{f10dd499-1585-4a63-b6af-58ffe8d8cd4b}[.]cab

Sharing

Copy URL Twitter E-mail

General

Target

{f10dd499-1585-4a63-b6af-58ffe8d8cd4b}.cab
Size

24.2MB
MD5

d67f885a794d5d437b397c51e880e2f1
SHA1

200be1b27c039be699a4e45935aa348d397221f0
SHA256

3d10a9e40d9f4828fb350ee60607fc65bdf59f40b4bc01998d3761b8008dcfcd
SHA512

bfd22ad9b963619bee4055785fd8bd3ec3e95349192937229dce85991a55a3a88fa6713c81dd0974003aeee274bc187b5ff8ecafeb7c9635e2ba92df89f6b483
SSDEEP

393216:k9VAUYH+6h2PFcQ5vQruuWRMQZ+DCovlKBdIyn/BnMkGFZFp51d6:kDYHiPF/SutRMQEDCo9o/BMk6K

Score

1^/10

Malware Config

Signatures

Files

{f10dd499-1585-4a63-b6af-58ffe8d8cd4b}.cab
.cab
manifest
{250e95db-8cdf-9f59-b22e-06f54c8b1711}
.dll windows x64

b3714ba8c2a904cd056f538893780a0c

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:96:7e:7d:b7:28:63:cd:97:6d:d6:4b:57:1f:41:38:25:62:71:d2:8e:17:b5:e9:a3:33:0e:3e:d7:df:e9:78
Signer

Actual PE Digest

6d:96:7e:7d:b7:28:63:cd:97:6d:d6:4b:57:1f:41:38:25:62:71:d2:8e:17:b5:e9:a3:33:0e:3e:d7:df:e9:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

TlsSetValue
FormatMessageW
TlsAlloc
TlsGetValue
TlsFree
MultiByteToWideChar
SetHandleInformation
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetFilePointerEx
WaitNamedPipeW
GetTickCount
GetOverlappedResult
Sleep
DisconnectNamedPipe
CreateFileW
PeekNamedPipe
WriteFile
GetCurrentProcess
SetNamedPipeHandleState
ReadFile
LoadLibraryA
FreeLibrary
SetLastError
GetProcAddress
GetModuleHandleExW
CreateIoCompletionPort
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
CreateEventW
PostQueuedCompletionStatus
CreateSemaphoreW
DeleteCriticalSection
InitializeSListHead
CloseHandle
GetLastError
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
ReleaseSemaphore
EnterCriticalSection
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetFileSizeEx
GetStringTypeW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
FlsFree
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
VerifyVersionInfoW
GetComputerNameW
VerSetConditionMask
CreateThread
GetSystemDirectoryA
FileTimeToSystemTime
CompareStringA
GetVersionExW
GetQueuedCompletionStatus
SetEvent
WaitForMultipleObjects
WideCharToMultiByte
LCMapStringW
CompareStringW
QueryDepthSList
SetFileCompletionNotificationModes
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
GetConsoleMode

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RevertToSelf
ImpersonateNamedPipeClient
EventRegister
EventUnregister
EventWriteTransfer
IsTokenRestricted

rpcrt4

UuidCreate

user32

CharNextW
CharNextA
CharNextExA

ws2_32

ntohs
connect
WSAEnumProtocolsW
WSARecv
WSAGetOverlappedResult
WSAPoll
WSACleanup
__WSAFDIsSet
FreeAddrInfoW
closesocket
getsockname
getpeername
WSAStartup
socket
GetAddrInfoW
recv
htonl
htons
sendto
setsockopt
WSAGetLastError
shutdown
WSASend
WSAIoctl
GetNameInfoW
bind
select
WSAStringToAddressW

crypt32

CertVerifyCertificateChainPolicy
CryptStringToBinaryW
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateChain
CertCloseStore
CryptStringToBinaryA
CertVerifyTimeValidity
CertFreeCertificateContext
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertOpenSystemStoreA
CryptAcquireCertificatePrivateKey
CertGetCertificateContextProperty

Exports

Exports

?_tlgEvent@?6??SNIPacketRelease@@9@4U<unnamed-type-_tlgEvent>@?6??1@YAXPEAVSNI_Packet@@@Z@B
?_tlgEvent@?BC@??SNIPacketRelease@@9@4U<unnamed-type-_tlgEvent>@?BC@??1@YAXPEAVSNI_Packet@@@Z@B
?_tlgEvent@?BN@??SNIPacketRelease@@9@4U<unnamed-type-_tlgEvent>@?BN@??1@YAXPEAVSNI_Packet@@@Z@B
GetSniMaxComposedSpnLength
SNIAddProviderWrapper
SNICheckConnectionWrapper
SNICloseWrapper
SNIGetInfoWrapper
SNIGetLastError
SNIGetPeerAddrStrWrapper
SNIInitialize
SNIOpenSyncExWrapper
SNIOpenWrapper
SNIPacketAllocateWrapper
SNIPacketGetDataWrapper
SNIPacketRelease
SNIPacketResetWrapper
SNIPacketSetData
SNIQueryInfo
SNIReadAsyncWrapper
SNIReadSyncOverAsync
SNIRemoveProviderWrapper
SNISecGenClientContextWrapper
SNISecInitPackage
SNIServerEnumCloseWrapper
SNIServerEnumOpenWrapper
SNIServerEnumReadWrapper
SNISetInfoWrapper
SNITerminate
SNIWaitForSSLHandshakeToCompleteWrapper
SNIWriteAsyncWrapper
SNIWriteSyncOverAsync
UnmanagedIsTokenRestricted

Sections

.text
Size: 356KB - Virtual size: 355KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
{28057d48-9814-70de-f3f1-1ffc737da0ac}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:b3:92:c9:a9:af:e1:94:5b:de:56:dc:44:8b:75:b2:97:8f:6f:42:60:3a:ee:ef:fc:16:b5:c1:db:98:9d:83
Signer

Actual PE Digest

ff:b3:92:c9:a9:af:e1:94:5b:de:56:dc:44:8b:75:b2:97:8f:6f:42:60:3a:ee:ef:fc:16:b5:c1:db:98:9d:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
{3d0bd7e7-2023-d4ae-cc09-cef247596e63}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:7c:f2:5a:1f:4b:cd:0d:8e:cc:94:f1:27:73:43:c9:12:07:56:eb:43:69:fb:19:63:68:fa:cc:6a:67:94:8e
Signer

Actual PE Digest

57:7c:f2:5a:1f:4b:cd:0d:8e:cc:94:f1:27:73:43:c9:12:07:56:eb:43:69:fb:19:63:68:fa:cc:6a:67:94:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
{43eaf4b3-be00-2106-60f9-0170d8102713}
{51458287-e314-b5ec-3adf-0e6e97bd4cbb}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:4d:cf:99:fb:c9:81:53:45:85:9c:76:19:2d:92:19:46:24:b4:29:94:49:84:66:18:0a:7a:64:96:1a:70:a8
Signer

Actual PE Digest

99:4d:cf:99:fb:c9:81:53:45:85:9c:76:19:2d:92:19:46:24:b4:29:94:49:84:66:18:0a:7a:64:96:1a:70:a8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
{760ede96-abfc-ae4b-7277-ae0e15fac70f}
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/01/2021, 00:00

Not After

14/01/2046, 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/07/2021, 00:00

Not After

14/07/2031, 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13/08/2021, 00:00

Not After

29/10/2024, 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:83:14:62:71:0b:df:9b:a6:3d:00:00:00:00:03:83
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2023, 23:45

Not After

15/09/2024, 23:45

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
{829b6fd8-bb8c-94bd-38c2-74c9cb8de43a}
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:5f:f1:d8:43:88:d5:9a:40:31:00:00:00:00:03:5f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 18:29

Not After

03/04/2024, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:f9:ce:97:54:a8:42:7e:5c:85:5c:51:c9:46:d8:2f:e8:7b:36:70:56:16:56:b9:f6:54:ea:22:f5:ac:b6:89
Signer

Actual PE Digest

23:f9:ce:97:54:a8:42:7e:5c:85:5c:51:c9:46:d8:2f:e8:7b:36:70:56:16:56:b9:f6:54:ea:22:f5:ac:b6:89

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
{a4dc0289-62a6-7f58-08d7-782c50a8baed}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:3f:d5:20:e8:32:56:7f:8a:4a:72:82:57:f6:70:2b:b8:6a:03:7a:39:99:15:2b:6e:d4:57:6c:98:29:a8:d1
Signer

Actual PE Digest

85:3f:d5:20:e8:32:56:7f:8a:4a:72:82:57:f6:70:2b:b8:6a:03:7a:39:99:15:2b:6e:d4:57:6c:98:29:a8:d1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
{d6103ed0-6be2-f1ab-37c3-e5c47ce215ff}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:35:aa:3e:97:e2:72:46:5f:ef:fd:51:2d:34:48:39:3b:c2:3e:e5:66:b9:b4:d3:f0:b4:b0:06:45:5b:4c:66
Signer

Actual PE Digest

3d:35:aa:3e:97:e2:72:46:5f:ef:fd:51:2d:34:48:39:3b:c2:3e:e5:66:b9:b4:d3:f0:b4:b0:06:45:5b:4c:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
{da87b1f9-2c1d-55e0-acd4-b4288a3fb1f3}
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:5f:f1:d8:43:88:d5:9a:40:31:00:00:00:00:03:5f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 18:29

Not After

03/04/2024, 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bc:e7:34:eb:a8:08:35:5a:d9:8a:8b:4e:d6:b4:9d:af:02:3f:60:e0:bf:42:07:ad:c6:01:ef:36:d7:4c:b8:94
Signer

Actual PE Digest

bc:e7:34:eb:a8:08:35:5a:d9:8a:8b:4e:d6:b4:9d:af:02:3f:60:e0:bf:42:07:ad:c6:01:ef:36:d7:4c:b8:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
{db0f43b7-c714-80f3-2377-e6e6636abe68}
.dll windows x64

88fd00077afa8e722d2cd11578a81d73

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:ce:b7:0b:44:d1:8a:ca:05:d4:a3:87:9a:74:f1:df:bc:b6:9c:e4:b6:6e:8a:e4:eb:01:ff:47:95:6b:fd:a2
Signer

Actual PE Digest

54:ce:b7:0b:44:d1:8a:ca:05:d4:a3:87:9a:74:f1:df:bc:b6:9c:e4:b6:6e:8a:e4:eb:01:ff:47:95:6b:fd:a2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

CredReadW
CredWriteW
CredDeleteW
CredFree
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
CloseServiceHandle
ControlService
EnumDependentServicesW
EnumServicesStatusExW
GetServiceDisplayNameW
GetServiceKeyNameW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
OpenProcessToken
GetTokenInformation
DuplicateTokenEx
CreateWellKnownSid
GetWindowsAccountDomainSid
IsWellKnownSid
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
CheckTokenMembership
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatusEx
SetThreadToken
GetSecurityDescriptorLength
EventActivityIdControl
DuplicateToken
LookupAccountNameW
FreeSid
DeleteService
OpenSCManagerA
CreateServiceW
OpenServiceA
ChangeServiceConfig2W
QueryServiceConfig2W
EnumerateTraceGuidsEx
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
EventWrite
EventEnabled

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptEncrypt
BCryptDecrypt
BCryptImportKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptCreateHash
BCryptGenRandom
BCryptDestroyHash
BCryptHashData
BCryptGetProperty
BCryptFinishHash
BCryptExportKey

crypt32

CryptMsgGetParam
CryptMsgClose
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptDecodeObject
CryptAcquireCertificatePrivateKey
CryptUnprotectData
CryptProtectData
CryptUnprotectMemory
CryptProtectMemory
CertFreeCertificateChainEngine
CertCloseStore
PFXImportCertStore
PFXExportCertStore
CryptFindOIDInfo
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetNameStringW
CertGetValidUsages
CertNameToStrW
CertOpenStore
CertSaveStore
CertSerializeCertificateStoreElement
CertSetCertificateContextProperty
CertStrToNameW
CertVerifyTimeValidity
CryptQueryObject

iphlpapi

GetAdaptersAddresses
GetNetworkParams
if_nametoindex
GetPerAdapterInfo

kernel32

SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue
TlsFree
TlsGetValue
SetLastError
CreateFileW
GetLastError
SetThreadErrorMode
GetTickCount64
LoadLibraryA
GetProcAddress
FreeLibrary
FormatMessageW
CloseHandle
WaitNamedPipeW
CancelIoEx
ReadFile
WriteFile
OpenThread
CancelSynchronousIo
GetCurrentThreadId
QueryPerformanceCounter
LoadLibraryExW
GetCPInfoExW
GetConsoleScreenBufferInfo
GetConsoleMode
GetFileType
ReadConsoleW
ReadConsoleInputW
SetConsoleTextAttribute
WriteConsoleW
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
LocalFree
ReadDirectoryChangesW
DeviceIoControl
LoadLibraryW
GetSystemInfo
GetNativeSystemInfo
GlobalMemoryStatusEx
DuplicateHandle
GetCurrentThread
GetCurrentProcess
K32EnumProcessModulesEx
IsWow64Process
GetExitCodeProcess
GetProcessTimes
CreateProcessW
TerminateProcess
OpenProcess
K32EnumProcesses
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetProcessId
QueryFullProcessImageNameW
CreatePipe
GetConsoleCP
WaitForSingleObject
CloseThreadpoolIo
GetCurrentProcessId
GetEnvironmentStringsW
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetCalendarInfoEx
CompareStringOrdinal
CompareStringEx
FindNLSStringEx
GetLocaleInfoEx
EnumSystemLocalesEx
ResolveLocaleName
LCIDToLocaleName
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcessorNumber
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
SignalObjectAndWait
IsDebuggerPresent
QueryPerformanceFrequency
GetFullPathNameW
GetLongPathNameW
GetCPInfo
LocalAlloc
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
EnumTimeFormatsEx
EnumCalendarInfoExEx
CreateDirectoryW
DeleteFileW
DeleteVolumeMountPointW
ExpandEnvironmentStringsW
FindNextFileW
FindClose
FindFirstFileExW
FlushFileBuffers
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetModuleFileNameW
GetOverlappedResult
GetSystemDirectoryW
LockFile
MoveFileExW
OutputDebugStringW
QueryUnbiasedInterruptTime
RemoveDirectoryW
ReplaceFileW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
SetEvent
ResetEvent
CreateEventExW
OpenEventW
GetEnvironmentVariableW
FreeEnvironmentStringsW
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
ReleaseSemaphore
FlushProcessWriteBuffers
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
UnhandledExceptionFilter
RtlLookupFunctionEntry
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

ncrypt

NCryptCreatePersistedKey
NCryptEncrypt
NCryptDecrypt
NCryptOpenKey
NCryptImportKey
NCryptExportKey
NCryptFinalizeKey
NCryptDeriveKey
NCryptSecretAgreement
NCryptOpenStorageProvider
NCryptGetProperty
NCryptSetProperty
NCryptDeleteKey
NCryptSignHash
NCryptFreeObject
NCryptVerifySignature

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoGetApartmentType
CoCreateGuid
CoWaitForMultipleHandles
CoInitializeEx

oleaut32

SysFreeString
VariantClear
SysAllocStringLen

secur32

GetUserNameExW

user32

LoadStringW

ws2_32

WSAConnect
shutdown
setsockopt
send
select
WSAGetOverlappedResult
listen
ioctlsocket
getsockopt
WSARecv
getsockname
WSARecvFrom
GetNameInfoW
WSASend
WSASendTo
FreeAddrInfoExW
accept
bind
recv
WSAEventSelect
WSAIoctl
closesocket
gethostname
WSACleanup
GetAddrInfoW
FreeAddrInfoW
WSASocketW
GetAddrInfoExW
WSAStartup
getpeername

api-ms-win-crt-math-l1-1-0

tanh
fmaf
nan
nanf
cosh
_dclass
_fdclass
fmod
fmodf
sinh
floor
ceil
atanh
asinh
acos
asin
atan
atan2
cbrt
cos
exp
log
log10
pow
sin
tan
modf
acosf
acoshf
asinf
asinhf
atanf
atan2f
atanhf
cbrtf
ceilf
acosh
coshf
expf
floorf
logf
log2f
log10f
powf
sinf
sinhf
tanf
tanhf
modff
log2
fma
cosf

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_callnewh

api-ms-win-crt-string-l1-1-0

_stricmp
strcmp
strncpy_s
_wcsicmp
strcpy_s
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
terminate
exit
abort

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s

Exports

Exports

Create
Dispose
DotNetRuntimeDebugHeader
Start
Stop

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 32.4MB - Virtual size: 32.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48.5MB - Virtual size: 48.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.5MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
{f89a4ca7-f877-8cab-d819-634d51a27a4c}
.dll windows x64

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:55:9a:7d:ab:64:fb:b7:14:c2:6b:59:25:59:9e:f1:e8:0e:37:6a:52:ad:f9:0b:08:37:c2:c1:bc:09:4f:16
Signer

Actual PE Digest

85:55:9a:7d:ab:64:fb:b7:14:c2:6b:59:25:59:9e:f1:e8:0e:37:6a:52:ad:f9:0b:08:37:c2:c1:bc:09:4f:16

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3714ba8c2a904cd056f538893780a0c

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:ccCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

6d:96:7e:7d:b7:28:63:cd:97:6d:d6:4b:57:1f:41:38:25:62:71:d2:8e:17:b5:e9:a3:33:0e:3e:d7:df:e9:78Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

rpcrt4

user32

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 356KB - Virtual size: 355KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 3KB - Virtual size: 36KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 512B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

ff:b3:92:c9:a9:af:e1:94:5b:de:56:dc:44:8b:75:b2:97:8f:6f:42:60:3a:ee:ef:fc:16:b5:c1:db:98:9d:83Signer

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

57:7c:f2:5a:1f:4b:cd:0d:8e:cc:94:f1:27:73:43:c9:12:07:56:eb:43:69:fb:19:63:68:fa:cc:6a:67:94:8eSigner

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

99:4d:cf:99:fb:c9:81:53:45:85:9c:76:19:2d:92:19:46:24:b4:29:94:49:84:66:18:0a:7a:64:96:1a:70:a8Signer

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 31KB - Virtual size: 31KB

.rsrc Size: 1KB - Virtual size: 1KB

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20Certificate

Key Usages

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73Certificate

Extended Key Usages

Key Usages

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6d:96:7e:7d:b7:28:63:cd:97:6d:d6:4b:57:1f:41:38:25:62:71:d2:8e:17:b5:e9:a3:33:0e:3e:d7:df:e9:78
Signer

.text
Size: 356KB - Virtual size: 355KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 3KB - Virtual size: 36KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 512B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

ff:b3:92:c9:a9:af:e1:94:5b:de:56:dc:44:8b:75:b2:97:8f:6f:42:60:3a:ee:ef:fc:16:b5:c1:db:98:9d:83
Signer

.text
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

57:7c:f2:5a:1f:4b:cd:0d:8e:cc:94:f1:27:73:43:c9:12:07:56:eb:43:69:fb:19:63:68:fa:cc:6a:67:94:8e
Signer

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

99:4d:cf:99:fb:c9:81:53:45:85:9c:76:19:2d:92:19:46:24:b4:29:94:49:84:66:18:0a:7a:64:96:1a:70:a8
Signer

.text
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 1KB - Virtual size: 1KB

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

33:00:00:03:83:14:62:71:0b:df:9b:a6:3d:00:00:00:00:03:83
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

.text
Size: 681KB - Virtual size: 680KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:5f:f1:d8:43:88:d5:9a:40:31:00:00:00:00:03:5f
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

23:f9:ce:97:54:a8:42:7e:5c:85:5c:51:c9:46:d8:2f:e8:7b:36:70:56:16:56:b9:f6:54:ea:22:f5:ac:b6:89
Signer

.text
Size: 58KB - Virtual size: 58KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

85:3f:d5:20:e8:32:56:7f:8a:4a:72:82:57:f6:70:2b:b8:6a:03:7a:39:99:15:2b:6e:d4:57:6c:98:29:a8:d1
Signer

.text
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

3d:35:aa:3e:97:e2:72:46:5f:ef:fd:51:2d:34:48:39:3b:c2:3e:e5:66:b9:b4:d3:f0:b4:b0:06:45:5b:4c:66
Signer

.text
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

33:00:00:03:5f:f1:d8:43:88:d5:9a:40:31:00:00:00:00:03:5f
Certificate