Sheet rat 2.6 Кастом.zip
- SHA256 631f2db6623cd76e6a9ebaa88c004aeb24577f2acfa1c96484f5e8ed66c724b4
Behavioral task
behavioral1
Sample
Sheet rat 2.6 Кастом.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Sheet rat 2.6 Кастом.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Sheet rat 2.6 Кастом/Stub/ethminer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Sheet rat 2.6 Кастом/Stub/ethminer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Sheet rat 2.6 Кастом/Stub/xmrminer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Sheet rat 2.6 Кастом/Stub/xmrminer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Sheet rat 2.6 Кастом.zip
- Size 47.2MB
- Sample260817-mf433ayvcs
- SHA256 631f2db6623cd76e6a9ebaa88c004aeb24577f2acfa1c96484f5e8ed66c724b4
- MD5 6b59ff40de8680a148935d335b240ea9
- SHA1 70fd7c147ca688aa4eff0f6e170c167e20c5d13a
- SHA512 b6815310769ea30371c79d9f4d1e4cfd87568c80d70dd0ff7635d110892d5bccbc1f4bc002f121cd5cd36456c8aaefaa80d66b68ba816560fcba42d0c9ef9522
- SSDEEP 786432:OX23QgeyHgC2/b4gmV5xlX2V2ZIvgHvuWP7khKOewXwvEVXqLeLwZfh3dE3N6Eli:OX23QghAUgkxlXZWuvuWP1OnAvoqLew9
- TLSH T1E5B733292BEE84C6EAAD407555FF294EDCDCF9ECC509260EE286817E0E589CC4543B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sheetrat
Version
-
2.6
Campaign
-
Sheet_eeexmjphqasgaw
C2
-
dc-income.gl.at.ply.gg:28999
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Plugins/SystemDisable.dll disable_win_def - Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Stub/Client.exe family_sheetrat_v1 - Detects Sheetrat obfuscated V1.8 and higher 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Server.exe family_sheetrat_v4 - Detects Sheetrat obfuscated version 1 IoCs
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Server.exe Sheetrat_v5 - XMRig Miner payload 2 IoCs
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Stub/xmrminer.exe xmrig static1/unpack001/Sheet rat 2.6 Кастом/Stub/xmrminer.exe family_xmrig - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Sheet rat 2.6 Кастом/Stub/sigthief.exe pyinstaller - Unsigned PE 54 IoCs
Checks for missing Authenticode signature.
resource unpack001/Sheet rat 2.6 Кастом/GMap.NET.Core.dll unpack001/Sheet rat 2.6 Кастом/GMap.NET.WindowsForms.dll unpack001/Sheet rat 2.6 Кастом/IconExtractor.dll unpack001/Sheet rat 2.6 Кастом/Ionic.Zip.dll unpack001/Sheet rat 2.6 Кастом/MetroFramework.Design.dll unpack001/Sheet rat 2.6 Кастом/MetroFramework.Fonts.dll unpack001/Sheet rat 2.6 Кастом/MetroFramework.dll unpack001/Sheet rat 2.6 Кастом/NAudio.dll unpack001/Sheet rat 2.6 Кастом/Plugins/AutoRun.dll unpack001/Sheet rat 2.6 Кастом/Plugins/AutoTask.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Chat.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Clipboard.dll unpack001/Sheet rat 2.6 Кастом/Plugins/DDos.dll unpack001/Sheet rat 2.6 Кастом/Plugins/FileManager.dll unpack001/Sheet rat 2.6 Кастом/Plugins/FreendConnect.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Fun.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Images.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Keylogger.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Map.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Message.dll unpack001/Sheet rat 2.6 Кастом/Plugins/MicroPhone.dll unpack001/Sheet rat 2.6 Кастом/Plugins/MinerEtc.dll unpack001/Sheet rat 2.6 Кастом/Plugins/MinerXmr.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Netstat.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Regedit.dll unpack001/Sheet rat 2.6 Кастом/Plugins/RemoteCamera.dll unpack001/Sheet rat 2.6 Кастом/Plugins/RemoteDesktop.dll unpack001/Sheet rat 2.6 Кастом/Plugins/ReverseProxy.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Scheduler.dll unpack001/Sheet rat 2.6 Кастом/Plugins/SendFile.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Service.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Shell.dll unpack001/Sheet rat 2.6 Кастом/Plugins/SpeakBot.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Stealer.dll unpack001/Sheet rat 2.6 Кастом/Plugins/System.dll unpack001/Sheet rat 2.6 Кастом/Plugins/SystemDisable.dll unpack001/Sheet rat 2.6 Кастом/Plugins/TaskMgr.dll unpack001/Sheet rat 2.6 Кастом/Plugins/Uac.dll unpack001/Sheet rat 2.6 Кастом/Plugins/WormJoiner.dll unpack001/Sheet rat 2.6 Кастом/Plugins/WormSMB.dll unpack001/Sheet rat 2.6 Кастом/Server.exe unpack001/Sheet rat 2.6 Кастом/Stub/Client.exe unpack001/Sheet rat 2.6 Кастом/Stub/UserMode.obf.dll unpack001/Sheet rat 2.6 Кастом/Stub/ddb64.dll unpack001/Sheet rat 2.6 Кастом/Stub/ethminer.exe unpack001/Sheet rat 2.6 Кастом/Stub/fds.dll unpack001/Sheet rat 2.6 Кастом/Stub/nvrtc-builtins64_112.dll unpack001/Sheet rat 2.6 Кастом/Stub/nvrtc64_112_0.dll unpack001/Sheet rat 2.6 Кастом/Stub/sigthief.exe unpack001/Sheet rat 2.6 Кастом/Stub/xmrminer.exe unpack001/Sheet rat 2.6 Кастом/Vestris.ResourceLib.dll unpack001/Sheet rat 2.6 Кастом/cGeoIp.dll unpack001/Sheet rat 2.6 Кастом/dnlib.dll unpack001/Sheet rat 2.6 Кастом/protobuf-net.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Sheet rat 2.6 Кастом/Stub/WinRing0x64.sys
File Explorer
-
Sheet rat 2.6 Кастом.zip.zip 47.2MB
-
Sheet rat 2.6 Кастом/ConfigBulid.json1KB
-
Sheet rat 2.6 Кастом/GMap.NET.Core.dll.dll 2.9MB
-
Sheet rat 2.6 Кастом/GMap.NET.WindowsForms.dll.dll 147KB
-
Sheet rat 2.6 Кастом/IconExtractor.dll.dll 10KB
-
Sheet rat 2.6 Кастом/Ionic.Zip.dll.dll 451KB
-
Sheet rat 2.6 Кастом/Maps.json2B
-
Sheet rat 2.6 Кастом/MetroFramework.Design.dll.dll 16KB
-
Sheet rat 2.6 Кастом/MetroFramework.Fonts.dll.dll 656KB
-
Sheet rat 2.6 Кастом/MetroFramework.dll.dll 345KB
-
Sheet rat 2.6 Кастом/NAudio.dll.dll 464KB
-
Sheet rat 2.6 Кастом/Newtonsoft.Json.dll.dll 695KB
-
Sheet rat 2.6 Кастом/Plugins/AutoRun.dll.dll 12KB
-
Sheet rat 2.6 Кастом/Plugins/AutoTask.dll.dll 95KB
-
Sheet rat 2.6 Кастом/Plugins/Chat.dll.dll 14KB
-
Sheet rat 2.6 Кастом/Plugins/Clipboard.dll.dll 9KB
-
Sheet rat 2.6 Кастом/Plugins/DDos.dll.dll 46KB
-
Sheet rat 2.6 Кастом/Plugins/FileManager.dll.dll 495KB
-
Sheet rat 2.6 Кастом/Plugins/FreendConnect.dll.dll 23KB
-
Sheet rat 2.6 Кастом/Plugins/Fun.dll.dll 45KB
-
Sheet rat 2.6 Кастом/Plugins/Images.dll.dll 11KB
-
Sheet rat 2.6 Кастом/Plugins/Keylogger.dll.dll 13KB
-
Sheet rat 2.6 Кастом/Plugins/Map.dll.dll 10KB
-
Sheet rat 2.6 Кастом/Plugins/Message.dll.dll 9KB
-
Sheet rat 2.6 Кастом/Plugins/MicroPhone.dll.dll 507KB
-
Sheet rat 2.6 Кастом/Plugins/MinerEtc.dll.dll 14KB
-
Sheet rat 2.6 Кастом/Plugins/MinerXmr.dll.dll 20KB
-
Sheet rat 2.6 Кастом/Plugins/Netstat.dll.dll 12KB
-
Sheet rat 2.6 Кастом/Plugins/Regedit.dll.dll 266KB
-
Sheet rat 2.6 Кастом/Plugins/RemoteCamera.dll.dll 95KB
-
Sheet rat 2.6 Кастом/Plugins/RemoteDesktop.dll.dll 1.2MB
-
Sheet rat 2.6 Кастом/Plugins/ReverseProxy.dll.dll 14KB
-
Sheet rat 2.6 Кастом/Plugins/Scheduler.dll.dll 353KB
-
Sheet rat 2.6 Кастом/Plugins/SendFile.dll.dll 19KB
-
Sheet rat 2.6 Кастом/Plugins/Service.dll.dll 10KB
-
Sheet rat 2.6 Кастом/Plugins/Shell.dll.dll 11KB
-
Sheet rat 2.6 Кастом/Plugins/SpeakBot.dll.dll 9KB
-
Sheet rat 2.6 Кастом/Plugins/Stealer.dll.dll 588KB
-
Sheet rat 2.6 Кастом/Plugins/System.dll.dll 9KB
-
Sheet rat 2.6 Кастом/Plugins/SystemDisable.dll.dll 13KB
-
Sheet rat 2.6 Кастом/Plugins/TaskMgr.dll.dll 12KB
-
Sheet rat 2.6 Кастом/Plugins/Uac.dll.dll 19KB
-
Sheet rat 2.6 Кастом/Plugins/WormJoiner.dll.dll 1.4MB
-
Sheet rat 2.6 Кастом/Plugins/WormSMB.dll.dll 458KB
-
Sheet rat 2.6 Кастом/Server.exe.exe 438KB
-
Sheet rat 2.6 Кастом/Server.exe.config.xml 7KB
-
Sheet rat 2.6 Кастом/Stub/Client.exe.exe 47KB
-
Sheet rat 2.6 Кастом/Stub/UserMode.obf.dll.dll 136KB
-
Sheet rat 2.6 Кастом/Stub/WinRing0x64.sys.sys 14KB
-
Sheet rat 2.6 Кастом/Stub/ddb64.dll.dll 32.2MB
-
Sheet rat 2.6 Кастом/Stub/ethminer.exe.exe 4.4MB
-
Sheet rat 2.6 Кастом/Stub/fds.dll.dll 106KB
-
Sheet rat 2.6 Кастом/Stub/nvrtc-builtins64_112.dll.dll 5.3MB
-
Sheet rat 2.6 Кастом/Stub/nvrtc64_112_0.dll.dll 30.5MB
-
Sheet rat 2.6 Кастом/Stub/sigthief.exe.exe 6.4MB
-
sigthief.pyc6KB
-
Sheet rat 2.6 Кастом/Stub/xmrminer.exe.exe 4.9MB
-
Sheet rat 2.6 Кастом/System.Buffers.dll.dll 20KB
-
Sheet rat 2.6 Кастом/System.Collections.Immutable.dll.dll 175KB
-
Sheet rat 2.6 Кастом/System.Memory.dll.dll 137KB
-
Sheet rat 2.6 Кастом/System.Numerics.Vectors.dll.dll 113KB
-
Sheet rat 2.6 Кастом/System.Runtime.CompilerServices.Unsafe.dll.dll 16KB
-
Sheet rat 2.6 Кастом/Themes.json33B
-
Sheet rat 2.6 Кастом/Users/1AECA2E5C88C3836BEBFA3C/Info_admin_DESKTOP-JGLLJLD.txt561B
-
Sheet rat 2.6 Кастом/Users/5572977BE700F2B42617C7A/Info_Xyesos_HOME-PC.txt718B
-
Sheet rat 2.6 Кастом/Users/999ED12B975C14C1FEB9EF0/Info_Admin_KOMP.txt654B
-
Sheet rat 2.6 Кастом/Users/ACF10C1FB745CEF04A951F2/Info_Artem_DESKTOP-MAVCR0K.txt599B
-
Sheet rat 2.6 Кастом/Users/BE1C1BF21A89FE60C442043/Info_Fase Mig_DESKTOP-4KGSDAE.txt641B
-
Sheet rat 2.6 Кастом/Users/CE9814B0971C0D1DBBB7706/Info_9bwFZvGCb_WIN-OIUYV0HQHNG.txt569B
-
Sheet rat 2.6 Кастом/Vestris.ResourceLib.dll.dll 76KB
-
Sheet rat 2.6 Кастом/cGeoIp.dll.dll 2.3MB
-
Sheet rat 2.6 Кастом/dnlib.dll.dll 1.1MB
-
Sheet rat 2.6 Кастом/protobuf-net.dll.dll 278KB
Sheet rat 2.6 Кастом/ConfigBulid.json
- SHA256 5e82ce4641a50116d3883ea8e1f4d7ce8ef7a365f75c91f1dce9d2fd52fdf46a
- MD5 2b0e67e00ddddd211371a91de9d41f68
- SHA1 b90627ca922702090046ea0df316dd3cb1190c86
- SHA512 7a2215138f537b525edbdc4002f505a4174a5f09905384f0c45678cab56fe927daf812f5acddb3894fdd5fc58d1b5d4333acea0d2d90a7f2d7423978b0872764
- TLSH T1D221DC61C044067FFB35C66884187A15BEB94FAF11344C3FB1F3A624A8D67673160715
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Ionic.Zip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd
- MD5 6ded8fcbf5f1d9e422b327ca51625e24
- SHA1 8a1140cebc39f6994eef7e8de4627fb7b72a2dd9
- SHA512 bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4
- SSDEEP 6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
- TLSH T155A4BE0023DC4A6AE2FE5775D4B782A5C3F2B815793ECB8F9D8464EF191A780D6107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
467790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb
mscoree
_CorDllMain
Name
.text
Size
449KB
Virtual Size
448KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Maps.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
Sheet rat 2.6 Кастом/MetroFramework.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
677726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e347abc9301d67dd7493a0fbbe5cc1f912900c204a84220cc8cdf0e0b8df0de
- MD5 2e68aeb46e26a29ffe74cf97b94cbaf0
- SHA1 9384fa2946f744be3b47e131df14cbc0632052d2
- SHA512 39e56b0dd316e9a927ffeff486969f2a472f9b262b6a131afa60c34baa01784cde9cc6944f1a46ee73f3cc7135cb0049cc5a4bdfa419fab37667829522f6e7c9
- SSDEEP 6144:igY2UEI+85kQDHzER++2a4cSuEsHTyRwl0AYTA7qkpRMUwbX/1rFXF:TY/HXQl40HHdS4qYWN1F
- TLSH T175A47D2233E4582BE4AF5776E8F40D2B47B2F5463976EBCF65446A6D1C837424E00BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
477866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8c4e2f96fe1030a276cd7fb6c5e5a0a675f953f2b33db08fdff3d472658d098
- MD5 2d1298818aa582a1f1dd51dedf879cbf
- SHA1 429d01cabab977bcade38754ed28d8793ce1592d
- SHA512 0f482a322df5ee24c99348ea084bb358e37c7a8137afa46132aa7c06f1119c12b5ac711344263eb9556ce179738bebe58af6fd72c57933d8ae2a7d60dfba71fd
- SSDEEP 192:MIoRKIwOQJOsOTtiavNAf9/HFd8BPCP2a2uPzNcg8wFlxUSod:aRKDOaOsOTtiaVk9/lYPCP2a2uxZISM
- TLSH T14942CA09EBE0466AD97D5E3A187243958332AE47B503DF9F0DC830DA6B263C58611FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\AutoRun\obj\Release\AutoRun.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/AutoTask.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6b04c5d6663a952b9a548936ec3c505905c82ed6479961a1753fb031a1656cd
- MD5 4cf1872f764b48691f7a1699c0de8448
- SHA1 1576883f83d5c2fc1f35b5387e077eb3de620bb7
- SHA512 429cf7c1078625481709485cbc4f7cd8119dd08091e6552c725f505cff0c3bc27997ad76191cb6fcb39b3f849c785719dd785c24bf3bc02d62f51aceee873bbf
- SSDEEP 1536:XpLLddrrRW8yyQQSScDB33ZZXXVK5vc7IrZdbWDNv6piPUiR+IpQpB+rmT71s/ws:XpLLddrrRW8yyQQSScDB33ZZXXVKpc7F
- TLSH T1C393595177B8C667D1AE92F1A1B647548B70C202B217F3DA5EF814FC2C637804AA26DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\AutoTask.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 68c12c72a722fbf333352aad3308d297642e81d3298a9db7a10fbaf9042aea52
- MD5 61f46a6a9dd8464648fc70402aad5fa7
- SHA1 6f527ab6fc489df4c3882ab32f9cbcf3abc2f17f
- SHA512 44263c4bad2d2c17a1e87d682dada5855c31c8018ea8f28aaec5746a87643c29aa1554bc8a8da774f2bd43dc9009f4e721191c9fbe3a12b60c85ce028e556256
- SSDEEP 192:fclXwW7eCEW0aGMuisfC5GsTT9gsn9Tu5IPa9iiAKxfjd:Ulg2eBH7isK5Gs+09Tu5IPpiA4fjd
- TLSH T10C622A2577B4867BCA7D2AF654E31384037657222403DFDB9DD520CEAF9ABC446107C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Chat\obj\Release\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 343c783191ce6fa824d6b64cb870b1f7fd41fe4cbdf0e17600d3615c444faa41
- MD5 d923f938fa89c84fe23cc827e4d71724
- SHA1 9c9a4d7a8b15b2e4a192f6d961c1241cb4d5326e
- SHA512 bc6766b5ba446034933a7031435056bbc93ce3f1ec2bbc8a6a98e4b0fa7bc708732b6c7bb4abf3dc7aba277b6f76100540fdb9ba85d8672d0cc778a4c3efd9ec
- SSDEEP 96:YCM73NjKIwOQcOsOC2708r4l+RnMqPM2cwRM92tTHoMbqLO:1iJKIwOQcOsOz7Jrh1WAC4tTIMbqq
- TLSH T10C121A15A774C67BDDAA063214BB83C04770D356751BDF9F0C98A4932F163C50321BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Clipboard\obj\Release\Clipboard.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ab6e77623d85c5c79798966105d24abaedf264c7c27762ce8a59752192638a7a
- MD5 c7a7a344b4e23bb4265b73505f1ad73d
- SHA1 126a4789db270e808a0ba8f7ade9b4a2f25b2637
- SHA512 1152f0486f47a059fb9a2b904704d507a8b76270dae343b45900e50e636e340dd5e67914e57dd957493dcfdb18873398847f146556972ba8934c9186a167064c
- SSDEEP 768:VIgSs5YPhaEDOVrqEkhshVh5hnh3hJhvh4nBlTOrktdzdxGqObI9DjWROeZ7:VIu8JOgEkWj/RxfZwQOet
- TLSH T17D231F14B3F01311F1FA627DA8F62506E93E7606FD32CBCE15B6620A0D627858885F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\DDos\obj\Release\DDos.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d77ec15d4e5b29333806cef28612a5116a7004957e7cddd13b82f3b9f6b46ec5
- MD5 55d4b8e492a76539047b0e4ee1bf1c17
- SHA1 71443b814c0df05bc7e039d9d2ee201936e91b90
- SHA512 4c20a537f314634b7928551794db4fc2eb9d76f3ab2efcfc104704a24d29973a8ba7df8c892befc7511f54758b41cfde39dac4eb10862377840c8b808eb4a6c0
- SSDEEP 6144:ZI10mIHHP5HyGtSV41QJDsTDDtUMle6ZjxLV/u9HnAdKXy:o0mEZpS4YsVUCe65fu9aKX
- TLSH T1F6B48D006BD4C65BF1BE27B5D0F292A1C770F462FA6EEB8F5D4424EE1C12344A9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
513202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
493KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/FreendConnect.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6145a438cedb77a2af3ba3fa696d0efb39402836beec724f0684a58c5495cc38
- MD5 38bdea28a600b421a06047120ad4f07d
- SHA1 61cb0c5748f01c94d7c64de3a898fc9bb23513ae
- SHA512 7c994e2fa1d8d2ae4533316a7a6f11b471397b66fe2555d9123e5928ebc9a97ed9d3b471848ac14df18efa6670a65133555cb5fde886e1264d2b2c04e14b57ee
- SSDEEP 384:SggTys1UIC05qq/ZAajzQlf8Ge1t5qbvw8TA9h/yKqS5RZR5ExqYcC:SNTyi/x/zSqXUbvuLqAYcC
- TLSH T1DCB24A0473D8C22DD1EE87792CB2971446B2E68B5503EF9E5CCC64FA193B7D08A10BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\FreendConnect\obj\Release\FreendConnect.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0fcb98533f6857132bd43168d31379475e4463c9069597bb553acdecd04482b2
- MD5 0e149283390d3272a652661627a0dddd
- SHA1 673b608a1485d5a2282e3862b617dc8992ff7954
- SHA512 6f9f6ac379394bd58ad9bc0cab77152c196dc4b11452b3ee1c960f14cee68d459fc2d9ad3706595b6964530e44138875cf5e36dd741d7c41a48ceb0485cb3e85
- SSDEEP 768:vhzTf/SqfaQdc6qBdwCFTyWp+UErybV1KfGGPzbGaUys/K8Fb6EN3tEmtJqu3XH7:lff8BdwCFTyWp+UErybV1KflPzC/K8FT
- TLSH T1A6234A1377E88518E2BD0BB594E3334A8231B6972416DB9F1DD920FE09B53D69710FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Fun\obj\Release\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Images.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a30cfa05b00bae06866742efa770ce32976be5095a3fb0e59c03dfda2e904c96
- MD5 b1bb08e62ae9e0944ab651c7cb8a0e4b
- SHA1 0921349fe92200c5bf263f683b98d9828056d8a5
- SHA512 0f7b61c5918f87f4abfb002e4ad06fbddacfe4b6d3cc5f4065264ea265746f4dd91cb49d862a1e91da656e3c4629448a3b98e82729370376e64e766604c6bece
- SSDEEP 192:nuf7mwOQSOsOF2nDgwPFksdruIyDVZ8JM9yN0sLLySB4hMbbi:g7FOROsOF2nUKVdSx9yN0sL/IMPi
- TLSH T195323911676CC63BCDAE0A722AB393984631EA43B807CF5F4DD870959F1B3CA62217D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Images\obj\Release\Images.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c234be82ce510981279a3d1e7f19b121cf63d066463a9da53b96d3d20573c0bf
- MD5 eb59ed6b40756e38d4d8484309a2132f
- SHA1 371b54789f857460c51370c600b47db98eedd405
- SHA512 cfb84003c82208e18ccc0f15b5cc1f971a5849961b513f5442aef13783ccf7ac2bbd6b41d97e9cdbdf5c4187c1623cb55b7d58e6d0e712896068cf84213abb56
- SSDEEP 192:XRKKIwOQmOsOX7poh4L1ncwRO4MprN/vMP0sXuDaVnux7V:hKKDO1OsOVIaA40N/UPVuDax07V
- TLSH T1815217097BE5823EDABE463B567353804BB0D6026957CF9B4DE9205E0F2A7C203127E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Keylogger\obj\Release\Keylogger.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a43c0dfa281a5011fc24bdcb377afcc6bfe6f0280a5452e993f8eccba695601d
- MD5 9a855fef0fcbf9e52fc947dd50cc8c76
- SHA1 dc2b23e32322d4353f7a674c147ea4f8afb76fed
- SHA512 33a5a4d664fcbd79663f3b83038e303efb763720821f0310cc25ec8a6b07b776f44c5367239ec59ef9ae5ae86b83a2f30e22879ac7ddd3dd2e5f7a3d5ae98842
- SSDEEP 192:GQDKIwOQ+OsOeuQzVw06ZTbXj6vMwoQyNZ73sj4b/b:DDKDOdOsOeupzjoMvf3sjc/b
- TLSH T19D222B1AAB74C67AE7BE4176586357440772D3836603DB9F8D98A0C61E0F3C90B25BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\ClassLibrary1\obj\Release\Map.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Message.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92e9ce567622ea1f71981e237dcfd2064b6d4d249e7d714e9bce946968538528
- MD5 da2c19714d375aa2e4a6068778de4475
- SHA1 57b9f2c656edf6c168eb1678905f99eddcb90d94
- SHA512 d58a780e1930549816bd5a1c755ba2d95f63c9a6098372dbee504392eaa3b7678e2a7c335a91adaca710b41c2e00701b0c848fea94e3e19413b4111024bc5ba7
- SSDEEP 192:dQBKIwOQb7OsO5omvu2eG9UU1j9d+sm5:+BKDOkOsO1u2l9Usjpm5
- TLSH T1AC12D901ABB0C27BF9BE0A36A5B397D44775E7425906DB6F485C70830E173C68225BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15434
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MesssageBox\obj\Release\Message.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/MicroPhone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0698c50082fa98b86f863e18e67c93289015c125a53bb7e986cabedacd03c484
- MD5 edcf7722663d21e80ce75809966a532b
- SHA1 a28e21fe834baee5d08445fa2450b21accc8687a
- SHA512 6503b51212fc373bb61f695fd2b423a98bfd8d53e150fcac3165fb923714b70afae23ed05c3e955931c1708ba8356d442e2b97c3b99268604bad0bdf47e3c950
- SSDEEP 12288:v7aFnooD9e9FRj05u/WX9/vbdN5UwMeWmB8:Tu/D9qx05Gi/BN5XB8
- TLSH T1ADB45B117BE4DD2BC06F37B6F4E20E2747F4E58AB266EB8B55801BA52D83B455C007A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
524686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\MicroPhone.pdb
mscoree
_CorDllMain
Name
.text
Size
505KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/MinerEtc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ad2970fc3b56fa9c9db1dd1d2a309398b216cce3dd750b6b562e13a7c198311
- MD5 9810d96bfd7236070008baf843c9e3f9
- SHA1 e2f306d064f82193b7fe1b2fe8f4c83b3a6db6e3
- SHA512 81f94596a9b3fac9945632ba04e08386c259aab7f60300a5352305d1808408bf6e21e8e087c963f39831be84e0d9600f6007f1704643c44b5b1e129f987cc9f4
- SSDEEP 384:+HgIeyB9nyO0NOTmFHHV8A/r8ZGcgM5rQtoCW:+HFB9MxT8rn
- TLSH T16762195277D48B3AEABD463B58B347584731F6876A13CB8F5CE820991B367CD1A10BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MinerEtc\obj\Release\MinerEtc.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/MinerXmr.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c1d6717a5adede293ca0cfbaeffc805add2eb1086d50c9b3465eea35391a395
- MD5 99fa25800b9fae285578f10f94028664
- SHA1 51e08fd7c41e857776efdb1562178bd7126f4b6b
- SHA512 e64eb8ed8183c0d78c25f7bb67b267792bf34cb8a7d72deac457cda8a69f16b737e8972f588ce58566c10fda6f57fa389c59ee5637f8e91ea7f51724dad9a3dc
- SSDEEP 384:LvgteruwfCeOZ2FcUbpg7gF1rTcUEj28A/fsoi1PD1OMI4C3CiC6CjCU4YztvXW:Lv1Cfr7gj0CMomC3CiC6CjC3YJ
- TLSH T14292F80577F48626F1FE8B7964B282184676BE83AD02CF4E4DF9604D0A75BC85A20FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MinerXmr\obj\Release\MinerXmr.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5fda1aa90d4bbc8762e488f8bfcf98d90993a4cccac1a866a9701a76cdb237f
- MD5 89a00c87c006c3a62058c0e748d2bd2e
- SHA1 902af277b4216bedac469ef06eabceaacbf6c1c1
- SHA512 d8d1fbb7bec76feaa48fd28f2c541c824d759a2fa3b9a244a17859452309eb901f73d864151a8808991eee7ebbd8542a8152a78409b44d398f032e5b2239e1b2
- SSDEEP 192:fCoKIwOQwOsOrgKpHIvlYKdeUXswRbXArvgwyz5lTTJd2oaRZx1C0FD:6oKDO7OsOPHq6KdeUXs2bX+ny9Jf2oab
- TLSH T155421A45AB60877ACB7D897210F343894778A7436A02DF9F09E850AD2E2F7CC0720BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Netstat\obj\Release\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 63f64144f2802f2298d3956c25eda341d961b99eec9b27fe74b0256d89146feb
- MD5 6d576833fe0c563d123d1091d26d5405
- SHA1 1af67253ef16a4244fb29bb37945aea6e2636976
- SHA512 10bc068bb79548b2d965feb555d504b28db8edcbba5a56dd52b902375a08ddc8a1cceded9180367e393582a76b86ca00bd2a7e2cb152692affba35c071252ec3
- SSDEEP 3072:mHmRQfn0eqpQn7FDS+NkI0wgMz7loHShEbPIEm4Tp:mHmGMu7FG/KzgShU/m4T
- TLSH T1F3441824ABE8CA1BF1BF77F984B8062C4BF5F41AE65AE74A049410F90D1374469193BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
264KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e33ae7f7b3e5838550a37501683aad0b77383ec8f3b7ddbfd295514c8645a67
- MD5 0fea40d86be5f053179814b6d7b6d17f
- SHA1 3778ef8bc09b791d517fe90da64978e58480dda4
- SHA512 a8e2ca51b343532a0ff7585f1a25f9b4b17f5dd521385fd2294b7197f0394279665f513af712a263d8d877d62a79008c794b958b1f0a838644ce092203e9ac9a
- SSDEEP 1536:oTCCYYiikT7ddjj99nVquu00OOYmb7e9EAmkGXdiPUM8+IpQai+QWS9gM0OLlunx:oTCCYYiikT7ddjj99nVquu00OOYmbSyl
- TLSH T157934BA26BA9C56BD2AF27F5A4A34B048B70C2126117F3CB1EB414FC6C537814E617E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f7a83c1455e0e0b41dbe6e69daa346356fbfc076f3edb12b99b9d0f76ec4068e
- MD5 f8aef2a46829420080682c1233dd0e15
- SHA1 b75cde7ad84f187a2ceaac0f32749a34539c342e
- SHA512 36e21f7ab7fbab14e5e56eb45950d999448201cb245ebe0471cacd5883d41e344eb80cf7408aacd6a1560fd9629b63f8e380dff8f17258a2db96907898abd522
- SSDEEP 24576:h2vONVAx+95vf8ROmqdWEI8s3FFFFFFFFGTt+xt:hlNVAxU5vf8RnqdUFFFFFFFFy
- TLSH T1AB555B51FFE06EA6C08F36BEF4A159130AB0B0411276E78B4B46216D9FC73849D1ABD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1311238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99997873b952b44998d9c28a25d26c97046c6152f517deb9c06f738733df7415
- MD5 da656fe7d882ae6f8c78101acf4e0a2a
- SHA1 99a183d8fcbab8b8e594627989b260ff1494558c
- SHA512 3b666d5c1e5a21facab580ad6837bab267c64c902f25af9fdf185e60e3c4d73a64681c987471803e3c48182e9b526cd35173ed3cb28d101e402638c7b9c344d4
- SSDEEP 192:OrkovhiP3SiKixEgeFdTzTbBSQEbho52J1XBCyCmmYLUnCP0w4:OrkovhhZikF9zBSQahogUyCmDYCP4
- TLSH T11262D6229FE88A7BE37C473454B253119332A84A3B83DB8F8D5834D76D2F7C192117A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\ReverseProxy\obj\Release\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Scheduler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f15a72a9f53fef2084ad853cdbfd867f4ac8f792fc649b8c3befa7c98a03d64
- MD5 a604f7d5acca504de9021798c3ac4bf7
- SHA1 8368cf3bd6035c9951eb83e4dbb95b237584c2a6
- SHA512 054b3e447d87c3433604bfa808fb7f0096fa0b05b74cd31a6faf9ed679f5e7a4694a25be78525bc7364b05060195e903e3154241171bf306d088c1c6a32b700e
- SSDEEP 3072:bkNXpEpNdgFR6+/7fbRwUqQK8vOQqny8EeWycJ5Dfwr9g0Sh5053gxeM72R6lCrk:IpEpDgP/7f1Jarv53by2nIDM65+lc
- TLSH T1E9744C10EFE8C22BE5BF17B6E4B302104BB5F586D566DB4F148864DC1C63349AE523AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
367326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Scheduler.pdb
mscoree
_CorDllMain
Name
.text
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d396f3c20883a3b71244c87c537595108010239e4e17e6c09bca83ea5a475677
- MD5 75ef0d23e82fe64a3ac7980a57149aa2
- SHA1 2e1505803f415c2f2c033a2b8996df0ed916f8a6
- SHA512 9b99b78cc3a94e68d72d2a5aadf07a12c6b18c0e076a25e17533323b7d8cfb86d05ce7e0b46aaf8821070bb369e277f28bc9d3c957904a6de66257e3502734e5
- SSDEEP 384:YJFOHOsOdVOB4jRKkACgdRngHPkHiMjWR+bSh0XSW9Ot575MZ919pCBmvec:Yi49g3FHiM1biF5wrMX
- TLSH T19F922B0DABE886A6D5EE4D762CB2861047B0FB175E03CB4F5CE990DD1E633C192507DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25570
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SendFile\obj\Release\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2a8c6e202547543b3230641976d83f6f73552b511dff7e4d3d67331a568fc27
- MD5 5784f50a914a811660b9f52dd06582cc
- SHA1 7657546e28dff1d6aefef1e686fbc0d94fd49fa3
- SHA512 d9bc3053733e085eb0b7dd69d99abce60822dd19ee2cba390448509de4365b56fe38f8d4f7837a4c5432f851cbc4f0ea070ce2046dc58518e86208f11393d339
- SSDEEP 192:d/3KIwOQwOsONbvnTyk44gopk6rBX2PVTriUR4IOY:R3KDO7OsO1vnTB4OVtX2PV/lRzOY
- TLSH T17A222906ABD486BAE9AE4A7348B343044375B786A947CB5F4DD8709B2E563CD1B327C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Service\obj\Release\Service.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 814ff32263b24e91ad6a8d00e6a9fce3e79bee939d76824d8727b04d772b4fa3
- MD5 3d2ba275ab2effe84b2133e454369d8d
- SHA1 459409c58abb1a9a3dfa982e4936b5cc0113f701
- SHA512 46fb7675a51df8b15c0460ba2d774d83b9630caa1fbc7cbab417ab4a966cbf30e9e64f3ee6e2e65cb1650d1cf431a2682b4f680256d8c3598b845cbeaf062977
- SSDEEP 192:oh87KIwOQSOsO/BC7hY1VxyZZTXoJc8aDPf/1BdTjtZD/ym:N7KDOROsO/BC7EVxpEPftBJjtZD/h
- TLSH T118320911ABF4C67FC9BD453618B3871042B4A3866907CF8F5CD460DA6F2ABC997227C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Shell\obj\Release\Shell.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/SpeakBot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f5cf80fdd20004e3a9613cb4bdfcfc388f84c8f94db88698da68ba450ff2b2c7
- MD5 8ecf481177682ecb8902dd85f7dcc607
- SHA1 0575c5068aabab48ab3b5895128cd95743dbd5da
- SHA512 472d0a67fea7411deb9ebb486495d92a7aa1c45fbc3fe05e7ac65b6d8f2839e2b34eb02ab55135726f3d0ae1942ba77f2e0bd9264b7bee0e3610d122aafe4d9a
- SSDEEP 192:aiSrKIwOQTOsOXLhLYN9NPMUsCdeCeCkoE7g9yrR:a9rKDO4OsOXLhLejRscePCkoEU9qR
- TLSH T1CB12E71ABBA1C33BEEBD4A3648B247A14771D786660BEF5F0C54A09A1E163C907217D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SpeakBot\obj\Release\SpeakBot.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bde5b1c709aee5e9f37da56e69311a4f90bb49b1d48f63837d9d2cb61c8d998
- MD5 4f4396fa54d391387278e7a01bf86b90
- SHA1 6b802ae39bc0b0124b5a728e1d8d82979d09dd85
- SHA512 e24f55ffe8e0f34450f7e2b84cc7e8df727282cd1153a720856c3d480ca4b165089d3134580a3f0e6f4b0a08bd358c0fba6a2203404ced1efdc23b8db9c5bf2e
- SSDEEP 6144:+hNTVz1OnnEZMnqLP4LXZbaKD0jyGtSV41QJDsTDDtUMle6ZjxLV/293truyeI3O:+hBVz0nEFpS4YsVUCe65f29d1gt
- TLSH T1A6D48D002FD5CA5BF1FF27B2C0F342949775F826B93AD78E198420ED2A1274499167BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
608274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Stealer.pdb
mscoree
_CorDllMain
Name
.text
Size
586KB
Virtual Size
586KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/System.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b16a3300b9e6fc91952aabdaae1e23988af9d11d47a219c943b24f9c34a96c5e
- MD5 c2385c1f53830a5460c1860a45d87d80
- SHA1 f17bfa6627fc74a25f3d1f820487e4186fe58d6a
- SHA512 4345833f6976f5e8c0a60e436e0a31c5a2778a7987eabf4da0d7319758c0ea3e258306573207b8101edd8f6c5a02b9104fe5d81bc6a101d161f8f3ec9000af15
- SSDEEP 192:4z1pmwOQ1OsOP5409hCZJYQvlwbGG9JAwZ29PL+:4JpFOmOsOP5p9hC/YQlwbN9JAGIPi
- TLSH T1E2120801AB74C2B7ED7D073658B7834147B1E342A907DB5B1DA8509B1E2B3CA5732BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\System\obj\Release\System.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/SystemDisable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5166d3458c98962a5c49786185d26600563b6ca3afef2c9e35079c7dd4b865c3
- MD5 416fb9285fe6e40959e3e2a9f4d87919
- SHA1 3ac1683244a009d8ccd43c5d136a7acd64203bc3
- SHA512 cf325b560d55c396cfaf25b005eb481db3acef4fed53729795c094faf238234474c2fd9bd9e45978b504bd1c881fb346781a606e90a2e102014b79adf8815010
- SSDEEP 384:XBFOkOsOsrNcwfu+nnROzb/92/n9euEFdj:XLTfuonRsbFYYDPj
- TLSH T1DD52D801BBF8866AF1BB4F31BEB66724CA37BD0AAD12CD1F0855104D49327C48921FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SystemDisable\obj\Release\SystemDisable.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/TaskMgr.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79c00793de5d62302c16d60f00dd21f864748de4ae17b2cb6cd4eeaab87fe9a4
- MD5 c49afe7c8af97fce442ef4e0dd796b7e
- SHA1 18234fb90c4676fc1a493fdef87168bce8775cc4
- SHA512 b36307eb3c2615cda99fdd594fb1c119df2ab59a87a2f4c34878ed640c47118439d02ccd0f43e9051dd188cd2fb9c3dc4952a13a9832ee129ea0fb2e6f880274
- SSDEEP 384:g1S/gg9WsoROf37h6JZ3mx2RJtGox/xyx7DwLo1jDl:g1YWvRODwbbRDfo1jDl
- TLSH T17A423B0AA3A4067BD8BE497B74B3C3A403B5A7426A17DF6F4DC860D60F163D61B107D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\TaskMgr\obj\Release\TaskMgr.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/Uac.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fec5ce9214e638a7b337177d4c9ac927734872e5198a7e7201a0ce6273cfa77b
- MD5 53bd2ce77bfb21d22bc831285d64a1ee
- SHA1 573b8beb4766374531eb373dd48ddde45f14e0d0
- SHA512 09bcb81d6a72d9ecb392f3fcbadddbdea8966e14cd6c64fa6011020dc48a84bbd8ee69a593dabf12e9711e09908edfde09581210a4501317bd107951eaa929ba
- SSDEEP 384:MzfirHbjkh0X8xNbGXO6+uqMi38wAAkYGbHFtslaDu1qQpX:cfqHG0kNbw+ei38+qSX
- TLSH T15C92F786BBDC5971E6BF4F796CF212010272BA160C27DB4F098540D91E7AAC497B0FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Uac\obj\Release\Uac.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/WormJoiner.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 83bf7e0729f78c1c38bb77025843d4b680103aa70c4a84f19041efff8c88c7cd
- MD5 47cd65eeacbf54f87f2aa9cc16c6e31c
- SHA1 eac36baa52bf5ee9a844732c1b84e1557a72c12d
- SHA512 b7a50627a50df81fa283cdec14b30576179d867a57fb9fdee42adf1740ab598f07a6424f795f34f457e82ddce8af74339fb88657b9a4761465cee4fcc86c67de
- SSDEEP 24576:MWLnVIj2bA+2Utr402pr7tdSWlufOkAQcyNkP1Q:MUVIj2Ftr
- TLSH T1DE655C01FFE4C62BE29F9777E57202641BF1D406A353F74B462896BA5C433406E863AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1432638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\WormJoiner.pdb
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Plugins/WormSMB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fe347d754bad7d8e7a9b446d94b965b43e987819af6afe6160d4dc73ea3b5b1c
- MD5 1a74d3d32675790e76281df64148383c
- SHA1 1191e52832f8a93e5bd814d147b9c70986c6af6d
- SHA512 e53b4bf6c8343b432ade5776971b9c79f6bf9393b11e692e9e6f7938416e97c7c78f40babd336f28481d59107f0cad8748dbfbaef5bd91d142450e8c07db3592
- SSDEEP 3072:b6m1g0sbmkuNoLXyh9KfocUh15BHrbdfOXu4yQ0SUTGTTrhqfldNeh6x3RMuSCgf:bv/dGESUTGTTr4fldNNhtJKLXBa8rWm
- TLSH T10EA42BF46BEB2966F1BECF76AD7315808C2D7C366F06C16C40B103590835BDA996E623
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
474910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\WormSMB.pdb
mscoree
_CorDllMain
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 faf2c6e855df9f1d75465c9b1ab0d6808b2bf0cdd227cfc177eafcae40a7d910
- MD5 27c3a3a79938fe4cbdb181b8c576b720
- SHA1 67cf7c4f220deaed200b26944b60019ea536210d
- SHA512 877590af7dc127c8a7130fabc48369da4eaf950415f6ca9657afda96a47e5b01e2f58a8a3b341a93d6c351a7fa03b98404ee52a737405ff4fc701132f5178ac0
- SSDEEP 6144:egJRbLamkvqB97dM4G5Us06D12e6VlWT8b9l95+6BXeZIhHYub0Kh3iV7L21RNM:zJKEEzDYPVle8T95+ApHYuSVH2K
- TLSH T16B94B40CFE91E806CE2E3DB3CFE614104B7125C12E219252715AAFFE8B6637658E657C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat obfuscated V1.8 and higher
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Detects Sheetrat obfuscated version
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
445070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
427KB
Virtual Size
426KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Server.exe.config
- SHA256 28026de2c65972cb8fac1ff2865c33e24d1086f7242b2fe951cef172909ad128
- MD5 2083876ec03ad06e5c16490fcb4ab8b6
- SHA1 b8f50f08abd53225c046912471dfd271a98cf15a
- SHA512 b16f1fbe8e10b66079d83a46818423fb2e2e8619cbdc1427ce0cd27f06092af52bcc003755e939320cf84f8cc5a26c92e43041013fe3ef60c7d73d8624ee6096
- SSDEEP 96:ur71Qz7KR7KprDRnbWCPAnnAnBbAnGAnXjzAn+AnYAnTAn/AntWAn+yAnbAnNAnc:ur7o747orDd5P
- TLSH T1ABE1310CB1C19F9A15366631E73052D1EDA006231276B0F0B8ED31676F70DDA5AB37BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Sheet rat 2.6 Кастом/Stub/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 71824238c3baec179911bd6e4655ebff234e15d0f14248077e2c388ef4337009
- MD5 a0e04bf9b43f0b442bd3193f06dc52b5
- SHA1 30bb0c17640c414d948ed3e2fdf571b98f125efb
- SHA512 d7015f5c8223ba0f4e3b478185fa3e4de0831aee949302185fdc8b3afe59105fe096a3e5ee23219a1c16dfcbc77d169a82774ecd727ef98bdb94a878583a2ae2
- SSDEEP 768:+nqRz+Q9CF6abcLPbUG9bOplP7ZXdEEyb:B9g6asD79bOHLDu
- TLSH T151232904F3E84519D2FE56B858A291C8827DF5DFA612C7DE0CCA90E91E1E7D48A01FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Client\obj\Release\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Stub/UserMode.obf.dll
- IMPHASH 6dbf95d81ab0cb2039f47259ddec333f
- SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
- MD5 16e5a492c9c6ae34c59683be9c51fa31
- SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
- SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
- SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
- TLSH T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetModuleHandleA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.0Dev
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=7, id=265, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Sheet rat 2.6 Кастом/Stub/WinRing0x64.sys
- IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- TLSH T1096218874B7E1906FB969F7592E9C7936D34F6C0CFA825CF421299982C413E0AF2861C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Chains
Jul 26, 2008
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Subject
CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f
Serial Number
01:00:00:00:00:01:15:37:24:21:a8
Issuer
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment
Revocation Status
Not revoked
Timespan
Sep 24, 2007 - Sep 24, 2008
Subject
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:00:f9:7f:aa:2e:1e
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 16, 2003 - Jan 27, 2014
Subject
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:1c:d6
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 28, 1999 - Jan 27, 2014
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d
Serial Number
04:00:00:00:00:01:10:92:eb:82:95
Issuer
CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 5, 2007 - Jan 27, 2014
Subject
CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:08:d9:61:24:48
Issuer
CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jan 22, 2004 - Jan 27, 2014
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
0
Major OS version
6
Entry point
20488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb
ntoskrnl.exe
IoDeleteSymbolicLink
RtlInitUnicodeString
IoDeleteDevice
IoCreateDevice
MmMapIoSpace
KeBugCheckEx
IoCreateSymbolicLink
MmUnmapIoSpace
IofCompleteRequest
__C_specific_handler
hal
HalSetBusDataByOffset
HalGetBusDataByOffset
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
380B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
546B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=1, productName=Unmarked objects,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=113, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Sheet rat 2.6 Кастом/Stub/ddb64.dll
- IMPHASH 2b41a6eaabd449bd2521813e69f0a7c6
- SHA256 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44
- MD5 82967b6c24f52664a3b9399f853ea812
- SHA1 064e83897c545f71f2f6a879ea0845f6d23ec9b9
- SHA512 69625de4e8cadfd361858cd588ef514cf8cac5f1a022541f831ff490bcc5048bb580f1c2a04820f3f978c299cf7b24058c9173cb51086e8bc4813432012e697f
- SSDEEP 196608:LEYDJk52U0CDn/DM4b5chY56H5dg5Ej9bUYvqNE6/+XBpSOXtOkO+O:jDcDn/DM4b5wY525dMy
- TLSH T1BC775CD97AA9754BC048157CA18BAFB4CC9E3623003F8ED42CD09DEB5E55EEDF412298
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
287728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
nvcuda
cuGetErrorString
cuDeviceGet
cuDevicePrimaryCtxRetain
cuCtxSynchronize
cuModuleLoadDataEx
cuModuleUnload
cuModuleGetFunction
cuLaunchKernel_ptsz
cuInit
nvrtc64_112_0
nvrtcDestroyProgram
nvrtcCreateProgram
nvrtcCompileProgram
nvrtcGetPTXSize
nvrtcGetPTX
nvrtcGetProgramLogSize
nvrtcGetProgramLog
nvrtcAddNameExpression
nvrtcGetLoweredName
nvrtcGetErrorString
kernel32
GetModuleFileNameW
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetFileSizeEx
SetFilePointerEx
GetConsoleMode
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
SetWaitableTimer
SwitchToThread
CreateWaitableTimerA
FreeLibrary
GetProcAddress
LoadLibraryExA
FindClose
GetLastError
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibraryAndExitThread
CreateFileW
SetLastError
GetModuleHandleW
LoadLibraryExW
GetConsoleCP
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionEx
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
CreateThread
ExitThread
GetModuleHandleExW
ExitProcess
SetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
WriteFile
FlushFileBuffers
NvOptimusEnablementCuda
alloc
astroBWTHash
astroBWTPrepare
cnHash
deviceCount
deviceInfo
deviceInit
deviceInt
deviceName
deviceUint
deviceUlong
init
kawPowHash
kawPowPrepare_v2
kawPowStopHash
lastError
pluginVersion
release
rxHash
rxPrepare
setJob
version
Name
.text
Size
423KB
Virtual Size
423KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
206KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nv_fatb
Size
31.5MB
Virtual Size
31.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nvFatBi
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=26715,
count=70, id=260, version=26715,
count=173, id=261, version=26715,
count=1, id=253, version=28518,
count=78, id=261, version=30034,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=2, id=257, version=26715,
count=2, id=257, version=25019,
count=3, id=203, productName=VS2012 build 50727, version=50727,
count=209, id=1, productName=Unmarked objects,
count=1, id=206, productName=VS2012 build 50727, version=50727,
count=16, id=207, productName=VS2012 build 50727, version=50727,
count=1, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=14, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Sheet rat 2.6 Кастом/Stub/ethminer.exe
- IMPHASH 601d901af8200f541117a59e7736bfef
- SHA256 7ca69c624f9745a11ece45baaec80a3e7b596199d4997b4a3a07caecb0cb02d7
- MD5 38cfdd6cac508c40137ee45dc6857a59
- SHA1 199f87fd7bb827b75543141acf580f4e53417595
- SHA512 d4dc8f03288c09c82308025e138c027335067cd6b88ef078ae6a6ec2a79f12e69628ca52a08c19cf0b985acee301c0b823b42ef9830fa94c305f2377c29deb50
- SSDEEP 49152:23LsR5jcDqJFfM0UZ+jkpXEIQwog9U2jU4AgIrHv2DR/1w+piac1wgmHyP3wn/z6:Uy5zTjMJzi01Zca7Uwn/t
- TLSH T143268C567BA810E8C47AD13CC54B8A17D7B1B42613718FDF12A44AA60F27AE5AF3F710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2428288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
opencl
clReleaseContext
clReleaseDevice
clCreateBuffer
clEnqueueNDRangeKernel
clBuildProgram
clReleaseProgram
clRetainDevice
clReleaseKernel
clCreateCommandQueue
clFinish
clEnqueueReadBuffer
clGetDeviceIDs
clRetainProgram
clCreateContext
clGetPlatformIDs
clGetPlatformInfo
clGetDeviceInfo
clReleaseMemObject
clGetProgramBuildInfo
clEnqueueWriteBuffer
clCreateKernel
clCreateProgramWithSource
clSetKernelArg
clReleaseCommandQueue
clCreateProgramWithBinary
kernel32
SetLastError
EnterCriticalSection
GetStdHandle
SetConsoleMode
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
GetConsoleMode
FormatMessageW
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
CreateWaitableTimerA
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
SleepEx
TlsGetValue
SetConsoleOutputCP
GetSystemTimeAsFileTime
TlsFree
GetComputerNameExA
FormatMessageA
CreateEventA
CreateIoCompletionPort
AreFileApisANSI
TerminateProcess
GetModuleFileNameW
MultiByteToWideChar
GetCurrentProcess
ReleaseSemaphore
DuplicateHandle
WaitForSingleObjectEx
QueryPerformanceFrequency
CreateSemaphoreA
QueryPerformanceCounter
Process32First
OpenProcess
CreateToolhelp32Snapshot
Process32Next
SetThreadExecutionState
GetTickCount
GetComputerNameA
GetModuleHandleA
Sleep
GetProcAddress
HeapAlloc
HeapFree
GetProcessHeap
ResetEvent
WaitForMultipleObjectsEx
OpenEventA
GetCurrentProcessId
GetCurrentThreadId
GetLogicalProcessorInformation
ExpandEnvironmentStringsA
LoadLibraryA
FreeLibrary
GetModuleHandleW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
FindClose
FindFirstFileW
FindNextFileW
LoadLibraryExA
VerifyVersionInfoA
HeapCreate
HeapDestroy
HeapReAlloc
InitializeCriticalSection
TryEnterCriticalSection
SwitchToThread
GetCurrentThread
VirtualAlloc
VirtualFree
VirtualProtect
FreeLibraryAndExitThread
RtlUnwind
GetProcessAffinityMask
SetThreadAffinityMask
LoadLibraryExW
FileTimeToSystemTime
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
ReadConsoleA
ReadConsoleW
PeekNamedPipe
GetDriveTypeW
ExitThread
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
TlsSetValue
SetWaitableTimer
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
ExitProcess
SetStdHandle
ReadFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
FlushFileBuffers
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetEnvironmentVariableW
FindFirstFileExW
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
DecodePointer
EncodePointer
GetExitCodeThread
RaiseException
RtlPcToFileHeader
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
WriteConsoleW
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetLastInputInfo
advapi32
CryptExportKey
CryptImportKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
GetUserNameA
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ws2_32
socket
freeaddrinfo
WSACleanup
WSAStartup
getnameinfo
ioctlsocket
getsockopt
recv
connect
WSAGetLastError
send
ntohs
getpeername
getaddrinfo
inet_pton
WSASocketW
shutdown
select
closesocket
__WSAFDIsSet
WSAStringToAddressW
WSASetLastError
ntohl
htons
htonl
WSARecv
WSAAddressToStringW
getsockname
listen
WSASend
WSAIoctl
bind
accept
setsockopt
crypt32
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
bcrypt
BCryptGenRandom
??0CharReader@Json@@QEAA@AEBV01@@Z
??0CharReader@Json@@QEAA@XZ
??0CharReaderBuilder@Json@@QEAA@AEBV01@@Z
??0CharReaderBuilder@Json@@QEAA@XZ
??0Exception@Json@@QEAA@AEBV01@@Z
??0Exception@Json@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Factory@CharReader@Json@@QEAA@AEBV012@@Z
??0Factory@CharReader@Json@@QEAA@XZ
??0Factory@StreamWriter@Json@@QEAA@AEBV012@@Z
??0Factory@StreamWriter@Json@@QEAA@XZ
??0FastWriter@Json@@QEAA@AEBV01@@Z
??0FastWriter@Json@@QEAA@XZ
??0Features@Json@@QEAA@XZ
??0LogicError@Json@@QEAA@$$QEAV01@@Z
??0LogicError@Json@@QEAA@AEBV01@@Z
??0LogicError@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Path@Json@@QEAA@$$QEAV01@@Z
??0Path@Json@@QEAA@AEBV01@@Z
??0Path@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVPathArgument@1@1111@Z
??0PathArgument@Json@@QEAA@$$QEAV01@@Z
??0PathArgument@Json@@QEAA@AEBV01@@Z
??0PathArgument@Json@@QEAA@I@Z
??0PathArgument@Json@@QEAA@PEBD@Z
??0PathArgument@Json@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0PathArgument@Json@@QEAA@XZ
??0Reader@Json@@QEAA@$$QEAV01@@Z
??0Reader@Json@@QEAA@AEBV01@@Z
??0Reader@Json@@QEAA@AEBVFeatures@1@@Z
??0Reader@Json@@QEAA@XZ
??0RuntimeError@Json@@QEAA@$$QEAV01@@Z
??0RuntimeError@Json@@QEAA@AEBV01@@Z
??0RuntimeError@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0StaticString@Json@@QEAA@PEBD@Z
??0StreamWriter@Json@@QEAA@AEBV01@@Z
??0StreamWriter@Json@@QEAA@XZ
??0StreamWriterBuilder@Json@@QEAA@AEBV01@@Z
??0StreamWriterBuilder@Json@@QEAA@XZ
??0StyledStreamWriter@Json@@QEAA@AEBV01@@Z
??0StyledStreamWriter@Json@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0StyledWriter@Json@@QEAA@AEBV01@@Z
??0StyledWriter@Json@@QEAA@XZ
??0Value@Json@@QEAA@$$QEAV01@@Z
??0Value@Json@@QEAA@AEBV01@@Z
??0Value@Json@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Value@Json@@QEAA@AEBVStaticString@1@@Z
??0Value@Json@@QEAA@H@Z
??0Value@Json@@QEAA@I@Z
??0Value@Json@@QEAA@N@Z
??0Value@Json@@QEAA@PEBD0@Z
??0Value@Json@@QEAA@PEBD@Z
??0Value@Json@@QEAA@W4ValueType@1@@Z
??0Value@Json@@QEAA@_J@Z
??0Value@Json@@QEAA@_K@Z
??0Value@Json@@QEAA@_N@Z
??0ValueConstIterator@Json@@AEAA@AEBV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z
??0ValueConstIterator@Json@@QEAA@AEBVValueIterator@1@@Z
??0ValueConstIterator@Json@@QEAA@XZ
??0ValueIterator@Json@@AEAA@AEBV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z
??0ValueIterator@Json@@QEAA@AEBV01@@Z
??0ValueIterator@Json@@QEAA@AEBVValueConstIterator@1@@Z
??0ValueIterator@Json@@QEAA@XZ
??0ValueIteratorBase@Json@@QEAA@AEBV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVCZString@Value@Json@@V23@@std@@@std@@@std@@@std@@@Z
??0ValueIteratorBase@Json@@QEAA@XZ
??0Writer@Json@@QEAA@AEBV01@@Z
??0Writer@Json@@QEAA@XZ
??1CharReader@Json@@UEAA@XZ
??1CharReaderBuilder@Json@@UEAA@XZ
??1Exception@Json@@UEAA@XZ
??1Factory@CharReader@Json@@UEAA@XZ
??1Factory@StreamWriter@Json@@UEAA@XZ
??1FastWriter@Json@@UEAA@XZ
??1LogicError@Json@@UEAA@XZ
??1Path@Json@@QEAA@XZ
??1PathArgument@Json@@QEAA@XZ
??1Reader@Json@@QEAA@XZ
??1RuntimeError@Json@@UEAA@XZ
??1StreamWriter@Json@@UEAA@XZ
??1StreamWriterBuilder@Json@@UEAA@XZ
??1StyledStreamWriter@Json@@QEAA@XZ
??1StyledWriter@Json@@UEAA@XZ
??1Value@Json@@QEAA@XZ
??1Writer@Json@@UEAA@XZ
??4CharReader@Json@@QEAAAEAV01@AEBV01@@Z
??4CharReaderBuilder@Json@@QEAAAEAV01@AEBV01@@Z
??4Exception@Json@@QEAAAEAV01@AEBV01@@Z
??4Factory@CharReader@Json@@QEAAAEAV012@AEBV012@@Z
??4Factory@StreamWriter@Json@@QEAAAEAV012@AEBV012@@Z
??4FastWriter@Json@@QEAAAEAV01@AEBV01@@Z
??4Features@Json@@QEAAAEAV01@$$QEAV01@@Z
??4Features@Json@@QEAAAEAV01@AEBV01@@Z
??4LogicError@Json@@QEAAAEAV01@$$QEAV01@@Z
??4LogicError@Json@@QEAAAEAV01@AEBV01@@Z
??4Path@Json@@QEAAAEAV01@$$QEAV01@@Z
??4Path@Json@@QEAAAEAV01@AEBV01@@Z
??4PathArgument@Json@@QEAAAEAV01@$$QEAV01@@Z
??4PathArgument@Json@@QEAAAEAV01@AEBV01@@Z
??4Reader@Json@@QEAAAEAV01@$$QEAV01@@Z
??4Reader@Json@@QEAAAEAV01@AEBV01@@Z
??4RuntimeError@Json@@QEAAAEAV01@$$QEAV01@@Z
??4RuntimeError@Json@@QEAAAEAV01@AEBV01@@Z
??4StaticString@Json@@QEAAAEAV01@$$QEAV01@@Z
??4StaticString@Json@@QEAAAEAV01@AEBV01@@Z
??4StreamWriter@Json@@QEAAAEAV01@AEBV01@@Z
??4StreamWriterBuilder@Json@@QEAAAEAV01@AEBV01@@Z
??4StyledStreamWriter@Json@@QEAAAEAV01@AEBV01@@Z
??4StyledWriter@Json@@QEAAAEAV01@AEBV01@@Z
??4Value@Json@@QEAAAEAV01@$$QEAV01@@Z
??4Value@Json@@QEAAAEAV01@AEBV01@@Z
??4ValueConstIterator@Json@@QEAAAEAV01@$$QEAV01@@Z
??4ValueConstIterator@Json@@QEAAAEAV01@AEBV01@@Z
??4ValueConstIterator@Json@@QEAAAEAV01@AEBVValueIteratorBase@1@@Z
??4ValueIterator@Json@@QEAAAEAV01@AEBV01@@Z
??4ValueIteratorBase@Json@@QEAAAEAV01@$$QEAV01@@Z
??4ValueIteratorBase@Json@@QEAAAEAV01@AEBV01@@Z
??4Writer@Json@@QEAAAEAV01@AEBV01@@Z
??5Json@@YAAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAV12@AEAVValue@0@@Z
??6Json@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEAV12@AEBVValue@0@@Z
??8Value@Json@@QEBA_NAEBV01@@Z
??8ValueIteratorBase@Json@@QEBA_NAEBV01@@Z
??9Value@Json@@QEBA_NAEBV01@@Z
??9ValueIteratorBase@Json@@QEBA_NAEBV01@@Z
??ACharReaderBuilder@Json@@QEAAAEAVValue@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AStreamWriterBuilder@Json@@QEAAAEAVValue@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AValue@Json@@QEAAAEAV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AValue@Json@@QEAAAEAV01@AEBVStaticString@1@@Z
??AValue@Json@@QEAAAEAV01@H@Z
??AValue@Json@@QEAAAEAV01@I@Z
??AValue@Json@@QEAAAEAV01@PEBD@Z
??AValue@Json@@QEBAAEBV01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??AValue@Json@@QEBAAEBV01@H@Z
??AValue@Json@@QEBAAEBV01@I@Z
??AValue@Json@@QEBAAEBV01@PEBD@Z
??BStaticString@Json@@QEBAPEBDXZ
??BValue@Json@@QEBA_NXZ
??CValueConstIterator@Json@@QEBAPEBVValue@1@XZ
??CValueIterator@Json@@QEAAPEAVValue@1@XZ
??DValueConstIterator@Json@@QEBAAEBVValue@1@XZ
??DValueIterator@Json@@QEAAAEAVValue@1@XZ
??EValueConstIterator@Json@@QEAA?AV01@H@Z
??EValueConstIterator@Json@@QEAAAEAV01@XZ
??EValueIterator@Json@@QEAA?AV01@H@Z
??EValueIterator@Json@@QEAAAEAV01@XZ
??FValueConstIterator@Json@@QEAA?AV01@H@Z
??FValueConstIterator@Json@@QEAAAEAV01@XZ
??FValueIterator@Json@@QEAA?AV01@H@Z
??FValueIterator@Json@@QEAAAEAV01@XZ
??GValueIteratorBase@Json@@QEBAHAEBV01@@Z
??MValue@Json@@QEBA_NAEBV01@@Z
??NValue@Json@@QEBA_NAEBV01@@Z
??OValue@Json@@QEBA_NAEBV01@@Z
??PValue@Json@@QEBA_NAEBV01@@Z
??_7CharReader@Json@@6B@
??_7CharReaderBuilder@Json@@6B@
??_7Exception@Json@@6B@
??_7Factory@CharReader@Json@@6B@
??_7Factory@StreamWriter@Json@@6B@
??_7FastWriter@Json@@6B@
??_7LogicError@Json@@6B@
??_7RuntimeError@Json@@6B@
??_7StreamWriter@Json@@6B@
??_7StreamWriterBuilder@Json@@6B@
??_7StyledWriter@Json@@6B@
??_7Writer@Json@@6B@
??_FStyledStreamWriter@Json@@QEAAXXZ
??_FValue@Json@@QEAAXXZ
?addComment@Reader@Json@@AEAAXPEBD0W4CommentPlacement@2@@Z
?addError@Reader@Json@@AEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAVToken@12@PEBD@Z
?addErrorAndRecover@Reader@Json@@AEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAVToken@12@W4TokenType@12@@Z
?addPathInArg@Path@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$vector@PEBVPathArgument@Json@@V?$allocator@PEBVPathArgument@Json@@@std@@@4@AEAV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@PEBVPathArgument@Json@@@std@@@std@@@4@W4Kind@PathArgument@2@@Z
?all@Features@Json@@SA?AV12@XZ
?append@Value@Json@@QEAAAEAV12@$$QEAV12@@Z
?append@Value@Json@@QEAAAEAV12@AEBV12@@Z
?asBool@Value@Json@@QEBA_NXZ
?asCString@Value@Json@@QEBAPEBDXZ
?asDouble@Value@Json@@QEBANXZ
?asFloat@Value@Json@@QEBAMXZ
?asInt64@Value@Json@@QEBA_JXZ
?asInt@Value@Json@@QEBAHXZ
?asLargestInt@Value@Json@@QEBA_JXZ
?asLargestUInt@Value@Json@@QEBA_KXZ
?asString@Value@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?asUInt64@Value@Json@@QEBA_KXZ
?asUInt@Value@Json@@QEBAIXZ
?begin@Value@Json@@QEAA?AVValueIterator@2@XZ
?begin@Value@Json@@QEBA?AVValueConstIterator@2@XZ
?c_str@StaticString@Json@@QEBAPEBDXZ
?clear@Value@Json@@QEAAXXZ
?compare@Value@Json@@QEBAHAEBV12@@Z
?computeDistance@ValueIteratorBase@Json@@IEBAHAEBV12@@Z
?containsNewLine@Reader@Json@@CA_NPEBD0@Z
?copy@Value@Json@@QEAAXAEBV12@@Z
?copy@ValueIteratorBase@Json@@IEAAXAEBV12@@Z
?copyPayload@Value@Json@@QEAAXAEBV12@@Z
?currentValue@Reader@Json@@AEAAAEAVValue@2@XZ
?decodeDouble@Reader@Json@@AEAA_NAEAVToken@12@@Z
?decodeDouble@Reader@Json@@AEAA_NAEAVToken@12@AEAVValue@2@@Z
?decodeNumber@Reader@Json@@AEAA_NAEAVToken@12@@Z
?decodeNumber@Reader@Json@@AEAA_NAEAVToken@12@AEAVValue@2@@Z
?decodeString@Reader@Json@@AEAA_NAEAVToken@12@@Z
?decodeString@Reader@Json@@AEAA_NAEAVToken@12@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?decodeUnicodeCodePoint@Reader@Json@@AEAA_NAEAVToken@12@AEAPEBDPEBDAEAI@Z
?decodeUnicodeEscapeSequence@Reader@Json@@AEAA_NAEAVToken@12@AEAPEBDPEBDAEAI@Z
?decrement@ValueIteratorBase@Json@@IEAAXXZ
?defaultRealPrecision@Value@Json@@2IB
?demand@Value@Json@@QEAAPEAV12@PEBD0@Z
?deref@ValueIteratorBase@Json@@IEAAAEAVValue@2@XZ
?deref@ValueIteratorBase@Json@@IEBAAEBVValue@2@XZ
?dropNullPlaceholders@FastWriter@Json@@QEAAXXZ
?dupMeta@Value@Json@@AEAAXAEBV12@@Z
?dupPayload@Value@Json@@AEAAXAEBV12@@Z
?empty@Value@Json@@QEBA_NXZ
?enableYAMLCompatibility@FastWriter@Json@@QEAAXXZ
?end@Value@Json@@QEAA?AVValueIterator@2@XZ
?end@Value@Json@@QEBA?AVValueConstIterator@2@XZ
?find@Value@Json@@QEBAPEBV12@PEBD0@Z
?get@Value@Json@@QEBA?AV12@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV12@@Z
?get@Value@Json@@QEBA?AV12@IAEBV12@@Z
?get@Value@Json@@QEBA?AV12@PEBD0AEBV12@@Z
?get@Value@Json@@QEBA?AV12@PEBDAEBV12@@Z
?getComment@Value@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4CommentPlacement@2@@Z
?getFormatedErrorMessages@Reader@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getFormattedErrorMessages@Reader@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getLocationLineAndColumn@Reader@Json@@AEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z
?getLocationLineAndColumn@Reader@Json@@AEBAXPEBDAEAH1@Z
?getMemberNames@Value@Json@@QEBA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?getNextChar@Reader@Json@@AEAADXZ
?getOffsetLimit@Value@Json@@QEBA_JXZ
?getOffsetStart@Value@Json@@QEBA_JXZ
?getString@Value@Json@@QEBA_NPEAPEBD0@Z
?getStructuredErrors@Reader@Json@@QEBA?AV?$vector@UStructuredError@Reader@Json@@V?$allocator@UStructuredError@Reader@Json@@@std@@@std@@XZ
?good@Reader@Json@@QEBA_NXZ
?hasComment@Value@Json@@QEBA_NW4CommentPlacement@2@@Z
?hasCommentForValue@StyledStreamWriter@Json@@CA_NAEBVValue@2@@Z
?hasCommentForValue@StyledWriter@Json@@CA_NAEBVValue@2@@Z
?increment@ValueIteratorBase@Json@@IEAAXXZ
?indent@StyledStreamWriter@Json@@AEAAXXZ
?indent@StyledWriter@Json@@AEAAXXZ
?index@ValueIteratorBase@Json@@QEBAIXZ
?initBasic@Value@Json@@AEAAXW4ValueType@2@_N@Z
?insert@Value@Json@@QEAA_NI$$QEAV12@@Z
?insert@Value@Json@@QEAA_NIAEBV12@@Z
?invalidPath@Path@Json@@CAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?isAllocated@Value@Json@@AEBA_NXZ
?isArray@Value@Json@@QEBA_NXZ
?isBool@Value@Json@@QEBA_NXZ
?isConvertibleTo@Value@Json@@QEBA_NW4ValueType@2@@Z
?isDouble@Value@Json@@QEBA_NXZ
?isEqual@ValueIteratorBase@Json@@IEBA_NAEBV12@@Z
?isInt64@Value@Json@@QEBA_NXZ
?isInt@Value@Json@@QEBA_NXZ
?isIntegral@Value@Json@@QEBA_NXZ
?isMember@Value@Json@@QEBA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isMember@Value@Json@@QEBA_NPEBD0@Z
?isMember@Value@Json@@QEBA_NPEBD@Z
?isMultilineArray@StyledStreamWriter@Json@@AEAA_NAEBVValue@2@@Z
?isMultilineArray@StyledWriter@Json@@AEAA_NAEBVValue@2@@Z
?isNull@Value@Json@@QEBA_NXZ
?isNumeric@Value@Json@@QEBA_NXZ
?isObject@Value@Json@@QEBA_NXZ
?isString@Value@Json@@QEBA_NXZ
?isUInt64@Value@Json@@QEBA_NXZ
?isUInt@Value@Json@@QEBA_NXZ
?isValidIndex@Value@Json@@QEBA_NI@Z
?key@ValueIteratorBase@Json@@QEBA?AVValue@2@XZ
?make@Path@Json@@QEBAAEAVValue@2@AEAV32@@Z
?makePath@Path@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$vector@PEBVPathArgument@Json@@V?$allocator@PEBVPathArgument@Json@@@std@@@4@@Z
?match@Reader@Json@@AEAA_NPEBDH@Z
?maxInt64@Value@Json@@2_JB
?maxInt@Value@Json@@2HB
?maxLargestInt@Value@Json@@2_JB
?maxLargestUInt@Value@Json@@2_KB
?maxUInt64@Value@Json@@2_KB
?maxUInt64AsDouble@Value@Json@@2NB
?maxUInt@Value@Json@@2IB
?memberName@ValueIteratorBase@Json@@QEBAPEBDPEAPEBD@Z
?memberName@ValueIteratorBase@Json@@QEBAPEBDXZ
?minInt64@Value@Json@@2_JB
?minInt@Value@Json@@2HB
?minLargestInt@Value@Json@@2_JB
?name@ValueIteratorBase@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?newCharReader@CharReaderBuilder@Json@@UEBAPEAVCharReader@2@XZ
?newStreamWriter@StreamWriterBuilder@Json@@UEBAPEAVStreamWriter@2@XZ
?normalizeEOL@Reader@Json@@CA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD0@Z
?null@Value@Json@@2AEBV12@EB
?nullRef@Value@Json@@2AEBV12@EB
?nullSingleton@Value@Json@@SAAEBV12@XZ
?omitEndingLineFeed@FastWriter@Json@@QEAAXXZ
?parse@Reader@Json@@QEAA_NAEAV?$basic_istream@DU?$char_traits@D@std@@@std@@AEAVValue@2@_N@Z
?parse@Reader@Json@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAVValue@2@_N@Z
?parse@Reader@Json@@QEAA_NPEBD0AEAVValue@2@_N@Z
?parseFromStream@Json@@YA_NAEBVFactory@CharReader@1@AEAV?$basic_istream@DU?$char_traits@D@std@@@std@@PEAVValue@1@PEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z
?pushError@Reader@Json@@QEAA_NAEBVValue@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?pushError@Reader@Json@@QEAA_NAEBVValue@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?pushValue@StyledStreamWriter@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?pushValue@StyledWriter@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?readArray@Reader@Json@@AEAA_NAEAVToken@12@@Z
?readCStyleComment@Reader@Json@@AEAA_NXZ
?readComment@Reader@Json@@AEAA_NXZ
?readCppStyleComment@Reader@Json@@AEAA_NXZ
?readNumber@Reader@Json@@AEAAXXZ
?readObject@Reader@Json@@AEAA_NAEAVToken@12@@Z
?readString@Reader@Json@@AEAA_NXZ
?readToken@Reader@Json@@AEAA_NAEAVToken@12@@Z
?readValue@Reader@Json@@AEAA_NXZ
?recoverFromError@Reader@Json@@AEAA_NW4TokenType@12@@Z
?releasePayload@Value@Json@@AEAAXXZ
?removeIndex@Value@Json@@QEAA_NIPEAV12@@Z
?removeMember@Value@Json@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?removeMember@Value@Json@@QEAAXPEBD@Z
?removeMember@Value@Json@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEAV12@@Z
?removeMember@Value@Json@@QEAA_NPEBD0PEAV12@@Z
?removeMember@Value@Json@@QEAA_NPEBDPEAV12@@Z
?resize@Value@Json@@QEAAXI@Z
?resolve@Path@Json@@QEBA?AVValue@2@AEBV32@0@Z
?resolve@Path@Json@@QEBAAEBVValue@2@AEBV32@@Z
?resolveReference@Value@Json@@AEAAAEAV12@PEBD0@Z
?resolveReference@Value@Json@@AEAAAEAV12@PEBD@Z
?setComment@Value@Json@@QEAAXPEBDW4CommentPlacement@2@@Z
?setComment@Value@Json@@QEAAXPEBD_KW4CommentPlacement@2@@Z
?setComment@Value@Json@@QEAAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4CommentPlacement@2@@Z
?setDefaults@CharReaderBuilder@Json@@SAXPEAVValue@2@@Z
?setDefaults@StreamWriterBuilder@Json@@SAXPEAVValue@2@@Z
?setIsAllocated@Value@Json@@AEAAX_N@Z
?setOffsetLimit@Value@Json@@QEAAX_J@Z
?setOffsetStart@Value@Json@@QEAAX_J@Z
?setType@Value@Json@@AEAAXW4ValueType@2@@Z
?size@Value@Json@@QEBAIXZ
?skipCommentTokens@Reader@Json@@AEAAXAEAVToken@12@@Z
?skipSpaces@Reader@Json@@AEAAXXZ
?strictMode@CharReaderBuilder@Json@@SAXPEAVValue@2@@Z
?strictMode@Features@Json@@SA?AV12@XZ
?swap@Value@Json@@QEAAXAEAV12@@Z
?swapPayload@Value@Json@@QEAAXAEAV12@@Z
?toStyledString@Value@Json@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?type@Value@Json@@QEBA?AW4ValueType@2@XZ
?unindent@StyledStreamWriter@Json@@AEAAXXZ
?unindent@StyledWriter@Json@@AEAAXXZ
?validate@CharReaderBuilder@Json@@QEBA_NPEAVValue@2@@Z
?validate@StreamWriterBuilder@Json@@QEBA_NPEAVValue@2@@Z
?valueToQuotedString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NIW4PrecisionType@1@@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z
?valueToString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?what@Exception@Json@@UEBAPEBDXZ
?write@FastWriter@Json@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@2@@Z
?write@StyledStreamWriter@Json@@QEAAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AEBVValue@2@@Z
?write@StyledWriter@Json@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVValue@2@@Z
?writeArrayValue@StyledStreamWriter@Json@@AEAAXAEBVValue@2@@Z
?writeArrayValue@StyledWriter@Json@@AEAAXAEBVValue@2@@Z
?writeCommentAfterValueOnSameLine@StyledStreamWriter@Json@@AEAAXAEBVValue@2@@Z
?writeCommentAfterValueOnSameLine@StyledWriter@Json@@AEAAXAEBVValue@2@@Z
?writeCommentBeforeValue@StyledStreamWriter@Json@@AEAAXAEBVValue@2@@Z
?writeCommentBeforeValue@StyledWriter@Json@@AEAAXAEBVValue@2@@Z
?writeIndent@StyledStreamWriter@Json@@AEAAXXZ
?writeIndent@StyledWriter@Json@@AEAAXXZ
?writeString@Json@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBVFactory@StreamWriter@1@AEBVValue@1@@Z
?writeValue@FastWriter@Json@@AEAAXAEBVValue@2@@Z
?writeValue@StyledStreamWriter@Json@@AEAAXAEBVValue@2@@Z
?writeValue@StyledWriter@Json@@AEAAXAEBVValue@2@@Z
?writeWithIndent@StyledStreamWriter@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?writeWithIndent@StyledWriter@Json@@AEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
NvOptimusEnablementCuda
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
989KB
Virtual Size
989KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
63KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nv_fatb
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nvFatBi
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=79, id=260, version=26715,
count=28, id=259, version=26715,
count=195, id=261, version=26715,
count=19, id=260, version=28427,
count=9, id=259, version=28427,
count=155, id=261, version=28427,
count=12, id=257, version=26715,
count=565, id=260, version=24245,
count=1, id=206, productName=VS2012 build 50727, version=50727,
count=16, id=207, productName=VS2012 build 50727, version=50727,
count=2, id=260, productName=VS2019 v16.5.5 build 28614, version=28614,
count=3, id=257, version=25019,
count=326, id=1, productName=Unmarked objects,
count=15, id=261, productName=VS2019 v16.5.5 build 28614, version=28614,
count=22, id=265, version=28614,
count=1, id=256, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
Sheet rat 2.6 Кастом/Stub/fds.dll
- IMPHASH 6dbf95d81ab0cb2039f47259ddec333f
- SHA256 97d5a331191b9361ed82c41dbdf74a0b54901d20129a0c0a0f1ecbeca5e9d1ab
- MD5 a6616dc75aa8f04a473e93d36315696d
- SHA1 bfaae46514424f27c1204aa7a4ddf3497a4eec4e
- SHA512 5eaf900eda2c6f494750d59b7bfa90d05374146e006ffce3b6997b9a3aedff1d0b9a6c4cffc796950b63f7c6708ad64bcaae3a517e8ee27c79e6a0bff435783f
- SSDEEP 3072:6iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MnWZpt:67yDSvdoRj2up
- TLSH T1CBB34A0772E600BFE2664638C5630A09E777B8211770DB6F23A4429D9F277E19D3AF61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\SheetRat\SheetRat\bin\Release\Stub\UserMode.pdb
kernel32
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetModuleHandleA
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=133, id=261, version=27412,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=7, id=265, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
Sheet rat 2.6 Кастом/Stub/nvrtc-builtins64_112.dll
- IMPHASH 8f855f48184bff75de5ed8f701a5f778
- SHA256 fdf1b46d181009aa3ea08e4692499e25edf2dd9ca6bbdd9cfa3ee37a73e8ad3b
- MD5 61c8ad0912cd1a5a4093342a4ceb9888
- SHA1 80c0b77d68643680b364604e91104f23a61ba2f4
- SHA512 deb8d3d9d95d7cb7380b1fb0835f3f80268dce63cc1bce06d30ef050179f92c403f6e8d45b0ad8d4ced53649c7a744ade6743c4a98384ee336a4c103b118e38b
- SSDEEP 12288:zpoJo2foXo2ko2NoYo2mo2To27o2go27o2Oo2so2no2Poroco2yo2ao2yo2Uo2UZ:zsnCDo
- TLSH T17D46642C79F8D0F8C8722933C9994749C5CEC8BB2A5D65F8B6492D2C290361BC9F95DC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5064
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineA
GetCurrentThreadId
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
Sleep
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
IsProcessorFeaturePresent
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryW
HeapSize
LCMapStringEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
getArchBuiltins
getBuiltinHeader
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=203, version=65501,
count=77, id=1, productName=Unmarked objects,
count=18, id=207, version=50628,
count=84, id=206, version=50628,
count=7, id=205, version=50628,
count=12, id=207, productName=VS2012 build 50727, version=50727,
count=1, id=202, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
Sheet rat 2.6 Кастом/Stub/nvrtc64_112_0.dll
- IMPHASH 4ca0827c1b67fe072d17a90113be5a0b
- SHA256 53275679bcf450cf7199a9267f7fcf669a2c457b19d67699391e30d5ff944481
- MD5 5bb58f73e1d17bf4263eac2390095140
- SHA1 a451494f177a323badee994f5973ec76c264c405
- SHA512 6396b27e243280ed7cfdd86ed8b9ea914e7a2b17bc21607ccd148ff1aa4c230603e58b5dc48244d3f2b47cc1dd53266c33502907b82e181b0b78dc9d2c0b964b
- SSDEEP 786432:lZKWAdkt9YpGoefLh5cXBgAFyJBBmT8Lhp:l0Wmkt9YpG3fLh5cXBgAUJBBmT8L
- TLSH T1B067AE6A716510D8C07BE1788A079D47FBB1349A4335AADF15A04AB62F13FF0263F7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10051492
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
user32
CharUpperW
advapi32
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
ole32
CoTaskMemFree
shell32
SHGetKnownFolderPath
kernel32
FindFirstFileExA
FindNextFileA
GetCommandLineA
HeapReAlloc
RemoveDirectoryW
HeapWalk
HeapValidate
CreateFileA
CreateFileW
GetFileAttributesA
GetFileAttributesW
SetFilePointerEx
WriteFile
CloseHandle
GetLastError
MapViewOfFileEx
UnmapViewOfFile
FormatMessageA
CreateFileMappingA
GetTempPathA
GetTempFileNameA
GetLocaleInfoA
FreeLibrary
GetProcAddress
LoadLibraryA
IsDebuggerPresent
OutputDebugStringA
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitProcess
GetModuleHandleW
GetModuleHandleExW
DeleteFileW
ReadFile
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetCurrentProcessId
SetConsoleCtrlHandler
QueryPerformanceCounter
QueryPerformanceFrequency
SetEnvironmentVariableA
SetEnvironmentVariableW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA
FindClose
FindFirstFileExW
FindNextFileW
SetLastError
GetCurrentThread
GetCurrentThreadId
HeapFree
HeapAlloc
GetStringTypeW
GetStdHandle
GetStartupInfoW
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetOEMCP
SetStdHandle
GetProcessHeap
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
HeapSize
SetEndOfFile
WriteConsoleW
InitializeCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateThread
CreateSemaphoreA
CreateWaitableTimerA
GetModuleHandleA
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetExitCodeProcess
GetModuleFileNameA
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
GetEnvironmentVariableW
CreateDirectoryW
GetFinalPathNameByHandleW
SetFileInformationByHandle
SetFileTime
DuplicateHandle
Sleep
GetSystemTime
GetSystemInfo
VirtualQuery
CreateFileMappingW
MapViewOfFile
SystemTimeToFileTime
LoadLibraryW
GetCommandLineW
GetProcessTimes
GetNativeSystemInfo
LocalFree
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SearchPathW
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
FormatMessageW
RtlPcToFileHeader
EncodePointer
DecodePointer
WaitForSingleObjectEx
CreateEventW
GetTickCount
SetEvent
ResetEvent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
__nvrtcCPEx
nvrtcAddNameExpression
nvrtcCompileProgram
nvrtcCreateProgram
nvrtcDestroyProgram
nvrtcGetCUBIN
nvrtcGetCUBINSize
nvrtcGetErrorString
nvrtcGetLoweredName
nvrtcGetNumSupportedArchs
nvrtcGetPTX
nvrtcGetPTXSize
nvrtcGetProgramLog
nvrtcGetProgramLogSize
nvrtcGetSupportedArchs
nvrtcVersion
Name
.text
Size
20.7MB
Virtual Size
20.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7.6MB
Virtual Size
7.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.2MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
900KB
Virtual Size
900KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=206, version=65501,
count=2, id=199, version=41118,
count=34, id=260, version=25019,
count=126, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,
count=79, id=260, productName=VS2017 v15.8.9? build 26730, version=26730,
count=13, id=203, version=65501,
count=220, id=1, productName=Unmarked objects,
count=45, id=260, version=24610,
count=22, id=259, version=24610,
count=210, id=261, version=24610,
count=116, id=261, version=24723,
count=40, id=260, version=24723,
count=10, id=259, version=24723,
count=873, id=261, version=25019,
count=1, id=256, version=25019,
count=1, id=255, version=25019,
count=1, id=258, version=25019,
Sheet rat 2.6 Кастом/Stub/sigthief.exe
- IMPHASH ba5546933531fafa869b1f86a4e2a959
- SHA256 c85e5240da0e9d06677278f01c55f7d2611641ebeeafff9529e383e6948fd9ee
- MD5 3e261becbfe12d7a5ffdbba91c76011b
- SHA1 2e5849aa0be921849f42121544895ce405fd9af1
- SHA512 02e897be04fd0d42300d6822f21cf8e435c53ef8ddd5054d9313fb348ad6ccfb70da3cec402d1aa1589217911f9bbfa3623d73dc647c23b0db3e0a656ffd76ae
- SSDEEP 196608:R8H4yqXdQmRrdA6lXCy1ArqkVpKCX+PrF4ZHnFHeghaemVe:w4ySdQOlXrAZYCuPJOHnVeg
- TLSH T10A66335423410CFDED6A403BC8A1991EE6D4BC53A750C56B83D48BAF2F6B6E06DBB710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
42656
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=190, id=261, version=30795,
count=10, id=260, version=30795,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=5, id=257, version=30795,
count=117, id=1, productName=Unmarked objects,
count=20, id=260, version=31937,
count=1, id=258, version=31937,
sigthief.pyc
- SHA256 ce721f5b11024398d7cd9dee3c09a8f0808ad47e41ddd8bad353915f5c4ba929
- MD5 bd259b78802e5d16e6e9270c24696abf
- SHA1 1450f17973f7226687d6bfde7b6a5de32b88d673
- SHA512 5170b410775c1ecbe80f333f598069858eeb0acddd0411c5a40c2945a85805ea6e6797690afb19d3c069e62bd11341c5cabb9f757c1c7fe409b4077c6b2173c8
- SSDEEP 192:EHmxQlq2qYEqG2myU2jNrvH9qN91HPJzRJuZs03i:EGxQY/YEqGqUKc5+s0y
- TLSH T15EE1544F8A522A91F9D6FBB0214D6D309960C2D713C81C1F2A06F21B1EEE5D8657F8ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Sheet rat 2.6 Кастом/Stub/xmrminer.exe
- IMPHASH 14ec8f3f7eee2e31d6dc574514386b4d
- SHA256 4766966b4c125dcdbba55f6d9beacc371ee9700e0f10900a35ef9f15b3357022
- MD5 f97406a10af445519bbb391b22366978
- SHA1 400339e335bc0352a9a342008c1d146cddb1b2d2
- SHA512 1df48a68e2458109d4cbc0331ab11c1c76558d617c2a70d6f60ca3783aea7c895f05204d647986d28b8d6e48f6479e68c4b9e87176a8761219ae4b636a37c6f0
- SSDEEP 98304:t5AfKZ70gcjrWgcTKUAEiLityOebCX+eui7V6ENz4G:sMmUAEqitCeXCiRXz4G
- TLSH T186368D16B6A500E8D9BBC07CC64B9A07E7F2B41543B09BDB16B446AA0F137D15E3EB34
- MD5 SHA1 SHA512 SSDEEP TLSH
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3208184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
htonl
htons
ntohs
WSARecvFrom
WSASend
WSARecv
WSAIoctl
WSADuplicateSocketW
FreeAddrInfoW
GetAddrInfoW
gethostname
listen
bind
getsockname
WSASetLastError
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
inet_pton
getaddrinfo
WSAStartup
getpeername
send
socket
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
psapi
GetProcessMemoryInfo
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertCloseStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
kernel32
GetStdHandle
SetConsoleMode
GetConsoleMode
GetComputerNameW
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
SetThreadExecutionState
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleTitleA
WriteConsoleW
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFinalPathNameByHandleW
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSection
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
RtlUnwind
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
QueryPerformanceFrequency
GlobalMemoryStatusEx
GetVersionExW
VerifyVersionInfoA
FileTimeToSystemTime
SetHandleInformation
CancelIo
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
SwitchToThread
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
CreateTimerQueue
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetLocaleInfoW
CompareStringW
CreateEventW
GetCPInfo
DecodePointer
SignalObjectAndWait
SetConsoleTextAttribute
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibraryAndExitThread
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwindEx
SetStdHandle
GetCommandLineA
GetCommandLineW
ExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCursorPosition
VerSetConditionMask
EncodePointer
RaiseException
WaitForSingleObjectEx
GetExitCodeThread
RtlPcToFileHeader
user32
GetSystemMetrics
MapVirtualKeyW
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
ShowWindow
GetLastInputInfo
shell32
SHGetSpecialFolderPathA
SHGetFolderPathW
advapi32
SystemFunction036
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptImportKey
GetUserNameW
bcrypt
BCryptGenRandom
Name
.text
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
71KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RANDOMX
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_SHA3_25
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=260, version=26715,
count=13, id=259, version=26715,
count=201, id=261, version=26715,
count=4, id=199, version=41118,
count=19, id=260, version=28427,
count=9, id=259, version=28427,
count=150, id=261, version=28427,
count=18, id=260, productName=VS2019 v16.5.5 build 28614, version=28614,
count=21, id=257, version=26715,
count=362, id=1, productName=Unmarked objects,
count=595, id=260, productName=VS2019 v16.6.0 build 28805, version=28805,
count=258, id=265, version=28614,
count=4, id=259, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
Sheet rat 2.6 Кастом/System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
17218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/System.Collections.Immutable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67730917b4e856e37a9d78245527584087fac6b20a7377677b2f444cd15db918
- MD5 8f55c22412f7d448d6e7b83102665368
- SHA1 88df86ee0b137992af15a35825804274fa252e30
- SHA512 058431aa2280511b00a72ea55ded9bdaef55420f5bce10c9352d4f92736a11884d1e70706016b988cca560358b3b43ce1bad5c9bd726f11d8ad66e3c91f98ccb
- SSDEEP 3072:gUbJLl+WMe7FJ02NPhVN0T2rcoNXvUJ4C0jucx2ejoVjM4xT56pL:gUVMWNvrxUJ4CDcY5G
- TLSH T127043901738C8736CABF4D77B46285DA9A36C253E183B3DE29DCFBB448933A49D91059
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:35:16:55:df:62:5e:90:93:72:fe:bd:fe:ac:db:f2:1e:96:b4:4d:30:e1:68:45:9c:04:3b:aa:ba:f4:42:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
174314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb
mscoree
_CorDllMain
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
- MD5 6fb95a357a3f7e88ade5c1629e2801f8
- SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
- SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
- SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
- TLSH T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:b0:3b:7a:83:84:ef:83:06:3f:da:91:51:13:f8:7d:32:fc:46:43:1c:0f:b6:cd:f7:db:87:4b:17:93:f7:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:8A82-E34F-9DDA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:19:8c:bb:54:08:0a:5d:fe:65:00:00:00:00:01:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
136106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
103866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/System.Runtime.CompilerServices.Unsafe.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
- MD5 da04a75ddc22118ed24e0b53e474805a
- SHA1 2d68c648a6a6371b6046e6c3af09128230e0ad32
- SHA512 26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
- SSDEEP 192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
- TLSH T1CD72294A4BA80313ED736B309AA4D443FE38A7D75812D72F1985F1B91CDB7D4AF21628
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:84:6c:5c:c9:e6:39:56:a6:5f:23:06:01:58:8b:e1:ae:37:c4:fe:71:62:f4:b5:f7:ae:87:52:ec:0c:f4:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:AE2C-E32B-1AFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:16:93:22:ea:bf:bb:2d:4d:e6:00:00:00:00:01:16
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Feb 11, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
12894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/Themes.json
- SHA256 d212383c21a5816acf46c55088753ba12c5ae838f8966a5eaaa318465c2fa65c
- MD5 e09f235ee19284d56f55e1b25f99eec9
- SHA1 4b0cebc24cf6747ebb9da69b709f1308611d4674
- SHA512 bf79ac7b3b0baa600f32558d48ea99741afdf27805886ca076510a30eef16b7eb7387b7161abdfacd64862bada664c550f338837bf37972b9f24b5e627ba52d3
- MD5 SHA1 SHA512
Sheet rat 2.6 Кастом/Users/1AECA2E5C88C3836BEBFA3C/Info_admin_DESKTOP-JGLLJLD.txt
- SHA256 623ff22a71f6d9bdb8d11076f6ab76cc32283f402a5cc7be899cbab512903a2d
- MD5 f19fb4b3dce264c3b6a8303a2322911b
- SHA1 9db78d73d9fd8c2c6a48ef304b75809d03ab5b9b
- SHA512 2d2c42e103e93ed61b32a4a6ff50bb94a8853af9d0a169177789c44ece20fdaecd0ec36f74a2a0b53e96d5cdc7c65c0606360820d4dc1b3db7bda3afcba26cec
- TLSH T14DF0F12102B4E031E39DC1840B1FCE0A38F5304724A20BF8B4CD1114AF962CAF2226AD
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Users/5572977BE700F2B42617C7A/Info_Xyesos_HOME-PC.txt
- SHA256 9c9c9055bf31bdc6bf10ded3f3fbf0728ca3b12856aa18775bf4513531e3797c
- MD5 ab159b672448acc532cccd476b5b1f14
- SHA1 16055d8673e09c7b4e31d30284ccf4ddb4798b87
- SHA512 f115f1be6e56359b7c5f444f5a7557ee2f11ca09a5536ca54c22e02b7abff424473ca90538deab272e6784d13e2cc7dc7ace7e3d9081615bc21d9dc111840bb7
- TLSH T1D10146931A27D9BF5A6CC04A13AAC265396330E5A2E30838FDDE4244EFE502C676225C
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Users/999ED12B975C14C1FEB9EF0/Info_Admin_KOMP.txt
- SHA256 3a29cc7d17603cafef49ab68d34f8668aac9857abf7a27a8bd0e19c4b3190a7e
- MD5 28f8f17fa4f9bf2e98b870260f182209
- SHA1 3f268ea1c8add00d867034f4bf8bc43d69db87bd
- SHA512 534bce436e339d6854c81d91338e3c7b92d46c7b85606406a24b8c0ccc86157b5ee651448dbffb78994bc6e5491e52d935f68881ff8e8020f9d791030558bf67
- TLSH T1D2F09E96167B99BE2A7CC459168FC74528B370B963930834F9DE1158FBE002C671A32E
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Users/ACF10C1FB745CEF04A951F2/Info_Artem_DESKTOP-MAVCR0K.txt
- SHA256 d4dbc66a92ff1190c41e9a099477f0e6ad3e98e318fd0ed9fe799f47dafdacb7
- MD5 0c014c22f2096946c16273e3d756d843
- SHA1 39eba96af7e83f57ff78e1699f052a452ad1bbfb
- SHA512 2085ea825aea0917a059ae91a2fd0f63f332334df8d8a6bac61e2dfcc88fab6922e5f5ff7a10a140d4939d5c05f75eeced4f6159f56d9204b3f6c1e4c8bbdea6
- TLSH T11AF023020978F4FB643641C0490FCE1220F3B06512330E79F4DF2604FB90004B096A5C
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Users/BE1C1BF21A89FE60C442043/Info_Fase Mig_DESKTOP-4KGSDAE.txt
- SHA256 2937b74e0f26605615d269b6892e20824dd4026ad2b442f975671e3c14023041
- MD5 9b9320140013b113b2fba23a294776e8
- SHA1 60b706bb448664e94d87e85f721b936feae38d3e
- SHA512 f4258fe2216111c4dcbd3a4002c634491e00f27dcd7f1bb5e84260fd618d0b436d5247763680feb6e0e6f1eb2a16970dbc14013de50bb0b4169e60e70c9158c7
- TLSH T151F05415065CE03719118AC50A0EDB92A5B3D02410338F70F0FF13A0F78040CB31709E
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Users/CE9814B0971C0D1DBBB7706/Info_9bwFZvGCb_WIN-OIUYV0HQHNG.txt
- SHA256 054070d9d5d957ee16af363fca0a4da0a03ffc08cf87ce01d36a16b4eaf21acd
- MD5 7c598436d332cdfd47828a31c2d1ee23
- SHA1 942d7e3f67a965f10ac10a9cfb94b568aace78cd
- SHA512 9925ea17138f61681a16e73938bf0705b599693b7c62eb3c55d894418f02c31fba91098b96c5237b1a9ac9f7f46574bf5fb1c73cf4855e13982598d545657268
- TLSH T162F0FA131528D0799D76C1C53E37CD0AB2A030413C930F7D71DD02647B4628C754297D
- MD5 SHA1 SHA512 TLSH
Sheet rat 2.6 Кастом/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c05a6f13106e2dd10ae279c3435fb63fbabdc328f94d8065231c3cacfff5fc4b
- MD5 22fbd571c82399e06e0a7321eedef722
- SHA1 ed5aa859dc8141d93a2bd8a8dd14fc50391b66db
- SHA512 65aa846054a2b0c0dcb2db15273269d8514e000ac67e71542f910d8f556a0ea11e5ab5400b7f2026e5e51fef185d8e12379ac52fa4788c8940727a3721d134d0
- SSDEEP 1536:RS0nOie9ZLjnhULE4ocLF3zqvtm0KMtI9eWG3fL+:M0w9ZPnGLEPc1qvtTKr9eHa
- TLSH T160731B1897BCDBE6C6FE0779B413552527F0C706B22BE35ECCC8E4E96C9579205222A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- TLSH T1EB356B0177E9AB3BC49E837AD432091943F2D40677A3EB0F1654EBB92C837959C217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1167430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Sheet rat 2.6 Кастом/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f01d9f2ed07e630ec078efa5d760762c3c8ad3b06e9e8a9062a37d63d57b026
- MD5 9fbb8cec55b2115c00c0ba386c37ce62
- SHA1 e2378a1c22c35e40fd1c3e19066de4e33b50f24a
- SHA512 da0211d1c9ba0a59616bc15de80a1fed62b0405cad3b11ae4220ef1488c7837634aad67cbc8b484621a2a6288ef5e424cd816a2523bdb6167abcab76f3ac1a04
- SSDEEP 6144:1kWu4n53u8Q5w+8yxIxM2NUpwMTRHslVz:G4n5e8kXOMkUp9GlV
- TLSH T12A546D2423FD5B1AE6FE97B8A478140C47F6F90B751BEB5E499094F90C22BC089117BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ