1b0a284bbbfeb5067964a0a3270a7b63144f7195faa7eeb61267645ad805fd81
- SHA256 1b0a284bbbfeb5067964a0a3270a7b63144f7195faa7eeb61267645ad805fd81
Overview
overview
3Static
static
3AFRemoting...ry.dll
windows10-2004-x64
3AFRemoting...ry.dll
windows11-ltsc_2024-x64
3AgileFrame.Core.dll
windows10-2004-x64
1AgileFrame.Core.dll
windows11-ltsc_2024-x64
1AutoProtocol376.js
windows10-2004-x64
3AutoProtocol376.js
windows11-ltsc_2024-x64
3Common.dll
windows10-2004-x64
3Common.dll
windows11-ltsc_2024-x64
3Communication.dll
windows10-2004-x64
3Communication.dll
windows11-ltsc_2024-x64
3F10哈林补20.xls
windows10-2004-x64
1F10哈林补20.xls
windows11-ltsc_2024-x64
1IrisSkin2.dll
windows10-2004-x64
1IrisSkin2.dll
windows11-ltsc_2024-x64
1Microsoft....el.dll
windows10-2004-x64
1Microsoft....el.dll
windows11-ltsc_2024-x64
1Protocol.dll
windows10-2004-x64
3Protocol.dll
windows11-ltsc_2024-x64
3RibbonMenu...ol.dll
windows10-2004-x64
1RibbonMenu...ol.dll
windows11-ltsc_2024-x64
1TabStrip.dll
windows10-2004-x64
1TabStrip.dll
windows11-ltsc_2024-x64
1TabStripCo...ry.dll
windows10-2004-x64
1TabStripCo...ry.dll
windows11-ltsc_2024-x64
1TermianlSe...st.exe
windows10-2004-x64
3TermianlSe...st.exe
windows11-ltsc_2024-x64
3TermianlSe...st.exe
windows10-2004-x64
3TermianlSe...st.exe
windows11-ltsc_2024-x64
3XPTable.dll
windows10-2004-x64
1XPTable.dll
windows11-ltsc_2024-x64
1找差异.exe
windows10-2004-x64
3找差异.exe
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
AFRemotingServiceLibrary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
AFRemotingServiceLibrary.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
AgileFrame.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AgileFrame.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
AutoProtocol376.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
AutoProtocol376.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Common.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Common.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Communication.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Communication.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
F10哈林补20.xls
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
F10哈林补20.xls
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
IrisSkin2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
IrisSkin2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Microsoft.Office.Interop.Excel.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Protocol.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
Protocol.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
RibbonMenuButtonControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
RibbonMenuButtonControl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
TabStrip.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
TabStrip.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
TabStripControlLibrary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
TabStripControlLibrary.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
TermianlServiceTest.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
TermianlServiceTest.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
TermianlServiceTest.vshost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
TermianlServiceTest.vshost.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
XPTable.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
XPTable.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
找差异.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
找差异.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 1b0a284bbbfeb5067964a0a3270a7b63144f7195faa7eeb61267645ad805fd81
- Size 3.7MB
- Sample260724-npcwlsyeqd
- SHA256 1b0a284bbbfeb5067964a0a3270a7b63144f7195faa7eeb61267645ad805fd81
- MD5 29855ba17e31afa45812982091f8e9d5
- SHA1 f67f0a8987b468d7b6a8631e3dfe42a937641b9c
- SHA512 52440b4337a730d38ec7fb2619920e53f2216f9978c5748ae3eb2303f51cc057c5437f503660e79e78c94d0986e3976f33d8d3e8f5884c53581b2d0f063d50ce
- SSDEEP 98304:B25MAGeEUcO2enhCFnyFGU8K/mIh7LfPHTPyseo36u+T22J6CQhjzL:B2RGvcyyP8K/XNLWseoMTuCQ9zL
- TLSH T11006333BEC3EDB86DFA655B80ABFA26A1CCFE0B769704C734FA687050D1965E1815301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/AFRemotingServiceLibrary.dll unpack001/AgileFrame.Core.dll unpack001/Common.dll unpack001/Communication.dll unpack001/IrisSkin2.dll unpack001/Protocol.dll unpack001/RibbonMenuButtonControl.dll unpack001/TabStrip.dll unpack001/TabStripControlLibrary.dll unpack001/TermianlServiceTest.exe unpack001/XPTable.dll unpack001/找差异.exe unpack001/终端测试服务软件.vshost.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Microsoft.Office.Interop.Excel.dll
File Explorer
-
1b0a284bbbfeb5067964a0a3270a7b63144f7195faa7eeb61267645ad805fd81.zip 3.7MB
-
AFRemotingServiceLibrary.dll.dll 46KB
-
AFRemotingServiceLibrary.pdb113KB
-
AgileFrame.Core.dll.dll 661KB
-
AutoProtocol376.txt.js 52KB
-
ChanConfig.xml.xml 920B
-
Command.xml119KB
-
Common.dll.dll 17KB
-
Common.pdb53KB
-
Communication.dll.dll 25KB
-
Communication.pdb91KB
-
F10哈林补20.xls.xls 76KB
-
IrisSkin2.dll.dll 504KB
-
Microsoft.Office.Interop.Excel.dll.dll 1.0MB
-
Microsoft.Office.Interop.Excel.xml3.4MB
-
ParamData.xml25KB
-
Protocol.dll.dll 493KB
-
Protocol.pdb767KB
-
RibbonMenuButtonControl.dll.dll 36KB
-
TabStrip.dll.dll 48KB
-
TabStripControlLibrary.dll.dll 60KB
-
TermianlServiceTest.exe.exe 3.7MB
-
TermianlServiceTest.exe.config.xml 528B
-
TermianlServiceTest.pdb3.2MB
-
TermianlServiceTest.vshost.exe.exe 21KB
-
TermianlServiceTest.vshost.exe.manifest490B
-
TextBoxInPutConfigDs.xml.xml 923B
-
XPTable.dll.dll 292KB
-
log/log2024-03-13_1.log3KB
-
vssver2.scc966B
-
主站地址.INI141B
-
协议修改记录.txt273B
-
找差异.exe.exe 111KB
-
电能表地址.txt33B
-
终端列表.xls.xls 68KB
-
终端测试服务软件.vshost.exe.exe 5KB
AFRemotingServiceLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e393c3659c9409dbbde5acdc5d10b42acf3f94704348808aba744e8f9bf3807
- MD5 8d59871bd3bf6c37854329084bf3e58c
- SHA1 c0e2f181f189f953dc124d823e0088939dde1384
- SHA512 92614555c87e6dc857e050c1f4f686034d1312542b2a9d40487ff764d1309ee36fa64dee357b9d0485d86919a1b16a8d39419c353ea1c9df8960ee368ebd1a7a
- SSDEEP 768:Ljrusw42CFwElF3jAXJcZxKBgtDHwLBIoTtOtYEEJwU0XHGDqdVc6vIrYOh3D7H:LXusw42CFwEl9jYC7DH8omfuUc2YG6v
- TLSH T1D8234D4927ECB622D9BD0FFFE4B511454371B06B6153FB191EC9A0EA2C637904E04B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\code\git\ZTGWZD3761\2.soft\ChintCommServerRemotingTask\obj\Debug\AFRemotingServiceLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AFRemotingServiceLibrary.pdb
- SHA256 96ed57b9fef94279d030a4cc184a3139306a2e02084f03c35e47e22df382917b
- MD5 c24ece6585ade644b9e9d4ed17cbabb3
- SHA1 1bfe7f32b832a565bf5c7ef1fb941c6c93c55e07
- SHA512 e7cdfbd8d2b0f752815bd32c7671b5059dc9e666a4911fd6ee1f5b775fb8ee448a1c21f8536711810eb56229eaded602073a842ee447859213acd3c3d638d648
- SSDEEP 768:kJzAzLbOgQSsG5ZR96+UlsKImqfxoVMBnzhjHoWWTebzwg8AgvfFCMEikfHuQbBP:jP6QxoenVnaizwygVCnHvO7w70LWFtl
- TLSH T189B32C037B90C933D854CAB882AB4F3D533CE9945B879B8F5799B46D2DF23AA2D45310
- MD5 SHA1 SHA512 SSDEEP TLSH
AgileFrame.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4096cb5f7fcf97e972f67aace8d634fd359a403813598b532d7720336da93572
- MD5 31f2618525e6a59ecc6ba3226b5b8fa3
- SHA1 b651bbd29fefb717cdea0db0c1fb405c0e8cd9cf
- SHA512 8c33c3ed7833e6872c1f7a668ab31e09e84542dda3fa5d749887b2a4714179d392008e4690129b5b87a120cb0877b6eb7245e5e1ef0e53cfbc6eb44bc79abba9
- SSDEEP 6144:Hce6FwHpk8z071k4cR1dt7SWCySvM8fAzEkYqlV4O2U:7j71WM80EZqGU
- TLSH T17EE4F60027ED4629F1FE1FB9A8F183094635FD16AC26D75F6A94B15E2CB2B448C107BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
682206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\工程项目\AgileFrame Data Integration Suite\AgileFrame.Core\obj\Debug\AgileFrame.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
658KB
Virtual Size
658KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AutoProtocol376.txt
- SHA256 c471f20708034698e82568f2eda25fbe34d7120c0d625a059274f39964ec37de
- MD5 a83d192a04b13d461f1f700756da801c
- SHA1 bed9922a918bb4ca12b48c29627f503e8e2d6afa
- SHA512 279f9d7c92196f73b6e54466e0d34d035662121cce3c3c557b4c6d6d27ad0a32b3de2e090092b88eaa4cc91e3a54e37149f117d007dc33aa3072c0f86d74dbaf
- SSDEEP 1536:X/V/Rw9wJwVwJwdwBwvwxwnwlw/whwtcGtNTY/0BCbANedWHiAWKps/eKvUKwY:X/V/Rw9wJwVwJwdwBwvwxwnwlw/whwtq
- TLSH T10C33C081BC46016197B275DC0FD5C21CF661561F66B2EA28FC4C64A4AF7B7B0E2F26A0
- MD5 SHA1 SHA512 SSDEEP TLSH
ChanConfig.xml
- SHA256 211b473d9b11af76adc373bcbe2e5496c2d9f3a360f5cb46aacf395c4ceaf3d4
- MD5 a92efa25455c9283a4fbe7e5acfc4f18
- SHA1 761d6ad555d2287d440ef58719730a63698be9ab
- SHA512 188b7ac70a324e1d492e9d2716b5c69c39e627de9c5d988dd0464e9ddc4df38dee9544454a7a9d361cc7a77cb0c7de6d094284f754fd3a39738ecaeb8d62d874
- TLSH T1FC118C86B5C66B37963450E50419081AFEA85BEB83110A78B2DEC20F4FF58281D87E53
- MD5 SHA1 SHA512 TLSH
Command.xml
- SHA256 c255146ac3fd0836bea79b53e3413bf307bb6a9ef1a39b98f9890bf3ecb76894
- MD5 a8b8d52bf1ed62999fb4343a46d9024e
- SHA1 2271d5e419a99cb6bbbf4c66494476d5744736b7
- SHA512 7a337eb3fd6d59867ddc197189272ba3c337490d43521514fa9c288428efdb4e450cf6aed04be778e8a6e5e0693f1c4b3d348a3b3a98cc77c26d7d6cd9369c19
- SSDEEP 3072:u7tTzBILseM1xTD+bHv5HMu2p2otltIQd/xiyDS:bb
- TLSH T1A9C30738B9D63A8E7136D970950A3861FF4E4F7FE148083372AA599F0F35182A54FA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1d5748dd50f6241efb72c5d29f99612fcb442137d949d26d4ed9eb84848bcf2
- MD5 4d506af7cf612dacc6abbf739234a247
- SHA1 1eadbb97fbe2f36476540e53be405a4baabec021
- SHA512 1c8dfefe421f0f87a57ea31136e3d977c2cd5bb7a6f8e6c020765daf8900d85513104893f75022256e0c1009ae32d3b52bc0c3c86bc126e51c05498a7999fcf3
- SSDEEP 192:OvyQkMmC2lPz9wWPRCj63EaHih++7v9/vihStKir1dirjpVtZMfEEny8wiqji9yw:fQkMSt/PRCjdd71/LtKixdir9rGEiPb
- TLSH T1EC722A18A3D8D936C86D07F594B31390A330F526E883FB6B56D8E1AA2D2771D04627ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\code\git\ZTGWZD3761\2.soft\Common\obj\Debug\Common.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Common.pdb
- SHA256 03b27bc69aeff0a0680e09a824c1c15e4e41def12022caa2ee5ef5e1a0b6766c
- MD5 0c38fbe88f1bf903eb4e796f0764dedc
- SHA1 97b10aebb51fce49036dd3976e0277da303df3e4
- SHA512 d309cd036e873a28bdbda99c89691c12ee9ca90196771a8302478c3783f48215d339637f70887f0dc57a8e78fdcaf6009e57ff81e66515e2367507982580b050
- SSDEEP 768:MhgHKu428VwqNSYw5slEZ4B9tCqajClZ:Sw5sl1rtnaCl
- TLSH T12F335F077B94D973C844CAB819AB9F2E633CED9457828B9F1398F52C2DF239A6D41314
- MD5 SHA1 SHA512 SSDEEP TLSH
Communication.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca0f67fd328ad19ef44d90579845ac3d54b402e15c9925577258c6c486203039
- MD5 f069ff7a86ea2d8daedd1c358b49de4b
- SHA1 08777490bd8b5dff00562f21e86b59da041cfde7
- SHA512 773156358b3aa158c679c198302911a9c110d68c39fdc18d0c4c06610ef904643e4ef7aad23441db23a0ae5a30cb4f44ef233e24b05955f27f976671b3721021
- SSDEEP 384:SOps4jwWGOR0RwZ1EHkKO1JpAyKtQqt/6dqbeTXctVy6U:Xs4jwWFRH1E03qtQqi/
- TLSH T1C5C2E90DA7BC9757C66D03FE68B24101977491237B03F3AB1FD5A0E638677B08A41A9B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\code\git\ZTGWZD3761\2.soft\Communication\obj\Debug\Communication.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Communication.pdb
- SHA256 7d4b0ba65fcab586efdb910ecfb8afb08b7a618143a72bca0ffd905e756a642e
- MD5 c4132758445763062aadd5985a8234d5
- SHA1 4388986b0217de8dc63e1c255c96b94105961b3b
- SHA512 6ce1d014b307bac1a7cdda8fd2618a47b6f8123c14509f1aee8fc35c0866624690259fd91cd7ad385d6a3510a3841cb52c4e28ee9302b393dcbfe55eec204373
- SSDEEP 1536:lpf1uf/NqDXm10eIspgzRbVffnPSPws2r:VudYs0DspSRbVffnPSPws2
- TLSH T19C9350C7B7A0C532D495C67962AB4F1E6334EE988F83575FA3A4B02D2DF23592E46700
- MD5 SHA1 SHA512 SSDEEP TLSH
F10哈林补20.xls
- SHA256 69d10496c07d24b97251f0e06ac79a76fc09fc388b2f40985ea84a2cbad80b2b
- MD5 23b91064be4b793c39872a7c9a46ef96
- SHA1 b3549256a909a4b6916c08fdc07d641cbced2b5a
- SHA512 e36157577ec68a3883a4aadf9788b319cf98a4fd96f7e060adf94991681e93b5694682ad6512a921c95a77c159b9bb722687e69af431dfc5c7876e464040cdaa
- SSDEEP 1536:N7777POmVms4Q5Z+JVKq75RwHllZ95KaNPEH8IHTBE:R9MPO
- TLSH T18273C1C2E3109DE2C13852B4DC5AA6D57B5ABC6305262F231BE9F11FEFE87641C960E1
- MD5 SHA1 SHA512 SSDEEP TLSH
IrisSkin2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f3f34bf408c4e1649c75f571a1b7a865a81a714b91c0e5a73dfed8ad5480bcb
- MD5 7deaf4a6fa52e8d23f75cf998d6cfe2b
- SHA1 61b3df1ba9f9a9e47562fed8415499389f47afee
- SHA512 b6cc28d6bd4f199de146f49578de8a06e0457d0d3127a9acff411c7d75e125e378671dc8a0d85c56d6134c8697e9f6288e9a74134b338af54c23504bc2c9d7e0
- SSDEEP 6144:no8eDxfCtWNx4R9Ro370tXpo2U9/xbLmaHsyPBvMCxBNomN4YH+Us55PKRzdyJr1:o8eDxkX+dNkcjSmiW+Szsvex6fZ
- TLSH T16EB4F504FB90C8B6D52F42B694964BAC33B1D2059E93EB87084873A5DDBF7127F0685B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
505406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
488KB
Virtual Size
485KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Office.Interop.Excel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0584b77828c17ddb9fb51c72a0dcce57bba05ce51b17aa8c1f04e6eb23a4d499
- MD5 bca37d329f34fef20d836b2ec5979220
- SHA1 17d29c58675ab71dcd31d06287bda45a7f4acb39
- SHA512 522d2466470601d01d28df4d2f54e02541c663a7289fdec7e12a7b15f35df94d7d6a7c189b0eca8f64eb2bbf400b6e23ae5f9a8a5f699f7cf044fb5838e813bb
- SSDEEP 24576:fbWtAPahkzulYHy5crGdQ/qx0DeVu/o1U7SRQneNMzqJFG/AJyT8dOXoBar6fwhi:fbWtAPahkzulYHy5crGdQ/qx0DeVu/oh
- TLSH T1AC35C412B75A8521DAD5C33E7C73AF381BBDA12422B4DF17261CB6716F832858D4237A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
24:40:d9:e5:7a:13:67:c9:99:11:87:d6:51:60:73:df:ad:21:4d:a2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 31, 2003
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Subject
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:11:43:00:00:00:00:00:34
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2002 - Nov 25, 2003
Minor OS version
0
Major OS version
4
Entry point
1086222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Office.Interop.Excel.xml
- SHA256 42f765789f61f9c03d4846c983877b95315a40e9fe7888dd6ee740484f5d4482
- MD5 d50d76e9ac3a9440bfa614f69e891861
- SHA1 918cc90437c32eeeb9198fc2275be0f078ca04fd
- SHA512 7d2bc4531e545bc713a3eeba1d8e59572eb01268f081c54c3bddca31b3160cb7dc3b364e70d0b86360fcd751be6497aaeee0ee806fe0af3c14845ace4928611f
- SSDEEP 6144:pJVbZwEp9OgFpb4cxL6UZtwnxWgQFZgPJ45gqCLonJwYdIAihTlp2uFlOHS/hVj5:pJFpb4cxWUZtwnI7UlQUhVjf0o0q
- TLSH T121F5A021E58AED53482601E11C56BD80FE1C49BB1249FD56B48F6CE387EB98BD1FB9C0
- MD5 SHA1 SHA512 SSDEEP TLSH
ParamData.xml
- SHA256 a35bef37a285cecd21d731757c1688fb8075f47729848894ddaebf00f412a65b
- MD5 173092e294020cd0d13396fd27d53ab2
- SHA1 2e392c0c8fd9f8014185c022ae0a5e34c803585b
- SHA512 659ed3e74f0820ddac37170794fbe0b6a1a17c691c939f431bfd96df82b78a0883ea87e137a7f0f48456a66a173d8b147f6269f9f9d9e4202ce915afd9d25c67
- SSDEEP 192:NWQxgTxzqifpoIzH/ZjGm5N0rlo3SiWWqMc96IzbFzKv:NWQxgYGphZ7ylo3zWucMaFuv
- TLSH T1B9C2EE6CF1CAE4B9E17186B95633FB26DF65754B24D80492734322874F3CA4D26EBE02
- MD5 SHA1 SHA512 SSDEEP TLSH
Protocol.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 03d74fe6698c1fdcffd27dcb35c9988b3e3a49ae539b8753e3c7d1b2a0833d3c
- MD5 75362f3db942dc6a4469810ce2587d00
- SHA1 c0741d46be327b5c5df0ad54de0e023a5c772f88
- SHA512 a4a2c2f2899752c662c8499a9f2fa47fd9e6b0338c92a1b76c2797548659fc7f2db3d24eeef82e60756b13e901626a269a8e3935f83d8243c8b6dcba6f69ada6
- SSDEEP 12288:2amfEVO7BuahEw+AAPGZnBcNSDHi2FecMz6HZMQZ8cqu2i:2AVONq/
- TLSH T136B4A355BE2DC611C94AED7F91F296B68676D02F0263FB23CCC5B4B82D3128D5A0588F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
509838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\code\git\ZTGWZD3761\2.soft\Protocol\obj\Debug\Protocol.pdb
mscoree
_CorDllMain
Name
.text
Size
491KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Protocol.pdb
- SHA256 433a9a3697b63284b62234b135b27e62496d8eb678830a29ad7d392fe92a4748
- MD5 c9e0137312a976ebab4d6e1b690c7f43
- SHA1 0abea7bead60f1420270f2e92f026e829f292933
- SHA512 d11157d934ce26f749ef9aba14c8ed2cdffda74367fc08e4ff0b59b7b1f07f76852eda124b73058eaa32d47d3b6ebd27543722309671b4dbfd8bd34c3104648a
- SSDEEP 6144:7W57qbzFVytTy/1kudiHZAh9DGGd7t+TP6UjsEbYFhdAAsadmTVUn62KAQeFlgck:sKV8TyNknQ9ys1OAfyOjWAMQnzlO
- TLSH T181F4B553B582C833C451C2B8037B4F2FC3B8C2A96F4B9B9FA974E55C2ED6757290A254
- MD5 SHA1 SHA512 SSDEEP TLSH
RibbonMenuButtonControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 be1a2a29dc0a89a31c3234f75d27ff62b75ceadd83a9b9f30e73f519ec3b004d
- MD5 8e751e7d715c07e49647344825aa853d
- SHA1 3bc77ce1d5abdee0e42a9c728b7f6ceaf70e9e93
- SHA512 5b02d95698a4b2d518442d6b0f0066ff3b8c6518a42c612b23175f71646069ae4eeadcddf91f595102c30b4954a5236bdc5a4b2d8aab3cc07bc9c0bea8341b0c
- SSDEEP 384:djpKq9DcwaQlJWOFPJBkiJHkMFAhBbl5hLpc5pmN7DOV6Y:djpN9Dc3QljFfBHkMFAh5l5AjmVCV6
- TLSH T10AF21A58B70C8227CB5F4BFCB86237A6137081B67641FBC84DC5A9EE1DD6B940242B97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\RibbonStyle\RibbonMenuButtonControl\RibbonMenuButtonControl\obj\Release\RibbonMenuButtonControl.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TabStrip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d57d5f73609e90255df932d78bca153ee43be61b04bb3b67dc1cadd578eff87
- MD5 209a0be1c57496ee7ba19a2f306a9542
- SHA1 6f62ff0e09bdddb98ec6fa75200e6d4c709d79e0
- SHA512 be85aab02f817dd04642e1cb3e90a409d28ddb4e0315268602c92a4094bcb14163752484b10e26ff7932a04b02472ab8f41f4c2634ca7bd57ea44233f700b695
- SSDEEP 768:2c+hwK8ebxEQeUbJiGuum85nSLHUK2UthTkXB6IstB4bw:2PhwKC+gG4KE2U3Tkhstew
- TLSH T139231804ABE5C73AECEE57BDA492100403F1D283B553E71A2FE920F61C6B7905A517EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Documents and Settings\Administrator\桌面\tab\TabStrip\obj\Debug\TabStrip.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TabStripControlLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee65384da7a50b6c1f24fa657013c92c0414df9c07e022aca51bb8096cd3ea67
- MD5 c6acc3c27e268d16b31e0a6967f1ab97
- SHA1 813d0b6c59c36063d7539b719e5ff1ffc4e9bc9c
- SHA512 d87128958ef51176ba583610ad28c181e7afd9a41c5fff8fbc46fa6b37e2bb05ba8fcdccd221d8c7cf7af51e86a1903f368d0e572149729da3a7cc672e848e1e
- SSDEEP 1536:KfRfhxnKhUxVkUkrebF3NyIolGKN13J9iZb6:K1hxnKhUxtfbdjolGKN13JkZb6
- TLSH T14E53F744669C9FB7EA6E0BFDE0812012137482336663E7D50FD114EA2DBB360C16A7CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
54510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Documents and Settings\Administrator\桌面\UI\Source\Source\TabStripControlLibrary\obj\Debug\TabStripControlLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TermianlServiceTest.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9f39e5bcd4a3646104a240e0b6482d02fa9fb67889945f0b4537dd28a6872a1d
- MD5 927cbf52849dd4e5ca68c68db99ccb38
- SHA1 cece212d53e414216a70dcb4cb2a66e4666e6e99
- SHA512 6af3ace8c906b0cff847efd20f2f9267b67a0fd737fbdb3f0a40f4589b2780f62fef6420bd86810187a0390f51557321f215bf67eaccd272a0f9e554f4fcd0bb
- SSDEEP 49152:CiN6kBs9dUAIz9z+GCkhPHwOeeexsJsgss7gvskaYheo3:xN6kBs9dUAIpZia
- TLSH T1850629901959AEADC97E07FBF2E6605857741322B084C60DCE525CE7AFB2FC12E8B117
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3695638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\code\git\ZTGWZD3761\2.soft\终端测试服务软件\obj\Debug\TermianlServiceTest.pdb
mscoree
_CorExeMain
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TermianlServiceTest.exe.config
- SHA256 aaea5c0f1130637d05dc450b3d76ae4b407e39433fcee4f47d6ace07c970c591
- MD5 fe73706ed6c2531a2901110cee695b3b
- SHA1 8dabb3f621355e4b82668c0b94d7776cf27c2aaa
- SHA512 956fc2af1f56efefc69f1411ccc0e4f2e2279e9c3bffe51275ce57bee9859e3e8fb5c905a8bbd612320ece4522014969196e1b24f9dd61c02fc6cf65fb196926
- TLSH T1C4F05912AD485C67EC316A7F8A354A40EB3C268EB159008CF06503832F7198F01132A1
- MD5 SHA1 SHA512 TLSH
TermianlServiceTest.pdb
- SHA256 77447e41d7ddf7dd3ab1293068bab5beb4282b799d5eea8b6771916ec1e47e10
- MD5 b960c8813d35e6caaf13e41acebf2fd0
- SHA1 e8df12aea8bcc93382c3c818363aea01004ae5c6
- SHA512 09e8b90df63acadf8d2adcadb3c6beb22b2bbcbd74237fb008d10fbc01aabbfb4bf7b26123746e872e07586a4e09be753deea801d625e2c1840d3ff04ab76406
- SSDEEP 24576:pgbotl0rGT4HICkeRsU8iS7Da5WlOy/5liZhepj:kAES7DWOiZhep
- TLSH T117F5B317B980DC72D899C2F903AB4F3E5338D2949B8397CF1BA195BC6EC678A2D45314
- MD5 SHA1 SHA512 SSDEEP TLSH
TermianlServiceTest.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 10318a11a37feaedfff671563c9c7d06ca12b6af956119ad392cd74a453f5530
- MD5 06fae0e5310fd28f842bde1fc9ee67a7
- SHA1 3ec631ab4b8f48d23fdef07715d73d4e4e98ee1d
- SHA512 18d8748d95f25db287da076006b0f3c8a0d06c23788578a1375e04f01a63d48aa35423a0e336f59b65268cc5773275e38f89ef6dd84cc6446dcd35c834713017
- SSDEEP 384:5s8okWdcWg/B0GftpBjV19H3HRN7i1lay6Rj:RovtivHiyy8j
- TLSH T1CCA24B96C77C8243EC935D70A6A5DA837C3CD7C34E21952B0499F6992C833C4EB2492E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
23:c5:49:0e:3f:69:43:95:f5:b8:05:39:c8:cf:0c:ba:60:5c:b4:cb:e1:58:9b:04:6b:69:a9:dc:00:56:55:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
84:5b:7f:13:5b:1a:0d:d4:7e:01:de:b3:04:42:c4:68:b8:c4:34:7d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 23, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:5a:ed:2f:f4:e4:20:99:3f:3a:00:00:00:00:00:5a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 23, 2014 - Aug 23, 2015
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:00:4d:8a:1f:fd:33:2e:37:f1:00:00:00:00:00:00:4d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 23, 2014 - Aug 23, 2015
Minor OS version
0
Major OS version
4
Entry point
11230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\vshost32-clr2.csproj__1926133318\objr\x86\vshost32-clr2.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TermianlServiceTest.vshost.exe.manifest
- SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
- MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
- SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
- SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
- TLSH T1F1F0DCC1D188CA6AD73042A13A66E420A2AD435B19DD49EC74DC2ABB6F0BBC680C30F1
- MD5 SHA1 SHA512 TLSH
TextBoxInPutConfigDs.xml
- SHA256 72b75eb6272a90502d4489ad6f2d40c9cf2337902c1b83657ce13ffd54e6f56d
- MD5 e6e7c2ccf824fa8ea3a3547721d9892a
- SHA1 429f6c322fcc1933185f60007699853824cb7df8
- SHA512 43007dd4eef312d705e42143c90457b7d24393802f2ab8395cca70bbbf6f146d36c33ace18e23419171c1489e22778490bf6835953e18cdb00965fa06a2b3c36
- TLSH T1A311E15178C407869677B17892E0174EECA1238F401A2C41B9FF051F4F3E60A734F163
- MD5 SHA1 SHA512 TLSH
XPTable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 88523f8b35d5b97b802f2bd4daf9858e40cb70c690b8ed6246b31cf2c7edcba4
- MD5 4806ee8ea8cc51948f0b176531b9d7e9
- SHA1 2ae499707bcbb76891c9a79a4d5029769c17a44b
- SHA512 e5e48ffb7a14b5ddb41010ebe70d8127ef55ef95c73fe5f5d1e710d5a6dd82d46dc21cd926d021cf3905745bdf41edadf4ec65b9ba2f354131beba792233d297
- SSDEEP 6144:sNEIkLSHWnRlGORvo1UOyRvmcQVM7cu77jbFJjV/d/9KbiFlZG3M:sNEIT8RlGORv4F2vm3
- TLSH T13C54F8221BAC492BDBAF83BDD05D084447F4E15BB29BFB9E699120FD1C87761C50326B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
log/log2024-03-13_1.log
- SHA256 d1a1d4a8ace5e9b2afa86ec5d66f54b1d35bfe022909f0c8500814c6cf0a5923
- MD5 0cf12fc05827a3bf60ba8cf587fdeeb2
- SHA1 b06bb42af94a3f2374d930b54f6ac394dd1dc069
- SHA512 e09b4df0024f2252ca8ccaef3042b46d1d8d77d63f00f7205bd35e3666f5a6bcc80ca50930d88c144b542b457d451e98b7955deb7785c5e9615584814b67790b
- TLSH T14B71317912A8807611A293AAF30F8558DCB4D66B3631BCA0F974759BDFEA4C4D3267C0
- MD5 SHA1 SHA512 TLSH
vssver2.scc
- SHA256 4ffc010b14c812616ccb4ac907b5495595d55d75afed63bf5919ec16d7ce3807
- MD5 81f98c121a8d9d7567c33a2ae2ec653b
- SHA1 da43bb356c7d645b6b42bd84cbfc31b1b136d5c2
- SHA512 5cb2bc7ba31f22dc456e4ca69df8af462c30daa0348db0341012312d05d332fa7fcd2ccb0d8e0eec89daac264ef628ad1bd1b42b871ed88f565a273ac54767d9
- TLSH T1C011101FE17EC4BDC378E0C500155DBC6D658BCA0C92B941AA35A54C2DDE648E0D0E0E
- MD5 SHA1 SHA512 TLSH
主站地址.INI
- SHA256 747a118b37d41cac5bf0da1a0e31a71f8fddec5b124f93cfff113d188ca17eb0
- MD5 b32ca9115d45b44c711424bfb6a76213
- SHA1 7e24e1786a791d92a13b5cc6ca930103b8e05647
- SHA512 ced8854ee5be0a3b890722c5794c3829bc9b96522e59206ad9485134e2ba6fc33bf84ab50c1c2acbb6f1501dea72c0bfb7d5ea90dedf110588456511fde8e4ae
- TLSH T148C04C8A63B51C7515E666BC64830A6D60CB6F640062260542E5235C4D732D157A9E05
- MD5 SHA1 SHA512 TLSH
协议修改记录.txt
- SHA256 b95d0c66a6df41acb7e9380c0318ef2c09c78ae5478cf252e12e3252b07457a3
- MD5 d6a44777c2c907e3393f259620609f56
- SHA1 82af00acd7b2409f8fbe849714af0915b4704646
- SHA512 cdfba20578f30ac527cf56c5950085348a5d353dca360042a3b654bcbdf869a3434dc427107e8bd707aea0ac561e28f7b8550b7dfc5aa1b0e17a308b96b8ae9b
- TLSH T110D02B871E4800517037D164D2B6C858E5D0B1D3554EB151FCD3B8940FD0C9D1CADF92
- MD5 SHA1 SHA512 TLSH
找差异.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 438b68423d0a519cdd1b8a61538eac65881610cff9fb0841fca5abda870b9c5d
- MD5 9471ee47e43cbfa1d2d342b240c46b25
- SHA1 55aa8a72b69b711290b1a41773a2cd9cebf6fe96
- SHA512 feebe0df8fd9a9cce2dcdc34c7457c42720cbb54bcf857f9415c9d1d0443bb9625321168c3d0918e3f9cce32296b2318d236b3f9b38024528342b6c060758a0c
- SSDEEP 1536:+f8X+1d/Ur5S9Rh5YjtWWPEubcGYa2s8X+1d/Ur5S9Rh5YjFWWPEubc:+vUe5YVEubcGYiHUe5YlEubc
- TLSH T17AB3D031023C824CC33917F3858AE731BFBA8F75D278D69A1E45F59F8A5A2920571C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
F:\万超鹏\VSS\终端测试服务软件V1.00\找差异\找差异\obj\x86\Debug\找差异.pdb
mscoree
_CorExeMain
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
电能表地址.txt
- SHA256 78b19951265db2b774a7c5852e1b9b3c4537aaf5e469bc805f5469daed6cf953
- MD5 e70451e795c3df2442497d649b2494dc
- SHA1 ad725218fcfcb2724e62247eb283a83fd38e2c91
- SHA512 879f405e6ae487a821d2f3ac3c5be442cc155e4f001a35c48099e91486ee7846bb40a28f4e2b65b1335a07735c684a52effe65be485d29ab75870694074c125b
- MD5 SHA1 SHA512
终端列表.xls
- SHA256 25415c3b404a2b19fec2bc2e7a576c53e188169707433cab44fac1d19aeae418
- MD5 7119a841366e27b98b64d67b7b3feaed
- SHA1 a6b07af8b893848f895382de78ff9cf9a83252aa
- SHA512 7344df668540c77a926b078f92c5ef3828ec38215904fa1534895956dcba9da122ed38206405877561280bd3667284314a3a24a306f44ca14983d71f77c0a5eb
- SSDEEP 1536:FgggMVtgOtvzLa6lKOJpgayrVBZ95UbanVWTPjP:agaA/
- TLSH T11263E0C597F5CAD8EB989232486725C11BA3DD006A5947D33D48F13CFF602A8ACE72E5
- MD5 SHA1 SHA512 SSDEEP TLSH
终端测试服务软件.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 07470371b6c705a49965ae5d98e26450b9fef50e4ba4851de91e29e9721ab197
- MD5 d9086aab959707dd1a8643f3df70db9d
- SHA1 31e855c2fbd8f69b0cc149696e3fd9ca887a30c4
- SHA512 7ce65c130e3e13683a0265fb5171d2a869f0c5059ee1e38728736963c832af4cebfe9b2384b7e12beac21f0414c54ed021d331d4f51ebb1ed5f34d6e709eca57
- SSDEEP 48:6PYfPQwY7B/6U7ghNb6REKUh7U2+Ivpo/fD3K/zDbdstXe8ZWfZEpK5zhGB5WguN:BPBYHguj2xvpafD3KrDbdsfWO0VmWgO
- TLSH T100C19716939E833BFDBB8A369CA357403579BE40CC73DB6F49C9424E5C26618D970B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\RTM\vsproject\vshost\vshostneutral\objr\i386\vshost.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ