NjRat.0.7D.Danger.Edition.zip
- SHA256 4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NjRat.0.7D.Danger.Edition.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
NjRat.0.7D.Danger.Edition.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target NjRat.0.7D.Danger.Edition.zip
- Size 15.8MB
- Sample260905-xrb7ja1bkh
- SHA256 4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb
- MD5 18b9e23e509ff221ebb1b8a0ce4bc82b
- SHA1 bacab6a415515e94b3083c4f7ebda6a82e1d4c7f
- SHA512 26091095397f3b229439bb4838f3321de63b9084beab20391a3f85fa8038836d9d0a96a44c7de1d860b182d0b072e0c752494201eb50fd36444cfe742d310ca1
- SSDEEP 393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi
- TLSH T17EF6332A4A16705AFE27731A50EB9CF0A7A609B6B159FC5D2AC830D0C50FDDECE5184F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 43 IoCs
Checks for missing Authenticode signature.
resource unpack001/Extensions/Anti.exe unpack001/Extensions/Compressor/Rpx.exe unpack001/Extensions/Compressor/Rug.Packing.Reflection.dll unpack001/Extensions/dotNET_Reactor.exe unpack001/Extensions/mpress.exe unpack001/Mono.Cecil.dll unpack001/NjRat 0.7D Danger Edition.exe unpack001/Plugin/1.dll unpack001/Plugin/10.dll unpack001/Plugin/2.dll unpack001/Plugin/3.dll unpack001/Plugin/4.dll unpack001/Plugin/5.dll unpack001/Plugin/6.dll unpack001/Plugin/7.dll unpack001/Plugin/8.dll unpack001/Plugin/9.dll unpack001/Plugin/Andex.dll unpack001/Plugin/Gren.dll unpack001/Plugin/P.dll unpack001/Plugin/cam.dll unpack001/Plugin/ch.dll unpack001/Plugin/chrome.dll unpack001/Plugin/cmd.dll unpack001/Plugin/dneg.dll unpack001/Plugin/explorer.dll unpack001/Plugin/explorerr.dll unpack001/Plugin/firefox.dll unpack001/Plugin/hms.dll unpack001/Plugin/inf.dll unpack001/Plugin/mic.dll unpack001/Plugin/mpress.exe unpack001/Plugin/plg.dll unpack001/Plugin/ps.dll unpack001/Plugin/pw.dll unpack002/pw.dll unpack001/Plugin/red.dll unpack001/Plugin/rq.dll unpack001/Plugin/sc2.dll unpack001/Plugin/spark.dll unpack001/Plugin/t.dll unpack001/Plugin/vu.dll unpack001/WinMM.Net.dll
File Explorer
-
NjRat.0.7D.Danger.Edition.zip.zip 15.8MB
-
ER/Abrairnotes.dll55B
-
ER/Abrier.dll79B
-
ER/Apraircam.dll83B
-
ER/Bipe.dll65B
-
ER/Delet A.dll83B
-
ER/Delettemp.dll199B
-
ER/Destentrnet.dll33B
-
ER/User.dll923B
-
ER/dcr.dll37B
-
ER/destedmous.dll.bat 160B
-
ER/dromous.dll67B
-
ER/infctcmd.dll53B
-
ER/laxer.dll58B
-
ER/logoff.dll37B
-
ER/maltExe.dll60B
-
ER/past0.dll183B
-
ER/prar.dll3B
-
ER/tela.dll76B
-
ER/trafs.dll140B
-
ER/windefnder.dll117B
-
Extensions/Anti.exe.exe 23KB
-
Extensions/Compressor/Rpx.exe.exe 147KB
-
Extensions/Compressor/Rug.Packing.Reflection.dll.dll 11KB
-
Extensions/dotNET_Reactor.exe.exe 5.9MB
-
Extensions/mpress.exe.exe 101KB
-
GeoIP.dat1.2MB
-
Mono.Cecil.dll.dll 305KB
-
NjRat 0.7D Danger Edition.exe.exe 8.2MB
-
Plugin/1.dll.exe 367KB
-
Plugin/10.dll.exe 1.1MB
-
Plugin/2.dll.exe 271KB
-
Plugin/3.dll.exe 223KB
-
Plugin/4.dll.exe 202KB
-
Plugin/5.dll.exe 292KB
-
Plugin/6.dll.exe 628KB
-
Plugin/7.dll.exe 31KB
-
Plugin/8.dll.exe 259KB
-
Plugin/9.dll.exe 469KB
-
Plugin/Andex.dll.exe 100KB
-
Plugin/Duck.dll.exe 63KB
-
Plugin/Gren.dll.exe 155KB
-
Plugin/P.dll.exe 29KB
-
Plugin/cam.dll.dll 63KB
-
Plugin/ch.dll.exe 75KB
-
Plugin/chrome.dll.exe 29KB
-
Plugin/cmd.dll.exe 29KB
-
Plugin/dneg.dll.exe 176KB
-
Plugin/explorer.dll.exe 29KB
-
Plugin/explorerr.dll.exe 29KB
-
Plugin/firefox.dll.exe 29KB
-
Plugin/hms.dll.exe 61KB
-
Plugin/inf.dll.dll 19KB
-
Plugin/mic.dll.dll 50KB
-
Plugin/mpress.exe.exe 101KB
-
Plugin/pd.dll139B
-
Plugin/plg.dll.dll 28KB
-
Plugin/ps.dll.exe 29KB
-
Plugin/pw.dll.exe 403KB
-
Plugin/pw.rar.rar 325KB
-
pw.dll.exe 403KB
-
Plugin/red.dll.exe 61KB
-
Plugin/rq.dll.dll 23KB
-
Plugin/sc2.dll.dll 12KB
-
Plugin/spark.dll.exe 29KB
-
Plugin/t.dll.exe 29KB
-
Plugin/vu.dll.exe 28KB
-
Settings.ini15B
-
Stub.il1.2MB
-
Stub.manifest.xml 487B
-
WinMM.Net.dll.dll 43KB
ER/Abrairnotes.dll
- SHA256 321fcf894e5a1853ffb430624d3085f04025563e8e5d8ae1c9c28dbce93d5f93
- MD5 cad085eb4a51b05d3f2905c9a2996fec
- SHA1 f2c6be581eac7a2580666fd3c589f15cf6599996
- SHA512 f6e50801d3de71926568c9b225b2c83607269b716aa18b9f9af417dbb32e7160395c1f53c80c07bef2b50209ab1e92a5b6aaac46d36ab6f14e62b8e83e1503c4
- TLSH T14990025D5062ED6F11A5A6814087849CB16FC0D61C5784464407057D8A454415449C49
- MD5 SHA1 SHA512 TLSH
ER/Abrier.dll
- SHA256 ed0aa6ecbb2d5d6ef3b8431d13d4562d89c2e1c88636c22dbbbbea81e32f913d
- MD5 5514b7e5a95e10c6d37278bb973651b2
- SHA1 44049d7456b90ef04b9c5c414167f1594f54bbf8
- SHA512 3b98f20638cd63612f035fe331b6bdb3ba1cb737df277da762005eb90f548f72fff43977ab502daa105ec571011e277bfdca0f34cafbdac4509ad53c8f175b56
- TLSH T125A0112220820A02200A88E0A0AAA080320BA3A30383ECC8282BC0308B803EC80E8823
- MD5 SHA1 SHA512 TLSH
ER/Apraircam.dll
- SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
- MD5 cc795c9c4a83aa1ede067f96f1eb8d15
- SHA1 32b8e1c43787353f7d87514e279288aff5f7d4f6
- SHA512 ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5
- TLSH T1E3A0121221814A01200C54B490699080304B62971343DCD0182AC13887C03CC80C8407
- MD5 SHA1 SHA512 TLSH
ER/Bipe.dll
- SHA256 c1c8afde84694f203ebb49766454ce17179e32c06a0bbdd272bf598c0d9b7c0e
- MD5 4992e2814a8597fb20b5282e568a032d
- SHA1 e0e1bb5cdcc6eae4714ed420e158717be66c45fa
- SHA512 dfe05b7db512c82b5c0d996c13086133ffd70547c69f819486d311aae3d687516bc4e412f8ef7c7755456d84e37ce33d55ff30b71208335144194fc2d67db903
- TLSH T1AFA0021261D11E05900C7AD8E99BE4C0345B82C71347A9C8283FC474CBCBBCD91AC91B
- MD5 SHA1 SHA512 TLSH
ER/Delet A.dll
- SHA256 fd8802c66f18b5d7175bd3eaf628c652525605be88b8149a37e7ec731f3ab963
- MD5 b256a2a73f8436243481712965f3fd48
- SHA1 696657223bc7be99c1cb275b2501850c03581001
- SHA512 aae2b68303ce9fe22f260f31f9fd5ee7edf4bdff7e99372df35a1e0d0a5a3714a915c23d8d68a97417cc5a3c431d0dac3a3c289aa74764308e63709b99d94dca
- TLSH T1B5A009059C4A0586A1291893208557E2A61649956F589A41028FA0E667C73466205459
- MD5 SHA1 SHA512 TLSH
ER/Delettemp.dll
- SHA256 5cbea0f270bc1d57e2231a4d2d5e5d8323710d5757e714d5559e90dc86432c93
- MD5 5fce1e96bf39cd18ede1c35b48a90b43
- SHA1 e8e323eac6292b077c0b9af93c89dd869477a4a5
- SHA512 bd5fa97a9c67c6b342569653362b6896b7eb82be561695ba46b4975a3d0dfd2d3d3ed108e7ae4dbbf1ed7a4deeca2f54fc2477a946b124a6e5819300b553b0e0
- TLSH T17FD04C233019360EB04C4D34C1B49015161DD364593A5AD1CC91D8107F175C4466F3D8
- MD5 SHA1 SHA512 TLSH
ER/Destentrnet.dll
- SHA256 0ec9ad05ab5eac77b92dcdf1b2f8f563d626b9b6a64619da9fd64aa375f97638
- MD5 0920bfe00503b41bc09350f6d60412e9
- SHA1 4ad929b21d7f51fc414619fc7c7a6eb702ac1aba
- SHA512 19f56252682e633293f08207cf88af0003c1959cfe102b66e59f8b4c76b4dea11830d77073cef35bf9f6f4e1200d0a98e78240622956a1cf614ccd6fe8cf764c
- MD5 SHA1 SHA512
ER/User.dll
- SHA256 e4125f396993ea0876f3ffa9bffc46134dd20d7c8e4d077ddadee67b6ca33abe
- MD5 456c3e1669d900ebe41355349deb28e0
- SHA1 57d3afa70c9cff74b74366fb6d34bc57cf01312a
- SHA512 7300fa661115e8606a766093698ee5c760162293d65216a26ba54fc83cf866bcc16da6e84aa304c917106eb94c0f5cce5c95b1d0fb1ee2dc1c1b2f0c631d02df
- TLSH T13611005EE00E362D2D5747F53C559485570550C913C579941475419CB55D5709155811
- MD5 SHA1 SHA512 TLSH
ER/dcr.dll
- SHA256 6a207f770478d59da0d2aa43a9719ef05b3f85c8c700400746ca3ab0463d08f0
- MD5 1cbc3a2f81d4259e3bf61249711fec81
- SHA1 7ba62560df466c6dcd794854a25aeb5b088968d8
- SHA512 74ba85a391d769686c95001af6e29f9fe2ccaa4d119247fac31e65c8becda7be1ea9fa3eb9f2a06c1d48ac4b580ad8e63c14e06d94e8dd07b26129df7f1f4bc0
- MD5 SHA1 SHA512
ER/destedmous.dll
- SHA256 b7dfc64c735cb92f98937b9bb77cbea0f8bc6bc94e3ef14155b2611a36482e25
- MD5 86db8aaa81d53ba3647175fa02aec88d
- SHA1 27277b6740e72bee1efdc2b21a6b4fb147e493e2
- SHA512 a846322ee5037dc8d9c8aa5be8badf7f295250c6374702d0e5e4972ff6db41fdd8f9765ed3313e9a083bb07a66d096c03f38a375ab5aee2b28a16c9d21527d4b
- TLSH T1EDC0803B600699049C075F65204964DD773F21D30385CCC0445754E4DA413C9D17CD2F
- MD5 SHA1 SHA512 TLSH
ER/dromous.dll
- SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
- MD5 1cc401169ef8cf1e8977f4e92dfe72c7
- SHA1 d04c32295d4e563978fa0abb1b32ba52699cb08d
- SHA512 076eb06d9fbf8bf1d6a4c5043d803ee7b5cf0307253de6358f8ea70e0bf240f5ae2208fbe9a44778e782e29c54751936f393ade6e292064d2134ed223506866b
- TLSH T17BA011A2200C0A0080080CB0208B008A382A20EA0322EE8A800B82E0AAA0288800CA0F
- MD5 SHA1 SHA512 TLSH
ER/infctcmd.dll
- SHA256 e677fb6d2da669557df503eb45de14c3d3acf5509bb2005fcc4be39ac975f2ae
- MD5 b72c081752f133cf07327f33fa4f819f
- SHA1 19d19299a17de80c1cb97df79b8a659f09fd958a
- SHA512 876dfe36eb1d47d49916512b3634bfb19a0b43f90b7348fcde4246e93dfef1521b59b4299c09071521d2d83e92385faa93557b18764e364ae1bc78cab56443eb
- TLSH T1209002A916421A14500D8E60A059E196682EB1DD41105B80504F75D4C9D1E4C8254D71
- MD5 SHA1 SHA512 TLSH
ER/laxer.dll
- SHA256 21ab187279045e81f550c170fdc8b73117f4e4dc2e608bdb80865540264fdab6
- MD5 e67ee9fa20340544e65bc2cfba5d8192
- SHA1 7b49b96219d3ef4a2660a0deb6d70df69d73ec6f
- SHA512 b1786afb5f50dd2001862e0a26fccba91aeecb338a14ee55ef0a09f5f0efb0e7e68a52e0c1b545032930a42668a27d729d334abacb1e0c85b1583887a32480a8
- TLSH T121A0028638050F4C118C4856208ED1C075BF10C74A50D9C2512FA0E0DA8C5D9859CD5B
- MD5 SHA1 SHA512 TLSH
ER/logoff.dll
- SHA256 2036a894b2c0eaeb684a56b5da1e2bbf992ff50fba536e606fb1adadf6cdec4c
- MD5 3d79995c5af417fb5b26f78b02000f49
- SHA1 7e1f39492457eb8be9c0b1bed130f1b205b41ad5
- SHA512 21a745ee1c5b8482573d619d54daa71c6b35095ec0521c1cf97c8d1e6470f236e94e0688d013c597699ee9af1df9be129e8b0e0e39b25a725daa7e9b7b0d92e6
- MD5 SHA1 SHA512
ER/maltExe.dll
- SHA256 4f553023c9fdfea5f806c86d6bdd40d94348843d4a4efd91dc952a53229a4358
- MD5 94070806e01c1ae7fe2aae46d929387a
- SHA1 0fcd747b0fd81b01ea54fbd849388b6e49ff1698
- SHA512 1334b73fadeb074ea1f31f379bb76f4274af5ddfc48a5c28139e766202c373a8b25e0ba2105537673bdf5de9df625dcbd870ef0b8a4506f9674c88bcd2595e08
- TLSH T17DA002472442DD3558391959208FB894749B01CA43DABB90244B44E08E817C8B089DBA
- MD5 SHA1 SHA512 TLSH
ER/past0.dll
- SHA256 71385e3fb017bb452466ab1ad8764950c14a7af856d0ee8c147cf8f7f073b2ec
- MD5 ab45b6913751e20d60d6c9a44a229a66
- SHA1 fbf98231ced1c5667bb8b83114ca2f83b044698f
- SHA512 b462bd82a58ff51d3351ae5168028439fe3dbfbaeb2465c8b300419fb5d9115eb2091aa6fe4e11cf30ba9ee37e3ef175211e5053d6fc7a3398deace787180f4e
- TLSH T138C0C01780802C0F40091B9830C7FCC29EA97C432C831D00C00EB8305F735C4A0C807D
- MD5 SHA1 SHA512 TLSH
ER/prar.dll
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512
ER/tela.dll
- SHA256 3be1adc56cfae9722bfa25df2ed2b112349b7aa4d8088cbf694e560dd9e53817
- MD5 18dc60bfb068d99a80fd22499ec5f252
- SHA1 4939c87a7ff6456971aa4baf517646d3df2a7710
- SHA512 890ba3a69f516df93154b7534f2530a5004f9d6ccc01e4f59a434e4c2c49912cc2630d34afcb24a60208173a089b8934ace4acad4cc587d21988a150d9ad32e3
- TLSH T123A0021556414555514C595570CF51D7352F10C54158D64015C750A0C55556CC675EFA
- MD5 SHA1 SHA512 TLSH
ER/trafs.dll
- SHA256 fc41e3b41dfe50d5ca916ee4800a122da3744754e6bc16f7aeb8dbfcdb48862e
- MD5 08c12660d57fb1679a2a881ffea7a929
- SHA1 4dfd98579bc18639be74e31f8129331038c13159
- SHA512 ef0d3ff581b43e0a8a11707f3e01abab341da6a11d846048fabaeb038b5e02fa13dc7b8ac13a06ee7a470aa89b82b94c892390999497b9c4231aba5808c16aaa
- TLSH T144C02B1078154633E0D07A10400F980233FB23CF3002E6D00D4E101C481A441C33C2DF
- MD5 SHA1 SHA512 TLSH
ER/windefnder.dll
- SHA256 467c340bf310cec9fa62eb6d9bc86592366bcd6cbc373977e1589357b5623ae7
- MD5 e7470172eed4177d0044118746564736
- SHA1 5318f1e92a00bf453019624dcdc0eb221042bd1c
- SHA512 0e4c42d548b18f36ea6cafdf6e02efc3038b3402e17f6af6e7ccd231d75b55db361a57ad8a2b359474e3c6faf491324354b1b01176a99a1a8635ba342deed30f
- TLSH T104B09207B407280749A80CE096DE409AF95BC0DB5968ABA8809612F1E844484D98DB9E
- MD5 SHA1 SHA512 TLSH
Extensions/Anti.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c98367ffbaec6e84c07efce9d80eae1c1b97cf98583257f16229a80578d500eb
- MD5 a21d32aa5073d7ccd8a7bc87b1fd4fa9
- SHA1 d5d4abe293934cc6ad93c94baa31964132358dba
- SHA512 09f87db37ba4f406885be9c3812e3ed04fd836d04a8c6eb0a79e0fce34a435f660ab63d26badfc3c5116c4bf6243ad19e72aa9a2e674737ae49a07a1abff2ac9
- SSDEEP 192:NhVFyr1bFd2lOIkVOAbvZm7nloYk4kNIDLR7PYoRGZR0bKxJd:NhV8FgOIkcAbRT4g+LRVsREKx
- TLSH T1BEB2821322CE7EE6C5B80A713B7343D1C72DEE058423DA2E65D47629CABE1037A527D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\سورسات برامج رات\SRC - Coringa-RAT 0.3\Stub AntiProcess\obj\Debug\MemoryDiagnostic.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/Compressor/Rpx.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 151e09c4e5d45d3d7247bedf08096ce1f8adaae59476ba1637839ead8099e53b
- MD5 4571a19fd31b61c8947490fac3b54ef2
- SHA1 a4a3026b943695189ae74344e550edd21dbdf103
- SHA512 5ad2d098f5b9097f5bab92a91b6d904bf374ae0e7c762f353b1dfc5190c8faca9072dcd330b13eb2290c70a7d27987e11c26cef7a4d05c8638817881bcad6fbf
- SSDEEP 3072:7xexpcRJvrGI2e6kQFXdhHaaKGxufkByDo1RZpwobf1Xv6IPcm9ddVMQKB:7xezsN2eY/vKoufkBy0RZpwobdT9ddVM
- TLSH T155E312107AC872B2F8B30B73B84691E482C27E417D92D5DE1289B9CB9FF1902A555FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
153406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/Compressor/Rug.Packing.Reflection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fc5c7454261c7dd016302be92362e4cf60a3c9c6c4633c65855b3258d534af73
- MD5 63b02fbfa302ee016bc83be8f18efe77
- SHA1 61ecf0bab944dc173e2c06a0b059cc620d75fb0b
- SHA512 6a9aa2b2c74b34e43549aa31d3621c47003e370c4fffc1fe9844df347eed61c8e319a6a42e158d772b81fd19eb9d7b845e736062d7e14d404a9d74da0d5990d7
- SSDEEP 192:2V6ksZ2Bnx+XEXi5U4fkR3WZs2NDqQp3BrPNBNoGN:2XA2BnUwCfkYZs6DqAl7oK
- TLSH T16232D71597E8823EEE7B0BBBBC63B22102F5FB44D552D92B4C4C414FAC677508A22776
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Code\CSharp\RugProjects\Export\Tools\Rpx\Stable 4.0\Rug.Packing.Reflection\obj\Release\Rug.Packing.Reflection.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/dotNET_Reactor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79f190a51af8a463f13ddd5a76947cf7ba2adfb8e231b37c5e0968602217a62b
- MD5 a7d69d6ddbe2586d698ebdf7f49c1afa
- SHA1 7b87de25c982d0cc42a1dde89790cd34acbcfd2e
- SHA512 2d4fb34f83d9794c38ec39f12f78b8d7c5af331aea475eaecf589f95c9e1849196a8d5252a7f9beaa596bb34ddc0c94b76a6c9092dc0fb93ec6b0af9fb66226e
- SSDEEP 49152:VXl2PFBegFNFLua2gBxnnim//7rF31inFhyNkLObEECwc0mjZ5tzCo3Eh5pfO+pD:VW5nnim//7uvwCt5tuo32v
- TLSH T1C6567B2076A8C911E0AE9774C3F281FF0BF0FD0BD226971B69857F6639B17425C06A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6205246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Extensions/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
318190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\njq8\Desktop\jbevain-cecil-0.9.5-73-ga5ffcc0\jbevain-cecil-a5ffcc0\obj\net_2_0_Debug\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
303KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NjRat 0.7D Danger Edition.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e6cff62a0e8e7c654eec97093a1295773f223cd3a6a11f65c91491cfbd6be751
- MD5 eda04645089d60f5cb602c8012a33e07
- SHA1 85ae9d1a404d0a2063bee3d8d7bb9bef233fa71a
- SHA512 fe9a1bddd90aabb6f5abb1d15666e75ab3c6136d1dbf2c79f0bbcd1dffe2089ac8a73ffe11b3d1cbbd6b393fc51f921fd5c50bf490a38e9038d2c366aaa9468d
- SSDEEP 196608:TZXg/uuzJ4eNyvXQoCV08GzIBcx8OyULg5fy2Sif8E0Wt:S/uuzJtGzzIw8OXmW80
- TLSH T14496DF117A6AE957D1BD227BC1D3B01963B4BC162BA3F346BAAF32BD11523634C094CD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8610190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.2MB
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
177B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/1.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 afda8e5fb125e27aa1062365ab4b77c4fa3acd14a6e435ab7ddde18644266af3
- MD5 c3e8ff959a4027bc8cd67e26d3003370
- SHA1 5469f8a06813027ab3f8bcfaf4d5c87810ab347a
- SHA512 d0f461200daa100f6d05320c538d793e662f9ddfb13fa70351bb1bdf21cf7a1c256d284c3378551d288d7275cfa9cb32e84cdb13e7bc49ca4b5483d8ef999f15
- SSDEEP 6144:ELPgpcVH6h+9Ve/B2Gmzoun1YUqqlkLqa8vcvIjlk0Hrg5eplNpi:EceD9uB+ca1Yg0qakwIjKU1Nw
- TLSH T1EA84F11756DCEEE1D87843353B338AC6BB685E08E957CB8FCAD4A11E9C3A143751A2C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
369646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
353KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/10.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4d04ead199b9f3433314ac5a4c5466d0ce5e4c43e2fdd381ae0d6a1e705e6f1e
- MD5 e3bf65ce42edca6891fb7123711ace2c
- SHA1 455a838ce4c51976faa9312ae212d7fc82ff7e19
- SHA512 1bce779f1afc8a10c9dffe245ebfb9c46c69cf805cc24dfbb5edfe6e3577b0b34e7ee59763a31e05579f22a584628c10c87fcfb6e9f180d16a0648b6fe05f490
- SSDEEP 24576:2cMzcRP/NYt1FxJlZfY+4VHM9gJppE2ZiH8BnoTsHa0GMG:2HcZN4FTfYxHHoHuoTV2
- TLSH T10745235B128DCE54CC748770377307D2EB5A6F046A238BAFC6D5B269CC3A506B8B12E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1175774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/2.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7ab30a602581387fa97faf7f8100d2c98bd3407372f723f805f2346addb7d008
- MD5 07194ab187366cab46972f2f2f1ef0b5
- SHA1 14927d4482a318004a42a5cf8cc40ad08673a302
- SHA512 989720c17fca490d1fb3a6166f713b07410b0525c7ee142d192de4f5a044f904633b3eb8c3e83f8448bc7ee3da5cb448711067025cdf037d20cf1e9d18131446
- SSDEEP 6144:HLPgpcVH6h+9Ve/B2GmzountZ0MGr33cPuWG69SvplN2r:HceD9uB+caYMIcmWG69SLNU
- TLSH T10E44E01752CCFEA0D47843312B3386D2B7689E04AA57CB8FCED4A169AD3B18379257D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
270942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/3.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 666f19c5d6528c4e071b4414aa410eae3497c809107739db87e39374ceb8593c
- MD5 fc2c601bba0029124a120db3035b5652
- SHA1 a56b3b16e0814ed4da024ab2eee968c17c004698
- SHA512 0c49ad30c8bbf125fa3a47ac63d862063b8feadd87968356237a7df08b8cf4ed4b66e1a8852303b32f6d8ff168a24743fc7adeb94de4aa6f72aed3f2c279b95c
- SSDEEP 3072:hLXfgUssa+sVyMMH6h+xr0we/4E2Gd0NRW5H76QM4o+aeMMf6W9plNNAGExB:hLPgpcVH6h+9Ve/B2GmzounxW9plNWl
- TLSH T15424BE1316CCEEA1D43943312B7386C2B7A89E04EA53CB9ECED4B16D9D3E14379666C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
221822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/4.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d22944f50fdbe7b9fc55807ebca0275e59a0ede94226e2ce365bc507bc96ec68
- MD5 621ff03775382229afbc039efba07212
- SHA1 3bcf1669b70df52059d2fb5c9025ad3fd30170ad
- SHA512 3168bb66d0e2a72df58c46275916fc9cd1d92512b4221fc0259859904d174f9a4b4cec3ff43ec91e4a084ebe4cbfd7349cfba230b1e56403bf36a711d2d8b90b
- SSDEEP 3072:NLXfgUssa+sVyMMH6h+xr0we/4E2Gd0NRW5H76QM4o+aeMyzBplN1AiENh:NLPgpcVH6h+9Ve/B2Gmzoun4plNud
- TLSH T19A14CE1712CCFE91D87847312B7387D2B7A89E05EA53CB8ECAC4B1699C3A14379263D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
201198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/5.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b6914d1ca3c871a2e79d54bb19a7a66e207548214b215698ac3371595cecb5a
- MD5 54b06dbc99832ca8a54232351af21059
- SHA1 42367bca4add1792f841f9c20bf8d6a6410c0ae1
- SHA512 e49dbe7b2a58dc5be68cc79aca83a090486786454d03461ae256f5a0b098d8e00f18032bf1eddd7ed7e863580b8c463771704df404009d3ba1b375b4ec9bd87a
- SSDEEP 6144:iLPgpcVH6h+9Ve/B2GmzountmmJwBISoHVgmRuPOLaplNZW:iceD9uB+cat3JKbFDOuNE
- TLSH T16A54E00312CCFE91D47817356B7386D3B7A8EE04A963CB8EDAC4A06D9D3A14375263D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
292654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/6.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0d01cc53ba6630b8bae7674cfd4deebe6cb0c9e5d2029e3f29c0bc25b2760207
- MD5 633b07e6516aea1d677b8d64bfcb04e7
- SHA1 8f55062fbec6bea8f8cb689e5228cb0f4b759b59
- SHA512 456207a76294bfc5f8f88b3c893b1d931604f935a67770349d6ef831674a65de73ed6d01b2c51c0a3499c30543e5011490b0ebfb34598d00504f1574adae3df4
- SSDEEP 12288:RceD9uB+caZ042+6tMOfLEawCDQuPBFjXwR0F+SbNV:RcMzcRG8pBVwyNb
- TLSH T1A0D4124311DEEE50D83053747B33E1C2AB6C9D09EA56CBAEDAC8A1699C37153B4A13E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
637278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
614KB
Virtual Size
614KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/7.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 814ac620ea996b45e8c0fc55ae57e10c11add1cf4fbe9d260a5f13052051b420
- MD5 ba2d32d8118f59ae4aab0bae941542ed
- SHA1 b627f2ffb0c8d82e8b9413228a8b75e70d716f2e
- SHA512 1181d91e843f1a51248e4080fe91539d77c749125017fb3a1382da3c7b15317337510a0e18827a7ef6ad091c66ff70801f68597895e81c08e6daf96ca0ade839
- SSDEEP 384:ZokI7SgVV+17QwkSoL20gNjhlLk245nKuk4Z/jKeK:an07QnaHjh5m3K
- TLSH T1F8E2092722CEBEE6C5B90674777353C0D76DDE008553CA2E69C0751ACABE2437A923C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\09\09\obj\Debug\09.pdb
mscoree
_CorExeMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/8.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06b3345a22309557ec7168efe1d4bb48a6180a9643faa472c9c90b004ce0a1ac
- MD5 8ca640310df5533abc19acd7dabc829e
- SHA1 38d126c7d252c5aa5963be1022060869bb3daea9
- SHA512 a7d699d09e0e78815e842eae633b44c03ad0c974985cf2faa4f8f64ab8ceec164f75390f120170847c59a4f09d9bcb3ab0c3f0377afa5cdf834b4612528a15df
- SSDEEP 6144:WLPgpcVH6h+9Ve/B2GmzounAbvkteYu6eYsvSplNH0:WceD9uB+caAbvZYA/v6NU
- TLSH T1DD44D00712DCFEA1D87803352B7386C2B7A89E04E953CB9FCAD4B0699C3A14379267D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/9.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 45aa36d007d27ca8e9659cd004a98f048b232161202553da643c4d1df3427459
- MD5 1a018036c48b4cd8e0c7d1a7ebea06a9
- SHA1 8ec946a133f07bf62754caddf3a884020f430f8d
- SHA512 a8a8cbb9a1bfbdbe610bcde92d49674ee155d11fb6992dcd74551926fb3c1d8c2eebc773655638f785079961129cc9112718f2d4764812bbca9f085d3d7bd79a
- SSDEEP 12288:BceD9uB+caeL5rWxh9FnOl5T3e2Vzdb3Cl9WNNg:BcMzcDL5yxhfnk5TnhVk9m
- TLSH T143A4010792CDEEA1D8395730AB7386C2F7589D04EA63D78ECBC47168AC361437A253E4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
474206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication9\WindowsApplication9\obj\Debug\WindowsApplication9.pdb
mscoree
_CorExeMain
Name
.text
Size
455KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Andex.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19dc8c66d04d1a1d781e59107e2a1db5fd6288761c9dfd0c6909e533e79d04e7
- MD5 6032ce8ceea46af873b78c1f323547da
- SHA1 8c5bd4a70e0f21aeba41c07976ace2919b64fd80
- SHA512 3ada1663cb730f43b44e32ceade5d0b9cae20d1c20001691a1d226d99c82510e001581f67f5131d6c21e0e0cf98e5089c3d0f22a6a1e3347053ed73304ccc6fe
- SSDEEP 1536:CQvlJNxwHPmtN2dWWWQmMTuAip6XIbY6i32Kf3oKwfTjK2f20:CQNwaFET6p6XOY6i32U3BwfPK2e0
- TLSH T1CBA37A1365CEBEF6C8B816B0377387D0D72DEE152413DA2E69E1341A89BE2537A523C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\Andex\Andex\obj\Debug\Andex.pdb
mscoree
_CorExeMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Duck.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5d1217e2c9e820c3e7b2fc28fab4e40d85e0e9f4362e66a451e42d597b8c2650
- MD5 d7d46952778a85491b34f62991a060d4
- SHA1 ff30ef03867eb74f2454375cbe3508ee26b07163
- SHA512 7c9b4c254a1977d1a16ac3aa8ce81d897eeda4465e51c9f0cbe2c03326cc6c3bb7acb89d8d1f4ce1dec03118574b57f30a3400b2dc47b70aa87bfd2f4f99f8bc
- SSDEEP 1536:miaFJkobMa8dBXu2IbV3DKyBzYDEBUhYW:miEbMRdBXnUV3DKyBzYDEal
- TLSH T18F53E814A7F84217F6FA4B71A9F4C047983AB953AD25C75D348E438D0B223C4DA62B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
47:d4:6c:da:67:78:ce:d8:05:cd:90:31:b3:c0:ae:26:f0:cb:f8:24:62:b1:48:e6:cd:cf:92:57:43:33:ab:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
33:9d:72:06:36:dd:88:70:f1:17:7c:b2:5f:38:3c:c5:83:f3:3e:b7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 30, 2016 - Jun 30, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9a:3e:ab:01:a5:36:60:a7:0b:00:00:00:00:00:9a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 27, 2016 - Jul 27, 2017
Minor OS version
0
Major OS version
4
Entry point
52746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
RegAsm.pdb
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/Gren.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9a8f461b55d753e7f66f3db602a29a079efe626c514920d933a471489ccab951
- MD5 8775af76bef724f22a0b5bb7c787a1cc
- SHA1 39620f580705b8b214f94acc7d1c81bceec15ba9
- SHA512 966de3d1d6463eb15ed0b1ad6e1902d343c1b587abecf4fa27798bd576effadbe99a7f787de320cf815dacbfb5795e3dff369802e13d95c96fcb9c54e32bf61f
- SSDEEP 3072:bbQsn8VDXc8qrTvJZErpoVAOjKsYMouMpYc6UI1i03AJJmdn8txICpH3SHB8zkFQ:Zn8VDXchT0IusmViHB8YdwLm
- TLSH T1BCF3F7181BE49E57E97E03B853BB026083B4D5614587E75F6EE064F05C7B392AF0B28B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\SRC - NjRAT 0.7D\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/P.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d3cf09c638fb94b81343c94dd1a9d7ee385a5240a1f3d78fc70dc591b417999d
- MD5 a7a746707ca4e136585570eef6daf2d4
- SHA1 50705953b5184d8c0fea9c10619d765648976b78
- SHA512 dc97a3cdeb599c976bac9ef4e901c97e4bf02035b6ea60c0e8d9a288b220ca66545a4810842623574293ff09bd4c60fdfaa878fd4e7aa2dbd493d4f001fb0ce5
- SSDEEP 384:Af/GMPhe22EjYdr1M8KdkMLk24jXPlCuoM/SYNp0DDZ3:eGq0dr1M8Kdkg2XPdS3
- TLSH T109D23D2752CEBEE6C9B90670373343C1D36DDE045413DA2E99D4B52AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ch.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 57a02c05691f47b13a6bd77258a559ff193a2e3bc19b6d4339ffd06d2f47569e
- MD5 8e39d0bb786fb308842102fb90211910
- SHA1 fcc8a86135ac63aaf51e6d80472813b5385feb4b
- SHA512 ace89e18827953ccd61af94ac49cc3b1005be3ab0ab5a44c28d690b33bbfa89c2e4e34970d3a8898e65d63f9956747708e2b64afa21c7fe5799131702fc45850
- SSDEEP 1536:bkU/zdQrxRqkFvoCC3TWuA9GyLJnFMarv:bkVlRqkBobiuA9GyLJnFMmv
- TLSH T19C73486745DE7ED6E07C2738277353C0C7BACE508603EA2E9DC4A55A8AB9603B9913C1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/chrome.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec85087f6830b71f106871c59dc8ffa0de91cc3d8ce8c269b7264359d9b4e80b
- MD5 685c1eade930e2b40f02f98328fca44d
- SHA1 e42f950e1dbed069d7c337c9ff09f55fb90afdf6
- SHA512 aceb433536f6f8f684219c2d62b64604175d1eb8fb0c3d0aba819c81b6793f2f96b2c8b13d7311f7513234d8d9e62dbb61750156d9ee8d8fdfdb7b5ec69262fd
- SSDEEP 384:rfBLiWh61JSBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYVjDsPIWS:12vTSB1p3Q1sGHw2XPIo
- TLSH T1DCD23E1752CEBEE6C8B90670373343C1D36DEE009413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/cmd.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1adfc8c1d730b305aa7b79973a2a9d7bd7437742e464de3671448b70658b860a
- MD5 189937260ddfd3b529ed1f5d80e9ac08
- SHA1 70e63e7ac92f55228a81aae93960df6551cb65a9
- SHA512 053d95d415ca3cbedae305eeb000c57978d96e6bb86319e6f600f7e3236ed95ae8b412d76494d1b4ab7f57956b4869799240b99b3f310dcda2b522eefbb6d464
- SSDEEP 384:VfBLiMh61XlBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SY4jDsuIWS:j2JNlB1p3Q1sGHw2XPvb
- TLSH T1F1D22E1752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/dneg.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5b9c1b0aedcd82ce25b5f7d6ced6b38943b5c0ca14f09a27b4bfb4eb4f0204d5
- MD5 0edfdfc37d6e263002e8294424783c35
- SHA1 e7bf2e195ff32d5f6d5b09164de94e83d1f0f3f2
- SHA512 14b4bd0a6e6ef26a4713cdb115f298d35530864b00a4c5a9d84c7e27086d232bca2ae18c58831a72ff687b4511735bb0669a5136b59b4813464bb25c384b123a
- SSDEEP 3072:owQoQ2z3lUnNx+DsH4ceTgXjrF5hvTjhppH1myZXGT2oelwxkzXJNVlzE9JmZcIR:ALf+/yDHlaNIR4tlYm
- TLSH T1AC043A045BE4ADA3D97F437843BB126043F5E9109207DB4E5FE0A4F55C3A39AAE0A6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\NjRat 0.7D Danger Edition\NjRat 0.7D Danger Edition\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/explorer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e05264acc620b4828ec23550351bdaa7cc429fb273ecc4450ea58f2b20b7f61
- MD5 9cc05ec9d58102696092dd1ab9103fc2
- SHA1 d4019f352ea64504a357c6447c56f79e06602131
- SHA512 a74f5ebbe8f154857af1408aabc2fab30240ff5dd892d5aa9b510c63d51cb8c67605ff6c34459d620c10bb9d13085ac34072235b7bea274605014f9f8a7dbe55
- SSDEEP 384:wfBLiyh61NmBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYsjDsqIWS:s2TXmB1p3Q1sGHw2XPrv
- TLSH T16BD23E2752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4792AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/explorerr.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b9347d22eab0264a0253aebcfb735ea687453fc85d9a906933673017abe4285e
- MD5 2407032a11e906cb7eb171d4e8256992
- SHA1 f6dfc9b6632435136167a16f8a5b23fa624246aa
- SHA512 55bed6d2c026c2f29a13f9d17e9c3d0594158cd8caab8a8fe9dd6fdbc5816efddf2c006489c062b7c191d5f6b40541f7d51d58da0353f5c9853162b13c8b325b
- SSDEEP 384:2fBLiyh61NmBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYwjDszIWS:O2TXmB1p3Q1sGHw2XPrE
- TLSH T1BED22E1752CEBEE6C8B90670373343C1D36DEE005413DA2E99D4792AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/firefox.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2fb77c75a773abb9f61c6c918c2ad90d2f694a3f4822e0f934d9549b386cd8ca
- MD5 1dae4ce0658e69e451d007200a69de1e
- SHA1 141f5b6c4ec400fe58ffdf384a08c138875ab904
- SHA512 786b69e5b96fd4ace34fa7226da9d4a0be7cd4f5b475116ac1a07d34a7a2891c5511fb3ff14540719a989e72d5c84c12dc7f0faeab108adb87746d6a611beb44
- SSDEEP 384:yfBLikh61PGBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYcjDsBIWS:C2x1GB1p3Q1sGHw2XPzW
- TLSH T11CD23E1752CEBEE6C8B90670373343C2D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/hms.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a5c1bdc7b8c0e456edac031568c8acca0524eeec7e91977d63c41c0a82c608c5
- MD5 f4407493019fe05f34b074539519ebc4
- SHA1 b3f5ff69ff4fee493440c133f033a0d05a6edd43
- SHA512 24668bd17617e038544ed5cc92385cba01ec1b70725930457a5deb6f4ef1a079e3af8d7f592dad851fb1685387daaf47cc02a6c406042dc7ec1f406d2ab3bfc4
- SSDEEP 1536:ne/lKI2YbmnzBSrw0fFGIa0H7BldTRu8j0ZwM0UCz:ned522fR1hYZuz
- TLSH T12053AE69EBD440A4CBA5AB37F19ABB131B32CDD78B8363B649D078111C93B444EBD642
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco\Documents\Visual Studio 2012\Projects\WindowsApplication7\WindowsApplication7\obj\Debug\GoogleCrashHandler.pdb
mscoree
_CorExeMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/inf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896
- MD5 cef141d894400bc2e0096d1ed0c8f95b
- SHA1 1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2
- SHA512 794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7
- SSDEEP 384:XioX36zZ00sK2qbc+LROMnDdU6cpobsTP4Fj:SC3wS0/9dcpFgj
- TLSH T1A792D805F3E86028EEBD1B329EB3C7616276BE274D2EC62F09D8715D19B23404A71B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
G:\NF\NF\obj\Debug\NF.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/mpress.exe
- IMPHASH 51e7ef6b1d43d0d05d7109dee9789560
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225455
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
imagehlp
CheckSumMappedFile
Name
.MPRESS1
Size
88KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MPRESS2
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Plugin/pd.dll
- SHA256 8701c0d8266cefd9ffb4006a278e9d28963e90e1688f5e1f5c65db6a132be733
- MD5 7e3c8627a5f7d7b9a8e54541bf4e1eec
- SHA1 92907340746a489ba6bdc1a887bf68b160057a3a
- SHA512 cf06e93ae7d4942539d5dbac9253c696663c7164697018c5bb9d2b92bfb27eb25a861acaadd81506c124f0ecd43230343f4c2f3257ed9106907bc0270494ffb4
- TLSH T156C08C27776B26A100339AF22AE2084C238B71FACA82D0A4B23481A6FA8512C5920620
- MD5 SHA1 SHA512 TLSH
Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/ps.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d215b8cc095e913f2d3adbd88ae7691be657104dd52340efba670d04eff1e368
- MD5 cc65ad514684506f9f22c71d94c537ea
- SHA1 36e2bf3159d14552279fc1b80db80a8c177925f4
- SHA512 5c505b4c49df8e7e83af47719f79018358a39f1df552b2b90dda244b1e41a30559cbe66b1d415a836f403452c5493b26e28ef170376eb5f1a310733e65d8eeed
- SSDEEP 384:GfGnw6ju+g/gvW+yCnbMLk24jXPl8a3XEWss4YY6:pwag/SZHnbg2XPM6
- TLSH T16AD21B1712CEBEE6C4B81670373393C1D36DDE045453DA2E9AD4752AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/pw.dll
- IMPHASH 720f62ecaae027b5c3ec6686644322e9
- SHA256 6d0b37a62e1d2215e2fd8936d3d1d13cd1d620d7678c773e013e70ccf55a674d
- MD5 b8cb1a1d76fe3fd71ac5b5fc175b699d
- SHA1 611589181cb1bb72a279e44116fa3ed7c1256ded
- SHA512 280d2dbb4702498e11879c1fbf62c6eac8a2c97c2cc520f310e658ee5162329e24ba23d752ba8f549c0ffc85d5c83781ea1c10788ad6546258f83ed9c3c2cc25
- SSDEEP 12288:u7eVQkTrvj4bwVmWyQSo6aQNlcjDzJsu2N:ueQkTf4sVmWyQSo65ToRW
- TLSH T13394E01160C1D9B3C47A043457F28BF5C72D7D36076A94DBB7E82BA56A382D2BA313C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
65519
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=102, id=1, productName=Unmarked objects,
count=41, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Plugin/pw.rar
- SHA256 3b45b9a4541d8eb282efb8cf55dd5070b89b7fe7ac520c79901ca1b14df60e9d
- MD5 6d59194c555d6878bcb82ebba07ad076
- SHA1 789b4f0c15dcd1296b2718ba42f58ddf10dd2f9d
- SHA512 b30d13896de4a1455af87040690dff1fe65ad23d303fc571fa7c05b3551fad12535900f33b3e7e5622763b7d980a40292eeb8bae49330d11ca04f5914d6ef384
- SSDEEP 6144:jPp5FkU23Y7wBUAtrL8vUPRW7Aenzui5pgdC+tf28EfyaY:jPfFkUZ6UAtrgvUZ+dKiwdho8EfnY
- TLSH T16364234E17E79EE6FA4F36CAAA0C4F8339033F942CD4D95D458F91AF80A2D15E41A643
- MD5 SHA1 SHA512 SSDEEP TLSH
pw.dll
- IMPHASH 720f62ecaae027b5c3ec6686644322e9
- SHA256 6d0b37a62e1d2215e2fd8936d3d1d13cd1d620d7678c773e013e70ccf55a674d
- MD5 b8cb1a1d76fe3fd71ac5b5fc175b699d
- SHA1 611589181cb1bb72a279e44116fa3ed7c1256ded
- SHA512 280d2dbb4702498e11879c1fbf62c6eac8a2c97c2cc520f310e658ee5162329e24ba23d752ba8f549c0ffc85d5c83781ea1c10788ad6546258f83ed9c3c2cc25
- SSDEEP 12288:u7eVQkTrvj4bwVmWyQSo6aQNlcjDzJsu2N:ueQkTf4sVmWyQSo65ToRW
- TLSH T13394E01160C1D9B3C47A043457F28BF5C72D7D36076A94DBB7E82BA56A382D2BA313C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
65519
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
RaiseException
GetLastError
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
Module32Next
CloseHandle
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
CreateFileA
CreateFileW
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapFree
GetProcessHeap
FreeLibrary
HeapAlloc
HeapReAlloc
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
HeapSize
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
FlushFileBuffers
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
RtlUnwind
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=102, id=1, productName=Unmarked objects,
count=41, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Plugin/red.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7ff23f4e452d1073547790f12070518b20bb4a305effebbb90212ce141d64e84
- MD5 35be497312c0fa928c92fa3e2fca1783
- SHA1 0adbaa1b4d0b9cccb45d0d50021035e254409beb
- SHA512 211643da52801dbea616e1a05d38c4ca4069d96cb50ee6c9ea6ecc43d6abc16750d4f19814061c8f48c924b6c61ae2d93e36a6a0d4493446fa7c1538f4f958a4
- SSDEEP 1536:EDi8HBf8KZyGOzx2ZC/5Mp23cs3uvzarv:oznY4G5ZLubmv
- TLSH T12653281752DEBEA1C67913747B3393C1D3A9DE008113D62E6ED434AA897E2037E827C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Fransesco Ctraik\Desktop\chat By Fransesco\chat By Fransesco\obj\Debug\chat By Fransesco.pdb
mscoree
_CorExeMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/rq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/spark.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4c19b629100abd685a936f1dfed09dab57c69733e9547ee1a9b9fd1d19d0f6e8
- MD5 c78f9243c3e40ab2f4198a61538c7efc
- SHA1 e9944ff9f066c8be968f55e319667f27bc41d5db
- SHA512 d1ca85d6767ea1ebd5ebdb2e9822f04a59404d3d61c4579f01704633c9d1fa12a783447a781808ed840523ae5884d984ef95a6f3663d3e6d1ef1c13829c2ad4b
- SSDEEP 384:ffBLi4h61LsbBpvl3rcA8k0H1sGvfcLk24jXPlCuoo/SYKjDspIWS:x29xiB1p3Q1sGHw2XPd+
- TLSH T17DD22E2752CEBEE6C8B90670373343C2D36DEE005413DA2E99D4752AD9BE2437A427D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Denger\Documents\Visual Studio 2012\Projects\explorer.exe\explorer.exe\obj\Debug\explorer.exe.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/t.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 712626ed1ae9b07a876300ee93619e76834b9c2e64d724bcc1daef3060d6cdaf
- MD5 771c11ce7b5e13bc7415aab054af9e4a
- SHA1 0bf166884a46b66471a4e03517d14cb1efa37e5c
- SHA512 4b7097f4e0d3e2736447ba1ec7ecbcf304cf6cfdc955841f780f35585cb0c9b71600273ee21a8b34ab337a279d857a899bc078eff3b6cdadfc6f0a8c6fb4220d
- SSDEEP 384:Lf/GoPhe22IPYdr1M8KdkMLk24jXPlCuoM/SY2DDZh:jGqgdr1M8Kdkg2XPuh
- TLSH T129D23D1752CEBEE6C9B90670373343C1D36DDE045413DA2E99D4B52AD9BE2037A927C8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugin/vu.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 501c36ac282029ccf7950a4957d4c10ea72fe18f0ad8d6daeabfe628fa4070a7
- MD5 6c2210ba180f0e1b9d831c3c6c14c8b4
- SHA1 00bebdf704f4cabf254583c6ad87c6e72872b61a
- SHA512 26a63ad05199cf45acd7519fbc63945097b4c4a89bb2cdfa4f87ba004e1ce106220b0b99419e656de26d164265b3868a9ce541c71b05d4e4db1a9a1343130e9b
- SSDEEP 384:Z3wflY4njjVCnyGbNJXn5MLk24jXPl8uor/SYDi39j:Z81tayGx5n5g2XPVj
- TLSH T10FD20B1712CEBEE6C5B81670377343C2D36DEE045453DA2E99D4B52AD9BE2037A823D8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\fransesco ctraik\documents\visual studio 2012\Projects\P\P\obj\Debug\P.pdb
mscoree
_CorExeMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Settings.ini
- SHA256 17f547710bf4fefb27ff4470e0f78089c4888567eec25380e136d9fde1e02276
- MD5 332f4072f2109e4d81f2701c2387b186
- SHA1 36bbaf7dfa5a6d6d52ab04f533359f3c65cfa8e4
- SHA512 53841fa1fb9f0fc1c6633e863f1195d27c8dfed1c0caa7ae519d224893eab3fb23487b130539b5c1839eb8aa99d51b3450b6d15cc63275c0a32841897c84d67a
- MD5 SHA1 SHA512
Stub.il
- SHA256 78a156fe7e6900ece45fdd25516c0f9ffeb2083ef3d62685f189fb5ef5a9a0a5
- MD5 abe394d9d5139ff9c586aa7dddc97e68
- SHA1 6b3ab81b04af61685cd480a41bc953cd6a963f90
- SHA512 30a7d44e319ef500802edc4c74c9bf39bf43ada220427c230973aeecd71f18f02466c824332cc265b96622b6588bda472f3949b1ca3d81bdaa4d6e617bf2a114
- SSDEEP 12288:frIAmhjIU7g9wYYxWzGzGhPRaquMSd0yNMyryKYtEo+vQRLtJkw9WPOSigRGIrKN:gAOU
- TLSH T1C445EC6982289589D5B2B11DBEB2CB46F37F12230F326C967C9FC659FF312884174636
- MD5 SHA1 SHA512 SSDEEP TLSH
Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ