16f6a93037e9d623be61aaf1d5cbc5db9673f7bf82b8635060f14cea0a25ba0d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-08 08:38:31
Debug artifacts C:\Users\PanRe1\OneDrive - Lam Research\Desktop\Material\Utility\source\repos\RemoteUtility\RemoteUtility\obj\Debug\RemoteUtility.pdb
FileDescription RemoteUtility
FileVersion 0.0.0.0
InternalName RemoteUtility.exe
LegalCopyright
OriginalFilename RemoteUtility.exe
ProductVersion 0.0.0.0
Assembly Version 0.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • sc.exe
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 bedab6698541645dd84e55dffe5d36e0 🔍
SHA1 d1ad8a0076a0e83bd3f2838b57f00e53bfde42ef 🔍
SHA256 16f6a93037e9d623be61aaf1d5cbc5db9673f7bf82b8635060f14cea0a25ba0d 🔍
SHA3 f64aef741276bba286b948cc4f040cdacacae97a66c12bd913167bedd5c50d07 🔍
SSDeep 384:k95NgsChyllXwXA+O77PYUJb/Lz4n8zo+bTx1IuWPAJcfc5tXgL4v1gP6njUAEv:k/Ch7X07AUF4n8BBevAQ4v1zbMt07 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Oct-08 08:38:31
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x6a00
SizeOfInitializedData 0x800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000881E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0xa000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xe000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ba2a4e2e7ce0e8f4836089be6dc64120 🔍
SHA1 d165df5f052a9f75906782ed3e82aa5042cc61a1 🔍
SHA256 6e7f27ea3b2f2d21a82b0c22899b66e56d92a4e727cdbaecbff79713e4353893 🔍
SHA3 8a25b824458b7d7d8ccd2e13bbb20161a202b6d067da2ac4c19e65da90f792dc 🔍
VirtualSize 0x6824
VirtualAddress 0x2000
SizeOfRawData 0x6a00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.67718

.rsrc

MD5 ace91aa3b8ebb43962b9f542ee66d866 🔍
SHA1 61fef9baa21266e88549b2f72b8ab33a836f0532 🔍
SHA256 267a3c2c2b35c61090019f329900e68be96bce00e459d78cc630a9f117a644e4 🔍
SHA3 277f81d2a853a410fb1fd37a15741e2b4842ebc1e89a8c9eabd556e31eb02d42 🔍
VirtualSize 0x504
VirtualAddress 0xa000
SizeOfRawData 0x600
PointerToRawData 0x6c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.78698

.reloc

MD5 7d300a8bc968541f2424e46f397823aa 🔍
SHA1 5b0dc3b10cead9afc057c11fd63d01938502bd36 🔍
SHA256 9a2d63ca45fa26c83852568e80ea515e438d1cefea24bf3bac2ae3869178509e 🔍
SHA3 b9cc2ce5237aee13a4d55f2644a10b892e58b3bc11ee4814f4839452f2cc2c44 🔍
VirtualSize 0xc
VirtualAddress 0xc000
SizeOfRawData 0x200
PointerToRawData 0x7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x274
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.16601
MD5 1c2c7ba5a578fa1c872f6d5b86435f59 🔍
SHA1 04525c30201b154810bf1aa5b0ca183f7701b934 🔍
SHA256 d03acb59652f170af1ab0ea3f0eebdb7cc576044e513aca6fed207a93d94d3ea 🔍
SHA3 8ccc621478f99c367b8fd4c2d44345d672af6a0835efafc30abb3a6b54d058af 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
FileDescription RemoteUtility
FileVersion (#2) 0.0.0.0
InternalName RemoteUtility.exe
LegalCopyright
OriginalFilename RemoteUtility.exe
ProductVersion (#2) 0.0.0.0
Assembly Version 0.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Oct-08 08:38:31
Version 0.0
SizeofData 284
AddressOfRawData 0x86b0
PointerToRawData 0x68b0
Referenced File C:\Users\PanRe1\OneDrive - Lam Research\Desktop\Material\Utility\source\repos\RemoteUtility\RemoteUtility\obj\Debug\RemoteUtility.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.