PaftixKurulum[.]exe

resource
PaftixKurulum.exe
unpack001/$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Core.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Kod.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Revit.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Core.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Kod.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Revit.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Core.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Kod.dll
unpack001/$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Revit.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Kaldir.exe
unpack002/$PLUGINSDIR/nsExec.dll
unpack003/server/Paftix.Core.dll
unpack003/server/Paftix.Mcp.dll
unpack003/server/Paftix.Mcp.exe
unpack001/PaftixLisans.exe
unpack001/kopru/Paftix.Core.dll
unpack001/kopru/Paftix.Mcp.dll
unpack001/kopru/Paftix.Mcp.exe

PaftixKurulum.exe

IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
SHA256 432fa9ab122d2285ec07a16d35e8026371477474e8ab3ff9ec53bcf1dad881aa
MD5 75e90734154aec9e2a5bdddd89e55493
SHA1 885630211815fcb0b50e63080a81864defde4731
SHA512 767a3477b3fb0cd9bf4689b926759c194442f2dbe43ec44484680a7971a9841b6e193e36810cbc96bbe102769deec1076e7d7d1ecb9bb61fdfbdd9e578df5f4b
SSDEEP 196608:K2rbQu23GjNzQ/Ch5RUL5dFMZJ+YUuKxux92F/vGG0eZJNOgQ8axF:KIbQuAGC/e5RUtdF0J+//xuxEvdrJ4Wm
TLSH
T10DA633FD3E3908FBFC62423099CA8564434AEC75C4F26EA6CF415367EB746286E255E0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$APPDATA/Autodesk/Revit/Addins/2025/Paftix.addin

SHA256 30b5171194db60596f31d7fff1b87c84783d067d10ef2c391c45e31d241db87d
MD5 5133d257938db5c2dd3520f92acaeb8b
SHA1 e82783981704aa862721ae113920cd4306a9d0e6
SHA512 bbeb9b2584d96ee509b2bfed52627dc2f572234c3d0ba5fc3654b289dc1a9a5d1a0266260395de9c4bc7c8ce8c37a68d7f4bb3ee04681bb441d2c4a308b78223
TLSH
T1F70125D134B191BDA50B1687CC55CD152E38E23F8C82D041F9A198E52F4A16D8EA2013
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Microsoft.CodeAnalysis.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c46e884a3f2910fd6098b104131cae600c1716ae14b27ffe2d22c54c7f71ff11
MD5 c031c139a3ba4be2e4866e006fded04f
SHA1 ca25d8bf4f421d29dce7d3c5154c5a150c669efa
SHA512 8515917b11a72d735ccfbac1800ad64a03a45cf3864c5bf14a5ad3acdb1ed761f9fd47676cef67596e5dbd2be1e7eb7fdc85b8d6ede2d4e7b9bcce7c84a63f82
SSDEEP 49152:ueaxFMavmcHyVbQuZqh1GI7LMZIbhngKV0VH3S0UHccQS33XABjgt4BzcYusH/kS:uBSV21jUCV0VH3S0Ut/XABjgt4FkPa
TLSH
T1F3666B15D7E89F2AE9AF533AF476202C53F9F8586342D74A1508E5BA2C877004A9F373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

37:33:32:f4:13:01:4a:5d:ee:38:3e:c1:4d:d8:b5:f8:b0:75:60:3f:12:22:c5:a1:9e:ec:84:3c:9f:bd:3f:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f1:b3:45:f5:27:e8:c0:16:d6:00:01:00:00:01:f1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

6493690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis.CSharp/Release/net8.0/Microsoft.CodeAnalysis.CSharp.pdb

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Microsoft.CodeAnalysis.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d919bcf3e2f0e74dc1e79c713f06934201cd2338ad23b9a430e53944ebc0408
MD5 153bfb3702230d31d2f221c8594ee6ea
SHA1 5f0076b69ea259a63023d16f90c0f227fdc05b8a
SHA512 53497197bdefe5ef1c22a6e6cfb32d45d156a141124ec0b8874950003504c1ad3c59772003fd12ed8d9d6d5f23da874fb934d21a14f0be8f571caa40de2f4c47
SSDEEP 49152:xWL6bCMQqrm4NhVJ6bq3d3WmI8h5XKligtUe5O0fS9:dCMQqrm4NhVJ6m3lXgdi
TLSH
T14AD55C01EAF95F6BC57F4B3AF47344C907BBEC9A1742970A6024A5BD2C437228E05E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

2f:2a:40:1d:42:e4:5a:32:40:ce:a2:ca:7f:49:0a:b8:72:6d:ca:ff:bf:19:13:86:a4:09:50:80:ed:d5:7f:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

2965098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis/Release/net8.0/Microsoft.CodeAnalysis.pdb

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Core.deps.json

SHA256 ccad3e0b2bc0a3ec9f768f576397317141de623672e6373de0d46ce6a61b178b
MD5 02f890943bd70060cbc7a63f4e7bf646
SHA1 128fe59734c805e2d74ce7878a5cf019465b6d60
SHA512 d73f47c796ec411826d988169e0a2c375e2bf224921e464c762ef46031fd4eb2f5ed2f08c791d838bcdf6ce571f91d8e1478ac9a37b4a946f9f105998dd7eaaf
TLSH
T106E0D828E6F408A301D629B304398183F330D653041D3C2476DE841C8F4992B58B4AEA
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8032e71aac171f0e6e05ff852680552735ab902393ac02090e6aa07e27d4dd3f
MD5 4802311900ff459d1457d86b4219f095
SHA1 c3a01b665ab185a856fdfe59043f4ff49004ce1f
SHA512 b68bde05549a320c51248bfbae68e00c3e163e6a96cd5a4e8877bc1d741c39c2c60a409fa325e3ba2adfe046210efb1d1c37e37a865de10908273982b5d871a3
SSDEEP 24576:44lZKXpi5ErV62Eg+yPa1TxN/EVOIQa8AFZdN8IxtGsVNryS:ci5Er1Eg+5xNeFfN8IxtGsVNryS
TLSH
T15DC529146EA8894BE3EE473E98F5270545BAA1133D20FB5F0F44EA50CE4C27F592972E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2626658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Core/obj/Release/net8.0/Paftix.Core.pdb

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Kod.deps.json

SHA256 bf1bce3ee0d3610b7bd3bfe2c0089e1bfc3576f3b48172b40f3920f1539f7f50
MD5 43dcdbb37523dae5f4d2ca4e635fc002
SHA1 21c13213cec0c55b57cb23eef0715e11f23e8265
SHA512 a4fd7be70bb7093f99df77db44112e1a92ff2ed132d19dfa88f5368a491a91330b2e4c816832cb4a31dca6b68b6c40a2a12bac410292b0f37624b70980d20351
SSDEEP 96:luxGoGNPkmEmE1IJyRK5ENkuzRyowNuDZmENE+L6tWBcZaJusMyaGGNDFwmypwNZ:gYFG6yyHonIyar/9Bm2uZo
TLSH
T12CA1F604C2644C5BE4D2B5A30AAE14C2F7272387642CBD98B45DA61C4FC77EC9DACA7D
MD5 SHA1 SHA512 SSDEEP TLSH

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Kod.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5cd33d86bdcb472e4583b33d9329e73f996ec1076985c52895f19681366e900a
MD5 b53f1b6dade9e093bf2c3e31ac881507
SHA1 821a3c8b0ad4111a2db4710fc09ff4d94a60be9d
SHA512 2c0e0c89f404f24d5a093ae37fefd276cc69d9e993e84738a527ffc17e417a27c7e825cba7e50f0ef8c8b4cb02d50cf438964487d241e0db173f8c08af4ad0bd
SSDEEP 192:j2Z41EHTvHVgnWrM96iJa+vUDOHpE+YPxEafd1ufxZ+9qii:jefHTv6n6MDk+8DOHsxEafd8xZTii
TLSH
T16A62182637EC9367F9FF4B39A9F296104372FA4A6812DA3D094C350E1C177405A92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Kod/obj/Release/net8.0/Paftix.Kod.pdb

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Revit.deps.json

SHA256 22e4bfd3473f496855c85669edf259393106cb6676ad3e12ec1be4b7d85da7db
MD5 def3e4b9332a5d47e9f3f503fac9eac6
SHA1 2300c7702e78352c2fd49a91c19a87e6707634fa
SHA512 36d376b9af8246582b4ecd4c433474e3527909b8cfe169d39a1f55967d08c7bd32b1df3faf5f2606bdd826e6d9ebaaa8ea4a44590314a9539eefc667ac647bcc
TLSH
T15A510918E1A04CBB5592B5B305BE00C3F325938754087DA8798CA45DCF8BAFD58BDBB9
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/Paftix.Revit.dll

SHA256 5c5fe7535adbb729b2b75f38ce1bcbeda356eeac8c1a6a8d213e8ee68837ad3a
MD5 4d4fe65a212a20ac3e7dd9bdcfb7e0a0
SHA1 fd7bbbbc2e8462e867c5ce0b21106ceee5cd1158
SHA512 8846443e14cc1fe53359c3ce520290d5d9d71383d39673484fc44a54a47903c5e6a78596348b21e7b29ba88edaa4ddb3dd5a68b8c7d6887767319b996c98f3c6
SSDEEP 3072:h87lzgEYjD3qM7fo6WHHApF2sw2rQs4qaCNhDTvXdbelmX1ymSFMhwqv7zWib3x+:h81e39LpF2sw2rQs4qaCNhvXdbqe1LSS
TLSH
T1FEF33B0827EC8E15EAFF1B3964F415481B72BA0B9AB7EB4D1CCA65E40D723C09E05767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Revit/obj/Release/Paftix.Revit.pdb

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/tr/Microsoft.CodeAnalysis.CSharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 76c1f8a8bd7d748170cf0e9b93039fb2bc2ee074ba19eedc10f9a9bc026ec197
MD5 409ebc320dd05403622d3c6d7d192207
SHA1 abe2fcc66f3efd6e2e59d30f960981680cbbb085
SHA512 8b108372e5d484dda29f3108348540590d8dbbce65ec0ee4076e9ed3e00d463640742f7f4bbd80088be733ac1be66285518677e93fafe4821e248d338261a38e
SSDEEP 6144:OtiZmnuQ3CPmQNAFNTy4q+eqJ+dHuqKXgOfc/LNiwzp79aoupOteocyIs0KHTBSu:RtqJ+DX3IzRU
TLSH
T19A94A401B6FD241CF3F71BD9BBF6851ADD6B7DA22B21C24D10094B1F17A4B8286A1736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

20:e2:67:6e:fb:e3:3c:2a:f5:b6:ff:70:e3:6c:3a:e1:b6:0c:ca:c9:a3:b7:51:8c:3b:66:c6:aa:2e:91:a9:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

435390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Autodesk/Revit/Addins/2025/Paftix/tr/Microsoft.CodeAnalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 660fa2661a524dd05402991750509edb72c5cce4ddec9cdc56126c1e1c50bcdc
MD5 1ff755b660625ba428d7ceb68c9082fe
SHA1 f564b162cf86e440ada471b1e78803d8aa50a6ec
SHA512 30b9ff878def41d8147045344cc466f159763cdebde834b47481ffd77bba37f380073b5d7def4816ae2d592fbae0f1b6d8a3b5e84c2d58b26cab0a0fca138d7e
SSDEEP 768:3w8HccQcF9wpnxC6giKChMYTTYbEJyp7WGF2KfWjU9z9:gwQc0FDhjTYbEO7WGF2KfWYz9
TLSH
T1B123B641BBF9200DF6F71F75BAB8865A9C7FBE923D21D05D0001860E1A72B85CAA5737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ca:0d:82:c7:50:c5:dd:d7:f2:3e:ed:b9:77:e3:5d:00:bf:10:ec:2d:87:ad:d9:13:0b:de:92:51:a0:47:0b:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:eb:e0:18:6c:b5:b6:ef:38:ed:00:01:00:00:01:eb

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

43086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Autodesk/Revit/Addins/2026/Paftix.addin

SHA256 78a070c5fd8060626146749e624ffdea2dfb270bd79219279f09fcde3c5451dc
MD5 997bd0826e9ea3c1fc4ce75142719f11
SHA1 872d1fe010b4249a2833240ecbdba89d67542f47
SHA512 d2f4228de9a820bd4868e1514f3c1d0b4595097ecbabb1b052053d9b23d4722c22e387039cdb7ee673f1c231f46d660c16d32f9ef71e4b2387c8b4fe4d74fa0b
TLSH
T1C711542034F1E1B5F3121A91C455CE112F79E12F8A82C0A0FE5444DBEFCC2994A630A3
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Microsoft.CodeAnalysis.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c46e884a3f2910fd6098b104131cae600c1716ae14b27ffe2d22c54c7f71ff11
MD5 c031c139a3ba4be2e4866e006fded04f
SHA1 ca25d8bf4f421d29dce7d3c5154c5a150c669efa
SHA512 8515917b11a72d735ccfbac1800ad64a03a45cf3864c5bf14a5ad3acdb1ed761f9fd47676cef67596e5dbd2be1e7eb7fdc85b8d6ede2d4e7b9bcce7c84a63f82
SSDEEP 49152:ueaxFMavmcHyVbQuZqh1GI7LMZIbhngKV0VH3S0UHccQS33XABjgt4BzcYusH/kS:uBSV21jUCV0VH3S0Ut/XABjgt4FkPa
TLSH
T1F3666B15D7E89F2AE9AF533AF476202C53F9F8586342D74A1508E5BA2C877004A9F373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

37:33:32:f4:13:01:4a:5d:ee:38:3e:c1:4d:d8:b5:f8:b0:75:60:3f:12:22:c5:a1:9e:ec:84:3c:9f:bd:3f:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f1:b3:45:f5:27:e8:c0:16:d6:00:01:00:00:01:f1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

6493690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis.CSharp/Release/net8.0/Microsoft.CodeAnalysis.CSharp.pdb

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Microsoft.CodeAnalysis.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d919bcf3e2f0e74dc1e79c713f06934201cd2338ad23b9a430e53944ebc0408
MD5 153bfb3702230d31d2f221c8594ee6ea
SHA1 5f0076b69ea259a63023d16f90c0f227fdc05b8a
SHA512 53497197bdefe5ef1c22a6e6cfb32d45d156a141124ec0b8874950003504c1ad3c59772003fd12ed8d9d6d5f23da874fb934d21a14f0be8f571caa40de2f4c47
SSDEEP 49152:xWL6bCMQqrm4NhVJ6bq3d3WmI8h5XKligtUe5O0fS9:dCMQqrm4NhVJ6m3lXgdi
TLSH
T14AD55C01EAF95F6BC57F4B3AF47344C907BBEC9A1742970A6024A5BD2C437228E05E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

2f:2a:40:1d:42:e4:5a:32:40:ce:a2:ca:7f:49:0a:b8:72:6d:ca:ff:bf:19:13:86:a4:09:50:80:ed:d5:7f:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

2965098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis/Release/net8.0/Microsoft.CodeAnalysis.pdb

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Core.deps.json

SHA256 ccad3e0b2bc0a3ec9f768f576397317141de623672e6373de0d46ce6a61b178b
MD5 02f890943bd70060cbc7a63f4e7bf646
SHA1 128fe59734c805e2d74ce7878a5cf019465b6d60
SHA512 d73f47c796ec411826d988169e0a2c375e2bf224921e464c762ef46031fd4eb2f5ed2f08c791d838bcdf6ce571f91d8e1478ac9a37b4a946f9f105998dd7eaaf
TLSH
T106E0D828E6F408A301D629B304398183F330D653041D3C2476DE841C8F4992B58B4AEA
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8032e71aac171f0e6e05ff852680552735ab902393ac02090e6aa07e27d4dd3f
MD5 4802311900ff459d1457d86b4219f095
SHA1 c3a01b665ab185a856fdfe59043f4ff49004ce1f
SHA512 b68bde05549a320c51248bfbae68e00c3e163e6a96cd5a4e8877bc1d741c39c2c60a409fa325e3ba2adfe046210efb1d1c37e37a865de10908273982b5d871a3
SSDEEP 24576:44lZKXpi5ErV62Eg+yPa1TxN/EVOIQa8AFZdN8IxtGsVNryS:ci5Er1Eg+5xNeFfN8IxtGsVNryS
TLSH
T15DC529146EA8894BE3EE473E98F5270545BAA1133D20FB5F0F44EA50CE4C27F592972E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2626658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Core/obj/Release/net8.0/Paftix.Core.pdb

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Kod.deps.json

SHA256 bf1bce3ee0d3610b7bd3bfe2c0089e1bfc3576f3b48172b40f3920f1539f7f50
MD5 43dcdbb37523dae5f4d2ca4e635fc002
SHA1 21c13213cec0c55b57cb23eef0715e11f23e8265
SHA512 a4fd7be70bb7093f99df77db44112e1a92ff2ed132d19dfa88f5368a491a91330b2e4c816832cb4a31dca6b68b6c40a2a12bac410292b0f37624b70980d20351
SSDEEP 96:luxGoGNPkmEmE1IJyRK5ENkuzRyowNuDZmENE+L6tWBcZaJusMyaGGNDFwmypwNZ:gYFG6yyHonIyar/9Bm2uZo
TLSH
T12CA1F604C2644C5BE4D2B5A30AAE14C2F7272387642CBD98B45DA61C4FC77EC9DACA7D
MD5 SHA1 SHA512 SSDEEP TLSH

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Kod.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5cd33d86bdcb472e4583b33d9329e73f996ec1076985c52895f19681366e900a
MD5 b53f1b6dade9e093bf2c3e31ac881507
SHA1 821a3c8b0ad4111a2db4710fc09ff4d94a60be9d
SHA512 2c0e0c89f404f24d5a093ae37fefd276cc69d9e993e84738a527ffc17e417a27c7e825cba7e50f0ef8c8b4cb02d50cf438964487d241e0db173f8c08af4ad0bd
SSDEEP 192:j2Z41EHTvHVgnWrM96iJa+vUDOHpE+YPxEafd1ufxZ+9qii:jefHTv6n6MDk+8DOHsxEafd8xZTii
TLSH
T16A62182637EC9367F9FF4B39A9F296104372FA4A6812DA3D094C350E1C177405A92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Kod/obj/Release/net8.0/Paftix.Kod.pdb

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Revit.deps.json

SHA256 22e4bfd3473f496855c85669edf259393106cb6676ad3e12ec1be4b7d85da7db
MD5 def3e4b9332a5d47e9f3f503fac9eac6
SHA1 2300c7702e78352c2fd49a91c19a87e6707634fa
SHA512 36d376b9af8246582b4ecd4c433474e3527909b8cfe169d39a1f55967d08c7bd32b1df3faf5f2606bdd826e6d9ebaaa8ea4a44590314a9539eefc667ac647bcc
TLSH
T15A510918E1A04CBB5592B5B305BE00C3F325938754087DA8798CA45DCF8BAFD58BDBB9
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/Paftix.Revit.dll

SHA256 d5c0c09e80cc8d5a9cb04b371cce56c6c8a0806998ce081dd0fa4561b553cdd7
MD5 5f476b7d880c87e43b5381a5f28526a0
SHA1 1da8f58dece04c3de14a2ef98860b1c201ad9b56
SHA512 9c8bed25c90ad22d6813b7a728a99dae76a5fd652ac866c74ee5cdf18a6c0087de81becde47bac0127c6ce323d58b9a043353c76150a9a96ed5e1f578b717ecf
SSDEEP 3072:T87lzgEYjD3qM7fo6WHHApF2sw2rQs4qaCNhDTvXdbelmX1ymSFMdwqv7zWib3x+:T81e39LpF2sw2rQs4qaCNhvXdbqe1LSe
TLSH
T1ECF33B0827EC8E15EAFF1B3964F415481B72BA0B9AB7EB4D1CCA65E40D723C09E05767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Revit/obj/Release/Paftix.Revit.pdb

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/tr/Microsoft.CodeAnalysis.CSharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 76c1f8a8bd7d748170cf0e9b93039fb2bc2ee074ba19eedc10f9a9bc026ec197
MD5 409ebc320dd05403622d3c6d7d192207
SHA1 abe2fcc66f3efd6e2e59d30f960981680cbbb085
SHA512 8b108372e5d484dda29f3108348540590d8dbbce65ec0ee4076e9ed3e00d463640742f7f4bbd80088be733ac1be66285518677e93fafe4821e248d338261a38e
SSDEEP 6144:OtiZmnuQ3CPmQNAFNTy4q+eqJ+dHuqKXgOfc/LNiwzp79aoupOteocyIs0KHTBSu:RtqJ+DX3IzRU
TLSH
T19A94A401B6FD241CF3F71BD9BBF6851ADD6B7DA22B21C24D10094B1F17A4B8286A1736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

20:e2:67:6e:fb:e3:3c:2a:f5:b6:ff:70:e3:6c:3a:e1:b6:0c:ca:c9:a3:b7:51:8c:3b:66:c6:aa:2e:91:a9:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

435390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Autodesk/Revit/Addins/2026/Paftix/tr/Microsoft.CodeAnalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 660fa2661a524dd05402991750509edb72c5cce4ddec9cdc56126c1e1c50bcdc
MD5 1ff755b660625ba428d7ceb68c9082fe
SHA1 f564b162cf86e440ada471b1e78803d8aa50a6ec
SHA512 30b9ff878def41d8147045344cc466f159763cdebde834b47481ffd77bba37f380073b5d7def4816ae2d592fbae0f1b6d8a3b5e84c2d58b26cab0a0fca138d7e
SSDEEP 768:3w8HccQcF9wpnxC6giKChMYTTYbEJyp7WGF2KfWjU9z9:gwQc0FDhjTYbEO7WGF2KfWYz9
TLSH
T1B123B641BBF9200DF6F71F75BAB8865A9C7FBE923D21D05D0001860E1A72B85CAA5737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ca:0d:82:c7:50:c5:dd:d7:f2:3e:ed:b9:77:e3:5d:00:bf:10:ec:2d:87:ad:d9:13:0b:de:92:51:a0:47:0b:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:eb:e0:18:6c:b5:b6:ef:38:ed:00:01:00:00:01:eb

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

43086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Autodesk/Revit/Addins/2027/Paftix.addin

SHA256 78a070c5fd8060626146749e624ffdea2dfb270bd79219279f09fcde3c5451dc
MD5 997bd0826e9ea3c1fc4ce75142719f11
SHA1 872d1fe010b4249a2833240ecbdba89d67542f47
SHA512 d2f4228de9a820bd4868e1514f3c1d0b4595097ecbabb1b052053d9b23d4722c22e387039cdb7ee673f1c231f46d660c16d32f9ef71e4b2387c8b4fe4d74fa0b
TLSH
T1C711542034F1E1B5F3121A91C455CE112F79E12F8A82C0A0FE5444DBEFCC2994A630A3
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Microsoft.CodeAnalysis.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c46e884a3f2910fd6098b104131cae600c1716ae14b27ffe2d22c54c7f71ff11
MD5 c031c139a3ba4be2e4866e006fded04f
SHA1 ca25d8bf4f421d29dce7d3c5154c5a150c669efa
SHA512 8515917b11a72d735ccfbac1800ad64a03a45cf3864c5bf14a5ad3acdb1ed761f9fd47676cef67596e5dbd2be1e7eb7fdc85b8d6ede2d4e7b9bcce7c84a63f82
SSDEEP 49152:ueaxFMavmcHyVbQuZqh1GI7LMZIbhngKV0VH3S0UHccQS33XABjgt4BzcYusH/kS:uBSV21jUCV0VH3S0Ut/XABjgt4FkPa
TLSH
T1F3666B15D7E89F2AE9AF533AF476202C53F9F8586342D74A1508E5BA2C877004A9F373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

37:33:32:f4:13:01:4a:5d:ee:38:3e:c1:4d:d8:b5:f8:b0:75:60:3f:12:22:c5:a1:9e:ec:84:3c:9f:bd:3f:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f1:b3:45:f5:27:e8:c0:16:d6:00:01:00:00:01:f1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

6493690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis.CSharp/Release/net8.0/Microsoft.CodeAnalysis.CSharp.pdb

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Microsoft.CodeAnalysis.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d919bcf3e2f0e74dc1e79c713f06934201cd2338ad23b9a430e53944ebc0408
MD5 153bfb3702230d31d2f221c8594ee6ea
SHA1 5f0076b69ea259a63023d16f90c0f227fdc05b8a
SHA512 53497197bdefe5ef1c22a6e6cfb32d45d156a141124ec0b8874950003504c1ad3c59772003fd12ed8d9d6d5f23da874fb934d21a14f0be8f571caa40de2f4c47
SSDEEP 49152:xWL6bCMQqrm4NhVJ6bq3d3WmI8h5XKligtUe5O0fS9:dCMQqrm4NhVJ6m3lXgdi
TLSH
T14AD55C01EAF95F6BC57F4B3AF47344C907BBEC9A1742970A6024A5BD2C437228E05E67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

2f:2a:40:1d:42:e4:5a:32:40:ce:a2:ca:7f:49:0a:b8:72:6d:ca:ff:bf:19:13:86:a4:09:50:80:ed:d5:7f:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

2965098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis/Release/net8.0/Microsoft.CodeAnalysis.pdb

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Core.deps.json

SHA256 ccad3e0b2bc0a3ec9f768f576397317141de623672e6373de0d46ce6a61b178b
MD5 02f890943bd70060cbc7a63f4e7bf646
SHA1 128fe59734c805e2d74ce7878a5cf019465b6d60
SHA512 d73f47c796ec411826d988169e0a2c375e2bf224921e464c762ef46031fd4eb2f5ed2f08c791d838bcdf6ce571f91d8e1478ac9a37b4a946f9f105998dd7eaaf
TLSH
T106E0D828E6F408A301D629B304398183F330D653041D3C2476DE841C8F4992B58B4AEA
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8032e71aac171f0e6e05ff852680552735ab902393ac02090e6aa07e27d4dd3f
MD5 4802311900ff459d1457d86b4219f095
SHA1 c3a01b665ab185a856fdfe59043f4ff49004ce1f
SHA512 b68bde05549a320c51248bfbae68e00c3e163e6a96cd5a4e8877bc1d741c39c2c60a409fa325e3ba2adfe046210efb1d1c37e37a865de10908273982b5d871a3
SSDEEP 24576:44lZKXpi5ErV62Eg+yPa1TxN/EVOIQa8AFZdN8IxtGsVNryS:ci5Er1Eg+5xNeFfN8IxtGsVNryS
TLSH
T15DC529146EA8894BE3EE473E98F5270545BAA1133D20FB5F0F44EA50CE4C27F592972E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2626658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Core/obj/Release/net8.0/Paftix.Core.pdb

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Kod.deps.json

SHA256 bf1bce3ee0d3610b7bd3bfe2c0089e1bfc3576f3b48172b40f3920f1539f7f50
MD5 43dcdbb37523dae5f4d2ca4e635fc002
SHA1 21c13213cec0c55b57cb23eef0715e11f23e8265
SHA512 a4fd7be70bb7093f99df77db44112e1a92ff2ed132d19dfa88f5368a491a91330b2e4c816832cb4a31dca6b68b6c40a2a12bac410292b0f37624b70980d20351
SSDEEP 96:luxGoGNPkmEmE1IJyRK5ENkuzRyowNuDZmENE+L6tWBcZaJusMyaGGNDFwmypwNZ:gYFG6yyHonIyar/9Bm2uZo
TLSH
T12CA1F604C2644C5BE4D2B5A30AAE14C2F7272387642CBD98B45DA61C4FC77EC9DACA7D
MD5 SHA1 SHA512 SSDEEP TLSH

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Kod.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5cd33d86bdcb472e4583b33d9329e73f996ec1076985c52895f19681366e900a
MD5 b53f1b6dade9e093bf2c3e31ac881507
SHA1 821a3c8b0ad4111a2db4710fc09ff4d94a60be9d
SHA512 2c0e0c89f404f24d5a093ae37fefd276cc69d9e993e84738a527ffc17e417a27c7e825cba7e50f0ef8c8b4cb02d50cf438964487d241e0db173f8c08af4ad0bd
SSDEEP 192:j2Z41EHTvHVgnWrM96iJa+vUDOHpE+YPxEafd1ufxZ+9qii:jefHTv6n6MDk+8DOHsxEafd8xZTii
TLSH
T16A62182637EC9367F9FF4B39A9F296104372FA4A6812DA3D094C350E1C177405A92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Kod/obj/Release/net8.0/Paftix.Kod.pdb

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Revit.deps.json

SHA256 5390ceab10f9faf76145cd668dbe0562042fe5d719d90ce1b6ab2a585d62b637
MD5 809a0b808eae945ee609e828b927f383
SHA1 7b3d1cc0ebf3fc25e7585cacece698feaf54a11b
SHA512 5459f99e00437832218e3c6eeb5be5c103183e73a473d6e601238f857b20b6767c33cbfc902d60e1377f84f91a4ff4a519117e068ac9760ca27ba83baa9dc172
TLSH
T1D4510C18E1A04CBB5591B5B305BE00C3F325938764087DA8798CA45DCF8BAFD58BDBB9
MD5 SHA1 SHA512 TLSH

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/Paftix.Revit.dll

SHA256 91d19c0cbc226803b748650876f1cb89bd383514b64b164b713dc31ba5795b77
MD5 788ca2e73b2481350eb93e2fe9b70957
SHA1 9b8ee903724c942f731a9d7ec99d0cb9b699abcd
SHA512 3aceb81f8a8fc61714afcebdf7b08b3476aec9a18adefdd67beb91940ddaac1cc6d644e28b174320fd6a549629e26706aae9aefb20dfdb9d5b9ab2ff45b9d2cb
SSDEEP 3072:787lzgEYj73qM7fo6WHHApF2sw2rQs4qaCNhDTvXdbelmX1Na+mSuFClwqv7zWiD:781eX9LpF2sw2rQs4qaCNhvXdbqe1Nwq
TLSH
T117F33B0827EC8E15EAFF1B3564F415480B76BA4B9AB3EB8D1CCA65E40D723C09E05767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Revit/obj/Release/Paftix.Revit.pdb

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/tr/Microsoft.CodeAnalysis.CSharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 76c1f8a8bd7d748170cf0e9b93039fb2bc2ee074ba19eedc10f9a9bc026ec197
MD5 409ebc320dd05403622d3c6d7d192207
SHA1 abe2fcc66f3efd6e2e59d30f960981680cbbb085
SHA512 8b108372e5d484dda29f3108348540590d8dbbce65ec0ee4076e9ed3e00d463640742f7f4bbd80088be733ac1be66285518677e93fafe4821e248d338261a38e
SSDEEP 6144:OtiZmnuQ3CPmQNAFNTy4q+eqJ+dHuqKXgOfc/LNiwzp79aoupOteocyIs0KHTBSu:RtqJ+DX3IzRU
TLSH
T19A94A401B6FD241CF3F71BD9BBF6851ADD6B7DA22B21C24D10094B1F17A4B8286A1736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

20:e2:67:6e:fb:e3:3c:2a:f5:b6:ff:70:e3:6c:3a:e1:b6:0c:ca:c9:a3:b7:51:8c:3b:66:c6:aa:2e:91:a9:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

435390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Autodesk/Revit/Addins/2027/Paftix/tr/Microsoft.CodeAnalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 660fa2661a524dd05402991750509edb72c5cce4ddec9cdc56126c1e1c50bcdc
MD5 1ff755b660625ba428d7ceb68c9082fe
SHA1 f564b162cf86e440ada471b1e78803d8aa50a6ec
SHA512 30b9ff878def41d8147045344cc466f159763cdebde834b47481ffd77bba37f380073b5d7def4816ae2d592fbae0f1b6d8a3b5e84c2d58b26cab0a0fca138d7e
SSDEEP 768:3w8HccQcF9wpnxC6giKChMYTTYbEJyp7WGF2KfWjU9z9:gwQc0FDhjTYbEO7WGF2KfWYz9
TLSH
T1B123B641BBF9200DF6F71F75BAB8865A9C7FBE923D21D05D0001860E1A72B85CAA5737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ca:0d:82:c7:50:c5:dd:d7:f2:3e:ed:b9:77:e3:5d:00:bf:10:ec:2d:87:ad:d9:13:0b:de:92:51:a0:47:0b:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:eb:e0:18:6c:b5:b6:ef:38:ed:00:01:00:00:01:eb

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

43086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$APPDATA/Paftix/keygen.json

SHA256 1a9641767444307cd90eb52fec22f014c67f3163d9a1394fdec523de5acd9450
MD5 768d9db1de840f9e625877df502891d4
SHA1 b8b2ee140b497ab3726651c2b0960f6f5c07d1c3
SHA512 ecb64722c513954c4914b41fc34d145c973f6e99a4b880468b21dbe1d68d9bc6446de8b275fc46a3242087116efd2fe103da03f34aa718befbf52b66859163ab
TLSH
T175E068770E04932B1744C8C859E047EB8B0294034D92B06B4707902AE98EAA0318D638
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/System.dll

IMPHASH b844086d4b3e59aa7b4439d88bcb40cb
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13105

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH c442f1649aa0670a32c622fadfcd00bd
SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
MD5 2726673c720a296442c8ed134b41d169
SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
TLSH
T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BENI_OKU.txt

SHA256 07b664c2d941af24e8748f23fee97c30ef643e20b8d952e5bb1842c322b0f485
MD5 81456768df235be5fe29446f429080a6
SHA1 c3c031b4eef9167ae82bbbc99289c73af421e2de
SHA512 b644a2d6e0ad7533e1e42eb36190e5f73eea1b3a8fe1d94204dfd1250f864ab829c2269fb95ac4a5682fc72a5f2251a526ebb3d6160cd95167e79fe85a63b702
TLSH
T12F31854131E8643DC4EB04CAD0A25F4AF19FAF0552A3D8F2BF6E02431B8A74C4408B5D
MD5 SHA1 SHA512 TLSH

Kaldir.exe

IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
SHA256 2269519a3ad99f9d7a6b72980aa802d3a96b8b6ed556900b3515e0f62c0df2ff
MD5 aa728f326d126b42a60872ccb12762a4
SHA1 7e4b696660e4d5bac4157b472e23f0f394d3b24b
SHA512 6ef1fc72d8ca363a0fe6d4d02cbc1b98c915e2be7bc16dafa9bb695b739a04ba56eac8638162260d775c65cbf7a8c4b5d4e1956fd3ebb88d80d2b8d51f609da7
SSDEEP 3072:Arv+LsMjvFsOTb98xQT+5U5qwCceA1zsQ:kWLsKB0ICm1z1
TLSH
T16AC38D1CBF268CF7D93241305597FAAF4A35AD71895A960BEB111B37DC335A1E60B302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

512B

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH c3edd09206117610ac78ba82816b607c
SHA256 0d7f702c518286a2d87db689af169c3857142324de4c9d76d51ebf639dced3df
MD5 e78bcd3208bff839e612041895bb8d42
SHA1 4b21b475b21d8f8bb2655d8e8e7d47548825831f
SHA512 eb38959a877d1af4ae53f25407ede3172f990f8c824624f5a2f385cddbd71a437b9033d45042a0e40f7fb611ff48836be166d97d42f3c169babb063ef48e8e35
SSDEEP 192:MItx8GSBYnUMu3Oad973Ykv/RGwC7ocJ4D4:bx8GOYnBu3Oad973YkvMwC7ocJ
TLSH
T12A22B8C9BA1579F5E0239838B18AF12F4D5D7C31DA2B840EE89A1E35B81F5E4571DB03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4671

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Paftix.mcpb

SHA256 83dc34e230c49b108d4a3b6ca272f803009075303cd646c06e3feea1210a19b8
MD5 617e2aeaf4fce77cc067173b5ac9c08e
SHA1 9151fd7cda193b46866091fd7a920e151e01ee28
SHA512 f05c0428954699862a6daf54079f6953a6491fb2361f37aa3dbe1d8bd50226b245858008366aaf5bbfab19d9369f87e739b11d9f01eae093db87d91466eb7fdc
SSDEEP 12288:fKac6DT6lKb19C2MsnMLsofv+o/rL50u3jHr/xu355VvgFCKaHCrt:fKacHUnnnMFv/jLB33xuJ5+CKB
TLSH
T199F4233670BF116978FFED205AAACD06F21CB83B65BE67440B544F12D09BEC9205DE98
MD5 SHA1 SHA512 SSDEEP TLSH

manifest.json

SHA256 6028b82cd4110498771fbcdbc0e1688baac342925d8d2ee8dd23289f72a86f6d
MD5 e0fdb28af2d38d33cea672d2a5f9cb78
SHA1 3d8db6c83c4fbdcd0d779ebf5af8daffbba4bf3a
SHA512 36f46aad69fa69d7a6e63191dfe5b8d402bae0ee242c1d396769a1e16c0f1660fcf8eff41f2b6cdab33526e45aefa32572e65ee501bbc1f636f30cb93f029b89
TLSH
T10311ED20D8F80D330AED62265CB6955312298E471644BCB9374E31CD0F0E23B163D69E
MD5 SHA1 SHA512 TLSH

server/Paftix.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8032e71aac171f0e6e05ff852680552735ab902393ac02090e6aa07e27d4dd3f
MD5 4802311900ff459d1457d86b4219f095
SHA1 c3a01b665ab185a856fdfe59043f4ff49004ce1f
SHA512 b68bde05549a320c51248bfbae68e00c3e163e6a96cd5a4e8877bc1d741c39c2c60a409fa325e3ba2adfe046210efb1d1c37e37a865de10908273982b5d871a3
SSDEEP 24576:44lZKXpi5ErV62Eg+yPa1TxN/EVOIQa8AFZdN8IxtGsVNryS:ci5Er1Eg+5xNeFfN8IxtGsVNryS
TLSH
T15DC529146EA8894BE3EE473E98F5270545BAA1133D20FB5F0F44EA50CE4C27F592972E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2626658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Core/obj/Release/net8.0/Paftix.Core.pdb

server/Paftix.Mcp.deps.json

SHA256 885bff23709b108d41f65b2eb3d38f8e71c6874fda90f893e0f11fa8aade8045
MD5 f6d824a71fc1bd7c24c743e726420dec
SHA1 be590ea91535bf523878edbb51602e6bd466b24d
SHA512 2a1975f75caf6c78f56ea1b566844c37791d0e0c7442e0ff864f1821d2a649e12e234bfea0f749442a5598bcac479f552e9d6c7595db83341ae8a9360e887a4c
TLSH
T1D501A218E5F40CA3019669F7043A8093F3719357581C7C687AED881C8F8AD6F58B8EBA
MD5 SHA1 SHA512 TLSH

server/Paftix.Mcp.dll

SHA256 0e326647d64536d02a3c596275ec501a48c4822f51cdff46ad630ee35a4e20dd
MD5 105788c25686a6d92a1d344f07b96e78
SHA1 3f5d7491e2c809e6a5a13225fc18547b4637aeec
SHA512 7c278a747516803fac30bad1f47e328b14ed0d04238821120877b1c31831e80a35168802acae2a1cfb0894c38658a76c8a05c99ac611fd6aee73cf94493d411e
SSDEEP 768:wL7tKswMmwjHkdRO/1jG7vRNyxFrVXHYfVobqaljWS0OrjJQxBVfNoRiigBVfNec:HOFZXHYtobLjW/OrjJQxBVfNopgBVfNR
TLSH
T1C903935467FD9B17FAFF1B39ADB042620A7BBE5A6931F64C058C61C90CB27909850B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

server/Paftix.Mcp.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 df4f835811838751e8e047db1b50573a651ec3b2edcd8b0933202a29011f3fe3
MD5 ab624524536703372df03d08243e4243
SHA1 4e127ace365a11c0226244de62ec59b1c80e8317
SHA512 032ba293386f397bb6fe31eb1e05139ff96ec149ab07c7e7576eea9a43f7b28acd5c6876e2aa526c414352372c9b3ba1c57d6ef2aab9ff91b411dc3998789f9b
SSDEEP 3072:GqeXA/4yIbHkNPN+6H6xCYOiVUE265IJ5:GvdHkNFdaxmVEoJ
TLSH
T1B4E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

server/Paftix.Mcp.runtimeconfig.json

SHA256 aa848552113b3925527b4e8c22ea4ceb065bd229b0a7ad51fe5e61ca59930c4f
MD5 c94bacad81e966956d736a9291f4d0e0
SHA1 17f12fcaa767a031095209a746e99e1a4c20bbc0
SHA512 cc445b2ade23f830aae5a6020381338363ef5d9b6fdfa2b829c2b8ea6567d5529df765087078c48972ebba1a4bedb9975ae8dad73c36606e72f95a2427b12392
TLSH
T107F0A0B4DE246CB3159E746E8969C0825A3892A748197CB475DD090C6F0F2EE1333B8A
MD5 SHA1 SHA512 TLSH

PaftixLisans.exe

IMPHASH 25f4444e0f8d2a8ae40cbacacc252543
SHA256 8d08a3666667789d09f8b85e4cfacec60f385b6e82e0ffef782c6fbcaaa38f11
MD5 486ba53ca77ce66ebfdbb4ee40b556b6
SHA1 aadf10aaeba06749f945c22e4a9f8317c5a4e881
SHA512 9d36b5390e996295fb733cb34297bcf9d4de0eba97b747c354a51cdee1309cac2586f9a9d193763d01dfbc92dd26dd997880b0b8cac1fdfa1c14d92e5a7ee045
SSDEEP 98304:bPiHuZYmAa29a0z+hrrwjp54PufqGQf8hfEeB8ng4hBcgLFBQICoflcGtviKardK:bGuM9a0wrs541GnhseggmBcg7QFM+rk
TLSH
T142C6BF56E2FD00E8E57AC0B8C6575517EBB234551730A7EB56A08A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6044112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry LocateXStateFeature RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread GetCurrentProcessId CreateThread GetModuleHandleW WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InterlockedPopEntrySList ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW CreateSemaphoreExW ReleaseSemaphore GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW QueryThreadCycleTime GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetCurrentProcessorNumberEx GetProcessAffinityMask QueryInformationJobObject CloseHandle GetSystemTimeAsFileTime GetModuleFileNameW CreateProcessW GetCPInfo LoadLibraryExW CreateFileW GetFileAttributesExW GetFullPathNameW LoadLibraryExA OutputDebugStringA OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetFilePointer MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable LoadLibraryW CreateDirectoryW RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose LoadLibraryA GetCurrentDirectoryW IsWow64Process EncodePointer DecodePointer CreateFileMappingA TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsFree RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx GetLastError CreateFileMappingW

advapi32

ReportEventW AdjustTokenPrivileges RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoReleaseMarshalData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

CreateErrorInfo SysFreeString GetErrorInfo SetErrorInfo SysStringLen SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx VariantClear VariantInit VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncat_s wcsncat_s _wcsicmp wcsnlen wcscat_s towupper iswascii _strdup strncpy strnlen wcstok_s isdigit isupper isalpha towlower _wcsdup iswspace isspace islower strtok_s strcmp strcspn __strncnt _wcsnicmp strlen wcscpy_s toupper wcsncpy_s strcpy_s strcat_s strncpy_s _strnicmp tolower wcsncmp iswupper strncmp _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush __acrt_iob_func __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vfwprintf fputws fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgets fgetc fputc _wfsopen _wfopen __p__commode _set_fmode __stdio_common_vsnprintf_s setvbuf _setmode _dup _fileno ftell fseek fputs __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s fwrite _flushall fopen fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex terminate _controlfp_s _wcserror_s _invalid_parameter_noinfo _errno exit abort

api-ms-win-crt-convert-l1-1-0

_atoi64 _ltow_s _wtoi strtoul _wcstoui64 atol _itow_s strtoull wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

asinhf atanhf cbrtf acoshf cosh cbrt coshf exp expf acosh atanh floor floorf fma fmaf cosf _fdopen cos ceilf _copysignf _isnanf trunc truncf ilogb ilogbf tanhf ceil fmod fmodf atanf frexp atan2f atan2 log log10 log10f atan asinf log2 log2f logf pow powf sin sinf asin sinh sinhf sqrt sqrtf tan tanf tanh acosf _copysign asinh _isnan _finite modf modff _dclass _ldclass acos __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_unlock_locales setlocale __pctype_func ___lc_locale_name_func _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kopru/Paftix.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8032e71aac171f0e6e05ff852680552735ab902393ac02090e6aa07e27d4dd3f
MD5 4802311900ff459d1457d86b4219f095
SHA1 c3a01b665ab185a856fdfe59043f4ff49004ce1f
SHA512 b68bde05549a320c51248bfbae68e00c3e163e6a96cd5a4e8877bc1d741c39c2c60a409fa325e3ba2adfe046210efb1d1c37e37a865de10908273982b5d871a3
SSDEEP 24576:44lZKXpi5ErV62Eg+yPa1TxN/EVOIQa8AFZdN8IxtGsVNryS:ci5Er1Eg+5xNeFfN8IxtGsVNryS
TLSH
T15DC529146EA8894BE3EE473E98F5270545BAA1133D20FB5F0F44EA50CE4C27F592972E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2626658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/rclic/src/Paftix.Core/obj/Release/net8.0/Paftix.Core.pdb

kopru/Paftix.Mcp.deps.json

SHA256 885bff23709b108d41f65b2eb3d38f8e71c6874fda90f893e0f11fa8aade8045
MD5 f6d824a71fc1bd7c24c743e726420dec
SHA1 be590ea91535bf523878edbb51602e6bd466b24d
SHA512 2a1975f75caf6c78f56ea1b566844c37791d0e0c7442e0ff864f1821d2a649e12e234bfea0f749442a5598bcac479f552e9d6c7595db83341ae8a9360e887a4c
TLSH
T1D501A218E5F40CA3019669F7043A8093F3719357581C7C687AED881C8F8AD6F58B8EBA
MD5 SHA1 SHA512 TLSH

kopru/Paftix.Mcp.dll

SHA256 0e326647d64536d02a3c596275ec501a48c4822f51cdff46ad630ee35a4e20dd
MD5 105788c25686a6d92a1d344f07b96e78
SHA1 3f5d7491e2c809e6a5a13225fc18547b4637aeec
SHA512 7c278a747516803fac30bad1f47e328b14ed0d04238821120877b1c31831e80a35168802acae2a1cfb0894c38658a76c8a05c99ac611fd6aee73cf94493d411e
SSDEEP 768:wL7tKswMmwjHkdRO/1jG7vRNyxFrVXHYfVobqaljWS0OrjJQxBVfNoRiigBVfNec:HOFZXHYtobLjW/OrjJQxBVfNopgBVfNR
TLSH
T1C903935467FD9B17FAFF1B39ADB042620A7BBE5A6931F64C058C61C90CB27909850B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kopru/Paftix.Mcp.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 df4f835811838751e8e047db1b50573a651ec3b2edcd8b0933202a29011f3fe3
MD5 ab624524536703372df03d08243e4243
SHA1 4e127ace365a11c0226244de62ec59b1c80e8317
SHA512 032ba293386f397bb6fe31eb1e05139ff96ec149ab07c7e7576eea9a43f7b28acd5c6876e2aa526c414352372c9b3ba1c57d6ef2aab9ff91b411dc3998789f9b
SSDEEP 3072:GqeXA/4yIbHkNPN+6H6xCYOiVUE265IJ5:GvdHkNFdaxmVEoJ
TLSH
T1B4E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

kopru/Paftix.Mcp.runtimeconfig.json

SHA256 aa848552113b3925527b4e8c22ea4ceb065bd229b0a7ad51fe5e61ca59930c4f
MD5 c94bacad81e966956d736a9291f4d0e0
SHA1 17f12fcaa767a031095209a746e99e1a4c20bbc0
SHA512 cc445b2ade23f830aae5a6020381338363ef5d9b6fdfa2b829c2b8ea6567d5529df765087078c48972ebba1a4bedb9975ae8dad73c36606e72f95a2427b12392
TLSH
T107F0A0B4DE246CB3159E746E8969C0825A3892A748197CB475DD090C6F0F2EE1333B8A
MD5 SHA1 SHA512 TLSH

paftix.ayar.json

SHA256 1a9641767444307cd90eb52fec22f014c67f3163d9a1394fdec523de5acd9450
MD5 768d9db1de840f9e625877df502891d4
SHA1 b8b2ee140b497ab3726651c2b0960f6f5c07d1c3
SHA512 ecb64722c513954c4914b41fc34d145c973f6e99a4b880468b21dbe1d68d9bc6446de8b275fc46a3242087116efd2fe103da03f34aa718befbf52b66859163ab
TLSH
T175E068770E04932B1744C8C859E047EB8B0294034D92B06B4707902AE98EAA0318D638
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer