CurvaLauncher.zip
- SHA256 25f41eeb70751edd3c28facd9c92aacc55dac189868ad7952d9266d822a4b504
Overview
overview
7Static
static
3CurvaLauncher.exe
windows10-2004-x64
7CurvaLauncher.exe
windows11-ltsc_2024-x64
3Plugins/Cu...or.dll
windows10-2004-x64
1Plugins/Cu...or.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ng.dll
windows10-2004-x64
1Plugins/Cu...ng.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ng.dll
windows10-2004-x64
1Plugins/Cu...ng.dll
windows11-ltsc_2024-x64
1Plugins/Cu...rl.dll
windows10-2004-x64
1Plugins/Cu...rl.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ch.dll
windows10-2004-x64
1Plugins/Cu...ch.dll
windows11-ltsc_2024-x64
1Plugins/Cu...on.dll
windows10-2004-x64
1Plugins/Cu...on.dll
windows11-ltsc_2024-x64
1Plugins/Cu...am.dll
windows10-2004-x64
1Plugins/Cu...am.dll
windows11-ltsc_2024-x64
1Plugins/Cu...or.dll
windows10-2004-x64
1Plugins/Cu...or.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ng.dll
windows10-2004-x64
1Plugins/Cu...ng.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CurvaLauncher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
CurvaLauncher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Plugins/CurvaLauncher.Plugins.Calculator.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Plugins/CurvaLauncher.Plugins.Calculator.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Plugins/CurvaLauncher.Plugins.Everything.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Plugins/CurvaLauncher.Plugins.Everything.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Plugins/CurvaLauncher.Plugins.Hashing.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Plugins/CurvaLauncher.Plugins.Hashing.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Plugins/CurvaLauncher.Plugins.RunApplication.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Plugins/CurvaLauncher.Plugins.RunApplication.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Plugins/CurvaLauncher.Plugins.RunProgram.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Plugins/CurvaLauncher.Plugins.RunProgram.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Plugins/CurvaLauncher.Plugins.Translator.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Plugins/CurvaLauncher.Plugins.Translator.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Plugins/CurvaLauncher.Plugins.ZXing.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Plugins/CurvaLauncher.Plugins.ZXing.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target CurvaLauncher.zip
- Size 3.4MB
- Sample261102-ff9j8azzet
- SHA256 25f41eeb70751edd3c28facd9c92aacc55dac189868ad7952d9266d822a4b504
- MD5 c01ffa895f50e4f744159cef8af7c7f2
- SHA1 cafbf7d0b4f55a6f9920fd9855eb4887ef0d5d0c
- SHA512 0a27a8b1ec9812949934c303a1425a5f1f7b8a2a37c7586763119684e5322264c694e865fb239536951d04836f4d38ff2996ed1820b7e7d0afae0e4b561f1115
- SSDEEP 98304:0JZKT6UoizZ+Xump9OgfH5uTmLFBgnCexC2QDTuxZN3:0a6Uoid+X9DOYZlsD4TuF
- TLSH T142F53344C6AFEC028B67B8F1F122770F71FB642789858AC8C5518247B6D67F3EA2D641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/CurvaLauncher.exe unpack001/Plugins/CurvaLauncher.Plugins.Calculator.dll unpack001/Plugins/CurvaLauncher.Plugins.Everything.dll unpack001/Plugins/CurvaLauncher.Plugins.Hashing.dll unpack001/Plugins/CurvaLauncher.Plugins.OpenUrl.dll unpack001/Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll unpack001/Plugins/CurvaLauncher.Plugins.RunApplication.dll unpack001/Plugins/CurvaLauncher.Plugins.RunProgram.dll unpack001/Plugins/CurvaLauncher.Plugins.Translator.dll unpack001/Plugins/CurvaLauncher.Plugins.ZXing.dll
File Explorer
-
CurvaLauncher.zip.zip 3.4MB
-
CurvaLauncher.exe.exe 7.7MB
-
Plugins/CurvaLauncher.Plugins.Calculator.dll.dll 54KB
-
Plugins/CurvaLauncher.Plugins.Everything.dll.dll 139KB
-
Plugins/CurvaLauncher.Plugins.Hashing.dll.dll 23KB
-
Plugins/CurvaLauncher.Plugins.OpenUrl.dll.dll 19KB
-
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll.dll 36KB
-
Plugins/CurvaLauncher.Plugins.RunApplication.dll.dll 697KB
-
Plugins/CurvaLauncher.Plugins.RunProgram.dll.dll 22KB
-
Plugins/CurvaLauncher.Plugins.Translator.dll.dll 51KB
-
Plugins/CurvaLauncher.Plugins.ZXing.dll.dll 537KB
CurvaLauncher.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 a4f910738f68aa1bab04d6608a527f6fecca0962b1f3cb7de356a2fada990379
- MD5 616584ea8f1c997fd5b1c46821a1ec7e
- SHA1 291ea8d0a85ce8d2aa9d25d08661d2928daa8fb5
- SHA512 d8211dc5edb52edfdf80fc8d835921dfe9bb75422e91eb21037e2c1ba262a32767696866b89ff52bdf10033978865ffa27ea19ec2bd88192e55a0c1920e98da3
- SSDEEP 98304:BXkg1eAN2do5OYoddtd/KGCvSmaRZ+nceNhD94j0AHDfyJrelA:6geAVORdtMvNhD9h
- TLSH T10A867D0D23E86D37D3B787399CB073115E746D162102EB4B6E899A1D29762C4CDF23AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33321,
count=1, id=258, version=33321,
Plugins/CurvaLauncher.Plugins.Calculator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70e71b37fef23207cfa78b52f6a6ee6e2de029f986ce13cc11c78ea505ddf732
- MD5 1e90e5332a4890b774b1ad101d864584
- SHA1 b6c52ee6cb2e0784943d412db59f650043d50ccc
- SHA512 781e23802dda80d1732f2ed2ee9f9c3d44724debdfbc907c5ef4464fedcb74cec08e59afb92131230575fab1440181ca28e54f7499d3d9a769a2f6d355105a23
- SSDEEP 768:6kDQwIFa5tJWilEPlvzAQH6WvAQZSPdvgA29UqNmqBZB:6kcwIE4uRK4uUqNmqN
- TLSH T175433A54672C816BC95B877DC4B9902143FFA1F23701DB2A681CB2EDDD13742AB07A67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.Calculator\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Calculator.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.Everything.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a87bcddcbc6f9ab7f6a02a36067134091058e4d8a8e22e7a0192713292562df4
- MD5 25d7bda7c4fc9dcfb41db8f3c02d7203
- SHA1 1bfb87e9ef5a7df994254c2f390489d0570b32d5
- SHA512 653cfa033240ada96ead7ff3849b4fd48bbe78e786b2d985168fac2df9dcf2310fb6bf4e42a49b5cf4d226f1c7b5b22a51d269a4a049346fb29df3b192c35494
- SSDEEP 3072:tfDq88rlJ48CzId0R8nCltA/MdQGf/hUFPKLYSIip:t7TXEuqCt5KGXhp
- TLSH T1A9D38D827748007AE9EB8279D4B342459B72B4412761A7CF067C828A2E733D59F3F776
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
148090
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.Everything\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Everything.pdb
mscoree
_CorDllMain
Name
.text
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.Hashing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34f278bcf7126354ce44070299bbb85054efc4c57610afd4ea705a2eff050fdf
- MD5 57d16575a8fabaec7a1ff15a247ed1a0
- SHA1 3ba2dad9af7f216f97c42d15e6cb9460bbb16cb4
- SHA512 1fba90203d2cb7495094cb132d3110a2963615eec59a09c45a3926b9271e2177b76c97b4c8826f820f82da49fe90b172bb1169574a711d4474799d02a141aed1
- SSDEEP 384:3WQZ5W2vGL510lAu2+2WwpAXV5A2M+4YQOPBj4qqwPhpC7CjC3CGFCGQzwAhjMIH:3WJLYlAu2pKkrwP2W+SvLwu
- TLSH T1E9B20810266DA26BCDBB0B35157551E433BBAB5B6B61CF1D98AC110CDC236078F12FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.Hashing\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Hashing.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9d1969ae4baea92367efd683fe7e935194944188e42508189a8e2465789b395
- MD5 87f0b635d313cbf8535af3263b9764b5
- SHA1 fa0a8f5406a4569fb595f9aec67ba0829455df0f
- SHA512 dfb9cb8f34cb99d848f61abfd67eee857571187ab9e29cd6669a76a3e3675f4977c786ff9d81974d8bb690a5d0b79b381647cf84ed90a40fd604dc817c8513b8
- SSDEEP 384:vj9fg9f63SRCtHWhqnkhMOpA2M5IwePBj4q9Vg7edCUCiCzuCcCsfQchgPh:rW9c3tHGZUAITfh5H9t
- TLSH T1AB92F8103A2C92BECDB70B35547911E0237B6B5AAB51CF7E5898220DEC635178F23EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.OpenUrl\obj\Release\net8.0-windows\CurvaLauncher.Plugins.OpenUrl.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2fd8704de20621b1893c3b8c2eac54ae229e752aaa6bf37a15ee785859fac24c
- MD5 41ce0891eff717908bec753290edc55b
- SHA1 778b1cbc904e0def16ee49725c9dbe8e39582949
- SHA512 e2babce52cb607c5bab58cfd1c90d2daafb311f3895404db9800cbfc7f3fecdfa42e434db7c7a625f74b7b5fbfd1a6efa4305151ede2f5977a707ef7a8a10e60
- SSDEEP 768:yGxBjD7uIxIy1IRIeIw5Vn6qCMDl35es:1fjPuIxIy1IRIeIwDEMZ0s
- TLSH T16EF23A50677C42BECDAB477AA57514E0337B26BEB7228D1CC46CB604DC42A4B8F41EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.QuickWebSearch\obj\Release\net8.0-windows\CurvaLauncher.Plugins.QuickWebSearch.pdb
mscoree
_CorDllMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.RunApplication.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 af044719aefa01a55c37142fb23ef220fd4cabfdc922c197ac13db0ac89b8086
- MD5 e04157eddf69336a23a2351442c79bee
- SHA1 f5d1018d33a99fe9c21612a7aac980dc195116af
- SHA512 4ddbc56db9d5472f932f6804680b2e0520fafe89e6bd8f04258ffe93a4f80d0cefd41fce39f50439ffc384c3afad33557d0f4e735e097b3df897440a0a019616
- SSDEEP 6144:QAyqB+nR5jufXHwRZDUWMr3nL725QZTde:cqujufAFGTQ
- TLSH T153E4817E72D0B065D1F5C5F239567448DE32822E8C8AD234BB20BF917B94384FA6E791
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
719686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.RunApplication\obj\Release\net8.0-windows\CurvaLauncher.Plugins.RunApplication.pdb
mscoree
_CorDllMain
Name
.text
Size
695KB
Virtual Size
694KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.RunProgram.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 046b601327329958376c2a23153b1610292ba05e48a7440ef9b985c0c283070a
- MD5 9ff0b46dfc513246a8a463420e97b475
- SHA1 f8168cb4cc9a5e7e61981a0dce9218747384de9b
- SHA512 e6610c661e3a38fa22bc31f83e3bbcf098823f4861ddc3107e0d711185f7ee60ccb001ec8f5ab40109393114e31a85592457084481a105e67e42a3318cfcf995
- SSDEEP 384:U+vxtYsTht8B2/5/PpPA2MDtXxlh6QPBj4qrnOKXn6CRClCoCnCg6PeDERgX:JxBTht5hPODtXxVOKXZQkzCAugX
- TLSH T1B0A2F911665C52BACD7B0B7954749091377BFB9A6B018F2D58AC930CFC2620B4B13FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.RunProgram\obj\Release\net8.0-windows\CurvaLauncher.Plugins.RunProgram.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.Translator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21d3891a471c5ee2439c020f58d4609af0ca73502e388c2654dc0b273a4556d4
- MD5 f0067caa6afa1ef51bc436e3c59df3e4
- SHA1 d710e754d38cdfd95c0e245e1852b0840aa4d87e
- SHA512 dc4609099ac6c9f8c7b0952aab0bb99795921cbf44d29986638bfdeab3009191d76270d9e65b748b9c07dd90ae563af76d1a87215b662141d0d76d594df86573
- SSDEEP 768:0APjikSYujDnP2bW55BjFG1AJoS1gJYBF5WclEpWO4A0N4GdE:J0Y0y4jBGuoS1e4DxlEpWgE3dE
- TLSH T164334C60136C81BBCA6B0B746530C5E02276A79E7B22DF5C999C7A49AC1374FC711FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.Translator\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Translator.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.ZXing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 46a5ccb4d02b98aa63b0e0212f39521cd2071d6847330f731ed329f16b454705
- MD5 6099ebcde441690fbac4d5fe2a60bf89
- SHA1 f68c57479a05ebd7a3165e8f5dcd6e318ba63620
- SHA512 872fb1167da2e675f75620640177a809d41a0ead038ba7273d16450dc81488dfdf4555dfe17d90013485eded2b8c522a90158802ef1532121f6724282c975043
- SSDEEP 12288:XpMg1APMcFONnNbPm9e/qtN6ffPWk135ScOazHv37lnLQOPw:WnMcQnNS8i6fZ35DzHP7lnTPw
- TLSH T117C47C157BDC6B6BC57F5F3A94B10004A2F4E4212313DB6F6D982A692E537C19E823E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
497838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\Plugins\CurvaLauncher.Plugins.ZXing\obj\Release\net8.0-windows\CurvaLauncher.Plugins.ZXing.pdb
mscoree
_CorDllMain
Name
.text
Size
535KB
Virtual Size
534KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ