Inject.zip
- SHA256 6be28be8bce71ebef4d9c025552c4feb399f53b5548f4c5ea97c24b9c016bd20
Password
2026
Overview
overview
10Static
static
3Inject/Louder.exe
windows10-2004-x64
10Inject/Louder.exe
windows11-ltsc_2024-x64
10Inject/Sys...nq.dll
windows10-2004-x64
1Inject/Sys...nq.dll
windows11-ltsc_2024-x64
1Inject/Sys...ol.dll
windows10-2004-x64
1Inject/Sys...ol.dll
windows11-ltsc_2024-x64
1Inject/Sys...ws.dll
windows10-2004-x64
1Inject/Sys...ws.dll
windows11-ltsc_2024-x64
1Inject/Ves...ib.dll
windows10-2004-x64
1Inject/Ves...ib.dll
windows11-ltsc_2024-x64
1Inject/Win...on.dll
windows10-2004-x64
1Inject/Win...on.dll
windows11-ltsc_2024-x64
1Inject/altv amph.dll
windows10-2004-x64
1Inject/altv amph.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Inject/Louder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
60 seconds
Behavioral task
behavioral2
Sample
Inject/Louder.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
12 signatures
60 seconds
Behavioral task
behavioral3
Sample
Inject/System.Data.SQLite.Linq.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral4
Sample
Inject/System.Data.SQLite.Linq.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral5
Sample
Inject/System.Security.AccessControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral6
Sample
Inject/System.Security.AccessControl.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral7
Sample
Inject/System.Security.Principal.Windows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral8
Sample
Inject/System.Security.Principal.Windows.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral9
Sample
Inject/Vestris.ResourceLib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral10
Sample
Inject/Vestris.ResourceLib.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral11
Sample
Inject/WinFormAnimation.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral12
Sample
Inject/WinFormAnimation.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
Behavioral task
behavioral13
Sample
Inject/altv amph.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
60 seconds
Behavioral task
behavioral14
Sample
Inject/altv amph.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
60 seconds
General
- Target Inject.zip
- Size 3.0MB
- Sample260627-ets9qagx4s
- SHA256 6be28be8bce71ebef4d9c025552c4feb399f53b5548f4c5ea97c24b9c016bd20
- MD5 d40f7595fd33764d401bcdfaa5c1c90f
- SHA1 9147d2a3519a1d2975996c31e851ac518d3a793d
- SHA512 9375ea48c1f4d006f79f667e7374a6481af978e6b621ba29080459b00eea29aefb450f5f50a85aeaa892e23b6f611b5360fe7d8c2b070c8aec1ab95b0891af4f
- SSDEEP 98304:2M86Ko3bZZozQc5qJE5dzV+4eyVSPTte7Qpvd:2M86PtZ1G5/+4KLsc1d
- TLSH T1DFE533F46E246604F7AB3CB9E234D352EBA315877AA43016CBD371C4EA61B4DDB08647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Inject/System.Data.SQLite.Linq.dll - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Inject/Louder.exe unpack001/Inject/Vestris.ResourceLib.dll unpack001/Inject/WinFormAnimation.dll unpack001/Inject/altv amph.dll
File Explorer
-
Inject.zip.zip 3.0MB
-
Inject/Louder.exe.exe 462KB
-
Inject/System.Data.SQLite.Linq.dll.dll 196KB
-
Inject/System.Security.AccessControl.dll.dll 30KB
-
Inject/System.Security.Principal.Windows.dll.dll 17KB
-
Inject/Vestris.ResourceLib.dll.dll 76KB
-
Inject/WinFormAnimation.dll.dll 37KB
-
Inject/altv amph.dll.dll 4.6MB
Inject/Louder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c51f7446d749059b4bc67bf9b01576a4992b21457a8a29038c3f325fe97f89f8
- MD5 ed192b7cad6e280cd1bc187307214a13
- SHA1 a001da88228649832db9998732a2a61889c3ef4c
- SHA512 012cdd089ec15bd8ed6d46fdd2d90bb6d99fdd4731600c800d653e7b48f1bb0f16a5a537f7c8a3a69681d5de0c4f5bbb75fe720ed08de2d69626d043e47c96bb
- SSDEEP 6144:+StneXG+TPQN+lqLNGeaWzfifZhAv5XhwL7IJMFjTBWzbSYtYfLOfCBumwbUzAlD:NV2qAy6W6AKdfKKn128
- TLSH T163A43A243FA98E08D580257E455E1A08CBDAD1F1253263033B1AEFA15D459EEDF2D3EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
479198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
460KB
Virtual Size
459KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/System.Data.SQLite.Linq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4fa3cc89f5c3cfa0f794c1f849b0ea8d081e5c0e69d7fb2d834caed08d1140c0
- MD5 bbb0d3ddaaba530dc111e665a4891217
- SHA1 cea5a71ff0305083a9add3c4755a8e54ab10f869
- SHA512 ebf248bb57355de887770d91ea2b40a98e0760335a57dc6ea92ab89e65177cae95eb1c08116855c8eeeca81d4022ccdde2fca7cf34fad68b4ff0e14b74c93b89
- SSDEEP 3072:0Nh7rny2puIm199zIsd9IZ16KP8cfYLcgML3:0b7G2wbdLm6KP8cwO
- TLSH T13E14B725B3F09E31C16B023028B57458ADB082F3737D5188FE9E63AD9F6A91117B7B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
2026
Digest
19:74:b5:53:55:33:c4:62:97:af:ea:b8:18:02:ef:ac:98:60:8a:00:c6:b1:1a:48:ec:49:45:ee:07:93:1e:87:b9:79:5d:16:76:f8:74:aa:98:f0:20:16:38:f5:a9:fd:d8:f2:d2:8c:b2:30:38:e0:4b:aa:af:f5:25:1b:6a:68
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
3f:8f:87:1d:f5:4f:a3:52:19:ab:82:91:cb:f5:8d:99:1b:51:70:a9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
190166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- TLSH T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
26694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
- MD5 be2962225b441cc23575456f32a9cf6a
- SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
- SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
- SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
- TLSH T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
2026
Digest
15:1f:de:b6:f3:56:f1:80:ad:c0:ff:4f:a8:55:41:ad:fa:07:51:b3:2c:1f:9e:57:30:1f:5d:fa:af:6c:1b:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:26:df:ba:4b:22:b9:82:82:07:00:00:00:00:01:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
14422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/WinFormAnimation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9052729b560d819c8d75149b6ca92c48b9e1b1b0ccaa50080a74166db8eaa12
- MD5 16b35ccfcf3e6e97e182d033cb7bb748
- SHA1 dadae07416824b194557ad182546e4faf5775d0f
- SHA512 b652c2eea4ca9da97db7660b8ea3dd43d045f1d0a7302b0d7ec6b09720ff242e8e03401cedb854fe1198f5ebf5d043502ef91ca8cfe03e27d8cb223b34ba5eb7
- SSDEEP 768:LkKguW2jU37VjIOsCF6sxx2trIOvwZw094wM8roBknl+8m3uPezhW:8FljVswHgV4oanlbm+24
- TLSH T1B503082907BCD67AC6AD457DA0C6451087F0D94E3C43C79A6E4CD0F9FD1A7A906823EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
4
Entry point
43878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Personal\Open-Source Projects\WinFormAnimation\WinFormAnimation[master]\WinFormAnimation\obj\Release\net4\WinFormAnimation.pdb
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Inject/altv amph.dll
- IMPHASH d1e5c82599d35fcff495326a816f6454
- SHA256 e026275f60e0004f85c2b58e7ad3c424e88fe011d3df52d8039f10d250c8ef69
- MD5 26386ebc868eedbeb99425281adbab4a
- SHA1 8a8e95cb6415e4a464b1658398fb452912a6ee38
- SHA512 a81c6f88d3864b5f1c35b370fc3231125db043daa04e984e6857cb09718cd30fed0fd1cd06f8f4b018b777da4bc7f01281568b00acb9a201ab6ac33dd2134d9d
- SSDEEP 49152:HS9CBahn6xkwhfdbnuW7Golh2iGym0bbT2WScIEAo9RUnGkaWnTCMf7O1aQGkkTr:E4ZJGoqamab8EAIkL7rkRqN/9Bs
- TLSH T17D26AE42E6AB30B5D2774434D712A21FD2B27C292310DACB33B49A5AAF33BE45D79711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
2026
Minor OS version
0
Major OS version
6
Entry point
1795556
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\alt-v source\ret9.cc - RAGEMP\x64\Release\altv amph.pdb
d3d11
D3D11CreateDeviceAndSwapChain
winmm
PlaySoundA
ntdll
RtlPcToFileHeader
RtlCaptureContext
RtlUnwindEx
VerSetConditionMask
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwind
kernel32
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
Thread32First
Thread32Next
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
DeleteFileW
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
VirtualProtect
FlsGetValue
FlsAlloc
GetExitCodeProcess
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
CreateProcessW
DuplicateHandle
K32GetModuleInformation
ExitThread
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
ExitProcess
LoadLibraryExW
HeapReAlloc
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
HeapAlloc
HeapCreate
VirtualQuery
GetTickCount64
CreateThread
GetCurrentProcess
Sleep
IsThreadAFiber
GetLastError
CloseHandle
UnhandledExceptionFilter
InitializeSListHead
LoadLibraryExA
FindClose
IsBadReadPtr
ConvertThreadToFiber
CreateFiber
DeleteFiber
SwitchToFiber
LocalFree
LocalAlloc
GlobalLock
GlobalUnlock
GlobalAlloc
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
CreateFileA
CreateDirectoryA
SetStdHandle
SetEndOfFile
VirtualFree
VirtualAlloc
GetStringTypeW
GetCPInfo
CompareStringEx
GetSystemInfo
TlsFree
CreateToolhelp32Snapshot
FreeLibraryAndExitThread
DisableThreadLibraryCalls
FlsSetValue
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringEx
DecodePointer
EncodePointer
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetCommandLineW
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetCurrentDirectoryW
IsProcessorFeaturePresent
GetModuleHandleExW
WakeAllConditionVariable
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
CreatePipe
HeapSize
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
GetSystemDirectoryW
LoadLibraryW
GetEnvironmentVariableA
SetLastError
FormatMessageW
MoveFileExW
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
WaitForSingleObjectEx
SleepEx
VerifyVersionInfoW
CreateFileW
GetFileSizeEx
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
RaiseException
FormatMessageA
GetLocaleInfoEx
user32
ScreenToClient
LoadCursorA
ClientToScreen
SetCursor
SetCursorPos
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
DefWindowProcA
CallWindowProcA
RegisterClassExA
CreateWindowExA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetAsyncKeyState
GetSystemMetrics
GetClientRect
MessageBoxA
GetCursorPos
GetWindowLongPtrA
SetWindowLongPtrW
GetClipboardData
advapi32
CryptReleaseContext
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
ConvertSidToStringSidA
GetFileSecurityA
GetSecurityDescriptorOwner
GetLengthSid
FreeSid
CopySid
AllocateAndInitializeSid
CryptAcquireContextW
shell32
SHGetFolderPathA
ShellExecuteA
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
d2d1
ord1
dwrite
DWriteCreateFactory
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
d3dcompiler_43
D3DCompile
bcrypt
BCryptGenRandom
ws2_32
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
WSAGetLastError
ntohs
WSACleanup
htons
socket
getaddrinfo
freeaddrinfo
setsockopt
WSAIoctl
htonl
accept
bind
getsockname
listen
recvfrom
sendto
__WSAFDIsSet
select
connect
recv
getpeername
gethostname
ioctlsocket
getsockopt
WSAStartup
wldap32
ord41
ord301
ord73
ord216
ord14
ord46
ord219
ord117
ord26
ord27
ord145
ord127
ord167
ord142
ord79
ord133
ord147
ord208
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
490KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.1MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=30, id=259, version=30795,
count=228, id=261, version=30795,
count=42, id=260, version=30795,
count=8, id=253, version=33808,
count=17, id=260, version=33808,
count=31, id=260, productName=VS2015 [14.0] build 23026, version=23026,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=36, id=261, productName=VS2019 v16.4.0 build 28314, version=28314,
count=1, id=259, productName=VS2019 v16.4.0 build 28314, version=28314,
count=14, id=259, version=33808,
count=101, id=261, version=33808,
count=27, id=260, version=32822,
count=125, id=260, version=33133,
count=11, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=30, id=257, version=30795,
count=7, id=156, version=21202,
count=383, id=1, productName=Unmarked objects,
count=18, id=261, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,