blackguard | d92665b8104b17cee50b45c5a391275bc336891a9a47ff35e5ecc73124a1ca48

resource
d92665b8104b17cee50b45c5a391275bc336891a9a47ff35e5ecc73124a1ca48
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/SysRestore.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/Accessibility.dll
unpack001/BouncyCastle.Crypto.dll
unpack001/DotNetZip.dll
unpack001/EntityFramework.SqlServer.dll
unpack001/EntityFramework.dll
unpack001/HtmlAgilityPack.dll
unpack001/Microsoft.AppCenter.Analytics.dll
unpack001/Microsoft.AppCenter.Crashes.dll
unpack001/Microsoft.AppCenter.dll
unpack001/Microsoft.CSharp.dll
unpack001/Microsoft.Extensions.Configuration.Abstractions.dll
unpack001/Microsoft.Extensions.Configuration.Binder.dll
unpack001/Microsoft.Extensions.Configuration.dll
unpack001/Microsoft.Extensions.DependencyInjection.Abstractions.dll
unpack001/Microsoft.Extensions.DependencyInjection.dll
unpack001/Microsoft.Extensions.Logging.Abstractions.dll
unpack001/Microsoft.Extensions.Logging.dll
unpack001/Microsoft.Extensions.Options.dll
unpack001/Microsoft.Win32.Primitives.dll
unpack001/Microsoft.Win32.Registry.AccessControl.dll
unpack001/Microsoft.Win32.Registry.dll
unpack001/Microsoft.Win32.SystemEvents.dll
unpack001/Mindscape.Raygun4Net.NetCore.Common.dll
unpack001/Mindscape.Raygun4Net.NetCore.dll
unpack001/NamedPipeServerStream.NetFrameworkVersion.dll
unpack001/Netlib.dll
unpack001/Newtonsoft.Json.dll
unpack001/Nito.AsyncEx.Context.dll
unpack001/Nito.AsyncEx.Coordination.dll
unpack001/Nito.AsyncEx.Interop.WaitHandles.dll
unpack001/Nito.AsyncEx.Oop.dll
unpack001/Nito.AsyncEx.Tasks.dll
unpack001/Nito.Cancellation.dll
unpack001/Nito.Collections.Deque.dll
unpack001/Nito.Disposables.dll
unpack001/PresentationCore.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

d92665b8104b17cee50b45c5a391275bc336891a9a47ff35e5ecc73124a1ca48

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 d92665b8104b17cee50b45c5a391275bc336891a9a47ff35e5ecc73124a1ca48
MD5 32d9805818fea93bb2bc835b4b5bbbf6
SHA1 a293f134f1ef2227b6a08de3dc8d8a56385c495c
SHA512 ae41872ef5fb8d42c6d1b7b9e8864159426153d193752636f5385c073dc9500bafe70a8c26992fd11278a5c7cdda8e8d849d4f9f9baf6d26015dee7d4cd8c049
SSDEEP 196608:/YkRw8bmX0OLOlAiiogi1rEOOolsRk1Usb4ILm7/Lm45YDskCAY:gkRwHO/TBE9ols+UeLm7/LhuYkCAY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$PLUGINSDIR/SysRestore.dll

IMPHASH a4814f13f35bacb060420cabbf9e8154
SHA256 c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
MD5 da046184a8d7269a0e138b0b0b9b2eb5
SHA1 d9bc5ea397857e17a86f80df1e50615eb6859044
SHA512 9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
SSDEEP 48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 9b2c306c8e0ed35e1aa50bd943de3719054102662db92a6f0a0f703197343147
MD5 51a39d41ab4a3b1ec542f45f3edc6f3b
SHA1 09b5853deb184e281885aa8421cd9ff578c51891
SHA512 a07f6d4e6026335e21c11227ba1f5c2f5154b836ce3dc05283424f5de981f5cc5d5ac8c3559a784bb98e20243b3b1d5ed7636bae6efa429bbf7911c5c197e52e
SSDEEP 1536:/eeeeeeeWeeeeeeekVVVVVneeeeee2V8eeeeeeexewHPLCjRE:/RE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 b2c7196bc66d0ba39812af671542664c2c8216b3334d1cbbd57241bf11653b0a
MD5 3eb2ff327fb3fc2495c7b4333d4bede2
SHA1 584c75cf25c01183d4849271d19a18406b4a8354
SHA512 db599db233a05d322895551a1de198639ca64cb7c01b096116ffcde43f2d87e50a426f927ddfce8db53eee24ad56a833419f4bbe52e2ecc816e6654e38940495
SSDEEP 768:tzut0F2PKoRtviqKg1oNEZneK9Nl34xcj4ghfrH64gi62PSfvLzGE2sv1+AdwM4F:JQeKxHvD6VqD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

API-MS-Win-core-xstate-l2-1-0.dll

SHA256 4879fe3ea58d853f21658aefc5e8b92b7e6333d77c0af31a6bf9ff769475f6fd
MD5 5f11b9bb427753bdae6d312a02c516f9
SHA1 6fb327e5a64a94c2489f3a82999b7d60babb228a
SHA512 09a317ecb7d83f1aa2d06e65371513ae770c9df4691b5ad3d50918e4bfacf1635fafaa43ada4efd5d23c448a7eb80675baecccb3ca9dbbfba4e829248a5bf466
SSDEEP 384:9cf5b+W1hWx7HRN7izd72vH3rPR9z/gtP:uf5bVGic3l9zM
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Accessibility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
MD5 1b4cc6782e295675217cd17df70057f3
SHA1 f468087e7fbaa5aeed1fc41062b198570ae017e3
SHA512 05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
SSDEEP 192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a02884adf7c6cea2de69d260034930ebf9a0bbb51e7ceeb12b7fdd6d38941f80
MD5 fb8d7d2f2d25346e8ce9a70b5df5db55
SHA1 b7507ea12e1d0583fdee17583af26cbb17ed884d
SHA512 33a79b89ad7750084a47392b193a57cd3392c1f175eb63c4ac1c64919e47194c95b6c0514f10e972503e13980b88df329fdec29d3b3cf18ffeeea16bbe03e12d
SSDEEP 12288:8quZ72AyO5lpt5dFjTMrEtZZwem1ajAHOGeVy+BIRwcls9P5m6wYiKoP2X:8q4yAy8lT5d6oVjj/8Hls9P5mui6X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

fc:83:af:35:53:5f:44:e4:4c:f2:df:8b:52:5e:6f:36:5e:20:4d:b9:04:41:30:49:fc:2d:d3:4f:04:bc:76:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1083182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll.config

SHA256 f9c12d9f6a4625c20e1f3bda1a076b50587be63ca2207376b085bd8b9d6bae86
MD5 7b6547aba2712929a012d362eb8adf74
SHA1 e7dde0f13bb8289f6b63aef2650d04ce6a8b1056
SHA512 9ed2348d075db48da699cc0f1131c17770ab2ab2b45298b003641201ac2b4639bdf2028cc2a0492b317de9d951a0cad2ce6dcd259e2f0421055a04ac43620985
MD5 SHA1 SHA512

NSIS installer

installer

BouncyCastle.Crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e7c9e901e6d927778938d3ee5d183dce495d6b6eb2a89242a700afe25d921cf6
MD5 9d34c40df4c87e378bdb0a3ebd36bfc2
SHA1 5c110a3a90e792270b44e3e3f6cf31bdd9020295
SHA512 51eea2113ac5acfd553b3e0b35390c38323218de55fd5b8abc8cf44bd0445df84eaf9349b52491737aa826ce76cfc2fe5eb5aaa60413cf376b4479ff21a19339
SSDEEP 49152:2brsw7nZ8pRbkwLdPkSAu5LdPkSAu5LdPkSAu5LdPkzkHi2LdPkSAu5LdPkSAu51:U8pRbx4kg1qA4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2369022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Branding.Desktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed3d49a91f5b88d425d5ceda3e120638c5a16116cf719e899a3395092dbd2fd6
MD5 83df60e9fa070f73fc478f3e2fa33118
SHA1 09f906f3834fad2f891f2faa88963035cde5f4ab
SHA512 6b8bb3f951676c5186f72053f6eddd807c9168e54452d97985536e0956752707ba5a8fd1b466631b6d3f7d5ee614398e8e0c07774d3998986982928495bcf90b
SSDEEP 384:vhPZBx2Y3p1iS90bIqEoZzHoNZsHLItkgtAM+o/8E9VF0NyCn:pBL2Gp1i7bIJkVikgtAMxkES
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

df:03:b7:17:03:23:b4:db:2d:f1:5a:59:80:49:01:92:95:7b:f4:98:ff:98:98:1d:ab:18:33:ec:a1:bc:b2:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

18142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47_cor3.dll

IMPHASH 185ce3a45c3a9cfb3bf83afd7f79c140
SHA256 e745872db4dd114a65ee1504f401ea26d879edb6614e369a07a80ce7ad1950ca
MD5 5e717c95808bcb5f654bb312d289b837
SHA1 c69448eafa40e35424744c28e68cf69ce11a3d97
SHA512 dc5e6ee0c8fe22897009060821b18bf2f7d0317d30682f7fa84a4c1889358c152d84d22ebe57d0ec8ccc1be8714bce6b1257d30671b8d0fea88309bbd137b8f0
SSDEEP 98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:03:25:89:c2:7e:fa:d3:87:c6:eb:60:79:f2:01:b5:35:a8:aa:17:92:20:75:6f:af:f9:c9:69:d8:6c:2d:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

10

Entry point

3010368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WriteFile FreeLibrary Sleep TlsAlloc TlsSetValue HeapDestroy TlsGetValue TlsFree GetFullPathNameW GetFullPathNameA GetEnvironmentVariableA VirtualFree VirtualAlloc GetSystemInfo GetProcAddress LoadLibraryExW SetLastError IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW RaiseException EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleW GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo SetFilePointerEx GetStringTypeW SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleFileNameW ReadConsoleW HeapSize HeapReAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LocalAlloc LocalFree GetFileSizeEx GetLastError CreateFileW HeapFree GetProcessHeap UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile GetFileAttributesW SetFileAttributesW DeleteFileW SetEndOfFile DeviceIoControl MapViewOfFileEx CreateFileMappingA ExpandEnvironmentStringsW HeapAlloc OutputDebugStringA CloseHandle LeaveCriticalSection EnterCriticalSection lstrcmpiA HeapCreate GetModuleFileNameA CreateFileA DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetDriveTypeW GetCurrentDirectoryW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW MultiByteToWideChar SetEnvironmentVariableW DisableThreadLibraryCalls

advapi32

CryptDestroyHash CryptAcquireContextW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA CryptGetHashParam CryptCreateHash CryptHashData RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext

rpcrt4

UuidCreate

DirectWriteForwarder.dll

SHA256 440c95dcdbe402d843095649773d1fc6da5d035802dd540ce29c71bc915d433b
MD5 a36d73301123334adc95e034b327daad
SHA1 cb4bd930cbe2c930d665dd4467e8b88815de8c1d
SHA512 438abf9aa1c00bf1f3e9ec7e9ac6bf5d89c492d68301044ba7fb205d3c5d34aae4940893eff721b91696de4c782a8a3558cdb39955943e350361639893ef3393
SSDEEP 6144:eTDF2kb51CJfk7g9wSikA+6Bl5f7d5rBkwLENfTKSr1dDqY9DGKwHrD:oDVbK6kA+6B/d5rlUfTrDT6KwHr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:d4:5c:5c:90:32:55:f6:ba:5a:1c:98:40:cf:5d:04:b2:38:eb:c0:52:e5:b7:cb:28:5a:8c:74:c0:7e:01:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DotNetZip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28d76d7ac169c5b71cca4e3073226f885a2f06720413a11e8db9b7fc08359462
MD5 6a8c8771bd399dd468595bab186c3e88
SHA1 df56e2573396ad8da5998c6aaf89c508f2060a85
SHA512 3e7a0e3b0b182e97e44504c4aa511065ea910a88e88ea849a5977f64dfd64aca6008815a6307e1d82a706b66811ddc5a1234b37c95a80e1a01feaa8b8fdc3d74
SSDEEP 3072:QXsFvbsM5ecgKXnukd2sn8Dhm58yEJEYkbQcHPoOFqvAvIMqUo1SccvdH8UfrxA6:tmE7gX22sGhs2JcjpIN9+8UfrOsWs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

244462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Engine.Win.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 270fc42dcaf1841d1871ae4b45404afe9cfc3b445e34aca1e386b67fda555434
MD5 da57061c46593965fe4583555fd6fba5
SHA1 968ee40fa24695eac44dc84a224e0c07230e317a
SHA512 d1877c261a2071f507ed80923f6db4073404b4b16ada02b3c21e9fb824dd92f0f81297b3a619a2f1acdae502f43434bbd9297562cbca653e1a7473c3f05fb4a9
SSDEEP 12288:nL43XI03XQnigPCHS/cEYjKbs4OjQ/I51Pq6Cs6YAD/z+87tho:nkoIXQigPJ/clg5kr6s078
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

db:e3:0b:40:67:d3:02:36:8b:4d:29:43:ab:52:fa:e1:50:1a:2f:a5:78:22:c7:89:37:44:6b:55:84:78:23:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

878734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.SqlServer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4c39d8f0fb669e6e337c5f3138f6171b0905cf875a92b0e3253f33955b87b55
MD5 4010a41e4730439275c00c358550393f
SHA1 572a2fb0526523e3669a53264fc51adac70c4ad8
SHA512 5a554c85ea0222c9d96ebe24b2b0730c3974c59389e2fd0672ccd2c99f78b937bc4529151a24cc68357a308d3e9990f09eb854b05466538c422847d9849f84a9
SSDEEP 6144:frmoela3kPuG2p6GeqDmjaVmnSmr/u65oPWtduB6yHtYw:fvelMwu65oqs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

584878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7f8427f0d039ba33d7b414604baec4b62d6dfef9e1f5c078d403e7a04e8dd9b
MD5 ab3c40670c848ac52f32221a7976cedb
SHA1 20a05ff58f34ae9c6b046169e42db3b68b805fb2
SHA512 8e97b78a6ae9590e84b0d06f5a37586893c4c099a99aad2c50a6ea49ea1aae2acd07501d4e6af905a2263cd2a14f743746e18059204d8dff9b19439000cba705
SSDEEP 24576:nhI7iceqhqPP3COtQmJnfylfF6RTazewudnOCJNBZ3tc1D1Q5UGLG16pd4XtwZou:IOm2y5Ea8c1p2fa+wvHo8IryABzw1k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4936030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GUI.Win.deps.json

SHA256 31057e87e93969845fa1e9d9585e7f28859f69a301d3b03c0091aab62c62413a
MD5 9ad72fd35adefee97e45c7d3f4aca4d2
SHA1 36f507f2cdeb0fa168e231a12f16a6182a465887
SHA512 8a3467cf8b05efe30c43da72801729c43592a6279166430e332d2cbd9f20a5de5586c6c046486f64930049e9e544e5e9f0a68b5a2bc7ea08560f2ba8e4ecd505
SSDEEP 3072:/A5fgBS/Rt1Y9Im07R1ARkgT9uextHZqeajAXhKg09p:/Dm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

GUI.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2055cb0ad752fcdcffeed5a3696c12b679dab82624fa12ecbc554df50057f51e
MD5 29726704682e0d40ea6b0cc18a30b019
SHA1 7f630904f0f6833bc41fcc417f158b4de29cf287
SHA512 f57ce9be08baf4ecc55377097b2fe059e0d000fe17b57c7b2620dde907892b3442d259c4c37dfbaf9e6ca7f1a793325d421fb29b84c4ad2d2efaf5f0173ada77
SSDEEP 12288:rw2bFAzeuL9lRC5+Rh2gVS8GZdgdGuJggQT4KJeEyMF5OcRkZBp:025AzfC5+RfVodgdzJOOskZH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c5:7b:2e:01:9a:13:0b:fd:9d:ff:89:bf:bb:8b:2d:32:14:49:45:a8:70:69:76:07:e7:ad:40:18:56:68:d3:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1929614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GUI.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f35cffed9992cf7af5710d8f48dd1ba55b9c16211746e16fa474277ec5e5e1a7
MD5 2ccdd5e34604c7b55df78be8d1977135
SHA1 785dfda116c774afa7270713b1308ad1d8c2d200
SHA512 89947874a3c167b6e1202f338ef084baca5c7f954205f65ecaa0b284e74618058b3b1db0fa8d45fd558746eb278feeedd98320c8b79cd67049af244f511e7049
SSDEEP 3072:imEWPCpf49WhHIDkWMeqoAomvoPdk/kdGYp9i5R3N:Yf49WMkso7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

166014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LICENSE.txt

SHA256 f9524cf8d591c32dc21902590e3182d0d0bef0cb0ba431f91bf6c9d71bd38cfa
MD5 6b1c894157e404adfa2c9168cc1feaf0
SHA1 de643d125afb3f3fbc698c87f125d5a0f64cd73b
SHA512 46ba913816ea8156aa1b676c415b98966ebaad608ce2b2b098d784a8f1b28323a12e47852a9c4f9aea8235854fa922ce3deaa75db790d955fb3c36a728691156
SSDEEP 1536:euu3tHOSJpAg81+XjOFYwT3Jtfefsw1FYwTbjQTfw0:ItHLzR8EOnJ61Ljo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Microsoft.AppCenter.Analytics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac8b2f3785163b38c4473f1aa25616a4616e2fbb29332fe3dd8da9574fc3c4cf
MD5 d4041b4e6cef641e52922aae24358e67
SHA1 03cd00c2094e6747b0bc489f1927d29dae39b5ea
SHA512 728dcee4a9e3909f760edbd6a6e582c6c40162f37cf0c5e61bb092679ef91e47e8e5bdba468c40f24010ae795f6e277ff1c60b9e46bee2dbc94b3d9c6491570a
SSDEEP 384:FHusqPUYyBiwwu9sXZsQb+Jx4veT6pzBcwyWUVMW:FOsqsYb9w7UBcH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.Crashes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ac20df009a8879ff946388741b781b37f8209ac93260ff8a00573376def08be
MD5 389e880efe79f750488feed7fa52b1d2
SHA1 b0a58209ddd87d4ec1240bc1b556889850965148
SHA512 ce378858dd67c8ff7972036db1b558603c0c7bf74b82c0c965fcd039138be3eee08fb729b879a1c66b41d8fab7c70c0a9ad1c8e5c9490c4967cec87b2f62b436
SSDEEP 768:qs8Fis/HebQPbM9z9iDk+gGCHeHGoSMwdevPf:qr1bMvHXlemtde3f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7ddc86b6500a27783071abb2a0769a1f47a7cb78d039642c2126ad1b879cefe
MD5 395ca70f6def000f67ae3334682c3a73
SHA1 5b32bb4f106e490044f8cb95b1da24605e66ffd0
SHA512 a47cde27ec3af919d68f6bba485b24c31b681b3572cc9af9c8df8e46af6d1441d4c5836303c4901f531fdc6e2092c6ecbd28a17b42616e42a0f9a2a9dd46dbec
SSDEEP 3072:O/6mN7KWjKL7gHdJWRYhvoiJVIAQlHvIRQ0OzbXq:cN7PjKL7gHdJWRYD5UHv3ZT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ce9323fc09281f1f8d86d741a594e29f7a9797de0284e1b168b1043c6c9a02
MD5 550c3defa28f7da52cfeb896254d5446
SHA1 9769ad55aee4cfbc94053e885d229ca98d953254
SHA512 264181da5f80966f2b0a76912d496ad55b403f99d31097b258c9ab87d39b41435015b8e702bfceed5f333fac9367f542dd397778504c8ed2a4b4ff4bb3a82370
SSDEEP 6144:3MsCfqudVKjZSkSNw1oxu0LhdkjVsZBwRnIfPk9eG3u9yHcohyz:csCfidSkSNw1otkcG3u9yHc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

299150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.dll

IMPHASH 2750e561997e3d2f8e185972112eba29
SHA256 f21da9fb831ac943736135b6ee109a4b352511b8d6c07cb03c66b61996d1ddc9
MD5 4ff7094e3edfda47ced912012044296b
SHA1 c6f3c9d81713687dc3820d8cabf14c2a32208d27
SHA512 372867bbae96c51ee11b413f552a67a53992b16dbfa44105381db3813e3c2f9a3dc9d16fc6bd6366514d4e1b4bf1eeccce5261bc3df837bf3e3eb5a04446c551
SSDEEP 24576:7Xg0Ff/wSOM0TJuCD0Kbyk3dIf//LXpWhIHWLRDAcc17QXk0:7HHFRKbhdIf/TcIIhk/0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

PE Signature issue

Digest

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 28, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

256480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError FreeLibrary WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualQuery VirtualProtect MapViewOfFileEx GetFileSizeEx GetFullPathNameW ExpandEnvironmentStringsW DeviceIoControl WriteFile SetFilePointerEx SetEndOfFile ReadFile GetFileType DeleteFileW VirtualFree VirtualAlloc WideCharToMultiByte SetFileAttributesW GetFileAttributesW MapViewOfFile CreateFileMappingW GetFileSize CreateFileW UnmapViewOfFile CloseHandle MultiByteToWideChar GetSystemInfo DisableThreadLibraryCalls GetTickCount GetEnvironmentVariableW LCMapStringW FormatMessageW LocalFree RaiseException LoadLibraryExW GetProcAddress TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError InterlockedFlushSList RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LocalAlloc GetCurrentThreadId Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateEventW

ole32

CoTaskMemAlloc CoTaskMemFree

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh _free_base free malloc calloc

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-string-l1-1-0

wcsncmp wcscpy_s _wcsdup wcscat_s _wcsicmp _wcsnicmp strcat_s _stricmp strncpy_s towlower wcsncat_s strcpy_s strncmp wcsncpy_s _memicmp

api-ms-win-crt-runtime-l1-1-0

_initterm _errno _crt_atexit _cexit abort __doserrno _execute_onexit_table _initterm_e _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo _seh_filter_dll terminate

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _close _chsize_s __stdio_common_vsnwprintf_s __stdio_common_vfprintf _wfsopen _wfopen_s fread fseek fflush __stdio_common_vswprintf __acrt_iob_func ftell _wsopen_s __stdio_common_vsscanf _open_osfhandle __stdio_common_vswprintf_s _read __stdio_common_vsprintf_s _filelengthi64 fclose _lseeki64 __stdio_common_vsnprintf_s _write

api-ms-win-crt-convert-l1-1-0

atoi wcstoul atol _wtoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _wfullpath _wsplitpath_s _wmakepath_s _fullpath

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

api-ms-win-crt-time-l1-1-0

_time32

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Microsoft.Extensions.Configuration.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9e4bf73dfed3d5aa9ff25780e87109a985cb6e2feab30bea42689cf7d1d4ed1
MD5 542b6ef0d8d600f43cecdaa5fe6a99a5
SHA1 3e5626ab326b8e0a08d48f1347c09eb3a8b1b882
SHA512 4ba7499c2b5cab18d185f63f857f8e94785642b5d0909d2c978b039d8920aadc0401f57ab7603f2ddae396c4c8edff5f56b31de36d24620733c9847f5b3152cd
SSDEEP 192:DMt6XYVhN6y0mb+dXM+4POdTJ6V2fGtbn/PTG/AxXEzRjz6P+M/FbSZbWsKTWM:D+V/6PI+1z8bXTG/ABEzRjz6P+M/Fbk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.Binder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4950a8400717903c28cd5b9562cff761afe5ac3470ab699855a898b29fe8a2e3
MD5 99ed54569b703e903f674ea4eda6c662
SHA1 5c59e3c564b4c057ebc1455cf7bc219b825aa11c
SHA512 fe4937471fee583ee73411eac6e256a622c2f8a10d885e2096546bbc93e393435fbc20d40b3f885f48f48767bfdde906209890e9088318505b10d84a7d4ae7e7
SSDEEP 384:dqnWO8HPEfXZ5PAxmLKRTuVWU28UJjyFygZ7gYU8ud/WiaGWM:dSWO86zgm0qfUTMuY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91be5d8e169d4e809d077108827c041988018f37924c312dcf3c3c77264eaa7c
MD5 d29ef3e603946cdd964ded903c205d62
SHA1 959896475fe1dd758adf857b72bea25cdcd405cd
SHA512 3f82b58932bbe771fd102065399e36822f061c769a211b85661d4b0575cbca90cd18ae92d76101e2219f22bc247a163ba95718a4303a6d43784723437f7b88cc
SSDEEP 384:/dfVJtVnucJYXVJig3xLm+NMsTks7WK4WJeVWWM:FtluT31Ugi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1663be664cb7a7afa5786dc9f071fca8aeac3737fe8e29153f29223c8ab1608f
MD5 1cca6bb1ef856aed16e29b17b92ea225
SHA1 59bcdfef44880db1daf87951619cbc776a22746d
SHA512 6daea2c19e873594e8486ee09ab0cb9d30e4f76a1ba51fd3c2a40ac5c27c870e1e7b533247c17b8386c9016103d1423cd886efbf1256e89ca2a8b99f0d2d57fd
SSDEEP 768:jwd02Ew1NODPOlwlwlwlwlNm/ST5T1yEf:jwd02EacZ/mJz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

32878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21d64f47e3d226854b93ec5b1f94d3b8ecabb0000a5b759decd96507789c307c
MD5 692c5f999645b4e9babc2e830a2534e5
SHA1 da1ce989d55ef32809a4c0471be5ae9e5614e483
SHA512 ee6da0eeb5617b6b0ddb754cdced46a68a4aa95e5127ed94090f3640d4d0df3f003135ca84e5b4870679b0972e3c4f6b8059bd8a9c870ce8c5237cb0930235d7
SSDEEP 1536:CPkLGoLSeeeJHlFDj4aQsxYZiKdD4Zfg+:Q+XHzjeN4ZfD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 971a367da28ccca459fe2f7d755f0cea978310fdd064f6368fb8c8af814d74fd
MD5 613442a0e2cd90d79c3401554b8fba9e
SHA1 380df211e2bada028536a6c55bc8f33495bce1a2
SHA512 ef9a5696774f111a7ec99a6cc96d976e761faee4e128510f278a6f606de3f898413808f4c53cd19d27e83a46a1adef945c60d4bdc41f2aef70f710027c6bac87
SSDEEP 768:qwHqGdhpezbPK/QN8jmN8CduUNxYci62wyq/:T3dv6eAuUocywyi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30f4630b82b19f77abf33c8287cf4a00e8285aa71df1bb3fc05b7abf9026841b
MD5 1649856f9ae8ea8aa53b5aaa04da894d
SHA1 03574a2e9baf4edab20375bbf968228ca717ce8b
SHA512 20dda82a3c9501c7de052c86c09dafe4251042011305a7224bdd7bbf99f7b705cf6f5992f9fc27fdd5526dcbb3fd6caf6fe2128631c769c59fbbd5c639dbfc17
SSDEEP 384:uUNoqS641Wkrb90zrAj1+dOECTEPC5nnAKacrWYrqpWraVWM:uS/SkkrbqxdOEQ3AFchr+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1332dfbef2bb538faed7c85ae6f6c26d64333eed95486e3f81c9f2c1af5b9f33
MD5 e80731180d3f61c207d1e759b5e422fd
SHA1 c9a8989cdb44ae95f6f6404a6618bd001ddf95fe
SHA512 da74e650dbe60705e02882e7877cf0f5e7f08c1a17b3da5cd892b9a66fc06dfc7be8e324c13d8df17f7bc9898f22b399e0e81808c76e1274f70b6b1f58564a82
SSDEEP 768:JmOSgq1fwDct4Ipp8nV485AoX5R9iV+Wml9lblyMbWndaM:O1fwDct4+YJA0R9I+X5bo8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3cef68b21c85327a9e55e1eabca27c15adc2c6a68b57f5f26b106f4bc9caf2
MD5 61f024f6b0322ba5b988314329dc27d2
SHA1 198fa3cd893e164a1c8144adaf36a9711f5ed258
SHA512 cfd645addfebee65fb7b7d6029c4d5359d73605e94708adb40c52d3ed498aea8d05559633671b5702635958f244bcf60bc2a09302f6e72f4a5d66479ab021608
SSDEEP 768:33/GX+hgQVTGdJS6CPIUqOF0vWusFQaui4m1/LcfJOVfAMxkEa:n/GX+BVTGbfi9qOF0v3sqauiJkJO9x+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0e:2f:1e:b1:81:a8:66:ae:e6:21:7a:ae:98:18:04:d0:18:a6:01:7b:5f:5c:2c:86:de:cc:c7:45:35:70:02:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

34190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Toolkit.Uwp.Notifications.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b14999bfdbb2a55f335ed3e9da022a73e9ff6e96ba341ffef22637a6f1826188
MD5 71829de02b099241bad4ef0efba785cf
SHA1 625aca08f1b7020456303794543cc669853003a3
SHA512 dc5248ec12ff04db6722d6640ce2eab8dbf154ceaecbcb5f473e4ca869f60ada4bd136d849db82524743c652f2bb27d08870d28e2d54977c717b73fc853d6557
SSDEEP 1536:I3FYVCl7jqFaTsU6+QFBwkGKXX/3+fibJ+zGgr6j0tdISOUpUfZ:ooClnxsU6+QFtxXX/3+2+3r/c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a8:a5:6f:e0:19:7c:75:8d:62:66:2b:14:a6:cc:fd:85:59:5d:68:92:91:b7:62:e7:c1:3c:d2:db:5e:d0:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Chains

Aug 12, 2020

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Serial Number

0e:71:58:6e:7d:8a:28:36:54:3d:5e:15:d2:b4:5d:e4

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 11, 2018 - Jun 15, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

109974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.Core.dll

SHA256 e0864f46e0f0ca66143b43c12a4b37dbe2fbe8fd138d5da59326fd632d6a3571
MD5 4ca0c139b698ff4b1a4fbaf653d8b607
SHA1 4881028e15d3fe3e52a6e0e8a10a3d926f3400d3
SHA512 db0e1eea47f75bde5427234888d88829fb184e31be0aefcf687e2dd4e351d9daa7cd5fdc5457ac445f17c5f784f4602f48fa8f49faa2c22c511729c5f550b93f
SSDEEP 24576:92o6FIAG8DgwIB0RLQh71gPOpxEDoQt7g8m:f6FjDgwAps2Itto
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:e2:c1:63:bc:69:df:61:1d:7e:fa:fc:f8:d6:62:f7:2d:79:1a:c8:da:00:2f:6f:49:16:cd:5c:96:7d:8e:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.dll

SHA256 89896b1dfdac9c395ef24e7e032f9b746ccc331bc0c9d791de3e5d2b357f1185
MD5 54427033e0d65a39722a76e07e430eb8
SHA1 7b83a4fe9997310c77aeaa5868b01b2b5a7b7c84
SHA512 b6304ec9042eee9d4c9e5f866fe9fa92582fe24dd3ba8f82374a17a7b87cc84e5f9608149269cc4c8e64cdc2c7b5ad7ac228070fe5cdd66da5b3bb9f00dfcb19
SSDEEP 384:JxWmH6L9QKWwQ3cgznLIqddm7HRN7d7EHR9zcIX:Y5QMgznLIkKd7Ex9zH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c2:b3:d2:9f:88:41:0d:3f:2c:f7:2c:87:ac:f0:24:2d:67:d0:8c:e9:45:d1:85:52:41:ce:e7:5b:4b:c1:ac:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 85c9a4fac07761d259bd91c669e4e1c10cf79d0939e64ee96e32abdcce51c86c
MD5 8607bdfc638e4fa1d8e716486a9c6475
SHA1 9e246a9f462097de2b3b2472950eb6273e874efc
SHA512 91314554e0937194f74c802c695090582e9a6b857da72026ccf5432f5ad960547b4f4e2235f0a56108a63cbb40d60fb7d7bbb30b39f1851606a09bcf34371c5a
SSDEEP 96:/0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+qxv87xbO+XDS8PODxVWhPIeWE:8spQgrpnkeQwRUOKlxEdr50WhPIeW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1af18aa247c88bdfa1dbee361b6b901e541c0f7a0c1c31336d65ed5176b13e39
MD5 47c158136040881155f35b4877460849
SHA1 a60ab328c456cdcb7f71e14358a0ac202287a534
SHA512 14ff78a7029229c046117afc1292c3a4712dc3a4e3c4ce735781deab842b41a9bbb5fb516f19eb614299199074bc1da583d903bc08dacda6b8eb969f1bb78525
SSDEEP 96:MUhxTU0KDgJtLuWcL1v8Pcir4c2+qR3nsluxvbo+mDmDBEbKWFF3a9wxW:MOKDYrcL1cc1UsXxhfWFlscW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d72bbe2fe0fbc2177dd211308ae7331504ba0317aae60761e94817dc8856580a
MD5 90ce1c7910d0f504b2e3787e1ba199f1
SHA1 3acb3b6dec3b9c51e887f6a750035357bea5ee5e
SHA512 da7f23717e9341565d36bfaa90ec1e37d7d1ec59df91e495c607d404b00324d7e1c8d216e7adb64ba4bf7973888342098debbb8b8a4a95019200e1735b5204d5
SSDEEP 768:anNkMiBZdxRhmlhOPXwYMIKNwqSAVi2jsd/v:qkBZFhmlMPXJpkIAViWs5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.SystemEvents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f05110e122fa7c73ac3571b82a0bfd5a8462a4b42b0b945c4f901928a29f3fc
MD5 fa51d1d280c2114a1de24feb9be14a32
SHA1 aa0916a3b709e2a19b7d3a55d2fdcb9cac333f88
SHA512 25c35857c79e03538825ccd6b87cee1d4a569d871889fd256fa413d69585a8e50340a0ececcf1824cac4ea976e15a3eff6ab367b0c4846f66593e0f67d233921
SSDEEP 768:Q8lYXXu7a7jtvp4VM7/9f+5KOo4KD2lJzPIsFPbPDT+9NWIc5YlL3qj:QyYXXu7a7jtvp4VM7/tSKO3KD8IsFr+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ea613cfa8e489c15d44bc1360e11be1d321de2d0327386df657425db4ebd847
MD5 2520a5a2506531cf6f8b4f2a733957bb
SHA1 202e824c042d89400c856a64624db4bd98e51f52
SHA512 8a95c483023177a8a88a1ebcdf8e00577f14a7b8603b722896ba1c714b2cc10477a74a0ff0bf7ffb70aba7e51327e54d07ee5dff6bfaffbb0ef51f08fe9adfac
SSDEEP 768:jOwA4HYdvQRXNJThTFYZSRcxEpZL5BWo1J8Bm5LhPUEfTZ75QluC9cjQvU+FlsLv:jOJ8PXNB5FZPL5BmBi8Ex+lbjkv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 839a8f2b052dadd685a7222f69c42c11edf9f1e06964dfddec61320e9f359a98
MD5 94b6fa3995eb2ba34afa532b9fab39a9
SHA1 42480243477d813498bd83839cd16f6b7b828e96
SHA512 3bc4eeead6053cbf09d48297b75e270117b52562ba21a71d8163e7dc932f02c837fed47a813d6dd3efd43812faf1c9cd934e43bd482d8664fbc5191437bb6d90
SSDEEP 48:6xJk1fkEdDhOGGmntavItLNMwxLFvLmehCZutd22JMKM6ER5MtR5MPTHX:4SkEdDaOXv3Jv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NamedPipeServerStream.NetFrameworkVersion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 463e1a53996e8de4d2ff2a7b3919e24358c1895da120060d32c1bf4f9462bc83
MD5 f8d4f30967bf2a130721f2ebc084cc7a
SHA1 14d81ae3e20c321636262cfca5c2fd6caa59fb9c
SHA512 a9cdf2ae64e408349e321a69fe609f7b9e7d14505468c9d986bf46fd9ac77d5c79bb14eefe67f6b977705150a2787a41b74e685545240d7d60c524b3bfbbcbca
SSDEEP 768:g/VWCKBOs3a0k/c6sYB3zYD0DvlRGh/D/QPi:6WXBK0c13Bu/Ai
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netlib.dll

IMPHASH f68acbcd9b68ea2a855ac109b1fca5e9
SHA256 9b33915254ff7c566937b73c0c98e579547fd50b65e4483277159d5c7eb44549
MD5 822cc56add5d97691b993f64b11f9847
SHA1 42b92efd9348f2306315274e34827953b8b26814
SHA512 a3c2e95bddeec26ae516e3b0cfa69a44ccd22f3930a692dd6e90fd4869676f5213781bc5523c15534eaaf3be5a949be07c0f5da4d6b2edf762b457363528f97e
SSDEEP 3072:GoC7RcDXGZYcS+sWv42+qct9iywOw174uXl8N:jc8uS+V42HcT/CXeN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fwpuclnt

FwpmSubLayerAdd0 FwpmEngineClose0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmEngineOpen0 FwpmFilterGetByKey0 FwpmSubLayerDeleteByKey0 FwpmGetAppIdFromFileName0

ws2_32

htonl inet_pton inet_addr

iphlpapi

ConvertInterfaceIndexToLuid

rasapi32

RasGetEntryDialParamsW RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryPropertiesW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW

kernel32

WriteConsoleW CreateFileW DecodePointer HeapSize GetStringTypeW SetFilePointerEx SetStdHandle GetConsoleMode CloseHandle TlsAlloc GetConsoleOutputCP WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetOEMCP TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetCPInfo

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74deaa342747cf77f6efac6bee1cb6da2e7fa31988b3f1304eb1d01d621ba4ee
MD5 3c88cafb11eb9ee403dc2980edfaed36
SHA1 b9664b423200e28882a8e543cfdb8bca5ebe25de
SHA512 c5044bcc98bbb639c40cac5b5333c890feb4afb2d54b55d5d702ee7f83d86d3aa329303f88c70683f89658d7fca279104bd2c94ef3641a6fde522716c8365dd6
SSDEEP 12288:7QXc8tdRz3R5TzIQ/cVEfH9LbCtubHkttbXBfGpYoC:kXX33R54Q/XbCtuWhXBfGpYoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

688574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14e949e8c2eff5bc7afda30804bdab15e293fde2c9f573c8d52ece54bb21c2a0
MD5 49add3e0dae1181cffc0d4dcde4e9502
SHA1 d2941dd7672b7e1d20ffe3d70dad84a71fb33852
SHA512 daa90a6db7cc28f4759deb2ffd3dd8c8f981839a8cca1299ebd558b41488ab0d9c56bda336396e7c6f46af192ca0fb02afb5851b66c65c47e3e39604fcdbf8d4
SSDEEP 384:iHd+/aJB+7+atTbuKE6CY+CTbkKM5E9P7EljEeDFkoFhx:i9SSaJ6KEpdBdrzx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Coordination.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe34dfb558d65d8b072f466021a0d15de8d202513b1f13a7b45ffc3e9125b588
MD5 805c7a0a6c838cd2e96b402417638ee9
SHA1 843ae9a6129c73f17df1a91ec09c4ac2a06099c6
SHA512 ccd6383841af4188b448d1ba153672b5861814ea8570d29ced77cffc10346c403a6f37bbf2d003b705f7a50a9c008e3a5e45a6bc30f617d9a34f64e0bc103e55
SSDEEP 768:m5MwEXdl+dbSMyWJ9TFOOo8pufD1oq2UcgFixdHGIcxCJVENySzWi+G:m5MIOEwJoDU1ixdCa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Interop.WaitHandles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f6c3af2124d0a7385ec595093062ae203573167332473c0dd6af323a8010190
MD5 a4a934cb7cda9fe457e751f43946b47d
SHA1 4cce8c0d38247450b158de3abd320003da9a4844
SHA512 15862a759007cf6211e0062e5257468e86f99868901c6565c08e6c401f9035ee86e2e639ceb8843ed4162adff35b3048c222948565a46e1df25b604254d9aa2f
SSDEEP 96:QH+IoX50CwqlKA2ANwIIv/GWnNwAh4TqBQBT+mu2hDOLFio1Xr5vKDAl:QpovZz9cGWiwBOa2hDOLFiWVl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Oop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75a30af7c9e46e45e6c2b11a8284d5eaf681b8d71e531200d4b480fc66b0f65e
MD5 73c77e64e8e1f0f010fc4158a1a7060f
SHA1 ed7a2e982f5475d4479467aa248e1e6cc4adb455
SHA512 0fbfa1d573da283c5898e9222349c523cb9c8b22f650af24b6980ab9202249020ee74e079acb6ed9ea3c1a74debef2aa70d33448d1012fc66868fe2f8db32c77
SSDEEP 96:zfaZaAMFhVyhCEvX7O+pqCbS0X1V0TzCw1:TAQ7QX/KCqz8eF1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edef045c965f1dc14805cd66e2a0b2cae2bb34aa2c8e80468f34c34446906d0d
MD5 17f57e0d9b7c5cc602553301cd7b1607
SHA1 cd7567d67967684e72ba10d24c47e3d5c0eaedbd
SHA512 759fcc7914add3c80080c6ed9da94e9fa5e2af91752f5d7846b8cf01cc261b1eb76ba59188b1391d04a61f7ffffab7b68e0d8ce3f4b5b81fc4ff53c4aed78bef
SSDEEP 384:ardaj8E2h7/D8tg1a3FLF/pNw2QNmtMdIDToMiOrS6U07dYdt0EYP8R0OekBVg2B:Jj8E6oflfOtdgTo+/Ugd6R0UVk4m6z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Cancellation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f905ec7901dd2b3e59ec23142518996769b3c6916075776319a1c960fbddef08
MD5 df073384d167ac9baf66b991ecd6df79
SHA1 1278cb3cb7fbca5736fc386ff5e72053c6eb0f28
SHA512 5d06ca462cdcfbf4223c1b354c3578a8074e15ce850b91861f642c1d9cb29ad31fff9c16144dd2e34c289788b678296a7fc3a664c4b27e655d39415923432330
SSDEEP 192:VE6Vnko3LO0Gnr1CPkjMD1oE8jEXXwgRh:VHHO3nWkjMD1oE8jEXgah
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Collections.Deque.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 570f6df8ea487a9977c23cca5ce9ae582f645f057015ef779bb1c75afc208052
MD5 f37027e4b63b3f6468fd37332684d105
SHA1 68c3e376ba053990875dabf222fbb320b2495a8d
SHA512 ca8c0eb8a5b884d015131de216d97045a5b7e7ab457901db231b28a289d829803adfe18f58ccd26b153ebff64bb542cc8a7cf0c5f628e7108aa02196933461d5
SSDEEP 384:WRLkjeUXeOVXGAUbDYNt93FLr+hK9oY7W++wj8a7WwF5LMmXU5rGoMjnJX6eP6+3:WNOVYbo93FLr+gnEz01/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Disposables.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36be2376633d785adec9031ea49b2f578f50d5d2c74babf86f44566b903b4197
MD5 e4f25b163ce2b0cfdd30e22d2fed7e07
SHA1 16ca226a1380d219ba511a872eaea47c51818d76
SHA512 5afb2c7b8aaf67eb40964bb0fecd50a9522aeedbe18fcaa3fa02c7305ac3815f49a1e17732fa6a3f08f79507b0f2e19e1bb3cd0246ec3c95a247f7c789c3deec
SSDEEP 192:w3zvRqpaQjjXdct0MDxRYJEHrlBqw16ho:Qzv4LAuJExf8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PCProtect.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 ee2a8218d5b7a6d11916691102f3e76c4be3da66f8f8cf6f4f1a6f24cfc99f54
MD5 94d591293fff2ede848a882dcb8a51ef
SHA1 feac4ee52d01861e8a95a2d55a7dab69b90cd2bb
SHA512 4b3abff4f3f07e1a9c0980a073619aa5b492d53e0b86b4de3ceff3c716dbc39cadb24c2c791a12b4741684514124f8b82f527a1d1e3803d18d7ecce9bb5e5597
SSDEEP 49152:2KfYKsQ5ruBz690WwOwcMvO0gDLx+edI/EDplyDYVv1Yu1Idz1XUoxV4DQvHYxUV:FoZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c6:07:90:e2:80:f1:49:c7:b0:cc:af:95:d5:01:76:c9:1a:47:a3:76:9b:91:9c:10:31:5a:7f:5b:7d:d4:17:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

PasswordExtension.Win.deps.json

SHA256 7b34d7ea90a9664a8f6370c3b0e98ac3114eb96f0ee9edab6c669d86c2c3cdc1
MD5 cb9268125c592ca792954257032bd7ec
SHA1 6b2f1f5b425639aabc73dd0c0b119a1a51fe5549
SHA512 0ed3ac6039d742768ad3eeede207d96abb393780a431330cca8c27561a8dc79777ed11174890513ba7ef71cefe79cb1e3e54e7dab11b9208cedfb754b2ef389b
SSDEEP 3072:dsA5agPSxot1Y9Im07R1ARkgT9ueGtHZqeag6K7gn9U:a9W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

PasswordExtension.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 af713223d450684b86abcdaf30c1ce92700d57f732ee8328492fa6930e33da4e
MD5 ffb09cb862daba449b12f3c76d833aac
SHA1 c5dac38c83e106475520345d964dca00b35b513e
SHA512 73c96c8f7ea507332e06a40fcf92e0b12f69f4c1f75d08cceb26f77b10793e0844809c6934cf1832a8da1e905a3f14c4a90b50fd253a22fc547a10fd16fb5072
SSDEEP 1536:QkYuTKG4tSaSsqnOcizwuAyZEpjZgxM9Na6WATrKpRF1EjniN7gmFOXrhOLvgqSY:vYpxgfnqXZEpjZgxM9NZWATrKpRF1Eje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

76:01:98:dc:ee:de:4a:2e:de:74:94:b9:81:12:b2:f1:e6:af:20:e9:8c:89:7f:6d:3f:b1:1f:32:d9:42:5f:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

82206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PasswordExtension.Win.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 6f2700976bdd9dd272958a3283faf11b17bd60f59307fffce77e91777fc37068
MD5 db3f6312f860508d9eacced7287fa31b
SHA1 293a25e5acb9d2f9acd9317afe7367fbe183b9ef
SHA512 2f837e89bf6d04776a9e4a1521568bb71c3e6c23bd231673e87c2839f79de7dc23f1efb9f4c922eb509bbb62bb438d833d116998b89e38b9498fae6e237cd891
SSDEEP 3072:hc/QPqpDnKYSO40L58FvumU9aDtxG12X85cHac+Y1oAILp6rS:QQPq1nKLOxCM4A2XvlA8S
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

17:f2:19:08:df:3c:f3:19:22:30:71:09:ae:93:a3:a5:d8:84:e7:76:6a:7c:66:e5:64:1d:25:01:33:fe:0f:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

PasswordExtension.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

PenImc_cor3.dll

IMPHASH 897d4b325f4d1ecbf05e1d417468dc0f
SHA256 3002b51d51172b402fdb20cb6f87a6c9c0abe8a4a8feab3d2bc4b82f1216e5e9
MD5 7560e528fcc8df6c4d4bbd86e0749c0d
SHA1 df3fee25640fb715b7ec590aba394e0457a612de
SHA512 c1871aa76e7ab34ab0e0a7ad9540b306ee45bded1e0e5cb0c9f031da6f69f057d34e0b4a386a0d1e31aab8ba17bd2e0d564e327b828e33dc4eb828eaf00b0a81
SSDEEP 3072:9/TNcQAdQk1RaV6tS/vfAcdtMUqfY4AvdhFXk:UQA+QSPATLA0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1e:8b:ae:78:77:81:91:fb:d5:1b:b9:f6:e9:be:e5:60:4a:b0:05:5e:ea:ec:21:fd:2a:3b:5a:30:f9:ad:68:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 15, 2024

Minor OS version

0

Major OS version

6

Entry point

68928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetThreadLocale SetThreadLocale DeleteCriticalSection DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateEventW GetCurrentProcessId OpenEventW OpenMutexW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetEvent LocalFree SignalObjectAndWait IsWow64Process GetCurrentProcess OutputDebugStringW CreateMutexW CreateThread QueueUserAPC SetWaitableTimer CancelWaitableTimer CreateActCtxW ActivateActCtx VerSetConditionMask LoadLibraryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedFlushSList TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CreateWaitableTimerW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind GetCurrentThreadId

user32

MsgWaitForMultipleObjectsEx CharNextW GetWindowRect EqualRect CallNextHookEx IsWindow SetWindowsHookExW MonitorFromWindow GetParent GetDesktopWindow GetWindowThreadProcessId PeekMessageW GetMonitorInfoW UnhookWindowsHookEx GetSystemMetrics GetWindow

advapi32

ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW

ole32

CoLockObjectExternal CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoGetApartmentType

oleaut32

SysStringLen RegisterTypeLi SysFreeString LoadTypeLi SysAllocString VarUI4FromStr UnRegisterTypeLi

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncpy_s wcscat_s wcscpy_s memset wcsncmp

api-ms-win-crt-heap-l1-1-0

_recalloc realloc calloc free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table abort _invalid_parameter_noinfo _errno _initterm_e _initterm _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _seh_filter_dll _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

rpcrt4

CStdStubBuffer_AddRef IUnknown_Release_Proxy NdrDllUnregisterProxy NdrOleFree CStdStubBuffer_DebugServerQueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_Invoke CStdStubBuffer_QueryInterface NdrOleAllocate CStdStubBuffer_DebugServerRelease NdrDllRegisterProxy NdrDllGetClassObject CStdStubBuffer_Disconnect IUnknown_QueryInterface_Proxy CStdStubBuffer_IsIIDSupported NdrDllCanUnloadNow CStdStubBuffer_Connect NdrCStdStubBuffer_Release CStdStubBuffer_CountRefs

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PresentationCore.dll

SHA256 b20edc49eeaaa1604bd571e169897fece95896099a53736255b895aff7e573b8
MD5 f3781cf9fe9f985ea26c9caac4b2bdfc
SHA1 fde8e866d4e5e730982311b36e449e628722f97c
SHA512 8d7024c17e2c802350a61319035ee9ca6a058713944fc8f4d60f3c0a7a1c0316ba010304964019612bb82225bad7087c1a7a8690dd274ef6204d62ea1c8f0b61
SSDEEP 24576:DIq1QsB+uMcon00bPVE9gg81922yxcYMiaHuCzV6nO1LHpB89rGOi7:X1BB4con0YW9r81922/V6nOrB89rXi7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3415742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SecurityService.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

Errors

General

Malware Config

Signatures

File Explorer

d92665b8104b17cee50b45c5a391275bc336891a9a47ff35e5ecc73124a1ca48

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/SysRestore.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

API-MS-Win-core-xstate-l2-1-0.dll

PE Signature issue

generic

Accessibility.dll

mscoree

dotnet

AviraLib.dll

mscoree

dotnet

AviraLib.dll.config

BouncyCastle.Crypto.dll

mscoree

dotnet

Branding.Desktop.dll

mscoree

dotnet

D3DCompiler_47_cor3.dll

PE Signature issue

kernel32

advapi32

rpcrt4

generic

DirectWriteForwarder.dll

PE Signature issue

generic

DotNetZip.dll

mscoree

dotnet

Engine.Win.dll

mscoree

dotnet

EntityFramework.SqlServer.dll

mscoree

dotnet

EntityFramework.dll