Risxn.rar
- SHA256 9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Risxn.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
32 signatures
600 seconds
General
- Target Risxn.rar
- Size 3.2MB
- Sample261113-cq46psft2m
- SHA256 9d4197cb3c179b13452b3a43bd7f9d48b9188175af84c8dd692756330da3f71a
- MD5 5885c2e476a34bb8ccc0c4dcdb743b4b
- SHA1 346232b4d13083db4985ed0dc97d6899e995cca7
- SHA512 0765debcc565db5ae4ba5da896046a484397c2951634798b86de8ae4f801ba019f198fa04725dc6cc6dd27eb595ae516dd731e810c7abf2158ba617587bbdf5f
- SSDEEP 98304:HlRFl0gOy1qGiD3BtRnl0gOc0UTuO26x/Qr:HlD2GWbRzmn6x/W
- TLSH T1E2F533AFAC216EC25511231BDFB71E037293DEDFC65F5A95CB3C58046BD882D2A09B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/Risxn/Risxn/extreme/0Harmony.dll unpack001/Risxn/Risxn/extreme/ExtremeInject.dll unpack001/Risxn/Risxn/extreme/ExtremeLaunch.exe unpack001/Risxn/Risxn/risxn/0Harmony.dll unpack001/Risxn/Risxn/risxn/RisxnHook.dll unpack001/Risxn/Risxn/risxn/RisxnInstaller.dll unpack002/costura.dll unpack001/Risxn/Risxn/risxn/RisxnInstaller.exe unpack001/Risxn/Risxn/risxn/RisxnLaunch.dll unpack001/Risxn/Risxn/risxn/RisxnLaunch.exe unpack001/Risxn/Risxn/risxn/run/0Harmony.dll unpack001/Risxn/Risxn/risxn/run/RisxnHook.dll unpack001/Risxn/Risxn/risxn/run/RisxnInstaller.dll unpack003/costura.dll unpack001/Risxn/Risxn/risxn/run/RisxnInstaller.exe
File Explorer
-
Risxn.rar.rar 3.2MB
-
Risxn/Risxn/Extreme.bat67B
-
Risxn/Risxn/Risxn.bat63B
-
Risxn/Risxn/extreme/0Harmony.dll.dll 2.1MB
-
Risxn/Risxn/extreme/ExtremeInject.dll.dll 17KB
-
Risxn/Risxn/extreme/ExtremeLaunch.exe.exe 9KB
-
Risxn/Risxn/extreme/ExtremeLaunch.exe.config.xml 174B
-
Risxn/Risxn/extreme/last_install.txt41B
-
Risxn/Risxn/readme.txt369B
-
Risxn/Risxn/risxn/0Harmony.dll.dll 2.5MB
-
Risxn/Risxn/risxn/RisxnHook.dll.dll 8KB
-
Risxn/Risxn/risxn/RisxnInstaller.deps.json1KB
-
Risxn/Risxn/risxn/RisxnInstaller.dll.exe 1.1MB
-
costura.dll.dll 5KB
-
costura.pdb7KB
-
newtonsoft.json.dll.dll 706KB
-
Risxn/Risxn/risxn/RisxnInstaller.exe.exe 149KB
-
Risxn/Risxn/risxn/RisxnInstaller.runtimeconfig.json515B
-
Risxn/Risxn/risxn/RisxnLaunch.deps.json478B
-
Risxn/Risxn/risxn/RisxnLaunch.dll.exe 8KB
-
Risxn/Risxn/risxn/RisxnLaunch.exe.exe 148KB
-
Risxn/Risxn/risxn/RisxnLaunch.runtimeconfig.json515B
-
Risxn/Risxn/risxn/last_install.txt47B
-
Risxn/Risxn/risxn/run/0Harmony.dll.dll 2.5MB
-
Risxn/Risxn/risxn/run/RisxnHook.dll.dll 8KB
-
Risxn/Risxn/risxn/run/RisxnInstaller.deps.json1KB
-
Risxn/Risxn/risxn/run/RisxnInstaller.dll.exe 1.1MB
-
costura.dll.dll 5KB
-
costura.pdb7KB
-
newtonsoft.json.dll.dll 706KB
-
Risxn/Risxn/risxn/run/RisxnInstaller.exe.exe 149KB
-
Risxn/Risxn/risxn/run/RisxnInstaller.runtimeconfig.json515B
Risxn/Risxn/Extreme.bat
- SHA256 daa60fee66064274789bb06c041c36b0bdd78b30f47839cea0283962acb1e0e2
- MD5 7a782b267e5a169101c321366f2fd132
- SHA1 f1e7707fa752a256ae03a855b61324be6fceb881
- SHA512 deab869183684dc8d5dcdabc22e85ba18e85859d61721496ad1f37c605141b10c91b5fc971d650bebb8ce995eb2c5d7dc18f4505e650e8f5261f76941f160caf
- TLSH T1C3A00211CD1180926ABA0840139A3955794E9487F5405DB534A714BE3CCF54D14883D6
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/Risxn.bat
- SHA256 de4437bb85ad76f7b113172bc4963bf334ab3f1c8245b26ec81ce16d7ed1bb71
- MD5 0feda21801b6630b109a3723071732db
- SHA1 d2a04eb3e707505ccb1ce388cbf065e4dbc84c46
- SHA512 bf4dc5dcf75736154625c3a72ce637dc0cbb45f8528c79cf48e6f2872f882f708c7921e1213d3876dc3433154d255e138075e4b49e895263a994a55322c1e434
- TLSH T18FA002298C3641D1BEA35A00156E3F59B94E94C7F5405D5424E2252F1D8F54A149C0C1
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/extreme/0Harmony.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 498ede1d20a87afaa6c7b1ed5b3beb505b01dc418b952c1be5c322204404b033
- MD5 ad6c335c09cf42975221a47b82268d14
- SHA1 76ce6a1276d99c27b3007bb4d9b543473f932531
- SHA512 35c2bb88852ddcdc8965e31590ff1194e0496973a87ea492208b08a6f68ed15ceee7e153c4e5bee4e084cf1ea594ad83055a255ad6b97e72f0d02dfcf09de6e1
- SSDEEP 24576:aDqxNcckUU2/LuBVKzW2jMDLL8QLpUch15R8rfsNU6Bmxgth:aPczUCQjZBXR4EN
- TLSH T145A56B85B7DE9E72C85E8F77E0A2010567B1D8879346DB2B15C0D27CBC8A34E5D623E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2200894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Brrainz\Source\Repos\Harmony\Harmony\bin\ReleaseFat\net48\ILRepack-22728-561476\0Harmony.pdb
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/extreme/ExtremeInject.dll
- SHA256 32c92d98b97afbb450a71f2ce657e09bf9b23a4ac6a68688a6bbb7e1939efd0e
- MD5 f195aa8938a8dee450771c6f2711b967
- SHA1 557dcdc80f098175c5b05a6a9d651ee344e515d6
- SHA512 17fadbc36af1f181cc9668a6e519896ced8c1287d271bc539b8b384580416c3e6ce9201c4e46e9950adc0c8e640557b41cb54b6cfdc7e58a472a4f4c26657f11
- SSDEEP 384:RXPYyuyBK3aC/8UXh2ISkgpPv39seZyQC:RFEaC/8UX8n9sedC
- TLSH T1CE82E54477FE4604E5FE8A706CBA520A87B6F5579825DB4E0CC860EE1D377402A30BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\MX\Downloads\rsxn\extreme\_hook_src\inject\obj\Release\net48\ExtremeInject.pdb
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Risxn/Risxn/extreme/ExtremeLaunch.exe
- SHA256 dc0284e74b805fde8862f9eaec2c1ce2d0b0dfe21a97b3c19dfc1b82635b6ec0
- MD5 5a361477eaad5e4fa238cc5a6b4e9ad2
- SHA1 dfccbdc0b6b4b662b138cb5e46e4bfbe4bf6e0cc
- SHA512 10f098b25da6ef755679eb6c3fa1df01f7287776f53a9ddd0a9d87d260b6c839086e64ee515fadf8fffa7ceb6c7dbde98f067a5b515c00ed1330524136215f9d
- SSDEEP 96:bMJCrsiQsNQSRlVCH0UcXga9kC+lV0qDnpan3fZGU2ROsMEdLMKFROPlwzRquDPv:wJ7iPnG0fga9p2ZNe8bpzFywtfwIK
- TLSH T13C12C505BBE90215FABB9736AEB791014B37BD538435C7BE244C690E5D33A444C91FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MX\Downloads\rsxn\portable\_src\launch\obj\Release\net48\ExtremeLaunch.pdb
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Risxn/Risxn/extreme/ExtremeLaunch.exe.config
- SHA256 051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
- MD5 2a2df45a07478a1c77d5834c21f3d7fd
- SHA1 f949e331f0d75ba38d33a072f74e2327c870d916
- SHA512 1a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7
- TLSH T101C08C1940E8BD278D328F27A352C926EBB0B2A6A064080CF02FA9670B3108D8247326
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/extreme/last_install.txt
- SHA256 455d11e46935ac8dacda17c7c1d437e93a7696d55cf16c7ba66fed70841a5b31
- MD5 219408dbd09a446b7be5d7829d9dee56
- SHA1 07bb13e9bab81cf78e139d3bca95d37b77463fa8
- SHA512 3032ceff626e73889fc93abd690266695e692e6ae5d2927bb0f59e0c8e72516ef9f6f40cf1c05538b4d61d0bd5e95b0290f637e2464bcc51c4907b90c147297a
- MD5 SHA1 SHA512
Risxn/Risxn/readme.txt
- SHA256 acad4d851751a2284acd1999155402c5324d4143a91770f9f1d194e9ea361b79
- MD5 4b00a669fb49733874a8a084e2dee0d3
- SHA1 87b82bb4040edbec77185c0bc604156f8c6c3f69
- SHA512 d5cd7b8da2b5aae14dfc24881a0829eb5de7a13461ed404b9ba4b7d4b2cf0f5b5529f8c994d96d6d7e7e733834c54459ac53c9200a38640cf1c9346d5863e00f
- TLSH T1FCE0D89FC64460222FB63216D35F714AC34BCC56AB9F8036B49E14116BE295350607B9
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/0Harmony.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2583358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Brrainz\Source\Repos\Harmony\Harmony\bin\ReleaseFat\net6.0\ILRepack-25624-930649\0Harmony.pdb
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/RisxnHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\MX\Downloads\rsxn\portable\_src\risxn\hook\obj\Release\net8.0\RisxnHook.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/RisxnInstaller.deps.json
- SHA256 39853ad174f7ed41026c54a609eab8ec7a279b56092baeca634a3d8dce38d684
- MD5 3bdc07a9a8dfcfede8b529fee9f5a807
- SHA1 b5d9ffb7a3e98d915ffcda0bd5505661a1f9cc50
- SHA512 9b3731cd9e0682bf4a4abbef3a8ccb256277ea66294fce0df81d925be1bb6a36bd146c3c9c1dfc0ed642f81bd6f007de7b3c6a0daa42baafc9367231ff36e9d1
- TLSH T134316B19D5A49D7709B52F6960394A41F722A33F9104199F7CFD20CC8FB2E6B6081F79
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/RisxnInstaller.dll
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.pdb
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:69:79:e3:5c:70:08:83:fe:bc:7e:9a:7d:cc:6b:4a:a2:9f:06:b4:df:02:3b:79:7d:fb:2f:07:8c:1c:fe:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 4, 2024 - Nov 3, 2027
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 26, 2024 - Nov 19, 2025
Minor OS version
0
Major OS version
4
Entry point
715818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
692KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/RisxnInstaller.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
71696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=34810,
count=1, id=258, version=34810,
Risxn/Risxn/risxn/RisxnInstaller.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/RisxnLaunch.deps.json
- SHA256 daf43c349af50bb4ada8bf9eb7b970977ae955c7f959495c002aa947bd1c2290
- MD5 446dde9213480f44f31c9ad8ea844765
- SHA1 c43c25e62e8ed4d4fe918f5ca77b98e13b8cd69c
- SHA512 328b74711a349edad665e1eb89da5517612a8b79b3b4f2dd8b1a762113e47280f24ecf4db85600aa92fbaa088357f449cfeacafd4dcd0937328f97c9a06e6f2f
- TLSH T16DF0302DE5D80C9706F137F5693A4366F5B257731825280A7DFE841C0F7291B5420F79
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/RisxnLaunch.dll
- SHA256 212e9255d6be4f10bf291c956e04a57c8bec9959d9aa787038f1d049ce5116f1
- MD5 bdeb2b300c4b6e827815044020194281
- SHA1 3de4dfa377225e0b887da3c240991a9ad762933f
- SHA512 e14721e52d40c1bde37e0110c132f12060bd90e4ba416f578cce671202ad479427e11eaab434891521085a9fbece4d4ca9feeccabecafe4c89e38059a540037d
- SSDEEP 192:5ymTI/v92k43SYteky1T/r1gHRpL7+pLGc1PC:S/v8i3tliVSVlP
- TLSH T172F1A400B7F88361E9BE0B35BDB652104732BE568836C3BE4444690E5EB321888B1F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MX\Downloads\rsxn\portable\_src\risxn\launch\obj\Release\net8.0-windows\win-x64\RisxnLaunch.pdb
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Risxn/Risxn/risxn/RisxnLaunch.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 4c466bb0909717ce39ee9d240c6a7e771fc8d459ac6ee73c9aa473b03bbd6aab
- MD5 bcdc8616fe29535ac64028a608aa039a
- SHA1 e9307e42d9427d64cb6995e9bb4eedd2faafc6d9
- SHA512 c27fc72e001866a58e2a97259ad072dc02f101eed3dfe5aa4b953f1a2f264c84c5f524ea7476491f6a964720a5b4241afc60ec0f2a71a72060d79f00570e3078
- SSDEEP 3072:RqeXA/4yIbHkNPN+6H6xCYOigUE265BJm:RvdHkNFdaxmMEhJ
- TLSH T125E33B07A2A851BEE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Risxn/Risxn/risxn/RisxnLaunch.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/last_install.txt
- SHA256 ba49397e8dc0afe00f590576ff8b11a564cd06e1c6c41158adfba5e5e838b740
- MD5 d57d82cd57e8b204b0c5d5b38d793802
- SHA1 8fd7836f1aee2a609dcfd3daa81cbbb66118740c
- SHA512 076c1cfdbc0dcb502bfc52f1b03d8b1d66b065494eea3d71627618f3aab76d1a376a498e0c133d3c82a669c76fa63ab8a3e3263911a0d776e4b90796e1bdc826
- MD5 SHA1 SHA512
Risxn/Risxn/risxn/run/0Harmony.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f1d64a21616375eda5d7fe25c7845ed4f4627b879d8d4432de6a8871de40391f
- MD5 dca2a93a5f990c61ff13ba608c8c8ae3
- SHA1 c8b7930d998acf7fbe74c7f66abf866d4ec3696d
- SHA512 4a7f0aa823a7fe20b1f53f260c75e40411b7d6f7b45b973fcac4828c6af2f46a6b126bbc0d73dcc46d182d29b96326d4021754a3373aa70854c8a0be800356c7
- SSDEEP 24576:mY8nQGClZeNkc4T6mCf6k7uiCEGzlf4YFDLZh9ajaMNfMjXqceV03plmnuyH8aTt:fEeeP4+m5kZWOcaTIL150RV
- TLSH T129C55A40FBDAEF36C56FCB32A4A2011256B2E89F3782EB566114663CBC433454D667E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2583358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Brrainz\Source\Repos\Harmony\Harmony\bin\ReleaseFat\net6.0\ILRepack-25624-930649\0Harmony.pdb
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/run/RisxnHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 307708f9303186777e54a4f31ba658f1ec438bbed83ab2b599afa7b08d70cbc0
- MD5 33a8741a4ce7f810d9437f5170709aa8
- SHA1 60628f5d038d779b00c29308cfbf6aa82634055a
- SHA512 48ee69127181dc1ed9efaebf2b42b3eed3c140eac3bd2ec91d82632c26681eeabee781dbd5bd27f4d909bc3dc0d8cdcb5ff1a3580a41767cd933dd4515bf4cbd
- SSDEEP 192:+PAv6sIOpz9BmZDQbpehPvxHYZLJn00fkpd:oAvpz7mZ81ehPgLJno
- TLSH T18802F8297FF5D729DDFF0B392CA226110271FA444901EA5E0CC8429B9C927145FA2F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\MX\Downloads\rsxn\portable\_src\risxn\hook\obj\Release\net8.0\RisxnHook.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/run/RisxnInstaller.deps.json
- SHA256 39853ad174f7ed41026c54a609eab8ec7a279b56092baeca634a3d8dce38d684
- MD5 3bdc07a9a8dfcfede8b529fee9f5a807
- SHA1 b5d9ffb7a3e98d915ffcda0bd5505661a1f9cc50
- SHA512 9b3731cd9e0682bf4a4abbef3a8ccb256277ea66294fce0df81d925be1bb6a36bd146c3c9c1dfc0ed642f81bd6f007de7b3c6a0daa42baafc9367231ff36e9d1
- TLSH T134316B19D5A49D7709B52F6960394A41F722A33F9104199F7CFD20CC8FB2E6B6081F79
- MD5 SHA1 SHA512 TLSH
Risxn/Risxn/risxn/run/RisxnInstaller.dll
- SHA256 9d29c23a4b0bf6003fdd7ce2e4a14a157ecb9974f7cf76b079490c7f2ad972d9
- MD5 76bf80c314da3373c1c12760ec75ce96
- SHA1 9b5d2453ea20dd271e7578f5ddf9419dd921a7ed
- SHA512 6ac9a407469662af4e0c6fec91290bac7585865c69c792a01e14c3938d5567dddc22286075f6fdeaa657a7cfa6cdef3d98aea7ecb84fc4f69e50459102c95087
- SSDEEP 12288:9ff3uIOHUHkAybcuvtPYOJjms25I6UdBcc7F4x4GjGPPPPPPPpX5:xBrgtwOpMfUdT1GqPPPPPPPpX5
- TLSH T172459E22BAD6780DEB6F2AFC9363831C6376F9757626831705BA73254A1B1D64D833C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.pdb
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:69:79:e3:5c:70:08:83:fe:bc:7e:9a:7d:cc:6b:4a:a2:9f:06:b4:df:02:3b:79:7d:fb:2f:07:8c:1c:fe:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 4, 2024 - Nov 3, 2027
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 26, 2024 - Nov 19, 2025
Minor OS version
0
Major OS version
4
Entry point
715818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
692KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Risxn/Risxn/risxn/run/RisxnInstaller.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 a1830df7d45d355e984e53e59ccd15a2c8de0d7b28ae21a60a655b81f7e7c272
- MD5 352756af8e69b5233c8b8a1148030748
- SHA1 3f5b1078f01672e93b910061d0c6b06d250e86b4
- SHA512 4498177be52032dfe50263b7911b54362bb0b5256db344a860c8096625b5865deb30c9d980f4745fe9ce2e49a14ca638731d616ac4639dba8e718b350eeafec8
- SSDEEP 3072:L4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZU10qY:Llm4sqMaFFBniJfBaWKq
- TLSH T152E32907B6A950FED2BBA678CD520905F7727C5A4B71A3CF135049B61F62BD09E3A301
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
71696
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=34810,
count=1, id=258, version=34810,
Risxn/Risxn/risxn/run/RisxnInstaller.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH