Suspicious
Suspect

28836910cc462cb69dc4c6a64a04b382

PE Executable
|
MD5: 28836910cc462cb69dc4c6a64a04b382
|
Size: 993.28 KB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
28836910cc462cb69dc4c6a64a04b382
Sha1
e38911f7bcda4404cd7229ebbb582e7024213a82
Sha256
a80e81bcf38664a48fa4087375ecb16d311fffdecd3d424ac1f088db61446ca1
Sha384
d5ac47e1d1ca6696c249917cf4639f9c74de0438e3b2f77ebaad7e295f6e2fedd2881f895489d4c8350bbd78052b5368
Sha512
b1fdbc29ad8f409c3e59bf0da30e326a9938dac52aedc7e755574c6837d241772c4e9e4bef17731540eac778e000dac759bdd09be668e35d88c3e442060e06f3
SSDeep
24576:USAPGdEuoN+mHVNqoDfJTdjDVpHxYcxMN0U:XxEuZaV7bvjDVfBxM
TLSH
B725126183E89E81D26FBBBCA0BC171147B0BB0618B1D78F1A8961D63D93B91CF56317

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
RCSEmulator.cert.pfx
RCSEmulator.recordings.zip
011cd7619aeb6b8d633d2e4d9ffec993.jsonl
0135d58cc54ae69b2ce91143f91de648.jsonl
04edafb75e90ef273ca1b82fb2382a49.jsonl
0682ed6e78020bac35a06b1a5492b8f0.jsonl
0732b214008913fefd3f5c52c56e94f6.jsonl
0749685b862869d43732a39da09aa70c.jsonl
08caccb184189cc985792e7d68646ce8.jsonl
09434e094aebdbe6fdc84315aec42206.jsonl
0960ebad172b4cd0818706d7b72167e7.jsonl
0b0098191b6a4c0006d61974fa12c6e6.jsonl
0cae8c488813c113610cad2e252c2e87.jsonl
0d0dc8d8af893c9b0ad74864a11791f6.jsonl
0ebee63251e4a25333b89bafdd6150b7.jsonl
0fa2dc0c3666e39e6fb85987f8c67648.jsonl
10d095393637f7cd642752e1587a38f8.jsonl
12b96af0344a18c13e6d33d956dafd9a.jsonl
134cc3b2770e06a73af96397cfe07778.jsonl
14ae94c10593b76a079ed8749074dd7a.jsonl
16c9068972204e02edfd142257a28415.jsonl
18d1ab6d812c066747598fc226ed845b.jsonl
18f462479573da4230d694e7f4c39d3d.jsonl
1929d7aefc4cf79266640f173d76b332.jsonl
1b8cd042706d7e437c1fd4cb5ab47774.jsonl
1ba51bfafc9229f6684593ce7e7b4e0b.jsonl
1ceacb6d6b4994d7044f1304af8bc2d3.jsonl
1f8a1dcc358181e9b9c6002c10c4d3e7.jsonl
1f9f774121f3aaaf58c27f6b2e2dc4ac.jsonl
1fa0912c1f6979810cbe08247fee350e.jsonl
1fbc4f1b542cd5d8a069e4558856321b.jsonl
203262569ae94df6f244efca7988b6ec.jsonl
252ea5e0709fd59d5b3d09237093635a.jsonl
2592666f9364f2d63e96c39a08d22d1b.jsonl
25b2c6b56472e20f1b82276d57418419.jsonl
25c275e8ec18257e4729a83570677041.jsonl
264c778b4e60d809e5a7577e6178d449.jsonl
26d01ddeed805cfde62228436c4eb8b7.jsonl
2960745875bce0cac81b6cc0e4ae585f.jsonl
2a163b150192f3350a66771b5fd253a3.jsonl
2bfd450ea9a148e7ad388bffb0bc3f04.jsonl
2ce14600ad37a8b2e526c782c0b4f3bf.jsonl
3002e6d2a6457d69e7d92faadc685873.jsonl
31a6e09abcc331664068567d6d1d7564.jsonl
3380c09d816d160573698eaf34bc3e2b.jsonl
35501ed1ee6211e50af45295b1ccad7f.jsonl
37527f8d44d541d0650e3351e22d3456.jsonl
3a75020f11928c37b11b8b4be3840530.jsonl
3b71ae34e054577b36a7f98439788449.jsonl
3b866747d92de1fce4fbec164847db1a.jsonl
3bed30aae1c13cc3e16e4cb3befe2a38.jsonl
3ff1e82447dab4effad0729d97c4ed29.jsonl
40a06b6748f376626fc84805f478371a.jsonl
41c8a9cb0a38db023a5ce52954f6521d.jsonl
42f1386ced896d47e8a95f9e3fa04cea.jsonl
472c9ddced3035df87f536afdbbf608b.jsonl
4a5520b2fc49ffdbe38f04aa3c06bde5.jsonl
4cfbe4e9187b2f7061e9b9cf398be801.jsonl
4feb3c6fb2e2aafdb5e69861caa38220.jsonl
51a5bfe89686703505058827bfc84f6c.jsonl
57267ce0dca894834050f3a543534cfc.jsonl
592433854b7702f8672a868309228628.jsonl
5b83695c501f3ada1148be4a4b9491b6.jsonl
5c9e7a5a62c3367cce5990b2db142130.jsonl
5e88bb63d59ec8419eb223e8af184699.jsonl
5ea234e2c0c94ad7b6e739ded962bb8c.jsonl
63e66ad591bf6704debc3651f1da8899.jsonl
6528c020619f82d7cc78859c6583853b.jsonl
65e4be6d02c1c5c97a320237bb6c5e92.jsonl
6d4b969ab78734d55fab365e37825d72.jsonl
726712eff694c5be76fc7b4953ad4643.jsonl
738974069e5a7fe18624b5cdaf84b8ef.jsonl
73f9562c596279ad9690a12d0a8c9b73.jsonl
7893fede09ee43c5113954d08bbb8064.jsonl
7915199e63f6c27e32669e96725967c6.jsonl
7a0932bf0328215d2adcfe21b6869c9a.jsonl
7aa0ee386e14ac9326a08d93df8dabad.jsonl
7bb2fc3bdd5e59cba2d0b9c2fbee6ee8.jsonl
7bf78cc72c610075fa91d584af071e5f.jsonl
7c1f91ebbe1727465366fdf411ec6873.jsonl
7cdb6b2d13a381a16bd6b6bc5057b695.jsonl
7dd45a570d979cf1ca5bb7594ebfdebe.jsonl
81e122e27805a10eb645892d1f02c3e1.jsonl
859012f58e96df76bb49c6b5470f5f79.jsonl
865912614de22cfc0eb4fbbb4e65a66a.jsonl
86a4b6e3455fe09309206c6b44ce2b1c.jsonl
87579d9d5b31387258ba3671c421123b.jsonl
8a181ed1d73fd3045c371cddad375586.jsonl
8a9aab4a74b0a1897ad8832975cd794e.jsonl
8c4953532fe92fb966f3ab4c30e26d4d.jsonl
8c982d4eaf7911fc307d75df7e27d2d7.jsonl
8eb2bd7ef546152148fc7567ae912626.jsonl
901ec15313d0730d3b46c2bc183cc10a.jsonl
904c5ea461833fb2b444c88388621557.jsonl
90a45cffa7614f271e79cddd8421fa05.jsonl
928c3b5f2d12c589acb177bdaa6d131e.jsonl
947026d1a83ed0c6d19cbff5cbb9fa79.jsonl
957f93f49d1d4a98795dac25c8c55031.jsonl
988f8e6cb5a3eeb9b60331d2278c27da.jsonl
99b160b8a2e0680cd84af8e32500f780.jsonl
9e2e89bc0ebc83ff2f9605b87bf33d5f.jsonl
9e9c8431cdd7e237383268f58a3b8334.jsonl
9ea9b13633069c3df9b5440aa90b48a9.jsonl
9f1050837fdf0651861a86c3b7ed0b8e.jsonl
9f3d30f3149f4bbfe6535555bd1fe111.jsonl
a008b3de19643dd61766042f13601444.jsonl
a043049a8ea164aa9f78999831545c24.jsonl
a10a1db032137bd355fc37f38f3fc5d7.jsonl
a2a2ff7f668a909ca232a32f6faaeb0d.jsonl
a3a72501b6b248ad8ed58b459502dadb.jsonl
a4fa3b8a82e25916783a27309a73d84c.jsonl
a624899dc58320f60def46b8779401b2.jsonl
a636f356acf7d575a3e710157db65389.jsonl
a8547d399fbfc249bce25b6e5eabc27c.jsonl
aa0a26ea305fd707be090421bb903f6d.jsonl
ae1a1e2d22b2f780fdbe58435edfa678.jsonl
aeebb1d3bf40b7d4e83bf5ed9e547d47.jsonl
af96f86d699ed33fcee2a895fbb5c0d2.jsonl
afa497d6cceeb35f1c07cbc52162b98e.jsonl
b49ccf14acc83912fb353346d823a548.jsonl
b56a0656c203a3472423025b30a29e5b.jsonl
b59335a50c5248d2b71c89be7a24fbc2.jsonl
b68e87efcd04d22b94d76bf92d724d62.jsonl
b737270e639ef245afbfefeef8d0b3f6.jsonl
b7a1e4328ae7a040486608b096d8353f.jsonl
b942a0d79545788b9b318ceb4cda0309.jsonl
baa25fa478129099e7621a2f7a6e1656.jsonl
bb09867a896aace6271c9902bfa736a9.jsonl
bb9066625c6f669c0af0a1c12bef4b7a.jsonl
bb9bc19066ff0c9e896e873c3e0fe665.jsonl
bc9238d37288ff826bfa04d4520a14d2.jsonl
bcee4769ee065538fd61188f85a670ca.jsonl
be60547047412a50aa54060f3f834864.jsonl
c014a09ba5da3a3419716ce81cbb24d7.jsonl
c36fb2bb5563196422b4c187a280d166.jsonl
c8481d1398cd7fc965033edfcb584f2c.jsonl
cc548410d8b7af32b91d6d46a18790fb.jsonl
ccb50bb8343caeff27dca8713e5c6e26.jsonl
cf19b06a9a45fc00335bdeba85e0cba7.jsonl
cf1c3ebe67d3ee9e1e9037e0c6a30168.jsonl
cfb6f2c183a7cd0de205258a37d8f7a5.jsonl
d2ac7f1f2d17372067b3515e8153dea9.jsonl
d31c08da6132c0aa7ecf33eded425d54.jsonl
d3dcce39456ae42729150f065819a8fa.jsonl
d5ad66be7c05e44a97899acac4b3db2e.jsonl
d692055b2379d80a1cff8992893b5cb7.jsonl
d734bdb1dc1d73f9b2c470ee4a97f88c.jsonl
d74e66b0c308fde08581f5241b3a2b07.jsonl
d785906100dab096adfda5fb4651a9ce.jsonl
d9a9617a7e2399e7365b9800dd3e76e6.jsonl
db6822f0fcdb1f2a6c02029bcc544181.jsonl
dbe06563943db5687def61f2011f649e.jsonl
de2b046ebc72022fb7912b38be66e66e.jsonl
dffa2f9996044eac49198e20a31ece93.jsonl
e0cf6728283f2a88623026db35ab6498.jsonl
e18d2ec5a5c863adb696b5bc02312dab.jsonl
e1c60e43fe77dbd5820f5559cb1a4dc3.jsonl
e2957f77c4004433e7ff631efccdfaf7.jsonl
e3a43f7d4afa1286ddf51893dbe1e70e.jsonl
e80249ea620d9b989849cdee33ceda03.jsonl
e873ee22079be7b22704685172c37b9d.jsonl
e8be4dacede23c035f52052245a2b6e2.jsonl
e920c683b972d16c5abfb87d8d4606a9.jsonl
ebd712d94662a297a5bc6457e9679163.jsonl
ee2b1ac989cf9cbdddcbd593e5bbca38.jsonl
eebf6ef995334eae98709af1c04a6185.jsonl
efb7ba3a7eee2c41340f0da801e78169.jsonl
f01500d8c510a8e79edddd8c14e30d4a.jsonl
f0f61b60748b3cca8e631d74ead89cae.jsonl
f27b19628ef372ddccef8ca377b2d88d.jsonl
f28c443480d2021a42bf6e6818cf0159.jsonl
f2c9a90b177fc90fbcf4fa19a5d45b80.jsonl
f304ed32adf114f8cfdc440364806682.jsonl
f36242c5d0efd065f608216c261d8c5e.jsonl
f3cc65c90a92d2535a7305ca1dd62e34.jsonl
f413fc860253d5f8482eeb32a10d99a1.jsonl
f4c95457b034df05e483191477444906.jsonl
f5c61c6070cdcefdb8f7fbcd2856f92c.jsonl
f6b19a5ceaa12ce83ba5b377bd4b3f2d.jsonl
f6d76e0a2ae26aee0c212330ae44938d.jsonl
f7a1845b978bfd1892fa20f4e5223354.jsonl
f80004d48ec4016487498b833e691ac5.jsonl
f86615d842c6b782ac6be430358ed178.jsonl
f8c5a0b349cc0a8f4cc1d6928c159ae8.jsonl
fa1b9c506ade3736ccb7eff9f2ecef5f.jsonl
fb06ebea4271188ab40863f2d9c2bdee.jsonl
fb68e20d6a4caef8c6160054baab5c36.jsonl
fd9976055d597860fdcfd65fdc95d6d3.jsonl
fe71496218017c48315aad80828648df.jsonl
costura.embedio.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.swan.lite.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.dll.compressed
[Authenticode]_a3656d89.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

RCS-Emulator-Net.exe

Full Name

RCS-Emulator-Net.exe

EntryPoint

System.Void E::<Main>(System.String[])

Scope Name

RCS-Emulator-Net.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

RCS-Emulator-Net

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

336

Main Method

System.Void E::<Main>(System.String[])

Main IL Instruction Count

7

Main IL

ldarg.0 <null> call System.Threading.Tasks.Task E::A(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

Module Name

RCS-Emulator-Net.exe

Full Name

RCS-Emulator-Net.exe

EntryPoint

System.Void E::<Main>(System.String[])

Scope Name

RCS-Emulator-Net.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

RCS-Emulator-Net

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

336

Main Method

System.Void E::<Main>(System.String[])

Main IL Instruction Count

7

Main IL

ldarg.0 <null> call System.Threading.Tasks.Task E::A(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

28836910cc462cb69dc4c6a64a04b382 (993.28 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙