321ddcbff813bb96f09a0422c3bf161b12b0f27db0d58df2e1272e1fa639067a6b97
- SSDEEP 384:8IEcF5kBLxnLSdLrj710JaHpaBWMqdjEsC0H17s7rXf6HfW/H5fYaRq2j6tEHJDT:RncnLSdzH1KwEHJNXU0bTyE
- TLSH T1CCA27123A348DE61C1459B3789A5C54E3634C310A703EF76F1D8A639D9AFBC847B32A5
- MD5 SHA1 SHA512 SSDEEP TLSH
PhotonConnect-V1/net9.0-windows/PhotonConnect.runtimeconfig.json
- SHA256 05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c
- MD5 6cc5992b5f24e3ff259ff61441f0bce9
- SHA1 98e9fecdc80c90f6d250b9afca50eab4c4c0151b
- SHA512 64b9612846b342fd254c439be1833b4fde0e7bcea5979879d333b54a7633a9936df65639101ddb28023a3877f9a4dd1cbde29b2dfe79538bec48cc4a8aecb377
- TLSH T150F02069CA106DA704B937BAC63AC182FB30573B00041D92B9FC080C2F77DB22212F89
- MD5 SHA1 SHA512 TLSH
PhotonConnect-V1/net9.0-windows/PhotonRealtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6961f8ac9ac7d9bc400a593978c95678fde970d1a0e81b48f86a73f26d39adb8
- MD5 383028a06f2f560d6ea1edfc9c04d162
- SHA1 33dea68c1ee9a5227653994b5378f94086b69ccc
- SHA512 febd2256c242d235b58a4828713a87a5463289a26bd3d4a350ab94d38fceebd32065870ca1a1833420c4e0424b5659464ee9a00e2f5ad31df97df619225bb7b7
- SSDEEP 3072:lmfUPKSvFJ1x/P7/PTqb+DifgEdAcb541mDFLF/uZSoKtUnms:esTr/P7/PTOtQcD//uQ9
- TLSH T19AD3287C53FC0E99F6EF1778E4B802118BF2B901752EE72E9E44A8DE48A27848511777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
142802
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\brand\OneDrive\Desktop\StaticLoss\photon-dotnet-sdk_v5-1-15\PhotonRealtimeApi\obj\Release\netstandard2.0\PhotonRealtime.pdb
mscoree
_CorDllMain
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ