KeyboardRemapper_v1.1.zip
- SHA256 d8f61b1f5c11ceaded6047fa32be77224f69b269fe61076b31d47244d8823e80
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
KeyboardRemapper_v1.1.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
KeyboardRemapper_v1.1.zip
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target KeyboardRemapper_v1.1.zip
- Size 1.1MB
- Sample260628-stem8ahy6x
- SHA256 d8f61b1f5c11ceaded6047fa32be77224f69b269fe61076b31d47244d8823e80
- MD5 2c976fae0b2bcb3257a654ecbc3f66ad
- SHA1 f230155bb3a789a66cfc35ca0886a9aeeade4586
- SHA512 46494f8fbc7f4f1c70ac520d47af9d51658c31d08d1031be55fc694824eaf27d15aa2ed6ac6ba402c7c317c76d7d489e78b9706f52392ee9393dd89f63df3e43
- SSDEEP 24576:HIX74wRlMSHltSiGaOszPWhIOx9oBlCSt+4luM1HHCiVZOkRS7CG8n6:HIbMSFtS/aVGXx4lCLal3O4S7C6
- TLSH T1A2353317ACDD90F9ABA75B2D055FD610267CBBA364F3EE132F8886F34E410A44690F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/Keyboard remapper.exe unpack002/adonisui.classictheme.dll unpack002/adonisui.dll unpack002/alphafs.dll unpack002/autofac.dll unpack002/castle.core.dll unpack002/costura.dll unpack002/jetbrains.annotations.dll unpack002/longpaths.dll unpack002/mvvm_tools.dll unpack002/settingsmanager.dll unpack002/windowsinput.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/newtonsoft.json.dll
File Explorer
-
KeyboardRemapper_v1.1.zip.zip 1.1MB
-
Keyboard remapper.exe.exe 1.1MB
-
adonisui.classictheme.dll.dll 197KB
-
adonisui.dll.dll 108KB
-
alphafs.dll.dll 359KB
-
autofac.dll.dll 224KB
-
autofac.pdb374KB
-
castle.core.dll.dll 424KB
-
costura.dll.dll 4KB
-
jetbrains.annotations.dll.dll .js 64KB
-
longpaths.dll.dll 6KB
-
mvvm_tools.dll.dll 17KB
-
newtonsoft.json.dll.dll 659KB
-
settingsmanager.dll.dll 9KB
-
windowsinput.dll.dll 22KB
-
Keyboard remapper.exe.config189B
Keyboard remapper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7209fce811c8ffd5cdd4853f99eb9ac6c2c48aea34aaaa8aad43a7fb8d6e9982
- MD5 1f89b9dd0be675cb36f7b9011905414e
- SHA1 b1477c7e7393b13461c54ee86edc0325e3949f43
- SHA512 8e54b64531931b5c9b7221e5ba38e071ca42848211388528fac6de80237de163cc57811f12dad97861427088c76fac7f42995660e372f92543a58dcbaf61419a
- SSDEEP 24576:lu4vF/0g4SHlVGKqkek3XW7I8xpobJ4SN2xsm7H7iyaEOyLZeG8Y:9yg4SFVGpkpqfx2J4/xRP3O+c
- TLSH T17345230772BCC2A9DA6B4B3D486BD19025B8BE5BD973DF13398437DF2E722820650746
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1170350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Files\Programming\C_Sharp\KeyboardRemapper\App\obj\Release\Keyboard remapper.pdb
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
adonisui.classictheme.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f5c2e6f4595c4b05a136565d1708006c3b64e4b4ae54436b191a8a7977220d8b
- MD5 98c2c86b26a7e64dd2708320ce98aaff
- SHA1 8855f1e4d032a99a2299bc1c19db4ff283ee6dc5
- SHA512 7a2d15540c8aaa112043e996b8ab13615c0a5439344ce04d7d633337b8864d076bc6aef54c3c3831afdca10831dd4ae54b5af93b7269c4771559d3c86abdaa01
- SSDEEP 6144:8FyELhmsacVP07aKRLs9ussMKozI5TUuQbp:UyELhmsaOP07aYs9ussMKozI5
- TLSH T1FD1409C42A304D79DA328B7BDED1B8093E39805D92F2A1176DDA3E4CDD9D24B092917F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
206962
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Benutzer\Project0rion\Dokumente\AdonisUI\adonis-ui\AdonisUI.ClassicTheme\obj\Release\AdonisUI.ClassicTheme.pdb
mscoree
_CorDllMain
Name
.text
Size
194KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
adonisui.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 111c0ba26e021de1d73d7434d9f4f67e4da2690b40c1de9921b37d75e7567f0d
- MD5 d9915bdbc7acdd9e6488e5bce7114cab
- SHA1 1cc9ab59850ff0efec785c8e769ac962da310825
- SHA512 3ae288c4334d265e6426cd3f4a3a7263c647013db8f1a633751669900ec1df84363327a5d822958ab6fbfb5977592b36009241110fa95ff79ab3e187d03c61f5
- SSDEEP 3072:7ZEcisSB4S0A0yAbTxin1JzqHf0llbSANWsN:yciso0ANWs
- TLSH T11FB3078833A9492BF3BF47B6847421550F32F6465953870F5ED430EE999BB0E0652BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
116730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Benutzer\Project0rion\Dokumente\AdonisUI\adonis-ui\AdonisUI\obj\Release\AdonisUI.pdb
mscoree
_CorDllMain
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
alphafs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd
- MD5 f2f6f6798d306d6d7df4267434b5c5f9
- SHA1 23be62c4f33fc89563defa20e43453b7cdfc9d28
- SHA512 1f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211
- SSDEEP 6144:QDyJst+jyCnzLp9hvHsPvPvPvS2JQvlojidPp:QDyJsvCnzZf4U1d
- TLSH T11B7429202BEC412EE79D263EE4A16516A776D1C5132FBB89744C9FF76C8738D86012E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
373054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\jjangli\Documents\GitHub\AlphaFS\AlphaFS\obj\Net452\AlphaFS.pdb
mscoree
_CorDllMain
Name
.text
Size
356KB
Virtual Size
356KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
autofac.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 025cb48223418fad11c8a35dbe669d26722d85f8db853a55f12a7ef7b3d64663
- MD5 aef7c46fa8ddd1ff8aa0f66a0e1e4936
- SHA1 bf77193aad5486555bfb203c7f332beb4c2c1b3a
- SHA512 f095533795f255067a131184324d68c40d8831e6ce777017aed71d6972070eab617787851912eaec0ba6a50c9e09bf8659549d0c40ef9b20fc221c195bb22b29
- SSDEEP 6144:LAntoi/LDhJd6C6ETDXzAQLVY1onLyTS:LAn2iffd65kDdv
- TLSH T10524191223FC522ED6FF0B7AB471504147B2F94BB44AEF4E2A8890F95563F905B90A73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
235026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\autofac\src\Autofac\obj\Release\net45\Autofac.pdb
mscoree
_CorDllMain
Name
.text
Size
222KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
autofac.pdb
- SHA256 1af60268ffdacf93e0e6eeb87432097b3efb98ed87fba0033751c941a913dd5c
- MD5 b7e24af0d5e3c509a026dcaf1e1393fb
- SHA1 4f537bc0f127f9459701f8e1e0b84ff79fb0dff0
- SHA512 d16f99e9212e29ffdadd3fbe154dd792563b5a981f6e3f69c764ecdc55184082bf7754179027ef4be18c4f569a64b689356bd9edb4a928be8cd532b08a773d9a
- SSDEEP 6144:DKEJ245YUeU1rF3Xzxk8wbpDWcI4LGcS06e+Hg2TGBsjhh8iI/M6HTjGZs+Nrhl:dPYUPBDxk8U/GcJrIbjhvI/XzOxD
- TLSH T1F284F16AFF246B12CA56203345235711737DE954AF1AD71722EB75B0FCAA7C01EA322C
- MD5 SHA1 SHA512 SSDEEP TLSH
castle.core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1796277a7aa9f2a9835c070d28fed44b3614ca221a2c1affc21a4c4e41194c3f
- MD5 726ab57d22c502a460576f55041a9ce1
- SHA1 04e9c98d812a180d954441f41225ffd6eb6ed60a
- SHA512 2d12178086a6bd835bbe38eb27303e630aa06dcaf229529d303eee90e11ba24fa2eb5c409edd73600844045594175012bbfbe17c3282c585515e838fe6d5dea2
- SSDEEP 6144:FGt/Gt/tvyi2rNJVGlINLvQGrMkwc+HRPyVqRBHItEqZDeF+:kt/9JVGlQLvQrPyVqRBHI5ZiF+
- TLSH T1A794381123EC4B3BE5EF1BBAB87114118BB6E846A67BDB5F1A44A1F90C93B158C40377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
439690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\core\src\Castle.Core\obj\Release\net45\Castle.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
422KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8ac0ae430fbb1af16b923011dd9c02ae5b3d89f2fecaa3e8c7a249f4b0f0c6b7
- MD5 ac10cdf4657b826c3c6d4d247464aee8
- SHA1 1bb14967938d99e768af208fb54668109e81abbb
- SHA512 8f377b31dbdd128322bdec2f566323fea42168c9059ae8d2e953a33ce082d92bfd1b356304a3cc13426d946311f329e5d7c3bd5bff3c1baac1c3528c4e181b78
- TLSH T1D481952293EC0A6AF9770FB29D3A03116775FA21ED33DB2F495561096C273548B32F22
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\costura\Costura\obj\Release\net40\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
jetbrains.annotations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d52e07e6a49c6c023977f5dd17dcac6eb0b7e325c7a6985bbdbb5b7a23bf99ff
- MD5 9bbce539ee4f609549a87a3e8a07b056
- SHA1 af312fce1f5300143ec8546a628fd7871d01fa4b
- SHA512 eb59f3652b1403a85c74e32a37c66ce18436083c9143cbd0f470b414d0890815f65572d05291ed7e732441816bee1dfb396d841fae3b2159d499d4fccd4fe2c4
- SSDEEP 768:nKUPa+gPkKX32yx/QkLuLc88/GFaZKWjo0DP3hfEmaZ7jmGB+EHdyKL3j+LbML/J:nP5PKX3jlGgW+LlPvrq
- TLSH T1EA5320356280D373ED7A43F3DA55F0C68B321066A72BC93176ABC2131B2A954117EE6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
longpaths.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7f476edad7c44c429e5319b8bd363e1b40e6abd174c9d809d7f0177e15a831a
- MD5 961cc3603f05ae89ab8aa42988566b6f
- SHA1 3cdc0c97fa4f6b9100d399aa449e78aca67d0fef
- SHA512 9f29e1e877bbb79dadbc52ba8e5a67c7ae0b21b80d6dcbe74f5ac2db3b921dd07fc374472fdfb2546ebdb8c91035486db15fbe9fb22962dcadc84b1f2376d5d4
- SSDEEP 48:6cMDBC5EqXTOguxDy3/SpCRLjr+nH6OmoEBnEG/dzWzvpNMKF9qjgiVzgPtYhvAo:aYyxD/M+nH6OgOGtO7jq8tB1DHig
- TLSH T1FBC1222057D86572EFEF0B326457D387C230DB70A5AB979F9540F23EA82271C0555BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Files\Programming\Repos\LongPaths\LongPaths\obj\Release\LongPaths.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
mvvm_tools.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 32ed358348158881b02a29be3ba790bddc04f7726696f3f7725a39ef06808d73
- MD5 6c58dce771077640f63914403b443d12
- SHA1 60e929bb4563426861126a09f751ceb13bc8c36a
- SHA512 f2bd879d991ffe195bff370003508e3d457580230da672f60efd7307a15627127f974c9944849de0b1c13d40fe02a9e926151be9b6aaf94fe913c8b62418b96d
- SSDEEP 384:j0Hu2b2YQnvzUxoKtqX2t8KAdlWpTXz06ppyc+FwfBGD8kdl8yuJ4bHbH:gxSXnvzrK8lCh+FkBY8auJ4/
- TLSH T17B823A0DB3A8677DDBFF0375647225508B78E985E8B2D718198C211F3CA3B505E6239B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Files\Programming\MyLang\Libs\MVVM Tools\MVVM Tools\obj\Release\MVVM_Tools.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b66749b81e1489fcd8d754b2ad39ebe0db681344e392a3f49dc9235643bdbd06
- MD5 d827dd8a8c4b2a2cfa23c7f90f3cce95
- SHA1 26c78dad612aff904f216f19f49089f84cc77eb8
- SHA512 9ce24c4497fe614b78b3f2f985cafb817d52f21d090aa23fd87f1a3478135abe95e0abe3557dd3f12a5b3f4c9a09e8337169988314c12c51b4951317e0569787
- SSDEEP 12288:4uLQZbq16LMLq42433d25X8STJmMRv0niBXh8KOBAj0W:4z/LMLq42t5X8STJmMRv0nQHOBAjx
- TLSH T192E45D15A3FC9B26D1EFA3B4B070495587F6F806A6BAE74F4B04E5E92C937408C407A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
e7:f7:51:e6:72:c9:8b:01:74:26:25:32:5b:fe:58:a5:df:cb:23:3c:93:43:64:58:dc:10:9e:40:c8:d1:97:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Jun 25, 2026
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
671750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
649KB
Virtual Size
648KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
settingsmanager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a49de301a2c1f3e8d944e5029934822967ded5ace9a9760945369c805ca5465
- MD5 b158d12c340a53da21fe315a4596af9d
- SHA1 6281f486683816560713102e160890299de33a78
- SHA512 14f833c34854b43630e4ea517cf0d9ff436f0e03c6b2d99a8d40cc49195f492cf993ca67d3f7f00ef6ac8a1e80875bb4e3daba410ec8d6c6aaf9a34ab9a2dc3b
- SSDEEP 192:6X2f3CeaUFnGSegBDqjYHVpFgZnDfGR6s0elvigr:C4CBAGSHBDsYzGxDfGR6svYgr
- TLSH T15412D804A7D84636F9FF0777ECB3164207B1BA81AA33D36E1A84619E1D933401AB17A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Files\Programming\Repos\SettingsManager\SettingsManager\obj\Release\SettingsManager.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
windowsinput.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81110d44256397f0f3c572a20ca94bb4c669e5de89f9348abad263fbd81c54b9
- MD5 d711daf0138d35bdb878e397e0abb7c0
- SHA1 92ad5ed3d195fa60b493948f86caadc6ba6d5076
- SHA512 6302420686f2968a0b00e24d7333bf86ecff62efe7598faaa06b51797d95f667b0c5cbbb3fcb5bc84d322c049249679340d373b807b39431ff5c6a16413f95cd
- SSDEEP 384:e0c3XP4cGqWpMgtZvtxsoOaY2ZXnFq+3xfJBRGCV:dsQtqwMkbvnFqqPgq
- TLSH T1D4A20951D3FD9513DCB9ABBDACE32B005FB0BC562963FB3F111840A42C522506AA537B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\TeamCity\buildAgent\work\1f6e193703b8b174\WindowsInput\obj\Release\WindowsInput.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Keyboard remapper.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- TLSH T17CC080454054BD274D334B1357518539EFB073A36424140CF42FA7560F3114D4657377
- MD5 SHA1 SHA512 TLSH