CurvaLauncher.zip
- SHA256 cb4291a1154ceb7c3eac9bcbffdd909112076fdd25b3b7e5bdc1b3b334e3afa4
Overview
overview
7Static
static
3CurvaLauncher.exe
windows10-2004-x64
7CurvaLauncher.exe
windows11-ltsc_2024-x64
3Plugins/Cu...or.dll
windows10-2004-x64
1Plugins/Cu...or.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ng.dll
windows10-2004-x64
1Plugins/Cu...ng.dll
windows11-ltsc_2024-x64
1Plugins/Cu...rl.dll
windows10-2004-x64
1Plugins/Cu...rl.dll
windows11-ltsc_2024-x64
1Plugins/Cu...ch.dll
windows10-2004-x64
1Plugins/Cu...ch.dll
windows11-ltsc_2024-x64
1Plugins/Cu...on.dll
windows10-2004-x64
1Plugins/Cu...on.dll
windows11-ltsc_2024-x64
1Plugins/Cu...am.dll
windows10-2004-x64
1Plugins/Cu...am.dll
windows11-ltsc_2024-x64
1Plugins/Cu...or.dll
windows10-2004-x64
1Plugins/Cu...or.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CurvaLauncher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
CurvaLauncher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Plugins/CurvaLauncher.Plugins.Calculator.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Plugins/CurvaLauncher.Plugins.Calculator.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Plugins/CurvaLauncher.Plugins.Hashing.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Plugins/CurvaLauncher.Plugins.Hashing.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Plugins/CurvaLauncher.Plugins.RunApplication.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Plugins/CurvaLauncher.Plugins.RunApplication.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Plugins/CurvaLauncher.Plugins.RunProgram.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Plugins/CurvaLauncher.Plugins.RunProgram.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Plugins/CurvaLauncher.Plugins.Translator.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Plugins/CurvaLauncher.Plugins.Translator.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target CurvaLauncher.zip
- Size 3.0MB
- Sample261102-fgclwazzew
- SHA256 cb4291a1154ceb7c3eac9bcbffdd909112076fdd25b3b7e5bdc1b3b334e3afa4
- MD5 b46764e8262197322bc8c27abcfd3224
- SHA1 764df341ff076994fe84e8232dba35b4f48f3e57
- SHA512 698d44e7038bde59eea578fe9740271e3bf1ad0ca3800cd5a1dd5e15c8ec900769da0b8250bbaf5b006ad769d1c36aaa54c74a35ba550b2f76b461f7654c7b45
- SSDEEP 49152:mTujAZUPSnPA1qWYf31ksNyfpsGCrke8BKxlP55cdIxnVKVxT06Ujtmwh:mCjAWPr1ti1ks8xQIPBKxlh5cAKVhotP
- TLSH T167E5339D9CD8A9B3D4623032E60F1F02579B13886DFF5BB17A1878EB803EDDD49550A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/CurvaLauncher.exe unpack001/Plugins/CurvaLauncher.Plugins.Calculator.dll unpack001/Plugins/CurvaLauncher.Plugins.Hashing.dll unpack001/Plugins/CurvaLauncher.Plugins.OpenUrl.dll unpack001/Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll unpack001/Plugins/CurvaLauncher.Plugins.RunApplication.dll unpack001/Plugins/CurvaLauncher.Plugins.RunProgram.dll unpack001/Plugins/CurvaLauncher.Plugins.Translator.dll
File Explorer
-
CurvaLauncher.zip.zip 3.0MB
-
CurvaLauncher.exe.exe 7.6MB
-
Plugins/CurvaLauncher.Plugins.Calculator.dll.dll 54KB
-
Plugins/CurvaLauncher.Plugins.Hashing.dll.dll 22KB
-
Plugins/CurvaLauncher.Plugins.OpenUrl.dll.dll 19KB
-
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll.dll 35KB
-
Plugins/CurvaLauncher.Plugins.RunApplication.dll.dll 46KB
-
Plugins/CurvaLauncher.Plugins.RunProgram.dll.dll 21KB
-
Plugins/CurvaLauncher.Plugins.Translator.dll.dll 49KB
CurvaLauncher.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 5ddbfe6052d54e6ad3796577d698a707995a8a3461aa062239b704ec5edb79be
- MD5 4cace73495c93b1a1a8ef03900542409
- SHA1 a5bc8d4f6e58fe8257c8ace18bbf8b695f83d8df
- SHA512 4a055bbda21e4da8c9d7a4fb7780d6c138d6a48999b2a74d33b3aa497f3c3bc50cfc9695ccbd943ae0c177a2accd884329af4f6b68727d0d764aaf66ac9139b1
- SSDEEP 98304:Rg1eAN2do5OYoddtd/KGCvSmaRZ+nceNhD94j0AHDfyJrelC:RgeAVORdtMvNhD9z
- TLSH T16B866D1D23EC6D32D3B74739DCB023215DB5AD561101EB4B2E89AE1D2A762C4CDE23A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33030,
count=18, id=259, version=33030,
count=86, id=261, version=33030,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33129,
count=1, id=258, version=33129,
Plugins/CurvaLauncher.Plugins.Calculator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 763dee48a17d327313bd6dc61e462709d95e4ca50d3a9ae8c159cca90a9539ee
- MD5 2cc91ed2c47481e17dbba0ec6df02c92
- SHA1 00f7f6a58cb1e66f7a9ca5b07ab1352c22ce827d
- SHA512 4ee89d05413d19d8d8a27126eabbd73b53d789e42b0fd49ea582a7b326ab29205597a6be509ea22c6be9903fc55dd254633f7997ad659bc43ae57a9b3435007a
- SSDEEP 768:E41c4Xk2mePMvy6ExrWge4ZSPFvsA0HZZ:E4C4X0lExIiay
- TLSH T16A434B582B6C813FCA4BC73DC4B1593147FBA1B23701EB6B581C71999E13712AA0BA77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
60574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.Calculator\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Calculator.pdb
mscoree
_CorDllMain
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.Hashing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ebd74b965a3e9e86d512cd64300d1288afbf483cd493019d8f020058e72b99c9
- MD5 3849f3e3f6d2a2901a3f14175cf84fff
- SHA1 77a1f5665e0f6a8f0ce032ebd58ba681da2cc2a3
- SHA512 ee4d3216606ecf6d3b4ae872f74f4eded2cb751781f271836092d6400b76a574402c4079fd6c589c6ec04be2cbfe9cf6e604158fd21cdcc9c0bb96236f307271
- SSDEEP 384:7HI0PSZKK3GCuHc0msgapABV5A2M+4YCOPBj4qyMESdutKkCkczwAhjMIJC:7orZirzDKelMEEwp
- TLSH T1E3A2D711565D6237CDFB0B3A147555E063B7ABA66A62CF1D98BC220CCC236074F22FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.Hashing\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Hashing.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.OpenUrl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bab5ed90ebba5f3edf49711945d0fae7fee42766e05a06d7ec3c234042829f1
- MD5 36dfa03a52389c7371e60d80662a5909
- SHA1 a94c6bd53610507a50c5002abb44c5c8e3445903
- SHA512 82e0db4507bcd6bfae6ef9fb806e15f4e279b2076f8eafda241726e70c36bbecc2d940025836db87b5f99e42886549b108e706dd0212a35b15f4d8686ca02548
- SSDEEP 384:Jj9fg9f63SRCtHWhwnkhMOpA2M5IwePBj4qZVg7Ui7Cty6wfQchgNh:VW9c3tHG3UoI0z
- TLSH T1859208102B2C92BECDB70B35547950A0237B7B5AAB51CF7E5898220DEC635178F23EB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.OpenUrl\obj\Release\net8.0-windows\CurvaLauncher.Plugins.OpenUrl.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.QuickWebSearch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7514163803dbcba7577bd4dce8f73e4eb50514fa5539729a409f97d2736621e1
- MD5 2b902b01d6dce5ef82ec8e1499fcfe47
- SHA1 99761eda3fc151190bf41c7427dda9a70af246af
- SHA512 98f708b40b70f2699e5ee215829aa665cbe41196db722ddff169ba39a3efba3dcfa54313a4d2ff447ba4186833c150852b09074b5476ee44d8c9bd3427537b36
- SSDEEP 384:ew8fxVLuj4vVATprA2MKddAkPBjv4qxyh02Z9ZPMZdjZSZ+g+SJXVn681C2cI25:hGxBlDxNDPWzgh5Vn6qCMDl356W
- TLSH T125F23A50677C42BECDAB437AA57554E0337F26BEB722CD2C846C76049C82A4B4F41EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.QuickWebSearch\obj\Release\net8.0-windows\CurvaLauncher.Plugins.QuickWebSearch.pdb
mscoree
_CorDllMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.RunApplication.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b590aa534c454b36211d22a8d87240e5c061637ec412a8943eb18dfe5eaf1f66
- MD5 5f4c00675e0439c3f499d94ee6354965
- SHA1 e91619936177286c4726d38cd072b7d142bb1cc4
- SHA512 bc5698fc46aaf7efa7c42cf8b5c60e1eb69e73b8a05d84d694b2f0ce582156d92774862436ac6b728d8044de0dc877e747d983aae78c71eb4d03860ff014f2a4
- SSDEEP 768:z4o+BFePmt/FTl/ftbqc8EROBAMN9M8fKQfLVST9qBUOKY2LYBK8+2:znsFeK9l/rx89M8fKwLVST9fk2LYZ+2
- TLSH T1DC234A02666CC277CAFB0B3DA039819112BBDA4E7B42DB9D4DE85159EC177038F126B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.RunApplication\obj\Release\net8.0-windows\CurvaLauncher.Plugins.RunApplication.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.RunProgram.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4d6c0c63477ef6a6ff07d1154be01d6ae880064696be8c8af09fbf850f8893f5
- MD5 698b537b85ef2486aa2de986ae548d59
- SHA1 038bbff96d2dbeebc9e537ef62dfd48aa2c10f53
- SHA512 4f258919a5a3dc172da5466e6ede66400d5fe08aea90e01314333cb3bcfa4800fd19ba02a9b486a22a72837895e3581919e221c0d5eee3b50f755a7840cc6e8c
- SSDEEP 384:J+vxtYsThv8B2/5/PpPA2MDtXxlh6QPBj4qrKO/XYAA7xOm6HeDE0gN:MxBThv5hPODtXx8O/Xa7gN
- TLSH T15CA20911665C52BACD7B0B7954749091367BFF9A6B01CB2D58AC930CFC2621B4B23FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.RunProgram\obj\Release\net8.0-windows\CurvaLauncher.Plugins.RunProgram.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/CurvaLauncher.Plugins.Translator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6fdaa46f640b840073b8f85f6a328a5b46ce44b91844a284d49f06a5a99c581b
- MD5 f6a0f1790171b3ee3460e5fb99d89e53
- SHA1 f2c9786cf08149a5ec25063bc8662e53a3999417
- SHA512 331b3bf47b9fb7213278ab4671daa37c76b1634d45eacbce890119e201b1400adaf2b13728dfb68543094e27356a6fd719dda1245a5ebb885be65f58bf047d05
- SSDEEP 768:1Ckd1TRdE2JwAeYH5eoSQg+OF5bQ4A0N4GdW:7vRS2DyoSQQD2E3dW
- TLSH T1FC334C90136C81BBCA5F0F39B434C5E02377A69B3B23DE5C9A9C6949AC177478B11E72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
55886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\slime\source\repos\CurvaLauncher\src\CurvaLauncher.Plugins.Translator\obj\Release\net8.0-windows\CurvaLauncher.Plugins.Translator.pdb
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ