PS22PS4-GUI.zip
- SHA256 86751484f8839d465a2dea02959ed424cda2733aa415b1eb714b28a02be39cd3
Overview
overview
5Static
static
5PS22PS4-GUI.exe
windows11-21h2-x64
3bin/dlls/D...re.dll
windows11-21h2-x64
1bin/dlls/D...60.dll
windows11-21h2-x64
1bin/dlls/D...et.dll
windows11-21h2-x64
1bin/dlls/D...ry.dll
windows11-21h2-x64
1bin/dlls/D...ms.dll
windows11-21h2-x64
1bin/dlls/H...ck.dll
windows11-21h2-x64
1bin/dlls/N...on.dll
windows11-21h2-x64
1bin/dlls/l...et.dll
windows11-21h2-x64
1bin/dlls/lzo.net.dll
windows11-21h2-x64
4bin/dlls/n...rk.dll
windows11-21h2-x64
1bin/emulat...V2.pkg
windows11-21h2-x64
3bin/tools/ext/di.exe
windows11-21h2-x64
3bin/tools/...c9.dll
windows11-21h2-x64
3bin/tools/ext/sc.exe
windows11-21h2-x64
4bin/tools/gengp4.exe
windows11-21h2-x64
5bin/tools/...ch.exe
windows11-21h2-x64
5bin/tools/...to.dll
windows11-21h2-x64
3bin/tools/magick.exe
windows11-21h2-x64
1bin/tools/...md.exe
windows11-21h2-x64
3bin/tools/replhex.exe
windows11-21h2-x64
1bin/tools/replhex.exe
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
PS22PS4-GUI.exe
Resource
win11-20260513-it
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
bin/dlls/DiscUtils.Core.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
bin/dlls/DiscUtils.Iso9660.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
bin/dlls/DiscUtils.Net.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
bin/dlls/DiscUtils.Registry.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
bin/dlls/DiscUtils.Streams.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
bin/dlls/HtmlAgilityPack.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
bin/dlls/Newtonsoft.Json.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
bin/dlls/lzfse-net.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
bin/dlls/lzo.net.dll
Resource
win11-20260513-it
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral11
Sample
bin/dlls/nunit.framework.dll
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
bin/emulators/JakV2.pkg
Resource
win11-20260513-it
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
bin/tools/ext/di.exe
Resource
win11-20260513-it
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
bin/tools/ext/libatrac9.dll
Resource
win11-20260513-it
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
bin/tools/ext/sc.exe
Resource
win11-20260513-it
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral16
Sample
bin/tools/gengp4.exe
Resource
win11-20260513-it
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral17
Sample
bin/tools/gengp4_patch.exe
Resource
win11-20260513-it
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral18
Sample
bin/tools/libmbedcrypto.dll
Resource
win11-20260513-it
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral19
Sample
bin/tools/magick.exe
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
bin/tools/orbis-pub-cmd.exe
Resource
win11-20260513-it
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral21
Sample
bin/tools/replhex.exe
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
bin/tools/replhex.exe
Resource
win11-20260513-it
windows11-21h2-x64
0 signatures
900 seconds
General
- Target PS22PS4-GUI.zip
- Size 28.2MB
- Sample260620-m8v1vsfx2x
- SHA256 86751484f8839d465a2dea02959ed424cda2733aa415b1eb714b28a02be39cd3
- MD5 5d3c3826efe3cdd063397afaba55b4ed
- SHA1 359c99e74e3fdb8721856b6c2f41703e3a9d38de
- SHA512 4dffd8397237f1d45355704a9d457813733073715c0fd3c6fcb15c59bed593900f7e587a5e53836587fe8304fe52751fe307406eeff3cde6d14e3ff91c663303
- SSDEEP 786432:d1z+2gu2CIOiXDWjRPyxOXzXKprYLuJOXYNzJPAKym:a2JiXDTOXzXKp8LuJpPIm
- TLSH T1775733CDEB7D3999DF0E997A252B2CEFDC352D14BD480A2EE44B0326395E3D31664A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bin/tools/gengp4.exe upx static1/unpack001/bin/tools/gengp4_patch.exe upx - Unsigned PE 21 IoCs
Checks for missing Authenticode signature.
resource unpack001/PS22PS4-GUI.exe unpack001/bin/dlls/DiscUtils.Core.dll unpack001/bin/dlls/DiscUtils.Iso9660.dll unpack001/bin/dlls/DiscUtils.Net.dll unpack001/bin/dlls/DiscUtils.Registry.dll unpack001/bin/dlls/DiscUtils.Streams.dll unpack001/bin/dlls/HtmlAgilityPack.dll unpack001/bin/dlls/lzfse-net.dll unpack001/bin/dlls/lzo.net.dll unpack001/bin/dlls/nunit.framework.dll unpack001/bin/tools/ext/di.exe unpack001/bin/tools/ext/libatrac9.dll unpack001/bin/tools/ext/sc.exe unpack001/bin/tools/gengp4.exe unpack002/out.upx unpack001/bin/tools/gengp4_patch.exe unpack003/out.upx unpack001/bin/tools/libmbedcrypto.dll unpack001/bin/tools/orbis-pub-cmd.exe unpack001/bin/tools/replhex.dll unpack001/bin/tools/replhex.exe
File Explorer
-
PS22PS4-GUI.zip.zip 28.2MB
-
PS22PS4-GUI.exe.exe 340KB
-
PS22PS4-GUI.exe.config1KB
-
bin/covers/SLES-54945.jpg.jpg 311KB
-
bin/dlls/DiscUtils.Core.dll.dll 171KB
-
bin/dlls/DiscUtils.Iso9660.dll.dll 50KB
-
bin/dlls/DiscUtils.Net.dll.dll 23KB
-
bin/dlls/DiscUtils.Registry.dll.dll 40KB
-
bin/dlls/DiscUtils.Streams.dll.dll 77KB
-
bin/dlls/HtmlAgilityPack.dll.dll 165KB
-
bin/dlls/Newtonsoft.Json.dll.dll 695KB
-
bin/dlls/lzfse-net.dll.dll 7KB
-
bin/dlls/lzo.net.dll.dll 10KB
-
bin/dlls/nunit.framework.dll.dll 477KB
-
bin/emulators/JakV2.pkg15.2MB
-
bin/info/SLES-54945.info56B
-
bin/tools/ext/di.exe.exe 692KB
-
bin/tools/ext/libatrac9.dll.dll 115KB
-
bin/tools/ext/sc.exe.exe 1.0MB
-
bin/tools/ext/trp_compare_default.css9KB
-
bin/tools/gengp4.exe.exe 658KB
-
out.upx.exe 2.4MB
-
bin/tools/gengp4_patch.exe.exe 658KB
-
out.upx.exe 2.4MB
-
bin/tools/libmbedcrypto.dll.dll 1.0MB
-
bin/tools/magick.exe.exe 22.3MB
-
bin/tools/orbis-pub-cmd.exe.exe 3.0MB
-
bin/tools/replhex.dll.exe 7KB
-
bin/tools/replhex.exe.exe 144KB
-
bin/tools/replhex.runtimeconfig.json253B
PS22PS4-GUI.exe
- SHA256 0d79fa3f02b7bfc5950c6b0a210746fa2d5fd5e51fc7ee7e08851a0fce1a6df1
- MD5 91013483c99543a0aeec408933159f9f
- SHA1 0db890c886f58fa1d61f643a7866460900f1de35
- SHA512 5ff774054856900084b6bd40e4839fdbd6a64ac9db7a73b155757668347c2f55282738cb639e7ed5b2856b2c4a5f9c86906c1b314cecad2138a44f10defc498c
- SSDEEP 6144:5EOSd8ybz1qMF1tdF/G4F1tdF/GA28Fs2k7TbqEANd0IF1tdF/G/:5EO7+hNd04Nd04s2kGEAgINd0/
- TLSH T1CA748D2133A41B87DBBF573109E1A11422F6B956967AD60C3E9D50CC0DA9BC0EEB2F17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\echol\source\repos\PS22PS4-GUI\PS22PS4-GUI\obj\Release\PS22PS4_GUI.pdb
Name
.text
Size
295KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
PS22PS4-GUI.exe.config
- SHA256 cfb94f2ad3a5c96efb7bc04a334f2af6f5230da404ea6a6ec8cafab663a3b73a
- MD5 6ae7992e951b42dfb0d266c5d0d41276
- SHA1 c059ea0961b2996aa1b0bc528789fb07e32eb313
- SHA512 f763199431ec6d9d6674f374284b936cb5180a8f6613e22b35deeb7e3c3b0caa6cb813c6bcdf2075aefc5f6f61e536a5eaeeb8bcfb0630f60553e27bb41dbaf5
- TLSH T1CE21081465C0AE9F46323B32E6319285DEB047A3117A64B8B8BD716B5F318CB47633B7
- MD5 SHA1 SHA512 TLSH
bin/covers/SLES-54945.jpg
- SHA256 f13b4e5845832e0a855bc9d65721af9a86385d53522ab95f1826ee89d5588516
- MD5 24ee4a7f4b3c3184523129139e69faff
- SHA1 ab38967f1ebcab44f430ca89298a40bc7b3b9cf1
- SHA512 a438ef3b4b0880cbfc4ec0fae5d227782efb9df749194b52ddd796f7d958deae63e29d9f2ce38238df5b800b886d668ec6593c8daaa4328cf54aeb640197c2b4
- SSDEEP 6144:L5YnsQP+SdKeL7AlTQ5u/xhBLfx4RN7NGTDNrEf4ldybgTuRSjJ/X2jhZ/IO:L5YsGdKe/AlhBx4RN7sBuRW2Hx
- TLSH T1B16423CCE9955BAFF4CF6D3B8A0021950D589D983C2764A01E4ED9735482EB5ECB0B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/dlls/DiscUtils.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c338a2fc6b0879f326237b32b1d15ef617f41a12356ff289e8a09cddcebf67a0
- MD5 b9ea6c772cfb2b208354e2b9db9772db
- SHA1 dfa516697b815c599870935477d024be93855e9e
- SHA512 59bceb0eb013a81c4233b1c229c27ef04e0fa15a13257942bd6963bbfc485a330f897c31373c5d8df0011c6618881a5ed6ba888bf33f461187a7da1eec83eb46
- SSDEEP 3072:z9Jpom+HpU3pp1WakEO/bd8Z1TmS87gStRLM8pUL7cArAenEymI+U9BOgli+6xRg:zzH+Js0akEO/kmS8/1vpUL7cArAenEy0
- TLSH T1E1045B0423EC0E6AC6AF8738B4A4704682F3F51AB5B3DB9A495C7DE937137509950B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
178594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DiscUtils\DiscUtils\Library\DiscUtils.Core\obj\Release\net45\DiscUtils.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/DiscUtils.Iso9660.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4aa30f253343f3e130f4ff8df0e955232134f339ffcb279cb8fe22a05acc727d
- MD5 c7340cdf1e4af72c007fe68694b7ecb5
- SHA1 cca5352e2fe608fc0bfadbd333490371a2e47770
- SHA512 f423dd51c50344b524c22699d33d36dd4cc6b00c145cdcc10bcef9a3d270f697548f5af95f558887cacd00c3c881b59f951eae23c15b3d8aec320351e7b55a0d
- SSDEEP 768:x2JAzTUhsJXaIjR4cVssGKfgJEwg3BmhjQ/Ivl2qsXsVNET:gA/2sBXssngOwCBmhyINJET
- TLSH T17F333A296FFC532BC69E06BAA4B5944163B0E23FA213D7996DC5B1BB6C037C419107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DiscUtils\DiscUtils\Library\DiscUtils.Iso9660\obj\Release\net45\DiscUtils.Iso9660.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/DiscUtils.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f2baf60c33cdd15be6b48aa2c63ad320d5a16e0d9b2f2de9cdf29b7524a5a501
- MD5 fc21b4213ab63a5fc23f5cb0d4f92d8c
- SHA1 8041edf4540d7e3693f0c1ef654ecc8d9b9e8bb4
- SHA512 df5f80d69e7d6b5b88ac60021173a5c7225e399e1331de455f49782f8727b8c9548e7b05afda14be0b353b9d415cb38237ccfdb1123f724c26da5a88ffcc4f5f
- SSDEEP 384:FINmHZDc8Iv5i8aD3KjkK3lx+vINIQwR6wbzJ9z+M0uhdBOMpv:FINkRc8IvA8g3jK3lAv8INUw3Lhddv
- TLSH T1E6B22919A38C833BC77ECE7AB4F1115212F1D218B223EF498D9CF4E72E167664901E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DiscUtils\DiscUtils\Library\DiscUtils.Net\obj\Release\net45\DiscUtils.Net.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/DiscUtils.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d2755946427cf06839259c656c87610a1a3f3cc77403e75707fdabbf2d27290
- MD5 ca7334d3e06ade1c6c91c2aa933f9254
- SHA1 48e88db01f765b99aaa65e2010a9984b0d678b09
- SHA512 8ece4a39ae5da4662ebe0bb60396acb80cfcdca9ecbbf111e3ac3735fde2a9f4e6358076157b5ed2cc253bd96ef610eda87ef2d7c12c7795588ff91b52118f1e
- SSDEEP 768:JXWW2gfWrp+V33Z0hBKTzUOHe6NMyFY4W:pp+r0V3J0hBKTztehyFY4W
- TLSH T1250328542BDC8B3BC7AD4EFCA8A1104647B1E2B6B703CBCE4D8925F53C417D15982AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DiscUtils\DiscUtils\Library\DiscUtils.Registry\obj\Release\net45\DiscUtils.Registry.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/DiscUtils.Streams.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4275a6241646141419d97e30acab3b2d7f4cda51b5adc9bb12f9c8b385022d51
- MD5 e4229054374707acece62079a0037610
- SHA1 78d778d6159fac469893ccf9bfa475aee31db9a5
- SHA512 5e9ca20fb0e46b2ab4712fb07bd667089f9add8e8bb687c98fd3bd760b2812fca9d0d131a0e0dd5302ca96b76c6b00ac26ab92d7d9d33b6745e7a2aef4922cfd
- SSDEEP 1536:lz69U1ZkKba4acbcCSpCK9W80sQ1EQF/CY+fgYUUtr2VLxh5S:FZkKRcCOfgYUUtr2VLxhI
- TLSH T120733B6C13EC8E27E6BEC9BDF87150AA0372F8A5B213DBDD494CB4B569137004994B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\DiscUtils\DiscUtils\Library\DiscUtils.Streams\obj\Release\net45\DiscUtils.Streams.pdb
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/HtmlAgilityPack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37e643b9ef95d1fb21de79ad0b19825fc15aaaf43232c15e030e4c3bdba07714
- MD5 7939c27033a7c0e80022a788c537275d
- SHA1 df3260a60a4223bd0666d1d13b15fb4e4bc78af7
- SHA512 798cd9a213ad3750521cd6ec2fc4e4806c88db50e9c30a6809f067c3a063731d08b67dc9662aa3572aa40c3ba5a037aca7b590f0d9b4214d4ab256525af6d6b6
- SSDEEP 3072:VKAQHsluAGimooRjc48chGlj6q3BEkMGNhYAFBZeihwFvWq:xFluAGMo3slTBEkMiqb
- TLSH T1EAF309443BEE5A72E6FBAFBED8B161024679BB659506DF480C4460CC0872794C8D3F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Repos\HtmlAgilityPack\HtmlAgilityPack.Net45\obj\Release\HtmlAgilityPack.pdb
mscoree
_CorDllMain
Name
.text
Size
163KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/lzfse-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d5cada3788e07233412be711ae24b7e86c054d8ec86542f78bf4c5d7a2d05e9
- MD5 30f712479f00f8831b9eeb1c2638ffa1
- SHA1 da33d7c560c55a5ae209277a54ea82a607efa3b9
- SHA512 a9bfefb7237d56dfa61944de74a930fd741a5410a3a2bf45ba72d45d18508e04ba61f6b691cc990a3ef3d39df9f8b2c1e395c6d0ce96d7d6ca2c07d2555c63f5
- SSDEEP 96:wuM+LkIt4OZwGl+iiAINcIteFNZ0N7oOk5KtgmC2EQTVX:R3ki4OWti+NcItaZkE4ODul
- TLSH T15AF19521A3D41273FEFE5F31ACB642459778BB85AC72CB1E1489006A2C59D18CB72F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\src\lzfse-net\obj\Release\net45\lzfse-net.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/lzo.net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8f25be02b3f1a55a5a791a7246e3707595cce07cd4031e3b1221de1fa0ee49b
- MD5 bd24f6c05fec63ad938ab954e1665ce8
- SHA1 ef2854e8692772d13d28672ae504bdfea3d46f4b
- SHA512 7ea05c1fe72cb7402c95bf882ad49256ed63c38fe6008c00527e5c8f5f29fa30d2e5b22d8d8fad18fa7eb43d56a729c475eda0a015125b460b8614554a22d116
- SSDEEP 192:r5cuTq81aE7iQes5evVbzY3GmQ1C2O158ju5xaOWzrgo:yuxNe9bUWmHSuvwz5
- TLSH T10222B314EBECD217D96E0BBCA5F3160203B56C75AE23EF8F1948219A1C22F544963B67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\lzo-net\src\obj\Release\net45\lzo.net.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/dlls/nunit.framework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 322333b3237b23ef06a01d4ead50ced2546a97e83a89cc6d12038e6daee5aef0
- MD5 c58e2d058fec773888e2f0ca63c96214
- SHA1 a496d3951f9362c98ff99266cca701ed0c86f2d3
- SHA512 68f1b9e69cedee1358b97abaef22613a53c13f1b42a60d0991377ee398d8f8ace1602dcb793723df2142109112a8945ac95d8e9fbde2497055c6d0ac1bef9e59
- SSDEEP 12288:APoRUNwxhkJdW5pgyKgnBf2e/mo6SQi+MvN:APwWJWDdf2tpMvN
- TLSH T14BA44A0817FC4615EABE6B7CE531090597B4F412B663E75E4A86E5BD2CB7720C880BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
494534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Src\NUnit\nunit\src\NUnitFramework\framework\obj\Release\net45\nunit.framework.pdb
mscoree
_CorDllMain
Name
.text
Size
475KB
Virtual Size
474KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/emulators/JakV2.pkg
- SHA256 c8ed64b35473c8de90abae8cba35d80fb5bfadc4fcdade7e838dc810c1665487
- MD5 2cb04b369ae89e625dbf3fe6724eb8a1
- SHA1 db897534624e54f40ba525dae5444c88f231b284
- SHA512 9083cc248fa4368fdffa8c725d22e5f585c731d2cd856470582ae43f08dc7e9b7c2ebd38bbb379fd59f7a2505d82016cd43bb300b2b4b3d4118f0359bf93da72
- SSDEEP 393216:WIQoB2+4mU6ywNZ1WiyrbEfcOK2GsgZiAP:qoM+4Iywyrb+tdvg3
- TLSH T173F633DE2FBD3E63D7496D3715BB3C7B89362E789F941E81E29B4B0124572931982C80
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/info/SLES-54945.info
- SHA256 32a48987611fe05dc73e82c7aa1e567ed49540f8eb2a67ae683391d2c6b81093
- MD5 d58374565cfa70c2463c1661e9e175da
- SHA1 f26162b93fc40346120af1727a79151cb22eef7e
- SHA512 3476eba122fbaab43f3e4af2895adc77c3c4cc5b6900e197eb7f47fc60ebccc4f92497be41e843f82b5573a8c4a9f187682dd0d60b38a232c772a7324584f8ba
- TLSH T1969002D0198162587081EC51B706D30855801580856AD2C122895628914A1E196457B0
- MD5 SHA1 SHA512 TLSH
bin/tools/ext/di.exe
- IMPHASH 6a36e3f662ffc6acba12733a3a3221bc
- SHA256 1d2a2f60416bddeb9e4c93da7721f9fe9cb4b7629894e7f85057c5205cb1f4b3
- MD5 66f80b89c95092f8a2fb65234505a5cd
- SHA1 9fe7dcb1fa82e2898ba45ec3a2bfbb5f9dd90b24
- SHA512 3d9e535b7dee8e7d8598f7d1c3ba088ae7f572c11c6b1adae07405eb43bb2f870bb5720539ca4e9721ef9c0f7fd2cab89b3e90e9b83b116d4cbca7c74ead1db1
- SSDEEP 6144:L/D0hliOTerp3JXBSf17ZHMP32HHJwa2Go3grTsCsBPX9OdGlqiNsWzPUPNmmXJb:Lr0E5UNFMP32Jwa27cKzRmFr
- TLSH T11CE4086DFB0700F4DA231B71856FE67F9B5579148021EEABFF0A0B02E8635277D46292
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_fstat
_lseek
_read
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_filbuf
_flsbuf
_iob
_onexit
_setmode
abort
atexit
atoi
calloc
fclose
fflush
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
getwc
iswctype
localeconv
malloc
memchr
memcmp
memmove
putwc
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strcpy
strerror
strftime
strtod
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
Name
.text
Size
489KB
Virtual Size
488KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
bin/tools/ext/libatrac9.dll
- IMPHASH 40557db7605402aa30b8b61f885521de
- SHA256 e1b1f3db147d7996a5b1fbddb2b7322e56f25bbf689f47c50638fd268fc1d3c7
- MD5 c878a972781e4d5c70666c45b92a155a
- SHA1 579a0fce04851bf57a9d143f3cc926944ab5ce34
- SHA512 36e44582bd6485eca4399202696b2fb544b139195e99bb16dd1d4021c382181394b8b311220c13bbfd5aec96159c4885813d37de6780ddf27e5afe49a90551eb
- SSDEEP 3072:Z5tVPq/1fdYeJNxRy/9XIO/YzQuaBI6lrwxZsjyuJDK7WJ9u:zd/2OYzQD5DEM
- TLSH T182C36C41FA8143A2E46A123D14F7A6376B295221CF198EC3A6D07B6AFCD31D19F713C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
73115
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcr90
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
_encode_pointer
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_CIexp
_CIpow
_CIcos
_CIsin
_CIsqrt
memmove_s
floor
_CIlog
memcpy
malloc
memset
memcpy_s
calloc
__CppXcptFilter
free
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
sceAt9DecDecode
sceAt9DecInit
sceAt9EncEncode
sceAt9EncFlush
sceAt9EncInit
sceAt9EncSetEncParam
sceAt9GetCodecInfo
sceAt9GetDefaultExtParam
sceAt9GetHandle
sceAt9GetInternalErrorInfo
sceAt9GetVersion
sceAt9ReleaseHandle
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=44, id=1, productName=Unmarked objects,
count=36, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/tools/ext/sc.exe
- IMPHASH a8a4e2919414a3700770d3d13b2a2914
- SHA256 32389fbd3dbfe62f140db1eb81e8d968259cd908d66aeb7a656de8e0a99abf35
- MD5 2b0e372b7d2bd1d7da721acc5bc835fd
- SHA1 6f327d25326970d96c0ae4bd8980d52fb0c5fc89
- SHA512 99dec97f75a746c4b1ed7a89971340236ef37c9e92237549c049676f75fd90e7811be880fd6117cd6a2b5412c63b9e85fd38ba67a0d51e3e680cde2e53c792f9
- SSDEEP 24576:IwlR4h8a9VWcXcWd4Devxo8qlvOfiXlthVLzD/j/3f:xD4P9Vn9Rpo5l/jH
- TLSH T1C4352919FB4B90F4DD131B71851FE27F9B207E088026EEABFF8A1A02E8636277D15545
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4716
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_fdopen
_fstat
_lseek
_mkdir
_read
_stat
_write
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_cexit
_errno
_filbuf
_flsbuf
_iob
_isctype
_onexit
_pctype
_setmode
abort
atexit
atoi
calloc
fclose
fflush
fopen
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
getwc
iswctype
localeconv
malloc
memchr
memcmp
memmove
putwc
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strcpy
strerror
strftime
strtod
strxfrm
toupper
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
Name
.text
Size
760KB
Virtual Size
759KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
bin/tools/ext/trp_compare_default.css
- SHA256 f13a0e3a78ea423dd4883aa030c2e898f206eb0f08693e83a32198217253790b
- MD5 c81f94f97fde3589b73f45dd8dbd6579
- SHA1 b5cd38f489c4431057c83d6e8a0b4ef0b5bb27c9
- SHA512 e165dbb4ea8902c788127ac54c49308ff46eed54403f974a34905361cec87c1077ff29f80a665afdb466b7769178cf729dd4841d7f78b88478b92626247987e9
- SSDEEP 192:pjHZ12zt/5nOy6vzD89D2sbSWQGvANSot:V4nOL32zbhQmq
- TLSH T19C228501D68B306F06E7ABA863714388528888BFE94735F9BFED755A0B747D053423C9
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/tools/gengp4.exe
- SHA256 65042f9982e6db4c8610e8e735ca296e685518917cb71e7db42451b5069846e6
- MD5 cbbb5c7c6944f33886262d8f8c27ec97
- SHA1 9d819873f6c60e11155eb07e2d90829978f892b0
- SHA512 f4713641ac4e6c126a13312a6b7c732e29c45eacf377890a11edbef2e3070b30d485ce67551056062f495760a17978e3a79043b2379a5045169976352e9399a8
- SSDEEP 12288:Rl4axzQlopnW+xecCGTQJ5wBhebihMKB3/EId2s21qqQEzLEZEdMReVMG2:fp9Qlow5SJ3/jdhHqxQqdkG2
- TLSH T117E42335A6CE3802F60D81774CA743C43B57F52A53B94E21B95C1B0B3EEF12619857AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2542816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
640KB
Virtual Size
640KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 b52482e14bcb32531cba9f0c14bbfce69ecaec903754caef85632d84701adccd
- MD5 51340a3bca5a564da06c2b0db0625b0a
- SHA1 b5727888965a5095dc37b5b3bc0683692f17cc5d
- SHA512 d2ee9b6dc6d12f3e76e6595ff68e375599b5fd1db544003d5dca691eb5b8fa5e9c1fc38a77acef987c44278a65b53520d3623d941ec99bb00666750187b3545e
- SSDEEP 24576:SyoSgmKxen+cZVsnaI+iBN1aGrqeMFaRULpb/ZIom2k/6waLBySowOg8Eu+rUAkd:2yZVYacqvkAplm2FDLwSlK+T
- TLSH T101B55C23B285653EC0AB1A324937D568D93BB7A125A78D4B57F1080CCF797C03E3A65E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2181092
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
72B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/tools/gengp4_patch.exe
- SHA256 65042f9982e6db4c8610e8e735ca296e685518917cb71e7db42451b5069846e6
- MD5 cbbb5c7c6944f33886262d8f8c27ec97
- SHA1 9d819873f6c60e11155eb07e2d90829978f892b0
- SHA512 f4713641ac4e6c126a13312a6b7c732e29c45eacf377890a11edbef2e3070b30d485ce67551056062f495760a17978e3a79043b2379a5045169976352e9399a8
- SSDEEP 12288:Rl4axzQlopnW+xecCGTQJ5wBhebihMKB3/EId2s21qqQEzLEZEdMReVMG2:fp9Qlow5SJ3/jdhHqxQqdkG2
- TLSH T117E42335A6CE3802F60D81774CA743C43B57F52A53B94E21B95C1B0B3EEF12619857AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2542816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
640KB
Virtual Size
640KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 b52482e14bcb32531cba9f0c14bbfce69ecaec903754caef85632d84701adccd
- MD5 51340a3bca5a564da06c2b0db0625b0a
- SHA1 b5727888965a5095dc37b5b3bc0683692f17cc5d
- SHA512 d2ee9b6dc6d12f3e76e6595ff68e375599b5fd1db544003d5dca691eb5b8fa5e9c1fc38a77acef987c44278a65b53520d3623d941ec99bb00666750187b3545e
- SSDEEP 24576:SyoSgmKxen+cZVsnaI+iBN1aGrqeMFaRULpb/ZIom2k/6waLBySowOg8Eu+rUAkd:2yZVYacqvkAplm2FDLwSlK+T
- TLSH T101B55C23B285653EC0AB1A324937D568D93BB7A125A78D4B57F1080CCF797C03E3A65E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
2181092
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
72B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bin/tools/libmbedcrypto.dll
- IMPHASH 95f02bed4e244ab70bd05f8080037571
- SHA256 d5031cd7bca8821e472e2048fec67a22ba999273593165ad8b994cbe26e135cb
- MD5 0a44661127cd7163c2f75d24b90db906
- SHA1 4759b18473145df1bae96d8de55c23bc0b733b2f
- SHA512 803d234c3f3e996f07237ed1797970aa4b83dfec888d5a267093c81024f6116093d17ea1ff5bf7741ba8d2efe9c8b3761778acf5eb8a8aae480a94b45f0bbe42
- SSDEEP 12288:B4ikuHoQqw8SEA3iukf+SKjoiYNbDZsdJhip5kbfM8AWPhkF8/49OL:B4iDHzqw8NA8KciYNQJhiggNg
- TLSH T1B2356D49EBC78BABFE011A3789E7C7160739F140DA47FF4BE24AD835E9162616D47088
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
kernel32
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_errno
_iob
_vsnprintf
abort
calloc
fclose
fflush
fgets
fopen
fread
free
fseek
ftell
fwrite
malloc
memcmp
memcpy
memset
printf
putchar
puts
rand
strcmp
strlen
strstr
vfprintf
mbedtls_aes_cmac_prf_128
mbedtls_aes_crypt_cbc
mbedtls_aes_crypt_cfb128
mbedtls_aes_crypt_cfb8
mbedtls_aes_crypt_ctr
mbedtls_aes_crypt_ecb
mbedtls_aes_crypt_xex
mbedtls_aes_crypt_xts
mbedtls_aes_decrypt
mbedtls_aes_encrypt
mbedtls_aes_free
mbedtls_aes_init
mbedtls_aes_self_test
mbedtls_aes_setkey_dec
mbedtls_aes_setkey_enc
mbedtls_arc4_crypt
mbedtls_arc4_free
mbedtls_arc4_init
mbedtls_arc4_self_test
mbedtls_arc4_setup
mbedtls_asn1_find_named_data
mbedtls_asn1_free_named_data
mbedtls_asn1_free_named_data_list
mbedtls_asn1_get_alg
mbedtls_asn1_get_alg_null
mbedtls_asn1_get_bitstring
mbedtls_asn1_get_bitstring_null
mbedtls_asn1_get_bool
mbedtls_asn1_get_int
mbedtls_asn1_get_len
mbedtls_asn1_get_mpi
mbedtls_asn1_get_sequence_of
mbedtls_asn1_get_tag
mbedtls_asn1_store_named_data
mbedtls_asn1_write_algorithm_identifier
mbedtls_asn1_write_bitstring
mbedtls_asn1_write_bool
mbedtls_asn1_write_ia5_string
mbedtls_asn1_write_int
mbedtls_asn1_write_len
mbedtls_asn1_write_mpi
mbedtls_asn1_write_null
mbedtls_asn1_write_octet_string
mbedtls_asn1_write_oid
mbedtls_asn1_write_printable_string
mbedtls_asn1_write_raw_buffer
mbedtls_asn1_write_tag
mbedtls_base64_decode
mbedtls_base64_encode
mbedtls_base64_self_test
mbedtls_blowfish_crypt_cbc
mbedtls_blowfish_crypt_cfb64
mbedtls_blowfish_crypt_ctr
mbedtls_blowfish_crypt_ecb
mbedtls_blowfish_free
mbedtls_blowfish_init
mbedtls_blowfish_setkey
mbedtls_camellia_crypt_cbc
mbedtls_camellia_crypt_cfb128
mbedtls_camellia_crypt_ctr
mbedtls_camellia_crypt_ecb
mbedtls_camellia_free
mbedtls_camellia_init
mbedtls_camellia_self_test
mbedtls_camellia_setkey_dec
mbedtls_camellia_setkey_enc
mbedtls_ccm_auth_decrypt
mbedtls_ccm_encrypt_and_tag
mbedtls_ccm_free
mbedtls_ccm_init
mbedtls_ccm_self_test
mbedtls_ccm_setkey
mbedtls_cipher_auth_decrypt
mbedtls_cipher_auth_encrypt
mbedtls_cipher_check_tag
mbedtls_cipher_cmac
mbedtls_cipher_cmac_finish
mbedtls_cipher_cmac_reset
mbedtls_cipher_cmac_starts
mbedtls_cipher_cmac_update
mbedtls_cipher_crypt
mbedtls_cipher_definitions
mbedtls_cipher_finish
mbedtls_cipher_free
mbedtls_cipher_info_from_string
mbedtls_cipher_info_from_type
mbedtls_cipher_info_from_values
mbedtls_cipher_init
mbedtls_cipher_list
mbedtls_cipher_reset
mbedtls_cipher_set_iv
mbedtls_cipher_set_padding_mode
mbedtls_cipher_setkey
mbedtls_cipher_setup
mbedtls_cipher_supported
mbedtls_cipher_update
mbedtls_cipher_update_ad
mbedtls_cipher_write_tag
mbedtls_cmac_self_test
mbedtls_ctr_drbg_free
mbedtls_ctr_drbg_init
mbedtls_ctr_drbg_random
mbedtls_ctr_drbg_random_with_add
mbedtls_ctr_drbg_reseed
mbedtls_ctr_drbg_seed
mbedtls_ctr_drbg_seed_entropy_len
mbedtls_ctr_drbg_self_test
mbedtls_ctr_drbg_set_entropy_len
mbedtls_ctr_drbg_set_prediction_resistance
mbedtls_ctr_drbg_set_reseed_interval
mbedtls_ctr_drbg_update
mbedtls_ctr_drbg_update_seed_file
mbedtls_ctr_drbg_write_seed_file
mbedtls_des3_crypt_cbc
mbedtls_des3_crypt_ecb
mbedtls_des3_free
mbedtls_des3_init
mbedtls_des3_set2key_dec
mbedtls_des3_set2key_enc
mbedtls_des3_set3key_dec
mbedtls_des3_set3key_enc
mbedtls_des_crypt_cbc
mbedtls_des_crypt_ecb
mbedtls_des_free
mbedtls_des_init
mbedtls_des_key_check_key_parity
mbedtls_des_key_check_weak
mbedtls_des_key_set_parity
mbedtls_des_self_test
mbedtls_des_setkey
mbedtls_des_setkey_dec
mbedtls_des_setkey_enc
mbedtls_dhm_calc_secret
mbedtls_dhm_free
mbedtls_dhm_init
mbedtls_dhm_make_params
mbedtls_dhm_make_public
mbedtls_dhm_parse_dhm
mbedtls_dhm_parse_dhmfile
mbedtls_dhm_read_params
mbedtls_dhm_read_public
mbedtls_dhm_self_test
mbedtls_ecdh_calc_secret
mbedtls_ecdh_compute_shared
mbedtls_ecdh_free
mbedtls_ecdh_gen_public
mbedtls_ecdh_get_params
mbedtls_ecdh_init
mbedtls_ecdh_make_params
mbedtls_ecdh_make_public
mbedtls_ecdh_read_params
mbedtls_ecdh_read_public
mbedtls_ecdsa_free
mbedtls_ecdsa_from_keypair
mbedtls_ecdsa_genkey
mbedtls_ecdsa_info
mbedtls_ecdsa_init
mbedtls_ecdsa_read_signature
mbedtls_ecdsa_sign
mbedtls_ecdsa_sign_det
mbedtls_ecdsa_verify
mbedtls_ecdsa_write_signature
mbedtls_ecdsa_write_signature_det
mbedtls_eckey_info
mbedtls_eckeydh_info
mbedtls_ecp_check_privkey
mbedtls_ecp_check_pub_priv
mbedtls_ecp_check_pubkey
mbedtls_ecp_copy
mbedtls_ecp_curve_info_from_grp_id
mbedtls_ecp_curve_info_from_name
mbedtls_ecp_curve_info_from_tls_id
mbedtls_ecp_curve_list
mbedtls_ecp_gen_key
mbedtls_ecp_gen_keypair
mbedtls_ecp_gen_keypair_base
mbedtls_ecp_group_copy
mbedtls_ecp_group_free
mbedtls_ecp_group_init
mbedtls_ecp_group_load
mbedtls_ecp_grp_id_list
mbedtls_ecp_is_zero
mbedtls_ecp_keypair_free
mbedtls_ecp_keypair_init
mbedtls_ecp_mul
mbedtls_ecp_muladd
mbedtls_ecp_point_cmp
mbedtls_ecp_point_free
mbedtls_ecp_point_init
mbedtls_ecp_point_read_binary
mbedtls_ecp_point_read_string
mbedtls_ecp_point_write_binary
mbedtls_ecp_self_test
mbedtls_ecp_set_zero
mbedtls_ecp_tls_read_group
mbedtls_ecp_tls_read_point
mbedtls_ecp_tls_write_group
mbedtls_ecp_tls_write_point
mbedtls_entropy_add_source
mbedtls_entropy_free
mbedtls_entropy_func
mbedtls_entropy_gather
mbedtls_entropy_init
mbedtls_entropy_self_test
mbedtls_entropy_update_manual
mbedtls_entropy_update_seed_file
mbedtls_entropy_write_seed_file
mbedtls_gcm_auth_decrypt
mbedtls_gcm_crypt_and_tag
mbedtls_gcm_finish
mbedtls_gcm_free
mbedtls_gcm_init
mbedtls_gcm_self_test
mbedtls_gcm_setkey
mbedtls_gcm_starts
mbedtls_gcm_update
mbedtls_gf128mul_x_ble
mbedtls_hardclock_poll
mbedtls_hmac_drbg_free
mbedtls_hmac_drbg_init
mbedtls_hmac_drbg_random
mbedtls_hmac_drbg_random_with_add
mbedtls_hmac_drbg_reseed
mbedtls_hmac_drbg_seed
mbedtls_hmac_drbg_seed_buf
mbedtls_hmac_drbg_self_test
mbedtls_hmac_drbg_set_entropy_len
mbedtls_hmac_drbg_set_prediction_resistance
mbedtls_hmac_drbg_set_reseed_interval
mbedtls_hmac_drbg_update
mbedtls_hmac_drbg_update_seed_file
mbedtls_hmac_drbg_write_seed_file
mbedtls_internal_aes_decrypt
mbedtls_internal_aes_encrypt
mbedtls_md
mbedtls_md5
mbedtls_md5_clone
mbedtls_md5_finish
mbedtls_md5_free
mbedtls_md5_info
mbedtls_md5_init
mbedtls_md5_process
mbedtls_md5_self_test
mbedtls_md5_starts
mbedtls_md5_update
mbedtls_md_clone
mbedtls_md_file
mbedtls_md_finish
mbedtls_md_free
mbedtls_md_get_name
mbedtls_md_get_size
mbedtls_md_get_type
mbedtls_md_hmac
mbedtls_md_hmac_finish
mbedtls_md_hmac_reset
mbedtls_md_hmac_starts
mbedtls_md_hmac_update
mbedtls_md_info_from_string
mbedtls_md_info_from_type
mbedtls_md_init
mbedtls_md_init_ctx
mbedtls_md_list
mbedtls_md_process
mbedtls_md_setup
mbedtls_md_starts
mbedtls_md_update
mbedtls_mpi_add_abs
mbedtls_mpi_add_int
mbedtls_mpi_add_mpi
mbedtls_mpi_bitlen
mbedtls_mpi_cmp_abs
mbedtls_mpi_cmp_int
mbedtls_mpi_cmp_mpi
mbedtls_mpi_copy
mbedtls_mpi_div_int
mbedtls_mpi_div_mpi
mbedtls_mpi_exp_mod
mbedtls_mpi_fill_random
mbedtls_mpi_free
mbedtls_mpi_gcd
mbedtls_mpi_gen_prime
mbedtls_mpi_get_bit
mbedtls_mpi_grow
mbedtls_mpi_init
mbedtls_mpi_inv_mod
mbedtls_mpi_is_prime
mbedtls_mpi_lsb
mbedtls_mpi_lset
mbedtls_mpi_mod_int
mbedtls_mpi_mod_mpi
mbedtls_mpi_mul_int
mbedtls_mpi_mul_mpi
mbedtls_mpi_read_binary
mbedtls_mpi_read_file
mbedtls_mpi_read_string
mbedtls_mpi_safe_cond_assign
mbedtls_mpi_safe_cond_swap
mbedtls_mpi_self_test
mbedtls_mpi_set_bit
mbedtls_mpi_shift_l
mbedtls_mpi_shift_r
mbedtls_mpi_shrink
mbedtls_mpi_size
mbedtls_mpi_sub_abs
mbedtls_mpi_sub_int
mbedtls_mpi_sub_mpi
mbedtls_mpi_swap
mbedtls_mpi_write_binary
mbedtls_mpi_write_file
mbedtls_mpi_write_string
mbedtls_oid_get_attr_short_name
mbedtls_oid_get_cipher_alg
mbedtls_oid_get_ec_grp
mbedtls_oid_get_extended_key_usage
mbedtls_oid_get_md_alg
mbedtls_oid_get_numeric_string
mbedtls_oid_get_oid_by_ec_grp
mbedtls_oid_get_oid_by_md
mbedtls_oid_get_oid_by_pk_alg
mbedtls_oid_get_oid_by_sig_alg
mbedtls_oid_get_pk_alg
mbedtls_oid_get_pkcs12_pbe_alg
mbedtls_oid_get_sig_alg
mbedtls_oid_get_sig_alg_desc
mbedtls_oid_get_x509_ext_type
mbedtls_padlock_has_support
mbedtls_padlock_xcryptcbc
mbedtls_padlock_xcryptecb
mbedtls_pem_free
mbedtls_pem_init
mbedtls_pem_read_buffer
mbedtls_pem_write_buffer
mbedtls_pk_can_do
mbedtls_pk_check_pair
mbedtls_pk_debug
mbedtls_pk_decrypt
mbedtls_pk_encrypt
mbedtls_pk_free
mbedtls_pk_get_bitlen
mbedtls_pk_get_name
mbedtls_pk_get_type
mbedtls_pk_info_from_type
mbedtls_pk_init
mbedtls_pk_load_file
mbedtls_pk_parse_key
mbedtls_pk_parse_keyfile
mbedtls_pk_parse_public_key
mbedtls_pk_parse_public_keyfile
mbedtls_pk_parse_subpubkey
mbedtls_pk_setup
mbedtls_pk_setup_rsa_alt
mbedtls_pk_sign
mbedtls_pk_verify
mbedtls_pk_verify_ext
mbedtls_pk_write_key_der
mbedtls_pk_write_key_pem
mbedtls_pk_write_pubkey
mbedtls_pk_write_pubkey_der
mbedtls_pk_write_pubkey_pem
mbedtls_pkcs12_derivation
mbedtls_pkcs12_pbe
mbedtls_pkcs12_pbe_sha1_rc4_128
mbedtls_pkcs5_pbes2
mbedtls_pkcs5_pbkdf2_hmac
mbedtls_pkcs5_self_test
mbedtls_platform_entropy_poll
mbedtls_platform_set_snprintf
mbedtls_platform_setup
mbedtls_platform_teardown
mbedtls_platform_win32_snprintf
mbedtls_ripemd160
mbedtls_ripemd160_clone
mbedtls_ripemd160_finish
mbedtls_ripemd160_free
mbedtls_ripemd160_info
mbedtls_ripemd160_init
mbedtls_ripemd160_process
mbedtls_ripemd160_self_test
mbedtls_ripemd160_starts
mbedtls_ripemd160_update
mbedtls_rsa_alt_info
mbedtls_rsa_check_privkey
mbedtls_rsa_check_pub_priv
mbedtls_rsa_check_pubkey
mbedtls_rsa_copy
mbedtls_rsa_free
mbedtls_rsa_gen_key
mbedtls_rsa_info
mbedtls_rsa_init
mbedtls_rsa_pkcs1_decrypt
mbedtls_rsa_pkcs1_encrypt
mbedtls_rsa_pkcs1_sign
mbedtls_rsa_pkcs1_verify
mbedtls_rsa_private
mbedtls_rsa_public
mbedtls_rsa_rsaes_oaep_decrypt
mbedtls_rsa_rsaes_oaep_encrypt
mbedtls_rsa_rsaes_pkcs1_v15_decrypt
mbedtls_rsa_rsaes_pkcs1_v15_encrypt
mbedtls_rsa_rsassa_pkcs1_v15_sign
mbedtls_rsa_rsassa_pkcs1_v15_verify
mbedtls_rsa_rsassa_pss_sign
mbedtls_rsa_rsassa_pss_verify
mbedtls_rsa_rsassa_pss_verify_ext
mbedtls_rsa_self_test
mbedtls_rsa_set_padding
mbedtls_set_alarm
mbedtls_sha1
mbedtls_sha1_clone
mbedtls_sha1_finish
mbedtls_sha1_free
mbedtls_sha1_info
mbedtls_sha1_init
mbedtls_sha1_process
mbedtls_sha1_self_test
mbedtls_sha1_starts
mbedtls_sha1_update
mbedtls_sha224_info
mbedtls_sha256
mbedtls_sha256_clone
mbedtls_sha256_finish
mbedtls_sha256_free
mbedtls_sha256_info
mbedtls_sha256_init
mbedtls_sha256_process
mbedtls_sha256_self_test
mbedtls_sha256_starts
mbedtls_sha256_update
mbedtls_sha384_info
mbedtls_sha512
mbedtls_sha512_clone
mbedtls_sha512_finish
mbedtls_sha512_free
mbedtls_sha512_info
mbedtls_sha512_init
mbedtls_sha512_process
mbedtls_sha512_self_test
mbedtls_sha512_starts
mbedtls_sha512_update
mbedtls_snprintf
mbedtls_strerror
mbedtls_timing_alarmed
mbedtls_timing_get_delay
mbedtls_timing_get_timer
mbedtls_timing_hardclock
mbedtls_timing_self_test
mbedtls_timing_set_delay
mbedtls_version_check_feature
mbedtls_version_get_number
mbedtls_version_get_string
mbedtls_version_get_string_full
mbedtls_xtea_crypt_cbc
mbedtls_xtea_crypt_ecb
mbedtls_xtea_free
mbedtls_xtea_init
mbedtls_xtea_self_test
mbedtls_xtea_setup
Name
.text
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
310KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/89
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
bin/tools/magick.exe
- IMPHASH e36aef61183a663a8d2496a5a5b18077
- SHA256 c9e972af0b6bfba0243618fe9144bc103d1a14078394f05682461867abbc5d9d
- MD5 86c81931d2d1b183e7debfd565f8c867
- SHA1 d2500e6fa1a2a1469490e8bc7dd36107cbcceede
- SHA512 a8ed9cdce06bd0a2285a055edefcdbdbab79b4b82a09fa42bf09bc7ffbbe6260c3ae600113d56a9dfd49ade4ab359d748d2217e9229e8238eff05e7443f63fe4
- SSDEEP 393216:s4WSKJ1GeS2f12pywmI7/XLbXLRjELT3cxiCV:X0mR7
- TLSH T173379F03A26014E5D577C038CE6B6717EBB1786907B157E727A846DA2F2BBE0393B701
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d2:6c:31:95:3f:2c:9c:03:ca:6b:62:a9:e7:7e:4d:99:45:3f:cf:4a:d1:a0:00:93:00:86:8b:c3:6c:29:b2:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,ST=Pennsylvania,C=US
Chains
Jan 22, 2023
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,ST=Pennsylvania,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,ST=Pennsylvania,C=US
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,ST=Pennsylvania,C=US
Serial Number
e4:24:b6:4c:66:e5:e9:e4:77:56:08:ac:4c:4a:41:3d
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 27, 2022 - Oct 27, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
3342240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
htons
ntohs
WSASetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
ntohl
WSAGetLastError
ioctlsocket
htonl
WSASetLastError
getservbyport
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
inet_ntop
inet_pton
getservbyname
freeaddrinfo
getaddrinfo
socket
setsockopt
send
recv
listen
connect
closesocket
bind
accept
WSACleanup
WSACloseEvent
WSAStartup
gdiplus
GdipGetImageVerticalResolution
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectI
GdipLoadImageFromFile
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGraphicsClear
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
urlmon
URLDownloadToFileA
kernel32
GetStartupInfoA
FindResourceA
SystemTimeToFileTime
SetConsoleCtrlHandler
SetConsoleOutputCP
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
LoadLibraryA
GetLogicalDrives
CreateThread
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
SetEnvironmentVariableA
CreateFileW
SetFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleOutputCP
GetFileAttributesExW
GetDriveTypeW
GetFullPathNameW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
DeleteFileW
MoveFileExW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetTempPathW
CreateFileMappingA
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
LoadResource
GetFileSizeEx
HeapReAlloc
HeapSize
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
LoadLibraryExW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
FreeResource
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetVersionExA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GlobalMemoryStatusEx
CreateProcessA
GetExitCodeProcess
FormatMessageA
GetCurrentProcess
GetProcessTimes
WaitForSingleObject
QueryPerformanceFrequency
QueryPerformanceCounter
PeekNamedPipe
CreatePipe
SetErrorMode
GetLastError
SetUnhandledExceptionFilter
SetHandleInformation
CloseHandle
SetEndOfFile
ReadFile
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetShortPathNameW
LocalFree
SizeofResource
FlsAlloc
LockResource
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
GetDriveTypeA
SignalObjectAndWait
InitializeCriticalSection
ReleaseMutex
CreateMutexA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
SetThreadPriority
GetThreadPriority
ResumeThread
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetFileInformationByHandleEx
SetConsoleMode
DebugBreak
GetSystemDirectoryW
GetWindowsDirectoryW
CreateEventA
GetVersion
LoadLibraryW
FormatMessageW
GetLocaleInfoA
GetThreadLocale
IsDBCSLeadByteEx
GetFileAttributesW
SetEvent
ResetEvent
ReadConsoleInputA
PeekConsoleInputA
DuplicateHandle
DeviceIoControl
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
SetFileAttributesW
GetTickCount
GetFileTime
ExitThread
FreeLibraryAndExitThread
RemoveDirectoryW
GetNumberOfConsoleInputEvents
SwitchToThread
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
InitializeCriticalSectionEx
DecodePointer
LCMapStringEx
SleepConditionVariableCS
GetOEMCP
user32
SystemParametersInfoA
ReleaseDC
FillRect
PeekMessageA
GetDC
MsgWaitForMultipleObjectsEx
MessageBoxA
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
EnumDisplayDevicesA
PostMessageA
gdi32
SetGraphicsMode
RestoreDC
GetGlyphIndicesW
SetBkMode
GetOutlineTextMetricsA
SetMapMode
SetTextColor
SetTextAlign
GetTextMetricsA
SetWorldTransform
ModifyWorldTransform
ExtTextOutW
CreateCompatibleBitmap
CreateRectRgn
ExtCreateRegion
GetClipBox
GetFontUnicodeRanges
GetGlyphOutlineW
GetFontData
EnumFontFamiliesExW
GetGlyphOutlineA
GetCharWidth32A
SaveDC
CreateDCA
CreateDIBSection
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
GetClipRgn
GetGraphicsMode
IntersectClipRect
SelectClipRgn
ExtSelectClipRgn
GetWorldTransform
GdiFlush
CreateSolidBrush
StretchDIBits
CreateFontIndirectW
advapi32
DeregisterEventSource
ReportEventA
RegGetValueW
GetSecurityInfo
RegLoadMUIStringW
RegOpenKeyExW
GetUserNameW
RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
CryptAcquireContextA
CryptReleaseContext
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetFileSecurityW
RegEnumKeyExW
CryptGenRandom
RegEnumValueW
RegisterEventSourceA
bcrypt
BCryptDeriveKeyPBKDF2
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptSetProperty
shell32
SHGetFileInfoW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32
CoTaskMemFree
CoGetObjectContext
CoGetApartmentType
dnsapi
DnsFree
DnsQuery_A
iphlpapi
GetIpForwardTable2
NotifyRouteChange2
CancelMibChangeNotify2
Name
.text
Size
14.3MB
Virtual Size
14.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
397KB
Virtual Size
804KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
517KB
Virtual Size
517KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=259, version=30795,
count=242, id=261, version=30795,
count=21, id=253, version=31823,
count=103, id=261, version=31823,
count=20, id=260, version=31823,
count=14, id=259, version=31823,
count=27, productName=Unmarked objects (old),
count=65, id=260, version=30795,
count=368, id=261, version=31937,
count=1, id=259, version=31937,
count=25, id=257, version=30795,
count=427, id=1, productName=Unmarked objects,
count=1437, id=260, version=31937,
count=1, id=255, version=31937,
count=1, id=151,
count=1, id=258, version=31937,
bin/tools/orbis-pub-cmd.exe
- IMPHASH 94e6bdca62437d968ae6e6ded61ddd89
- SHA256 10f39b739b9d146f3d447ae2bc3a8c66e9d76181a35413bc42c3c25cb317a864
- MD5 75cc4073efe568e64623c3be960b3d63
- SHA1 d27c24bb98f874706e50e8871a523876c8f5c7ab
- SHA512 4a7ac6b08c6354bb59a0aac921d29098807f60939d245aade8c32243e6d945e194ae8b0b680f0d1f42f2397a0088e478b10e5ab82ed9477d2bf0e337fd08ca87
- SSDEEP 49152:HkuvAQSB4XtnQV8WueT6Ki+ypKtA0Rgt0ArZlw0grOTYm8k3asYIMNna:E0nQVKzUTWt0ArZGN
- TLSH T105E5B042FBC780F1ED47167611ABA76A9E36A3160334D9C3E3A82E554D113E16B3F389
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
1608552
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
FlushConsoleInputBuffer
GlobalMemoryStatus
CopyFileA
SetLastError
GetFileType
GetVersion
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
TlsAlloc
ReleaseMutex
TlsSetValue
GetCurrentThread
InterlockedCompareExchange
InterlockedIncrement
TlsGetValue
CreateMutexW
GetVolumeNameForVolumeMountPointA
SetFilePointer
GetTempPathA
GetModuleFileNameA
DuplicateHandle
CreatePipe
GetStdHandle
GetExitCodeProcess
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetSystemTime
GetCurrentProcessId
GetCurrentThreadId
GetSystemInfo
CreateEventW
GetLocalTime
GetEnvironmentVariableA
CreateProcessA
SetEvent
WaitForSingleObject
GetFileSizeEx
ReadFile
WriteFile
DeleteFileA
CloseHandle
GetDiskFreeSpaceExA
GetFileTime
FindNextFileA
DeviceIoControl
MoveFileA
FindClose
RemoveDirectoryA
GetLastError
FindFirstFileA
CreateDirectoryA
FileTimeToSystemTime
GetFileAttributesA
Sleep
SetFileTime
SetFilePointerEx
SystemTimeToFileTime
SetEndOfFile
GetFileSize
CreateFileA
GetFullPathNameA
GlobalFree
WideCharToMultiByte
LoadLibraryA
GetProcAddress
FreeLibrary
msvcr90
_CIlog10
floor
_CIsqrt
_CIatan2
_CIcos
_CIpow
_CIsin
_getch
_CxxThrowException
__CxxFrameHandler3
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_vsnprintf
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
ceil
printf
getenv
sscanf
_endthread
_stat64i32
_wstat64i32
_wfopen
realloc
longjmp
abort
memchr
fprintf
calloc
atof
_snprintf
fseek
ftell
fwrite
ferror
_time64
srand
rand
fclose
fread
fopen
_fseeki64
feof
_ftelli64
malloc
free
strtoul
strrchr
strncpy
_beginthread
_errno
strchr
strtok_s
strstr
_strtoi64
_strtoui64
strncmp
memmove
strncat
strtod
vfprintf
signal
fputs
_gmtime64
fflush
__iob_func
vprintf
_stricmp
isupper
_getcwd
memcpy
memset
wcsstr
raise
atoi
isdigit
strcmp
qsort
isspace
_setmode
_fileno
fgets
isxdigit
sprintf
_strnicmp
tolower
??3@YAXPAX@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_purecall
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
memmove_s
toupper
_setjmp3
msvcp90
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Xran@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
winhttp
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
user32
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
advapi32
DeregisterEventSource
RegisterEventSourceA
ReportEventA
shell32
SHGetFolderPathA
ws2_32
htons
closesocket
socket
setsockopt
WSAGetLastError
connect
shutdown
recv
WSASetLastError
send
ntohs
getservbyname
getsockopt
gethostbyname
ioctlsocket
htonl
WSAStartup
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
692KB
Virtual Size
692KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=150, version=20413,
count=14, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=291, id=1, productName=Unmarked objects,
count=17, id=123, productName=VS2005 build 50727, version=50727,
count=460, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=351, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/tools/replhex.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a8c40d718b695adf50fa34bd09efd02195849d522411061f64ccd0285a1ce791
- MD5 42ce1e658be9e2041d37e09e7a591389
- SHA1 e002b3f12ac79b2dc11dc87c5903e3d45f6413e8
- SHA512 552cd2403e9a16d35f8908ff937d5a8d27bf5fb19431726ccd8c79c00df495d7039e304bd449b34796e34ca17f357ef5149f10b42c432e52950a55edfee41ecf
- SSDEEP 96:eGWY52RvYK8JfgegarElr11r0UwTKD2e/zEVhytCtoXbdm2fMrxBNKFzNt:vXcvJ8Olfl5wTKbktoXbsU
- TLSH T145E1B7027FD641AAF57B4A302CF247121739BAD18F36DF6D2981871AAE27714C171F61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\echol\source\repos\replhex\replhex\obj\Release\net6.0\replhex.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/tools/replhex.exe
- IMPHASH 6dbf27f4c70fe2c8ed3e0122ba75d641
- SHA256 9af926594f75b86d66ae356a2f53e2c71e2a64ecea4ce7a374d579b689349e44
- MD5 9228cae18d0fc674ee19add4341f791d
- SHA1 ca4bb6709818c08872ded5f7ebdfddcab1e4a7f6
- SHA512 23bbdec91e870e34fd2d3681790855648c1f56823dd99a1e03b1494608b76c8aadcfd8b2544a82c5384f2ebacfb32b5149117b1442b9c9d787e505e2a125be11
- SSDEEP 3072:o8vbzyQ6Y1YXrbNK+3FNxacPEMk6jRQAATWH:oszAXNK+3FVHRQLTW
- TLSH T155E32817B2AD11FDD1ABE23C89A24A06F7767826473597CF0390463A0F67BE09E79311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
79696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30140,
count=1, id=258, version=30140,
bin/tools/replhex.runtimeconfig.json
- SHA256 ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91
- MD5 24e4653829de1022d01cd7ddd26e2f22
- SHA1 9160a009cb381e044ba4c63e4435da6bfeb9dc6d
- SHA512 efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820
- TLSH T1BCD0A766DD106DB312F517B6D071C583FE20632740145C5574FD590C1F3B6B61012F55
- MD5 SHA1 SHA512 TLSH