spoofer.7z
- SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
Overview
overview
8Static
static
3spoofer.7z
windows10-2004-x64
1spoofer.7z
windows11-ltsc_2024-x64
1bin/Debug/...IN.exe
windows10-2004-x64
3bin/Debug/...IN.exe
windows11-ltsc_2024-x64
3bin/Debug/...s_2.7z
windows10-2004-x64
1bin/Debug/...s_2.7z
windows11-ltsc_2024-x64
1bin/Debug/...nt.dll
windows10-2004-x64
3bin/Debug/...nt.dll
windows11-ltsc_2024-x64
3bin/Debug/...s.json
windows10-2004-x64
3bin/Debug/...s.json
windows11-ltsc_2024-x64
3bin/Debug/...er.exe
windows10-2004-x64
1bin/Debug/...er.exe
windows11-ltsc_2024-x64
1bin/Debug/...er.exe
windows10-2004-x64
8bin/Debug/...er.exe
windows11-ltsc_2024-x64
8bin/Debug/...er.pdb
windows10-2004-x64
3bin/Debug/...er.pdb
windows11-ltsc_2024-x64
3bin/Debug/...g.json
windows10-2004-x64
3bin/Debug/...g.json
windows11-ltsc_2024-x64
3make_icon.ps1
windows10-2004-x64
3make_icon.ps1
windows11-ltsc_2024-x64
3obj/Debug/...tes.cs
windows10-2004-x64
3obj/Debug/...tes.cs
windows11-ltsc_2024-x64
3obj/Debug/...st.exe
windows10-2004-x64
1obj/Debug/...st.exe
windows11-ltsc_2024-x64
1obj/Debug/...er.exe
windows10-2004-x64
1obj/Debug/...er.exe
windows11-ltsc_2024-x64
1obj/Debug/...er.exe
windows10-2004-x64
1obj/Debug/...er.exe
windows11-ltsc_2024-x64
1obj/Debug/...nfo.cs
windows10-2004-x64
3obj/Debug/...nfo.cs
windows11-ltsc_2024-x64
3obj/Debug/....cache
windows10-2004-x64
3obj/Debug/....cache
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
spoofer.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
spoofer.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin/Debug/net10.0-windows/AMIDEWIN.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/Debug/net10.0-windows/AMIDEWIN.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/Debug/net10.0-windows/net10.0-windows_2.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/Debug/net10.0-windows/net10.0-windows_2.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
bin/Debug/net10.0-windows/spoofer.deps.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
bin/Debug/net10.0-windows/spoofer.deps.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral15
Sample
bin/Debug/net10.0-windows/spoofer.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
bin/Debug/net10.0-windows/spoofer.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
make_icon.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
make_icon.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
obj/Debug/net10.0-windows/apphost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
obj/Debug/net10.0-windows/apphost.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
obj/Debug/net10.0-windows/ref/spoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
obj/Debug/net10.0-windows/ref/spoofer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
obj/Debug/net10.0-windows/refint/spoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
obj/Debug/net10.0-windows/refint/spoofer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target spoofer.7z
- Size 716KB
- Sample260729-eafjhsv1bv
- SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
- MD5 11f3fe1a16d72c441965f836db3be5e9
- SHA1 c778f88c5ebf777d30efcaad6686afd95a7f1d48
- SHA512 30178ece8805df527117820e74c0f42e99dc70c44253656de854e77bbdd0d71f9a0426807d67881228f3637a4df8dfbf5e26b980aa7b2855e7f361dd7de6062b
- SSDEEP 12288:LDzMbHGPnKlMirOwpA5X1hEb264ZPG0H8PnK3MJrOgpz5X1hEjZ:fEHnrOwpi1eVM/KrOgpl1ejZ
- TLSH T143F423974E138FCDA79D043583A97A61E60EF73EF64F3F41F0152A81190C0A99991FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 4 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/bin/Debug/net10.0-windows/amifldrv64.sys unpack002/amifldrv64.sys unpack003/amifldrv64.sys unpack004/amifldrv64.sys - Unsigned PE 20 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/Debug/net10.0-windows/AMIDEWIN.EXE unpack001/bin/Debug/net10.0-windows/AMIDEWINx64.EXE unpack002/AMIDEWIN.EXE unpack002/AMIDEWINx64.EXE unpack002/spoofer.dll unpack002/spoofer.exe unpack003/AMIDEWIN.EXE unpack003/AMIDEWINx64.EXE unpack004/AMIDEWIN.EXE unpack004/AMIDEWINx64.EXE unpack004/spoofer.dll unpack004/spoofer.exe unpack003/spoofer.dll unpack003/spoofer.exe unpack001/bin/Debug/net10.0-windows/spoofer.dll unpack001/bin/Debug/net10.0-windows/spoofer.exe unpack001/obj/Debug/net10.0-windows/apphost.exe unpack001/obj/Debug/net10.0-windows/ref/spoofer.dll unpack001/obj/Debug/net10.0-windows/refint/spoofer.dll unpack001/obj/Debug/net10.0-windows/spoofer.dll
File Explorer
-
spoofer.7z.7z 716KB
-
Form1.Designer.cs907B
-
Form1.cs41KB
-
Program.cs440B
-
app.ico766B
-
app.manifest.xml 465B
-
bin/Debug/net10.0-windows/AMIDEWIN.EXE.exe 148KB
-
bin/Debug/net10.0-windows/AMIDEWINx64.EXE.exe 453KB
-
bin/Debug/net10.0-windows/System.Management.dll.dll 72KB
-
bin/Debug/net10.0-windows/amifldrv64.sys.sys 18KB
-
bin/Debug/net10.0-windows/net10.0-windows.7z.7z 338KB
-
AMIDEWIN.EXE.exe 148KB
-
AMIDEWINx64.EXE.exe 453KB
-
System.Management.dll.dll 72KB
-
amifldrv64.sys.sys 18KB
-
runtimes/win/lib/net10.0/System.Management.dll.dll 306KB
-
spoofer.deps.json1KB
-
spoofer.dll.exe 36KB
-
spoofer.exe.exe 159KB
-
spoofer.pdb21KB
-
spoofer.runtimeconfig.json447B
-
bin/Debug/net10.0-windows/net10.0-windows_2.7z.7z 676KB
-
AMIDEWIN.EXE.exe 148KB
-
AMIDEWINx64.EXE.exe 453KB
-
System.Management.dll.dll 72KB
-
amifldrv64.sys.sys 18KB
-
net10.0-windows.7z.7z 338KB
-
AMIDEWIN.EXE.exe 148KB
-
AMIDEWINx64.EXE.exe 453KB
-
System.Management.dll.dll 72KB
-
amifldrv64.sys.sys 18KB
-
runtimes/win/lib/net10.0/System.Management.dll.dll 306KB
-
spoofer.deps.json1KB
-
spoofer.dll.exe 36KB
-
spoofer.exe.exe 159KB
-
spoofer.pdb21KB
-
spoofer.runtimeconfig.json447B
-
runtimes/win/lib/net10.0/System.Management.dll.dll 306KB
-
spoofer.deps.json1KB
-
spoofer.dll.exe 36KB
-
spoofer.exe.exe 159KB
-
spoofer.pdb21KB
-
spoofer.runtimeconfig.json447B
-
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll.dll 306KB
-
bin/Debug/net10.0-windows/spoofer.deps.json1KB
-
bin/Debug/net10.0-windows/spoofer.dll.exe 36KB
-
bin/Debug/net10.0-windows/spoofer.exe.exe 159KB
-
bin/Debug/net10.0-windows/spoofer.pdb21KB
-
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json447B
-
make_icon.ps1.ps1 780B
-
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs200B
-
obj/Debug/net10.0-windows/apphost.exe.exe 159KB
-
obj/Debug/net10.0-windows/ref/spoofer.dll.exe 8KB
-
obj/Debug/net10.0-windows/refint/spoofer.dll.exe 8KB
-
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs1KB
-
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache66B
-
obj/Debug/net10.0-windows/spoofer.GeneratedMSBuildEditorConfig.editorconfig1KB
-
obj/Debug/net10.0-windows/spoofer.GlobalUsings.g.cs305B
-
obj/Debug/net10.0-windows/spoofer.assets.cache1KB
-
obj/Debug/net10.0-windows/spoofer.csproj.AssemblyReference.cache453B
-
obj/Debug/net10.0-windows/spoofer.csproj.CoreCompileInputs.cache66B
-
obj/Debug/net10.0-windows/spoofer.csproj.FileListAbsolute.txt1KB
-
obj/Debug/net10.0-windows/spoofer.dll.exe 36KB
-
obj/Debug/net10.0-windows/spoofer.genruntimeconfig.cache66B
-
obj/Debug/net10.0-windows/spoofer.pdb21KB
-
obj/project.assets.json23KB
-
obj/project.nuget.cache283B
-
obj/spoofer.csproj.nuget.dgspec.json22KB
-
obj/spoofer.csproj.nuget.g.props1KB
-
obj/spoofer.csproj.nuget.g.targets150B
-
spoofer.csproj517B
-
spoofer.csproj.user278B
Form1.Designer.cs
- SHA256 f4ad8e6f46d54b26f79adb0d7135377c84371c860a2c7e4bad134cb9477cda0d
- MD5 7b53427226d8a63613f3ba827168f062
- SHA1 4f7a6cb245ac08c9bad944b8f5bf5bff0c6b6a83
- SHA512 099540b19283884a2c98f18862866f2bb5c2fc0a4b5a5872b6ff287de25f4def5ba4ecd64e28a8ca04611caff793a570963b2ae1f8c75e4ff9ba4c705fe479c7
- TLSH T11511AB2846F4EA381D87E1DC572B35834BE8481BCADACC11B97F47A89FD6120D658DE1
- MD5 SHA1 SHA512 TLSH
Form1.cs
- SHA256 16df0c2c2cdd35be176531569dbdb7b3b20872f63de63b313e7461a75eb3904b
- MD5 82dfa61a60c9af2541914a502600e5b5
- SHA1 45d18bc783a4bc46c40061e8e8024ce5a892f795
- SHA512 8f0db9927b308d8f751421ea575d09638f22512e42ad380dae7968be18ae053f75a82f73757f84b9a32181a1f8a802215acc5401cb2ca4aa6dd44396ce20cbf0
- SSDEEP 768:WN89/yhyryEy9MyNyJybymyryZynXrfpKy+T:9WCX9+mGzA2Arfp+T
- TLSH T1D9137209FEAB45D54EB3E01DCF860A82DF66200B144DE528BEAF51005FC456DDABCBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Program.cs
- SHA256 73f196a19570d2b67f2177b74165b6312285476fed800d24288592954254f162
- MD5 33d6afa73f153837a2ef0fd469fcb77c
- SHA1 06d865023a92ba450908e7fe12b46a519cfafd35
- SHA512 1ed9ef3b091c6dcbe1ce5883cad490026a9b5273000b3c774a4fc124c51f5832b175a8f288d18eeb390f22168e3d8a45e0cf7fa9e20b552c819f915aff4ef9f9
- TLSH T1E6F022C3304988E31EB396FB970AA0C1D5325A3F499AB505F03F43555F364A4671B882
- MD5 SHA1 SHA512 TLSH
app.ico
- SHA256 5a0aa35eb1f468b7a21072fcdf4104d91727ab326c1dbcc2a0ec547a7a679c9f
- MD5 ac5e39c7809070e4d6404425d21f71ab
- SHA1 145ebb835b0d242632a504cc73e084d9237c5058
- SHA512 fd2ea780d8172ce1c39415c027d7c2a4249ffca98a3f6d7445ecc14b524f7b4a83ced96f28caa590cefad66c7ed63c971cb21912e65217f9e9b77cf91b5cc92c
- TLSH T1D5017CD1711A84AFC4F00A31CD87CAF87A153C3D4D21AC0272E07F5F3970302A801669
- MD5 SHA1 SHA512 TLSH
app.manifest
- SHA256 11b4d8f83f8da83f5b6322bd09a069f66bd6b54b4f2ae6835db4177d3e92cb40
- MD5 6755084f1f7d71fdfc6868756e28ef59
- SHA1 caa7ddc7abbb12a9a5736bafc89e6cfcc57ba4ec
- SHA512 fca5a10c64bb023d66d64e904821c9cb5f4fcda750f3362188100f780be806a6f4f46db81c57cda3dbbbde9a1a28e109dbce16c57b13226215d7cc9a07451735
- TLSH T143F05CC1E294E21BD70051912B66612813A95357209E45ECB1DC9EBEAB49AC6C5C31F4
- MD5 SHA1 SHA512 TLSH
bin/Debug/net10.0-windows/AMIDEWIN.EXE
- IMPHASH e4bef79f59242df9daf28c2c8193c40e
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
CopyFileA
GetCurrentProcess
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
Sleep
GetVersionExA
DeviceIoControl
GetLastError
SetFilePointer
WriteFile
ReadFile
CreateFileA
SetProcessAffinityMask
CloseHandle
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
DeleteFileA
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FlushFileBuffers
GetProcAddress
GetFullPathNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetDriveTypeA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
user32
wsprintfA
advapi32
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
OpenSCManagerA
CloseServiceHandle
ControlService
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=12, version=7291,
count=17, id=14, version=7299,
count=100, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=19, version=8034,
count=85, id=1, productName=Unmarked objects,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
bin/Debug/net10.0-windows/AMIDEWINx64.EXE
- IMPHASH ed928bd060b03bab412d37a11b9d26a0
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
245880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
DeviceIoControl
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
SetThreadExecutionState
SetConsoleCtrlHandler
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
GetEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
GetVersionExA
LoadLibraryA
GetProcAddress
HeapSize
FreeLibrary
FreeEnvironmentStringsW
shell32
ShellExecuteA
user32
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
CreateWindowExA
wsprintfA
advapi32
ControlService
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
StartServiceA
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=144, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=44, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
bin/Debug/net10.0-windows/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:86:01:e1:1d:41:a5:f4:50:5d:f0:1b:f4:75:70:dd:4f:44:d1:b3:02:8d:67:49:3b:6a:4c:63:4b:08:35:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/Debug/net10.0-windows/amifldrv64.sys
- IMPHASH 363922cc73591e60f2af113182414230
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 21, 2017
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 24, 2014 - Aug 30, 2017
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
1010B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
bin/Debug/net10.0-windows/net10.0-windows.7z
- SHA256 14b5d197ad07d7e649562b23da31c5be4eef9393cf803a2d81cddfa1cf591f1b
- MD5 792b08bd72b17f01d2a6c71d3b9cae81
- SHA1 2a97316598c6dc3386360f5ac0e56a274d16876c
- SHA512 f5aff8dda2c19495f4d0a77aac83525c2afb70bbfa9082a815a717c27c7891290c4265318339a0c501750fe2f71987541f79adea5172bb6690189af5e4f0c830
- SSDEEP 6144:Sd/md5vAHI+z/vQRPnKzw+p6Ew5Qy78lqf6erDitTjCpkGI9P5X1hER/:gG0H8PnK3MJrOgpg5X1hEh
- TLSH T12D7423CB0E075B8DD75E193487AA7A95EB0EB73DDAAF3E41F4502AC1191C0B58901BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
AMIDEWIN.EXE
- IMPHASH e4bef79f59242df9daf28c2c8193c40e
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
CopyFileA
GetCurrentProcess
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
Sleep
GetVersionExA
DeviceIoControl
GetLastError
SetFilePointer
WriteFile
ReadFile
CreateFileA
SetProcessAffinityMask
CloseHandle
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
DeleteFileA
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FlushFileBuffers
GetProcAddress
GetFullPathNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetDriveTypeA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
user32
wsprintfA
advapi32
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
OpenSCManagerA
CloseServiceHandle
ControlService
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=12, version=7291,
count=17, id=14, version=7299,
count=100, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=19, version=8034,
count=85, id=1, productName=Unmarked objects,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
AMIDEWINx64.EXE
- IMPHASH ed928bd060b03bab412d37a11b9d26a0
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
245880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
DeviceIoControl
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
SetThreadExecutionState
SetConsoleCtrlHandler
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
GetEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
GetVersionExA
LoadLibraryA
GetProcAddress
HeapSize
FreeLibrary
FreeEnvironmentStringsW
shell32
ShellExecuteA
user32
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
CreateWindowExA
wsprintfA
advapi32
ControlService
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
StartServiceA
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=144, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=44, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:86:01:e1:1d:41:a5:f4:50:5d:f0:1b:f4:75:70:dd:4f:44:d1:b3:02:8d:67:49:3b:6a:4c:63:4b:08:35:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
amifldrv64.sys
- IMPHASH 363922cc73591e60f2af113182414230
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 21, 2017
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 24, 2014 - Aug 30, 2017
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
1010B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
runtimes/win/lib/net10.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:e5:16:07:80:31:c6:a3:92:f8:d3:bd:26:8b:69:41:fd:f3:f6:d5:36:26:ed:10:4c:a4:22:78:c1:9c:3d:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
309150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.deps.json
- SHA256 2ea9c54b4dbedc2de2b418d0706323559556271dd2680a886faf0af2985a1f79
- MD5 9218656cca300421727f1f9f9a0970d4
- SHA1 83e2d2c5c3e75107fb775c2f58b2b56926eecda6
- SHA512 52f66411264b310e661ee96c960ce3523eb9a604129373c4a0c1724178425945f11ae1c6980e32bdd81e740c039a2c3a914ccfbf819e81f9b602a665b770831d
- TLSH T1C9212726E6884C6705B52777347543A2FA32632BB0441C4A78FCA86CCF77E5B1120F75
- MD5 SHA1 SHA512 TLSH
spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\spoofer\obj\Debug\net10.0-windows\spoofer.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
spoofer.pdb
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
spoofer.runtimeconfig.json
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
bin/Debug/net10.0-windows/net10.0-windows_2.7z
- SHA256 f751063f3f89ec7838d268fb9c8a1cf5d1a53e53692f64bab9e628dc1ebe6e49
- MD5 03815f9eb8bebfc7354853df33370da4
- SHA1 cd9f5e32f1adfa4b340acbde13f0d6d613af06a4
- SHA512 e692c7e2114f6c85ddfe3d1b6399538eb22ca1c7099fd1690cb7bc951ff8b02f3617853a18f6e3e6c4c429e07550e339f0ff6174756e70d91d190bab063d5e2b
- SSDEEP 12288:AG5HmPnK6MJrOkpV5X1hEAXG0H8PnK3MJrOgpg5X1hEMf:B5cIrOkpH1eVM/KrOgpC1eg
- TLSH T16AE423CB5E074B8DD61E1D7483AA39A5EA0EFB3DDA6F3E41F4152AC1191C0B69801BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
AMIDEWIN.EXE
- IMPHASH e4bef79f59242df9daf28c2c8193c40e
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
CopyFileA
GetCurrentProcess
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
Sleep
GetVersionExA
DeviceIoControl
GetLastError
SetFilePointer
WriteFile
ReadFile
CreateFileA
SetProcessAffinityMask
CloseHandle
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
DeleteFileA
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FlushFileBuffers
GetProcAddress
GetFullPathNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetDriveTypeA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
user32
wsprintfA
advapi32
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
OpenSCManagerA
CloseServiceHandle
ControlService
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=12, version=7291,
count=17, id=14, version=7299,
count=100, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=19, version=8034,
count=85, id=1, productName=Unmarked objects,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
AMIDEWINx64.EXE
- IMPHASH ed928bd060b03bab412d37a11b9d26a0
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
245880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
DeviceIoControl
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
SetThreadExecutionState
SetConsoleCtrlHandler
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
GetEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
GetVersionExA
LoadLibraryA
GetProcAddress
HeapSize
FreeLibrary
FreeEnvironmentStringsW
shell32
ShellExecuteA
user32
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
CreateWindowExA
wsprintfA
advapi32
ControlService
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
StartServiceA
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=144, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=44, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:86:01:e1:1d:41:a5:f4:50:5d:f0:1b:f4:75:70:dd:4f:44:d1:b3:02:8d:67:49:3b:6a:4c:63:4b:08:35:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
amifldrv64.sys
- IMPHASH 363922cc73591e60f2af113182414230
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 21, 2017
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 24, 2014 - Aug 30, 2017
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
1010B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
net10.0-windows.7z
- SHA256 14b5d197ad07d7e649562b23da31c5be4eef9393cf803a2d81cddfa1cf591f1b
- MD5 792b08bd72b17f01d2a6c71d3b9cae81
- SHA1 2a97316598c6dc3386360f5ac0e56a274d16876c
- SHA512 f5aff8dda2c19495f4d0a77aac83525c2afb70bbfa9082a815a717c27c7891290c4265318339a0c501750fe2f71987541f79adea5172bb6690189af5e4f0c830
- SSDEEP 6144:Sd/md5vAHI+z/vQRPnKzw+p6Ew5Qy78lqf6erDitTjCpkGI9P5X1hER/:gG0H8PnK3MJrOgpg5X1hEh
- TLSH T12D7423CB0E075B8DD75E193487AA7A95EB0EB73DDAAF3E41F4502AC1191C0B58901BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
AMIDEWIN.EXE
- IMPHASH e4bef79f59242df9daf28c2c8193c40e
- SHA256 948dbd2bc128f8dc08267e110020fee3ff5de17cf4aaef89372de29623af96fa
- MD5 182ec3a59bd847fb1bc3e12a41d48fa6
- SHA1 2f548bceb819d3843827c1e218af6708db447d4b
- SHA512 91ecc5a76edc2aea4219f68569b54d3e9fe15c2a30a146edc0d09e713feaa739a5c1e7dbfa97e60828696078d43d1f8fd3466234525b099ed6e614e854ac6c4c
- SSDEEP 1536:tNFrdLFZ7JxIVhlPBo8Upxwpwf+gHkow3SMT4HOw2htj6oANy/ht+vSMoqEcViWw:Pv7JIhlBAKwf+gWCM4OwyWscSMoqtLe
- TLSH T14AE36C1639D01CB2E861863144B99F21EB37DD38066142A3F79C92D61F897B0AF3D76E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetSystemDirectoryA
CopyFileA
GetCurrentProcess
GetTimeZoneInformation
CreateProcessA
WaitForSingleObject
Sleep
GetVersionExA
DeviceIoControl
GetLastError
SetFilePointer
WriteFile
ReadFile
CreateFileA
SetProcessAffinityMask
CloseHandle
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
DeleteFileA
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FlushFileBuffers
GetProcAddress
GetFullPathNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
RtlUnwind
SetStdHandle
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetDriveTypeA
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetEndOfFile
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
user32
wsprintfA
advapi32
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
OpenSCManagerA
CloseServiceHandle
ControlService
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=12, version=7291,
count=17, id=14, version=7299,
count=100, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=7, id=19, version=8034,
count=85, id=1, productName=Unmarked objects,
count=12, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
AMIDEWINx64.EXE
- IMPHASH ed928bd060b03bab412d37a11b9d26a0
- SHA256 53e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
- MD5 6a6505b2413d2c7b16c6d059448db9e5
- SHA1 dfe6c6b6051c26326a12dc9d0d5701cb4728266c
- SHA512 1c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
- SSDEEP 6144:JIeh4+TOKGuTSuXCJ6AtCoZPhGL/TnJ+z5rsxQhsCI9t/tk7MP:jpPTxXihA+zBhsC2Z
- TLSH T126A4095AEB5220E1D872D1B888815316FA70BC7847349BEB729C85161F736EC9E3DF18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
245880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetFullPathNameA
CloseHandle
Sleep
GetCurrentProcess
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
DeviceIoControl
GetModuleFileNameA
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
GetLastError
CreateMutexA
SetThreadExecutionState
SetConsoleCtrlHandler
ReadFile
WriteFile
CreateNamedPipeA
CreateThread
LocalFree
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
RtlPcToFileHeader
RaiseException
GetEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetStartupInfoW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcessHeap
ReadConsoleW
SetFilePointerEx
HeapReAlloc
GetStringTypeW
CompareStringW
LCMapStringW
SetStdHandle
WriteConsoleW
OutputDebugStringW
CreateFileW
SetEnvironmentVariableA
SetEndOfFile
GetVersionExA
LoadLibraryA
GetProcAddress
HeapSize
FreeLibrary
FreeEnvironmentStringsW
shell32
ShellExecuteA
user32
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterClassExA
MessageBoxA
BlockInput
SystemParametersInfoA
ExitWindowsEx
CreateWindowExA
wsprintfA
advapi32
ControlService
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
CloseServiceHandle
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
StartServiceA
Name
.text
Size
240KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=199, version=41118,
count=52, id=225, version=20806,
count=144, id=224, version=20806,
count=12, id=223, version=20806,
count=1, id=209, version=65501,
count=9, id=203, version=65501,
count=127, id=1, productName=Unmarked objects,
count=44, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 build 21005, version=21005,
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0df38202fc81fac3017d9510cfc22b488f2989a7bec6ab9f88aae1cc739dcde5
- MD5 fd048963edc0e0a2fe8a9ef488ee8a44
- SHA1 524d556e01abe3c078fcd1ee07fb1e2cb3a1917e
- SHA512 9178cf14c68934818cf84e22ded998e917d9ffca7e8c88d3ef6c382413b7ce988d25d04dda687cfa6e4d6872e4f306124eaf938b6f18500e02fc431ca150c437
- SSDEEP 768:h3d7FaaAo2k+jsRaRF1S9h6VkVFxGooZOkiSLJKdbjf3AU+9zVCB:hN7FaaAFk7aRFy6edvoZOxS9yPfV6zIB
- TLSH T11E73A4005FE8571FCAE70672F4B84234EB74B6C72C11DA4B2A3B511D4876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:86:01:e1:1d:41:a5:f4:50:5d:f0:1b:f4:75:70:dd:4f:44:d1:b3:02:8d:67:49:3b:6a:4c:63:4b:08:35:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
amifldrv64.sys
- IMPHASH 363922cc73591e60f2af113182414230
- SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
- MD5 785045f8b25cd2e937ddc6b09debe01a
- SHA1 029c678674f482ababe8bbfdb93152392457109d
- SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
- SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
- TLSH T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 21, 2017
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 24, 2014 - Aug 30, 2017
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
1
Major OS version
6
Entry point
24676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb
ntoskrnl.exe
ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace
hal
HalTranslateBusAddress
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
1010B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=27, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=137, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
runtimes/win/lib/net10.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:e5:16:07:80:31:c6:a3:92:f8:d3:bd:26:8b:69:41:fd:f3:f6:d5:36:26:ed:10:4c:a4:22:78:c1:9c:3d:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
309150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.deps.json
- SHA256 2ea9c54b4dbedc2de2b418d0706323559556271dd2680a886faf0af2985a1f79
- MD5 9218656cca300421727f1f9f9a0970d4
- SHA1 83e2d2c5c3e75107fb775c2f58b2b56926eecda6
- SHA512 52f66411264b310e661ee96c960ce3523eb9a604129373c4a0c1724178425945f11ae1c6980e32bdd81e740c039a2c3a914ccfbf819e81f9b602a665b770831d
- TLSH T1C9212726E6884C6705B52777347543A2FA32632BB0441C4A78FCA86CCF77E5B1120F75
- MD5 SHA1 SHA512 TLSH
spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\spoofer\obj\Debug\net10.0-windows\spoofer.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
spoofer.pdb
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
spoofer.runtimeconfig.json
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
runtimes/win/lib/net10.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:e5:16:07:80:31:c6:a3:92:f8:d3:bd:26:8b:69:41:fd:f3:f6:d5:36:26:ed:10:4c:a4:22:78:c1:9c:3d:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
309150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.deps.json
- SHA256 2ea9c54b4dbedc2de2b418d0706323559556271dd2680a886faf0af2985a1f79
- MD5 9218656cca300421727f1f9f9a0970d4
- SHA1 83e2d2c5c3e75107fb775c2f58b2b56926eecda6
- SHA512 52f66411264b310e661ee96c960ce3523eb9a604129373c4a0c1724178425945f11ae1c6980e32bdd81e740c039a2c3a914ccfbf819e81f9b602a665b770831d
- TLSH T1C9212726E6884C6705B52777347543A2FA32632BB0441C4A78FCA86CCF77E5B1120F75
- MD5 SHA1 SHA512 TLSH
spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\spoofer\obj\Debug\net10.0-windows\spoofer.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
spoofer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
spoofer.pdb
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
spoofer.runtimeconfig.json
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a266b7a856baced0e757caf7c2e71649999f1321e7e6ff5df5bdee477d32a2e
- MD5 6d7348721c70a6121bd9361f8e794b9e
- SHA1 13353b674eb95006dc57034bef7167c6a521ea38
- SHA512 ab6b7d4aee822c0e79a41aeddbad8f4ced132c6fceb800c9278a4ec211ab769901bc86a56135e30098087fe6053eb23b58e1f02084d2e9926e7730170ebecc99
- SSDEEP 6144:WSZQ2/bmbrBsj0G2OkLYOgHynXjmxZtwFs:WSq2/bmbrB8RkLYOgcKxZj
- TLSH T13464061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:e5:16:07:80:31:c6:a3:92:f8:d3:bd:26:8b:69:41:fd:f3:f6:d5:36:26:ed:10:4c:a4:22:78:c1:9c:3d:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 30, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c8:24:3a:c8:1e:4d:93:88:bb:00:00:00:00:01:c8
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1e:a3:ac:a4:6e:39:6f:7c:49:00:01:00:00:02:1e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
309150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/Debug/net10.0-windows/spoofer.deps.json
- SHA256 2ea9c54b4dbedc2de2b418d0706323559556271dd2680a886faf0af2985a1f79
- MD5 9218656cca300421727f1f9f9a0970d4
- SHA1 83e2d2c5c3e75107fb775c2f58b2b56926eecda6
- SHA512 52f66411264b310e661ee96c960ce3523eb9a604129373c4a0c1724178425945f11ae1c6980e32bdd81e740c039a2c3a914ccfbf819e81f9b602a665b770831d
- TLSH T1C9212726E6884C6705B52777347543A2FA32632BB0441C4A78FCA86CCF77E5B1120F75
- MD5 SHA1 SHA512 TLSH
bin/Debug/net10.0-windows/spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\spoofer\obj\Debug\net10.0-windows\spoofer.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bin/Debug/net10.0-windows/spoofer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
bin/Debug/net10.0-windows/spoofer.pdb
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
- SHA256 039a0defb81019310fa2e8a17ef8d2ad086b1a37656149aa598f1f75893f2a22
- MD5 b451096fec6028f9acbd24badac69055
- SHA1 d7d2be96751913015927effb0d58b0ac1d3fd839
- SHA512 cb3e5230de93c3fed5cf8165107de145c613655fbda729e604419a80e3a51431ceaf4e30c92a71fb73a8ffe2c713bd95f8f34abad7e12d0f1bc692fc9886d490
- TLSH T141F0222ACA100DA308B973BAD62AC182FF30432B20141956B5FC081C2FB3A611100F99
- MD5 SHA1 SHA512 TLSH
make_icon.ps1
- SHA256 6d03af647b1d6038e56ad2e26bf3e3fac47082d5f169065a25c4f157eac42ec4
- MD5 908628e9278444944057cfd1f89a8e7a
- SHA1 1e493ca8525fdd5e57e204124ffb3996c1ec1039
- SHA512 4ab1001bc459962aadc5d54a0d3b1f14cc36945657a000642377dae0eec890f0315f187cc3e3fe16e74bca1f482a500cbdfb300b58d31fa70a9a9c3ff6f2ab4b
- TLSH T13201BD60A31BC0D94BA6689933BCDD01C7356211210BFC09BA8FC71BE32F0590A380FA
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
- SHA256 93d67476196ebfc80d1d7d8844b91146cfd678d105f5ce635eb900ca40610c9b
- MD5 8479efdf06e2d26e053d27ffa6964185
- SHA1 5b5f335f3a4f6a9e63fcf9dd2259865be88e19b9
- SHA512 2f51a6612a17528390d0b4a8ce21bfddf3968be2205ca64c8da05cd796ecb3cef47bcbbf0c562a790298c24cbb2ee6c610f810c7f97743bd7b3dab57f973a9e9
- TLSH T1EFD0223CB345973A0A3011C7C801E0C817BD73507A66A8A434FCE00BEE9EA364130AA7
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/apphost.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
- MD5 a54d9cb6d84c6e88440e01df3a4f1024
- SHA1 575ad7eac8126dc9895d75664043d4453b011644
- SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
- TLSH T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
obj/Debug/net10.0-windows/ref/spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 aedb2a645ecb6ef8c4a1a9395bfd2bd76c410ca842ac121cfad6f8ad6c1b8d7c
- MD5 008f1f1929580ab6fc7b7405fe1e4301
- SHA1 817f8b706c8659d3e05438265adad6b5b081cf04
- SHA512 2e4aa6f77eca2e727954a325904ca7a8b58d44e188e2bc821a930f5822a2a6776c2462ac28edddc49d1d88695c53ada1d62944cab49182dd92c40b85ba6a917a
- SSDEEP 96:+j0iOERjjjjjUSbZzOgJXGbG/osFH8WU/8xvb32HLlYR:NFYjjjjjPNOCyoH8sToY
- TLSH T101020FB3F3684226DC650635F962C3512336B9384C461B9B7AC87F0B7E7D3544E62B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.mvid
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
obj/Debug/net10.0-windows/refint/spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 aedb2a645ecb6ef8c4a1a9395bfd2bd76c410ca842ac121cfad6f8ad6c1b8d7c
- MD5 008f1f1929580ab6fc7b7405fe1e4301
- SHA1 817f8b706c8659d3e05438265adad6b5b081cf04
- SHA512 2e4aa6f77eca2e727954a325904ca7a8b58d44e188e2bc821a930f5822a2a6776c2462ac28edddc49d1d88695c53ada1d62944cab49182dd92c40b85ba6a917a
- SSDEEP 96:+j0iOERjjjjjUSbZzOgJXGbG/osFH8WU/8xvb32HLlYR:NFYjjjjjPNOCyoH8sToY
- TLSH T101020FB3F3684226DC650635F962C3512336B9384C461B9B7AC87F0B7E7D3544E62B25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.mvid
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
- SHA256 b9ec3dc45b838c103413f325d62959f7e1d1ce4707244cbb63e0372eb477fb46
- MD5 61e470419ddd30f2797a56c98f380d1d
- SHA1 f747d6afea52259432bc3c2a1c05ffd9872d4fa7
- SHA512 27913c9feac356aa91e9a7d72bc7ba92969e3d74bbdd47c10f044b909a2de82225c383604b354712ec7e31c18659c7715c1c2af8bf5164433509d5b1bc5ac3f6
- TLSH T1012103786E90873ADF01C4C3AC87B1D9C53E3310429D9C1430EC9D07EA2E834416E5A7
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
- SHA256 7e546cea9fde1175b922f41098ff0a43dd950b05dabbd8175a9b134abd448b10
- MD5 3e3e38fe481373751408322c7fe21e83
- SHA1 dfcfb6f0cfa072f43074107cac708b9ea5d8f8cc
- SHA512 751874b4595ecb9b2c7dfd28519d6db8c5194c2605f7d273c22697f55a15bc2ce8c5ee809671733430842ebbc8f4ec28286e0eec3e8b5681a3c11051282968b0
- TLSH T103A022F8C03308208303B2EFC802200E0A0232CCE83A80003020203C08E088C00080C3
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.GeneratedMSBuildEditorConfig.editorconfig
- SHA256 6dfda1492daf76e532500e22c6e01fcfefe77e1c7f9c08816b928bfd26abf7f3
- MD5 2224f00e06ce0e636edf91df93bda849
- SHA1 ae249808bccc456d9654137d360c0667596fc40c
- SHA512 15a58f721dd9b319dc61e2de66f6a071362dac88adb86de9e9f6332897ed602bf5bf22d59bdaa40ef2eb67bac67f0fca237b12da087aa6fbc13358c863f55274
- TLSH T1EF11C770B206FC80D1E221166C79373AD0BC10F969F320A6B3960F055863B5E43B767B
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.GlobalUsings.g.cs
- SHA256 c95ea51a9e8c77e5367f652ede0c8871e7d6413090add59e1b8dd6805ac37e70
- MD5 197595243b8c7777128c3ea17e98ffd3
- SHA1 21a9e2cf2f8bf9ea7957015e81eea6a5497f6789
- SHA512 7e9ad121a0340dd6566fadae966de28a79e1ee9d2208e33301ac34161d69cb490cefeb7dc1df6b0b15a70f76441d99a429fb60ac2f91ee346d475e11dc2259a8
- TLSH T1C9E0243A362AABA81418089CDC05E1B87333E323A2ACCDC87CED5281D95AE0D06B0C65
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.assets.cache
- SHA256 be43d0c0de9753b565373a799997fc269a8a7a71635c198ca7f8f4cda7b6be69
- MD5 4abee4e7f704f1211e97881fa4e1361a
- SHA1 89ee2fae00ab0bfac8d588546c89405b28cd6375
- SHA512 0f43ae71ccdd82433db037221d60941ff92918eec2163a4801fd5b36074eaab47788dc33fe6e6083284febff5918f9244844970e7e7d583cf55f7b5969628001
- TLSH T11D21C611AF459739D4AE393734B592E810B5B392B185BBD63684C930DE73C8B0B67A24
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.csproj.AssemblyReference.cache
- SHA256 bc5bd2ccd59138c3867e8f6680b7f33de55a67c02552273287310b99879bac4b
- MD5 067954485f1d92c95006e4694afb17c9
- SHA1 1063958b250a8f2135190b32debceeb924590929
- SHA512 83b9681c20e553a7e8875cecafdedf3edbdc388c937851e1ebbf9f4fa316dab52de779b8e62fed1abf05ab4a7635a7750f5e981c50647bfb2dff8753a399f258
- TLSH T145F0AB503702822DCAAD9237387503E05375A289EB943B8A3358C358CDB2ACB5B22069
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.csproj.CoreCompileInputs.cache
- SHA256 a29cd466fbbdda054953fa036fc05be2b98e563b982981d6003805f9eaf16671
- MD5 fa63de3cde1aed8130b9a0fe08bd48fc
- SHA1 e2ab25067f78a9cd1725113467e8ed40d27113eb
- SHA512 642cee17ee37c223ada2d8cd37f480683896d8a5a42ff69ef6b2015c61d91bc1689c1614313f2f7f94fc772af982e7eac827c154345a46043a269d062540bf1b
- TLSH T158A002AED5DC1899D5D1069ED88705981317770576596389C52AF00515434F7D432AD0
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.csproj.FileListAbsolute.txt
- SHA256 0541108ff25bf180a20571412c8fb8e71459c2db796c7204fcfd1a9f63c7de5f
- MD5 c8918e53486dca1044777c0ee7316d6e
- SHA1 77bea3911e150c92b77853674594c56871e5570d
- SHA512 5b534c89f74d0a48e6a00046911babd9df825603109d935020fd9b45b87830ded920fe650c885d284b553478ec97df61fcfb0364895978126a27ee6546807de5
- TLSH T14B21C12670F8093184A31C37E29E36EE59E3DE01E946AA8AB01D04EB5427943FDD47F8
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 815ae5c45d45f5817bb8b5d6e593c5186b4dabc07063745be370d43b12175e3e
- MD5 f080e8b923d33efcaf4fa4d2e24d1e3a
- SHA1 78b972031129170254f5d30207fad49160490778
- SHA512 224c4a59623a51338eb991258f180b635221f7fab5e6b46ba3eaa29bb3e74b9f2b0a35c3df69c81af8378cf558597ad85e68b03e13d5481218c5492ede946c29
- SSDEEP 768:0MMOLM7vsP/ft1+W4NtcND1ahhS6kB+J:7t1N4oRAhS6m+J
- TLSH T17EF2F80432F98732E4F88BF5CAB190110BFA792A5D62D70D2DDA30EE1A62F544991F97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\spoofer\obj\Debug\net10.0-windows\spoofer.pdb
mscoree
_CorExeMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
obj/Debug/net10.0-windows/spoofer.genruntimeconfig.cache
- SHA256 414bc26badc1dd4078ef2ea943650a2f82ef2ca0a5f1381ba1b3fcee8d32bc43
- MD5 5da48cd9dd70d34f65518d70e973ab80
- SHA1 4591c3554d5d8f643764e9724da41827efff9a4b
- SHA512 4fc55af6fd320bc1f6a2c7da93d5d385206f776e6740a42dc9ca38e09da2d65ae0cd238e02c85d76c0cda671be768b8dda0d265edf7e1bf284130e79048a29ae
- TLSH T19DA022303C800CA0802B0083C20B0C000A23B0C0E8A000E00CCB80000E0B0000C2AEE2
- MD5 SHA1 SHA512 TLSH
obj/Debug/net10.0-windows/spoofer.pdb
- SHA256 c47bd1c6642e1b8db92004d3a32f4adbefd59d6de0c12e213409dd9927f59bad
- MD5 45bea5b0b9b269fc0d43be286edf1e37
- SHA1 7fdfda32ce8d7ab0a54ad7a4748b6ea0b64193b9
- SHA512 39e42b8cc49d49e3d8849382e71335ba8b88b7384d5b94e7c58a72c4de4f07ee549790d58f65822dc296300c2e850a57aafc9dc2847b41f9986b6658432b1846
- SSDEEP 384:DklYPEbgk8xk5Y1piszFDkas1io12i/sXGTUY7gmv9yV/RU8PmiHIfWl7H5weYIw:AlgEd8xkanJYTrLsRU63rJS1
- TLSH T180A27033E3D5E550C25166725833C34C77B8C7142241DF7AF2C8AA1AED9F7A88BB6260
- MD5 SHA1 SHA512 SSDEEP TLSH
obj/project.assets.json
- SHA256 e4d35de1a32a2d96976f7e55d5a8af9238d1b7db22358b9e356c471e877acea9
- MD5 0b58f433c9a22d748b42ccc211adb397
- SHA1 df4a4fed00e6c4e8a780d30d7d55f662879a3c23
- SHA512 7d0a5d7c355affe75a4827a73650f7b71d07d77af1741de1d288d24e7c75d87c6df2011ec403bb5b89f824bc1f27321f2a785b75c934c46ded0bb3cad85079c6
- SSDEEP 384:wNJzeBdyAlHnpkGkLmGOo+MkEPH/RR1tB89ZaTgAHyPy3AhljZT+N+cb2HAwGUpY:wNJzeBdyAhpkGkyXGv/XVm7jZT+N9
- TLSH T150B2E83BCF647DB214B667469D30C981A36A93CFD0006886B5FD4E68DFE2B4C6625B13
- MD5 SHA1 SHA512 SSDEEP TLSH
obj/project.nuget.cache
- SHA256 2574202ac13c3ba806b668ff57968311f921941297e195b1eee03e78ea918a3d
- MD5 ed320f0475bef4a5845e3e144b8eade3
- SHA1 7590972ba2552ebfc090d08ecc0455b660c140b5
- SHA512 a0eea9340fe12395775dcdf4d588286617091e7679fd745df0c78ee2ec2fb22faf493492b579ff88adfbefa4ac67880f7ea671bf8424f7be7f2e0fa701975bc7
- TLSH T154D0C291E724423AE4F6B62534204452D1613F6B50F01C8B31BA8910A766A9B2DD6AA9
- MD5 SHA1 SHA512 TLSH
obj/spoofer.csproj.nuget.dgspec.json
- SHA256 43e757cdb77c3daa14dfdc19e722023104769549750801e4d5ffd3064bd10bdc
- MD5 1904ae66452d19413e39964533733e6a
- SHA1 ce96ca7f171f1f8f8662835e0d952c3e440fe635
- SHA512 0f2970ee385934ba20ad1b993f09cedbd39e16809fa099a9fe0dff3c61c6f30dca69a0a380a009f31f616808f96225cc43455b1f320a450050341c990c588013
- SSDEEP 384:HnBkGsDOumIWkMkn/HJ5NFZcVRa7gAvyXifIRlDp7+luErOHI4ecJI2Q:HBkGsSH+/HHtObDp7+lR
- TLSH T179A2D93BCF647DB2147657469D30C981A36A93CFD0006886B5FE4E68DFE2B4C6625A13
- MD5 SHA1 SHA512 SSDEEP TLSH
obj/spoofer.csproj.nuget.g.props
- SHA256 b4d9bc6cebbb65c52bb65f4151231a675b64ddd9b678c766ad654ebbe19304e6
- MD5 cfff55a18fef92e7e0704637486b1040
- SHA1 72e8eadff5f1e35edbbe045707426f680088bb0d
- SHA512 e49ffc99590fdc7f5810e2d4a8181e06425c56ca15816def887aba723cb8fbf612827341c6979dd98df2f83f27342fc9482288b95752f4eb6fa8d120e2e01649
- TLSH T1B0218B11C4C4A2A82AEBBD4935EA0C98F87821B23B606498F403C67B1733FA816CF701
- MD5 SHA1 SHA512 TLSH
obj/spoofer.csproj.nuget.g.targets
- SHA256 971cc9b535384849b5c661d776cd7a80833a416265e32e8968e06c367368b8b5
- MD5 05bc08ea387f5f895fb2cf4fa4c4fda5
- SHA1 ed53cf83c80ff11824ec704f6f2d22a04d071197
- SHA512 00e237c906022444faa37d7f291aef9dc0324f1877c4d0f9bca631f93a7ccf800b974b9f1a4139f747f1ce5eacb65dddf7603a14fc0234aa7b1b07bbe25e44a0
- TLSH T1FAC02B92D100DC31BBA01D241378C868F3F632E324A0C0DDE8C0842C62261DA51283A7
- MD5 SHA1 SHA512 TLSH
spoofer.csproj
- SHA256 7c0084df7be4bd35ee45df9cc0ae98ff320a484c43e013960a71ec093bb69696
- MD5 55455fc63bb49ab34819627815566e29
- SHA1 82540e00dcf95f84b1545ce545b661e041e017b4
- SHA512 81c70d54a471261daebc403bed8688370adf481b1aed5504b293a72db18d2131e548232fd6d209ed20751363f15e430bdc9d9235b043e1be71632d730d796370
- TLSH T1D8F09EC294CA37F412B17039D4B7D582DF39C6E724934CE43650E90B6E228940A17757
- MD5 SHA1 SHA512 TLSH
spoofer.csproj.user
- SHA256 3d6b17cfbaff603db720a83180b5826ad667a9277443c4e4a97989af799509b4
- MD5 50d1e7e1b4b4d9bfabef76e929d23721
- SHA1 39af7c32407a1b492e7b7f67db12331cb9b0a975
- SHA512 0b0cad60cf56aa25b237d3b6cf371d5055a972bcb62ecc0d4bcc72c599310ea945fb6567e37c73a14efe4149d307cf7f8216ce0db1596d519a1f536b0884622a
- TLSH T1CAD0971060C0B92263B0897C43998C38FFE9A3F70CE000BAF6CCC54F1B221A0603BB61
- MD5 SHA1 SHA512 TLSH