22.rar
- SHA256 d7e4dad76866a3f6d17733c5bc291e941e08c67b189a3afc2318e9252d2e50a9
Overview
overview
9Static
static
3Debug/net8...I2.dll
windows10-2004-x64
1Debug/net8...I2.dll
windows11-ltsc_2024-x64
1Debug/net8...ll.exe
windows10-2004-x64
1Debug/net8...ll.exe
windows11-ltsc_2024-x64
1Debug/net8...ll.exe
windows10-2004-x64
9Debug/net8...ll.exe
windows11-ltsc_2024-x64
9Debug/net8...io.dll
windows10-2004-x64
1Debug/net8...io.dll
windows11-ltsc_2024-x64
1Debug/net8...re.dll
windows10-2004-x64
1Debug/net8...re.dll
windows11-ltsc_2024-x64
1Debug/net8...di.dll
windows10-2004-x64
1Debug/net8...di.dll
windows11-ltsc_2024-x64
1Debug/net8...pi.dll
windows10-2004-x64
1Debug/net8...pi.dll
windows11-ltsc_2024-x64
1Debug/net8...ms.dll
windows10-2004-x64
1Debug/net8...ms.dll
windows11-ltsc_2024-x64
1Debug/net8...MM.dll
windows10-2004-x64
1Debug/net8...MM.dll
windows11-ltsc_2024-x64
1Debug/net8...io.dll
windows10-2004-x64
1Debug/net8...io.dll
windows11-ltsc_2024-x64
1Debug/net8...nt.dll
windows10-2004-x64
1Debug/net8...nt.dll
windows11-ltsc_2024-x64
1Debug/net8...nt.dll
windows10-2004-x64
3Debug/net8...nt.dll
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Debug/net8.0-windows/Guna.UI2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debug/net8.0-windows/Guna.UI2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Debug/net8.0-windows/JHNM_PowerShell.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Debug/net8.0-windows/JHNM_PowerShell.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Debug/net8.0-windows/JHNM_PowerShell.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
Debug/net8.0-windows/JHNM_PowerShell.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral7
Sample
Debug/net8.0-windows/NAudio.Asio.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Debug/net8.0-windows/NAudio.Asio.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Debug/net8.0-windows/NAudio.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Debug/net8.0-windows/NAudio.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Debug/net8.0-windows/NAudio.Midi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Debug/net8.0-windows/NAudio.Midi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Debug/net8.0-windows/NAudio.Wasapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Debug/net8.0-windows/NAudio.Wasapi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Debug/net8.0-windows/NAudio.WinForms.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Debug/net8.0-windows/NAudio.WinForms.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Debug/net8.0-windows/NAudio.WinMM.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Debug/net8.0-windows/NAudio.WinMM.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Debug/net8.0-windows/NAudio.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Debug/net8.0-windows/NAudio.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Debug/net8.0-windows/System.Management.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Debug/net8.0-windows/System.Management.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Debug/net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Debug/net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 22.rar
- Size 1.2MB
- Sample260822-xbchcsszhs
- SHA256 d7e4dad76866a3f6d17733c5bc291e941e08c67b189a3afc2318e9252d2e50a9
- MD5 b7ad03f3334c26b2c79221214e1d4e9e
- SHA1 7adae63f756048a03570d04e9d55bef1ef5981f9
- SHA512 48e02539df7174e7fd12a232a3d0327eb60dc89c6c2574b7c4403ff09835a73e4c29e93d9e77b03ee448ba24f68aa1a6f29f21e2794b67bc4d593b87013bd1d3
- SSDEEP 24576:pw7L/gFtTrxFXgQXL1icaC7hwLfVunJ8Wy2ztlhIkeqCkHYs1FosRtxfQp:pM4rrxNJ1rb1k0i6xPeqRHYs19Rfy
- TLSH T1E0453307DF2444C4F875CD3DC97A970FB460CED5E091CA2BAE2ACAF69269A7074071A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/net8.0-windows/JHNM_PowerShell.dll unpack001/Debug/net8.0-windows/JHNM_PowerShell.exe unpack001/Debug/net8.0-windows/NAudio.Asio.dll unpack001/Debug/net8.0-windows/NAudio.Core.dll unpack001/Debug/net8.0-windows/NAudio.Midi.dll unpack001/Debug/net8.0-windows/NAudio.Wasapi.dll unpack001/Debug/net8.0-windows/NAudio.WinForms.dll unpack001/Debug/net8.0-windows/NAudio.WinMM.dll unpack001/Debug/net8.0-windows/NAudio.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Debug/net8.0-windows/Guna.UI2.dll
File Explorer
-
22.rar.rar 1.2MB
-
Debug/net8.0-windows/Guna.UI2.dll.dll 2.1MB
-
Debug/net8.0-windows/JHNM_PowerShell.deps.json6KB
-
Debug/net8.0-windows/JHNM_PowerShell.dll.exe 11KB
-
Debug/net8.0-windows/JHNM_PowerShell.exe.exe 148KB
-
Debug/net8.0-windows/JHNM_PowerShell.pdb13KB
-
Debug/net8.0-windows/JHNM_PowerShell.runtimeconfig.json357B
-
Debug/net8.0-windows/NAudio.Asio.dll.dll 33KB
-
Debug/net8.0-windows/NAudio.Core.dll.dll 183KB
-
Debug/net8.0-windows/NAudio.Midi.dll.dll 45KB
-
Debug/net8.0-windows/NAudio.Wasapi.dll.dll 175KB
-
Debug/net8.0-windows/NAudio.WinForms.dll.dll 33KB
-
Debug/net8.0-windows/NAudio.WinMM.dll.dll 56KB
-
Debug/net8.0-windows/NAudio.dll.dll 7KB
-
Debug/net8.0-windows/System.Management.dll.dll 72KB
-
Debug/net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll.dll 288KB
Debug/net8.0-windows/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
- MD5 b429ae86c5be521bc8ca3b164cec3acb
- SHA1 387560073ff5a1f2191abc6f75fc34532bbb6dd2
- SHA512 eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1
- SSDEEP 24576:DgWuftU4WrNOA6sM6kXxMfNmnjk/c5NrH0UUoo2QkJXVSItH5ppoO0KzJ6nFwHQL:DA+NOpXm1mnj0cP+DkhMAiawnFV
- TLSH T168A5F9187D94E727D26BDF3395D61011E3F1E4532AB3EB0D26D367A8184378978823AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5e:00:a7:1b:7e:46:57:12:de:98:da:e3:8d:91:ea:26:6d:ef:71:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2226574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/JHNM_PowerShell.deps.json
- SHA256 62ff4cd0df5831e262f41f2449eff1596c866672cc0206506d04773bf8d6675b
- MD5 527129c97f0114706b96a33b09e71569
- SHA1 f667a293f86253fab2c921bb6064475c4c5cc2a9
- SHA512 9ba8af064313d715c6919fae34e69680be00762dcca37f4aa1808dff08d80267dc68d44bc81f51c8acfa1290ee14fe1ee5f7505d8caae37aaa1304acedd725e2
- SSDEEP 48:BC00OR+V23Pg3CN3MNBN3w13635A3mazEmaSkHDME8OaH0MkDHoHmGbbH65pZHJ+:COhMjsOayDIr3epZ298MtsvEi+
- TLSH T113D15725D8902E6746F12BE924364282F272D73F8301590FB8BC649C8F73E97685AF35
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/net8.0-windows/JHNM_PowerShell.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3fd1ec286b927d50049574006da22eabe13ca0f4d84a43b24fc3396f882beba1
- MD5 466750d120376f960d613c5444260df9
- SHA1 743a26ca519dda77f423b123dcc599f01b731fc7
- SHA512 f125f5cee81c7e272a2818a4d7ed46cbeb7dd3ace002feb9822cf55bd90e5e03cd899ef5adf3baf7f897518d081be70bdb1a51ad8fe6abee55390dbb73b2428e
- SSDEEP 192:WjB+xa0Ok+zHJcd6qPF6STkbvja2KGmp8CEoF8JJMH:Wt+hicd6qPFbCrKGwpGJ
- TLSH T1F632B911B7E48A35E5BE6F35BDB282141736FA81DC69EA1F15C8504A5E23308CEF1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ft305\Downloads\files (9)\obj\Debug\net8.0-windows\JHNM_PowerShell.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/JHNM_PowerShell.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 3a3ac7d29150412e7a3341c035f81f11ab220b6a4593015559d4f82e57b50f8c
- MD5 6b784b944fe08191eff96753f79dbcdc
- SHA1 c97afff51a01344d535366b68afd85ecfe83151e
- SHA512 9fca9252065188d849c2ab78a5bcab4cc10bb744c1f24f24da027a97be9097fe01d56fd56ea424bc6259ce9d2096fcfcbbaa2cc75f04df0d64c120236e755f28
- SSDEEP 3072:sqeXA/4yIg9vkNPNu6H6xCYOiVUE265fJa:svgvkNFNaxmNE/J
- TLSH T186E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Debug/net8.0-windows/JHNM_PowerShell.pdb
- SHA256 590578b664116bd084f0f9d06ed3a8d4a2637b73dcb18e685c2c2fdd4db48734
- MD5 3284e3b296bb4cd8410dac0e472557ce
- SHA1 5b788e1f8cb573b7d205cc8bf6154b54c34e6fdc
- SHA512 079aaaf8cd0bda39463637c7815c14739ea9c9f834ae520572548b44bfb3819d7a38a7a4a8e394d7ab96d1a8af607173a84067f7f56c3b65c943004992537af4
- SSDEEP 384:VuMenPkw6l4D7aIXzsZ1cBa17kG7KT7Bir/cN0aDj+0exHTfyv8G7ldfY/DEnf:4s7kCs6UNFfY/4f
- TLSH T1A752B477939CD660CA4625732936C6CC3634C3212701EE7AF2C42A48EFAF69907F6172
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/net8.0-windows/JHNM_PowerShell.runtimeconfig.json
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
- MD5 35bc322bd42045632a8cb4fce81a90d2
- SHA1 351f78a6441ac2c8a34a03d92561000889260326
- SHA512 747651399d598da800d2d0090924b682bac3578c6718adf60cd6d99fa4f89ae8c343addb97476b64597c59007b2259fdc1a49380d7c33c8cfe220a30201ee718
- TLSH T192E08C3AC9144DA315F53BBED52AC287FE3047AB0158092AB6BC441C1F725625000F88
- MD5 SHA1 SHA512 TLSH
Debug/net8.0-windows/NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
173KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b313f530227fd31fc2b6fa74547f4c8a964cde7696c07624dfc19b693fe9c468
- MD5 2da1307837dc63aaab828470701a2761
- SHA1 3d862f84328d8fba810da31fffcdfc53a8cf786c
- SHA512 503fa2ff0ccea1d51aa59c4f38a2d552626556b0cc692a699f15714b9af901d9e664642adf5e25d6cf5ce77a6ded59427dd1bd23e030aedb3891ae943629d2b4
- SSDEEP 768:+GRcd/kDtaVL9ugB/0p6oCPREb4DmHBRrne5:zaVL9ugQLMOb4Dm/2
- TLSH T166F21919239CC36BC67F0FBA50A611430336E681F552EBED6DC831A99EA37510761BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\netcoreapp3.1\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c001e49d31497f608b14066b0f10304c0ccb7e3b9df9d5fec5cf3196f92961b8
- MD5 555d4c629b3d58d3d4314e2fa51d2f63
- SHA1 0aae01bac50a5abfe42a6cde715f391069fed72c
- SHA512 b3cde721761fe1210a5b31da4637ae6e501d489d3209a179669ad80c03e4ff717af81f82d130673080194e5f2f7a17fcd4891ac598aedca14c10c7f2b0904b8d
- SSDEEP 192:7HBYhRUzpGapaMW2Son1MRl4CAJj6GjSm8:7HCMzpGbx2Kvm8
- TLSH T1A7F1C739A7A4C237CA964F75E81707940374EB40DA57CF2D0D8CA09BE913749AB727D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net6.0-windows\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f515ca5c944c332ab706ff0a7c2e53e66d0d9d8a663e9b2691b35129ee22559b
- MD5 1c71e5310151ce1e9a3a92797776bdad
- SHA1 fd452b874fec4a9dae61a3710fb32749dc7d701e
- SHA512 2a4f18c77449c2d06a3ab6807338f73b03b1faa332e78319829ba3a2b6fd98bb9a83c5e29b47d55e4ce7f0dfdcd8524fa592a0f3ca8ee09daae2894b681265a8
- SSDEEP 768:BrEP45HksbMU3se5c/0b/9nLZV1BCUkVoV0lP7H0CkkiSLJKdbY8Mtuo0eDQP9zu:bbz5wulNV1zkSQzHxkxS9yc8no0nzu
- TLSH T12773C410E7E88378C8E707B6B5B3A3214F74B5C52F22D61D292A611D08EAFC15765E3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
21:dd:70:75:07:79:76:e9:4c:2e:f9:e2:e8:a9:c9:0c:99:41:ca:c8:0f:9f:d0:4f:af:43:ef:2a:ed:0a:ac:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 18, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2022 - Aug 3, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:C4BD-E37F-5FFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a3:fb:9a:b3:8e:7b:86:43:4f:00:01:00:00:01:a3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net7.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7e248c3e6f25f4673e2006fa77f4a4322a3c74c2652dcc395178329feb7ff28
- MD5 76e0aaa7182e77403bf6fe2af8d90f28
- SHA1 d013c5d649f9ebce5bee1c8b774f3290b1f1f532
- SHA512 8e161a375fe174d9b203c2a098c92aff411d8521eef133d5174ae7409c394157f7a067c2a9dfe3f76cb02acbed52c33a11579b9a1cbee75e4092e6487d1a7bc1
- SSDEEP 6144:TMbKUVLmD7HP9ab+T5sBFzPnQpEZFAc2Q:45VL2Z++tw92Q
- TLSH T10654195033F841D4C47FAABA903161958FB4736BA60EDF9E1452FCED1AF1B81960326B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
46:92:b4:35:81:df:77:c6:04:16:3b:5f:4b:00:f9:6b:d7:8e:d5:f5:f8:ff:d4:65:68:9d:fe:34:58:96:d2:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 18, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2022 - Aug 3, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:4D2F-E3DD-BEEF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b0:a1:e3:83:32:e8:8d:3b:c0:00:01:00:00:01:b0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
289818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ