blackguard | a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709

resource
a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/SysRestore.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/Accessibility.dll
unpack001/BouncyCastle.Crypto.dll
unpack001/DotNetZip.dll
unpack001/EntityFramework.SqlServer.dll
unpack001/EntityFramework.dll
unpack001/HtmlAgilityPack.dll
unpack001/Microsoft.AppCenter.Analytics.dll
unpack001/Microsoft.AppCenter.Crashes.dll
unpack001/Microsoft.AppCenter.dll
unpack001/Microsoft.CSharp.dll
unpack001/Microsoft.Extensions.Configuration.Abstractions.dll
unpack001/Microsoft.Extensions.Configuration.Binder.dll
unpack001/Microsoft.Extensions.Configuration.dll
unpack001/Microsoft.Extensions.DependencyInjection.Abstractions.dll
unpack001/Microsoft.Extensions.DependencyInjection.dll
unpack001/Microsoft.Extensions.Logging.Abstractions.dll
unpack001/Microsoft.Extensions.Logging.dll
unpack001/Microsoft.Extensions.Options.dll
unpack001/Microsoft.Win32.Primitives.dll
unpack001/Microsoft.Win32.Registry.AccessControl.dll
unpack001/Microsoft.Win32.Registry.dll
unpack001/Microsoft.Win32.SystemEvents.dll
unpack001/Mindscape.Raygun4Net.NetCore.Common.dll
unpack001/Mindscape.Raygun4Net.NetCore.dll
unpack001/NamedPipeServerStream.NetFrameworkVersion.dll
unpack001/Netlib.dll
unpack001/Newtonsoft.Json.dll
unpack001/Nito.AsyncEx.Context.dll
unpack001/Nito.AsyncEx.Coordination.dll
unpack001/Nito.AsyncEx.Interop.WaitHandles.dll
unpack001/Nito.AsyncEx.Oop.dll
unpack001/Nito.AsyncEx.Tasks.dll
unpack001/Nito.Cancellation.dll
unpack001/Nito.Collections.Deque.dll
unpack001/Nito.Disposables.dll
unpack001/PresentationCore.dll
unpack001/PresentationFramework-SystemCore.dll
unpack001/PresentationFramework-SystemData.dll
unpack001/PresentationFramework-SystemDrawing.dll
unpack001/PresentationFramework-SystemXml.dll
unpack001/PresentationFramework-SystemXmlLinq.dll
unpack001/PresentationFramework.Aero.dll
unpack001/PresentationFramework.Aero2.dll
unpack001/PresentationFramework.AeroLite.dll
unpack001/PresentationFramework.Classic.dll
unpack001/PresentationFramework.Luna.dll
unpack001/PresentationFramework.Royale.dll
unpack001/PresentationFramework.dll
unpack001/PresentationUI.dll
unpack001/PropertyChanged.dll
unpack001/ProtectedAPC.dll
unpack001/ReachFramework.dll
unpack001/SQLite.Interop.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709
MD5 cf869f7c2b2a2794d10b7ce6fc46a2ef
SHA1 3623b62dedf73d60e902971f91d798b5fff92f79
SHA512 a3e16f5e51538762b198b155bdaf9d9edcc1a3cc0ad1f49d119eb22d43886295ffc196c4b142834d3b2c7d2235ab1c6eedfab55cae9bc5fff568562888bb9679
SSDEEP 196608:6/PN6s6e0FBEJbrGg0eXqGrN6rh84uk7mjRG6QhKCDRttKWdD:8Pr69BEJBfrrkqOZDRXKW5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$PLUGINSDIR/SysRestore.dll

IMPHASH a4814f13f35bacb060420cabbf9e8154
SHA256 c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
MD5 da046184a8d7269a0e138b0b0b9b2eb5
SHA1 d9bc5ea397857e17a86f80df1e50615eb6859044
SHA512 9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
SSDEEP 48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ed4c84c1d03daad325d9459f9e9469b9aab0d2ae2e5ce1d399e215f41db14dc5
MD5 748a0ab6dabcc1668833cd7e91267e8d
SHA1 cc42fbbdfad3033fb852f6a789a7cb26cc6fc8e9
SHA512 2cddd641a923339a49bad024dd6ece937ffabd48cf47a547092cfe81cb99540e92b062385ffc351cc0d48ffea7dd654461bd8f3076ba4e6977c9075deae2c26e
SSDEEP 192:xzlfKojR36cOrTn+p9XGwiWJ2OfHmDikCKi:xBfKe3NOnEXGwiWJ2OHeVC7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 548f4ef4dbb596d961f398358e8aba24c7ff434ea88f7f9f33653d33859b5116
MD5 6e5aa65d7e27bf6ab1a67d6d6c099b4c
SHA1 bf0e41e081bd9060a13ed40f7250ea8c33b5573d
SHA512 74fdf8f2a73127e124f91dde14deb44a959d1103e66bb66396896c20f1869fe0dd8dc2ce6c484456edd02ec5a9c1cbccf349f30aae49da4f8b26d7f684347993
SSDEEP 768:5NGz99m4aSTpmuXolSiskT5+kVz9U4d+fRv:+Dm4aSTpmuSzm4i
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

API-MS-Win-core-xstate-l2-1-0.dll

SHA256 4879fe3ea58d853f21658aefc5e8b92b7e6333d77c0af31a6bf9ff769475f6fd
MD5 5f11b9bb427753bdae6d312a02c516f9
SHA1 6fb327e5a64a94c2489f3a82999b7d60babb228a
SHA512 09a317ecb7d83f1aa2d06e65371513ae770c9df4691b5ad3d50918e4bfacf1635fafaa43ada4efd5d23c448a7eb80675baecccb3ca9dbbfba4e829248a5bf466
SSDEEP 384:9cf5b+W1hWx7HRN7izd72vH3rPR9z/gtP:uf5bVGic3l9zM
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-xstate-l2-1-0.pdb

Accessibility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
MD5 1b4cc6782e295675217cd17df70057f3
SHA1 f468087e7fbaa5aeed1fc41062b198570ae017e3
SHA512 05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
SSDEEP 192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3f1485ce848ed572de29a6633073eb61aab22cc32e4a3f20de3f035012b7356d
MD5 3f8ae290194e30366e28fdc6bba361dc
SHA1 da03cd90422cd26ce2fdfb20f2345afd9f75f3db
SHA512 6a58e6d23bb4389ddecb693ac5aa89653d1fe28f4b6cf0619a3237eeff0d6503bfc96687c4faf308216deebb83bb4097184866d91d36d9a9490ab8c59242f8cb
SSDEEP 12288:BquZ72AyO5lpt5dFjTMrEtZZwem1ajAHOGeVy+BIRwcls9P5m6wYnKoPyJ:Bq4yAy8lT5d6oVjj/8Hls9P5munmJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

fc:83:af:35:53:5f:44:e4:4c:f2:df:8b:52:5e:6f:36:5e:20:4d:b9:04:41:30:49:fc:2d:d3:4f:04:bc:76:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1083182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll.config

SHA256 f9c12d9f6a4625c20e1f3bda1a076b50587be63ca2207376b085bd8b9d6bae86
MD5 7b6547aba2712929a012d362eb8adf74
SHA1 e7dde0f13bb8289f6b63aef2650d04ce6a8b1056
SHA512 9ed2348d075db48da699cc0f1131c17770ab2ab2b45298b003641201ac2b4639bdf2028cc2a0492b317de9d951a0cad2ce6dcd259e2f0421055a04ac43620985
MD5 SHA1 SHA512

NSIS installer

installer

BouncyCastle.Crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e7c9e901e6d927778938d3ee5d183dce495d6b6eb2a89242a700afe25d921cf6
MD5 9d34c40df4c87e378bdb0a3ebd36bfc2
SHA1 5c110a3a90e792270b44e3e3f6cf31bdd9020295
SHA512 51eea2113ac5acfd553b3e0b35390c38323218de55fd5b8abc8cf44bd0445df84eaf9349b52491737aa826ce76cfc2fe5eb5aaa60413cf376b4479ff21a19339
SSDEEP 49152:2brsw7nZ8pRbkwLdPkSAu5LdPkSAu5LdPkSAu5LdPkzkHi2LdPkSAu5LdPkSAu51:U8pRbx4kg1qA4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2369022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Branding.Desktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b7df3656e162b87b3ca044832d50a8d62ab30248663572dc64a00e7658f15f70
MD5 03b64c991144e8b366d5023a19f2acb7
SHA1 326c3cb488036754e8598a9200f0795a96a317f1
SHA512 972c5832a2b5e091c95c86a8e46a38448ebda74ed64d0ddcf68437cccfa42f8aeed045f9b621ef0559e0e497513abc68b96fdfc8fbc26f8c9bc78eb44193e3f3
SSDEEP 384:lhPZBx2Y3p1iS90bIqElZzHoNZsHL0tkI4AM+o/8E9VF0NywBJn:bBL2Gp1i7bIJPVmkI4AMxkEgt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

df:03:b7:17:03:23:b4:db:2d:f1:5a:59:80:49:01:92:95:7b:f4:98:ff:98:98:1d:ab:18:33:ec:a1:bc:b2:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

18142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47_cor3.dll

IMPHASH 185ce3a45c3a9cfb3bf83afd7f79c140
SHA256 e745872db4dd114a65ee1504f401ea26d879edb6614e369a07a80ce7ad1950ca
MD5 5e717c95808bcb5f654bb312d289b837
SHA1 c69448eafa40e35424744c28e68cf69ce11a3d97
SHA512 dc5e6ee0c8fe22897009060821b18bf2f7d0317d30682f7fa84a4c1889358c152d84d22ebe57d0ec8ccc1be8714bce6b1257d30671b8d0fea88309bbd137b8f0
SSDEEP 98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:03:25:89:c2:7e:fa:d3:87:c6:eb:60:79:f2:01:b5:35:a8:aa:17:92:20:75:6f:af:f9:c9:69:d8:6c:2d:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

10

Entry point

3010368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47.pdb

kernel32

WriteFile FreeLibrary Sleep TlsAlloc TlsSetValue HeapDestroy TlsGetValue TlsFree GetFullPathNameW GetFullPathNameA GetEnvironmentVariableA VirtualFree VirtualAlloc GetSystemInfo GetProcAddress LoadLibraryExW SetLastError IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW RaiseException EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleW GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo SetFilePointerEx GetStringTypeW SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleFileNameW ReadConsoleW HeapSize HeapReAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LocalAlloc LocalFree GetFileSizeEx GetLastError CreateFileW HeapFree GetProcessHeap UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile GetFileAttributesW SetFileAttributesW DeleteFileW SetEndOfFile DeviceIoControl MapViewOfFileEx CreateFileMappingA ExpandEnvironmentStringsW HeapAlloc OutputDebugStringA CloseHandle LeaveCriticalSection EnterCriticalSection lstrcmpiA HeapCreate GetModuleFileNameA CreateFileA DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetDriveTypeW GetCurrentDirectoryW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW MultiByteToWideChar SetEnvironmentVariableW DisableThreadLibraryCalls

advapi32

CryptDestroyHash CryptAcquireContextW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA CryptGetHashParam CryptCreateHash CryptHashData RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext

rpcrt4

UuidCreate

DirectWriteForwarder.dll

SHA256 440c95dcdbe402d843095649773d1fc6da5d035802dd540ce29c71bc915d433b
MD5 a36d73301123334adc95e034b327daad
SHA1 cb4bd930cbe2c930d665dd4467e8b88815de8c1d
SHA512 438abf9aa1c00bf1f3e9ec7e9ac6bf5d89c492d68301044ba7fb205d3c5d34aae4940893eff721b91696de4c782a8a3558cdb39955943e350361639893ef3393
SSDEEP 6144:eTDF2kb51CJfk7g9wSikA+6Bl5f7d5rBkwLENfTKSr1dDqY9DGKwHrD:oDVbK6kA+6B/d5rlUfTrDT6KwHr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:d4:5c:5c:90:32:55:f6:ba:5a:1c:98:40:cf:5d:04:b2:38:eb:c0:52:e5:b7:cb:28:5a:8c:74:c0:7e:01:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DirectWriteForwarder.ni.pdb D:\a\_work\1\s\artifacts\bin\DirectWriteForwarder\Release\netcoreapp3.1\DirectWriteForwarder.pdb

DotNetZip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28d76d7ac169c5b71cca4e3073226f885a2f06720413a11e8db9b7fc08359462
MD5 6a8c8771bd399dd468595bab186c3e88
SHA1 df56e2573396ad8da5998c6aaf89c508f2060a85
SHA512 3e7a0e3b0b182e97e44504c4aa511065ea910a88e88ea849a5977f64dfd64aca6008815a6307e1d82a706b66811ddc5a1234b37c95a80e1a01feaa8b8fdc3d74
SSDEEP 3072:QXsFvbsM5ecgKXnukd2sn8Dhm58yEJEYkbQcHPoOFqvAvIMqUo1SccvdH8UfrxA6:tmE7gX22sGhs2JcjpIN9+8UfrOsWs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

244462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Engine.Win.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 549153cfb08aabeea212d004431ef710e922aebab79d14aaa6db53a42993293b
MD5 bb990ed0f78c4433bf95088be4429a75
SHA1 5583889c284392f007cc2d352b218dd7e42db029
SHA512 621784d2fb5fd9832679628b59c3a790db35608e1c324ff96d098b100f16b53115b7da8556376ffe8afa1f3d29310d718fbb480f4dd0aa0eeefcfc243d8e41e3
SSDEEP 12288:CL43XI03XQnigPCHS/cEYjKbs4OjQ/I51Pq6Cs6YAD/z+87thG:CkoIXQigPJ/clg5kr6s07q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

db:e3:0b:40:67:d3:02:36:8b:4d:29:43:ab:52:fa:e1:50:1a:2f:a5:78:22:c7:89:37:44:6b:55:84:78:23:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

878734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.SqlServer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4c39d8f0fb669e6e337c5f3138f6171b0905cf875a92b0e3253f33955b87b55
MD5 4010a41e4730439275c00c358550393f
SHA1 572a2fb0526523e3669a53264fc51adac70c4ad8
SHA512 5a554c85ea0222c9d96ebe24b2b0730c3974c59389e2fd0672ccd2c99f78b937bc4529151a24cc68357a308d3e9990f09eb854b05466538c422847d9849f84a9
SSDEEP 6144:frmoela3kPuG2p6GeqDmjaVmnSmr/u65oPWtduB6yHtYw:fvelMwu65oqs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

584878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7f8427f0d039ba33d7b414604baec4b62d6dfef9e1f5c078d403e7a04e8dd9b
MD5 ab3c40670c848ac52f32221a7976cedb
SHA1 20a05ff58f34ae9c6b046169e42db3b68b805fb2
SHA512 8e97b78a6ae9590e84b0d06f5a37586893c4c099a99aad2c50a6ea49ea1aae2acd07501d4e6af905a2263cd2a14f743746e18059204d8dff9b19439000cba705
SSDEEP 24576:nhI7iceqhqPP3COtQmJnfylfF6RTazewudnOCJNBZ3tc1D1Q5UGLG16pd4XtwZou:IOm2y5Ea8c1p2fa+wvHo8IryABzw1k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4936030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GUI.Win.deps.json

SHA256 31057e87e93969845fa1e9d9585e7f28859f69a301d3b03c0091aab62c62413a
MD5 9ad72fd35adefee97e45c7d3f4aca4d2
SHA1 36f507f2cdeb0fa168e231a12f16a6182a465887
SHA512 8a3467cf8b05efe30c43da72801729c43592a6279166430e332d2cbd9f20a5de5586c6c046486f64930049e9e544e5e9f0a68b5a2bc7ea08560f2ba8e4ecd505
SSDEEP 3072:/A5fgBS/Rt1Y9Im07R1ARkgT9uextHZqeajAXhKg09p:/Dm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

GUI.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d0a6191da89db05d77088feef99dbfa66111f79a34907be726f9c49569fc4857
MD5 51ec550fb1f0651492dee6d40f99bb7e
SHA1 45e42e268e718cda03adae5f9af77c9c8d8e5d50
SHA512 a2310391c21b0f255a920ba11064cf590247e3c153878298f3ccc8a488ed4fd084b3ab44f3a202b6df265fb3811af99999c4d7cf216ec71ccd64ede49eee6178
SSDEEP 12288:Gw2bFAzeuL9lRC5+Rh2gVS8GZdgdGuJggQT4KJeEyMF5OcRkZBS:Z25AzfC5+RfVodgdzJOOskZ8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c5:7b:2e:01:9a:13:0b:fd:9d:ff:89:bf:bb:8b:2d:32:14:49:45:a8:70:69:76:07:e7:ad:40:18:56:68:d3:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1929614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GUI.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f35cffed9992cf7af5710d8f48dd1ba55b9c16211746e16fa474277ec5e5e1a7
MD5 2ccdd5e34604c7b55df78be8d1977135
SHA1 785dfda116c774afa7270713b1308ad1d8c2d200
SHA512 89947874a3c167b6e1202f338ef084baca5c7f954205f65ecaa0b284e74618058b3b1db0fa8d45fd558746eb278feeedd98320c8b79cd67049af244f511e7049
SSDEEP 3072:imEWPCpf49WhHIDkWMeqoAomvoPdk/kdGYp9i5R3N:Yf49WMkso7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

166014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LICENSE.txt

SHA256 f9524cf8d591c32dc21902590e3182d0d0bef0cb0ba431f91bf6c9d71bd38cfa
MD5 6b1c894157e404adfa2c9168cc1feaf0
SHA1 de643d125afb3f3fbc698c87f125d5a0f64cd73b
SHA512 46ba913816ea8156aa1b676c415b98966ebaad608ce2b2b098d784a8f1b28323a12e47852a9c4f9aea8235854fa922ce3deaa75db790d955fb3c36a728691156
SSDEEP 1536:euu3tHOSJpAg81+XjOFYwT3Jtfefsw1FYwTbjQTfw0:ItHLzR8EOnJ61Ljo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Microsoft.AppCenter.Analytics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac8b2f3785163b38c4473f1aa25616a4616e2fbb29332fe3dd8da9574fc3c4cf
MD5 d4041b4e6cef641e52922aae24358e67
SHA1 03cd00c2094e6747b0bc489f1927d29dae39b5ea
SHA512 728dcee4a9e3909f760edbd6a6e582c6c40162f37cf0c5e61bb092679ef91e47e8e5bdba468c40f24010ae795f6e277ff1c60b9e46bee2dbc94b3d9c6491570a
SSDEEP 384:FHusqPUYyBiwwu9sXZsQb+Jx4veT6pzBcwyWUVMW:FOsqsYb9w7UBcH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.Crashes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ac20df009a8879ff946388741b781b37f8209ac93260ff8a00573376def08be
MD5 389e880efe79f750488feed7fa52b1d2
SHA1 b0a58209ddd87d4ec1240bc1b556889850965148
SHA512 ce378858dd67c8ff7972036db1b558603c0c7bf74b82c0c965fcd039138be3eee08fb729b879a1c66b41d8fab7c70c0a9ad1c8e5c9490c4967cec87b2f62b436
SSDEEP 768:qs8Fis/HebQPbM9z9iDk+gGCHeHGoSMwdevPf:qr1bMvHXlemtde3f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7ddc86b6500a27783071abb2a0769a1f47a7cb78d039642c2126ad1b879cefe
MD5 395ca70f6def000f67ae3334682c3a73
SHA1 5b32bb4f106e490044f8cb95b1da24605e66ffd0
SHA512 a47cde27ec3af919d68f6bba485b24c31b681b3572cc9af9c8df8e46af6d1441d4c5836303c4901f531fdc6e2092c6ecbd28a17b42616e42a0f9a2a9dd46dbec
SSDEEP 3072:O/6mN7KWjKL7gHdJWRYhvoiJVIAQlHvIRQ0OzbXq:cN7PjKL7gHdJWRYD5UHv3ZT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ce9323fc09281f1f8d86d741a594e29f7a9797de0284e1b168b1043c6c9a02
MD5 550c3defa28f7da52cfeb896254d5446
SHA1 9769ad55aee4cfbc94053e885d229ca98d953254
SHA512 264181da5f80966f2b0a76912d496ad55b403f99d31097b258c9ab87d39b41435015b8e702bfceed5f333fac9367f542dd397778504c8ed2a4b4ff4bb3a82370
SSDEEP 6144:3MsCfqudVKjZSkSNw1oxu0LhdkjVsZBwRnIfPk9eG3u9yHcohyz:csCfidSkSNw1otkcG3u9yHc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

299150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.dll

IMPHASH 2750e561997e3d2f8e185972112eba29
SHA256 f21da9fb831ac943736135b6ee109a4b352511b8d6c07cb03c66b61996d1ddc9
MD5 4ff7094e3edfda47ced912012044296b
SHA1 c6f3c9d81713687dc3820d8cabf14c2a32208d27
SHA512 372867bbae96c51ee11b413f552a67a53992b16dbfa44105381db3813e3c2f9a3dc9d16fc6bd6366514d4e1b4bf1eeccce5261bc3df837bf3e3eb5a04446c551
SSDEEP 24576:7Xg0Ff/wSOM0TJuCD0Kbyk3dIf//LXpWhIHWLRDAcc17QXk0:7HHFRKbhdIf/TcIIhk/0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

PE Signature issue

Digest

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 28, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

256480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.pdb

kernel32

GetLastError FreeLibrary WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualQuery VirtualProtect MapViewOfFileEx GetFileSizeEx GetFullPathNameW ExpandEnvironmentStringsW DeviceIoControl WriteFile SetFilePointerEx SetEndOfFile ReadFile GetFileType DeleteFileW VirtualFree VirtualAlloc WideCharToMultiByte SetFileAttributesW GetFileAttributesW MapViewOfFile CreateFileMappingW GetFileSize CreateFileW UnmapViewOfFile CloseHandle MultiByteToWideChar GetSystemInfo DisableThreadLibraryCalls GetTickCount GetEnvironmentVariableW LCMapStringW FormatMessageW LocalFree RaiseException LoadLibraryExW GetProcAddress TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError InterlockedFlushSList RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LocalAlloc GetCurrentThreadId Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateEventW

ole32

CoTaskMemAlloc CoTaskMemFree

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh _free_base free malloc calloc

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-string-l1-1-0

wcsncmp wcscpy_s _wcsdup wcscat_s _wcsicmp _wcsnicmp strcat_s _stricmp strncpy_s towlower wcsncat_s strcpy_s strncmp wcsncpy_s _memicmp

api-ms-win-crt-runtime-l1-1-0

_initterm _errno _crt_atexit _cexit abort __doserrno _execute_onexit_table _initterm_e _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo _seh_filter_dll terminate

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _close _chsize_s __stdio_common_vsnwprintf_s __stdio_common_vfprintf _wfsopen _wfopen_s fread fseek fflush __stdio_common_vswprintf __acrt_iob_func ftell _wsopen_s __stdio_common_vsscanf _open_osfhandle __stdio_common_vswprintf_s _read __stdio_common_vsprintf_s _filelengthi64 fclose _lseeki64 __stdio_common_vsnprintf_s _write

api-ms-win-crt-convert-l1-1-0

atoi wcstoul atol _wtoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _wfullpath _wsplitpath_s _wmakepath_s _fullpath

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

api-ms-win-crt-time-l1-1-0

_time32

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Microsoft.Extensions.Configuration.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9e4bf73dfed3d5aa9ff25780e87109a985cb6e2feab30bea42689cf7d1d4ed1
MD5 542b6ef0d8d600f43cecdaa5fe6a99a5
SHA1 3e5626ab326b8e0a08d48f1347c09eb3a8b1b882
SHA512 4ba7499c2b5cab18d185f63f857f8e94785642b5d0909d2c978b039d8920aadc0401f57ab7603f2ddae396c4c8edff5f56b31de36d24620733c9847f5b3152cd
SSDEEP 192:DMt6XYVhN6y0mb+dXM+4POdTJ6V2fGtbn/PTG/AxXEzRjz6P+M/FbSZbWsKTWM:D+V/6PI+1z8bXTG/ABEzRjz6P+M/Fbk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.Binder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4950a8400717903c28cd5b9562cff761afe5ac3470ab699855a898b29fe8a2e3
MD5 99ed54569b703e903f674ea4eda6c662
SHA1 5c59e3c564b4c057ebc1455cf7bc219b825aa11c
SHA512 fe4937471fee583ee73411eac6e256a622c2f8a10d885e2096546bbc93e393435fbc20d40b3f885f48f48767bfdde906209890e9088318505b10d84a7d4ae7e7
SSDEEP 384:dqnWO8HPEfXZ5PAxmLKRTuVWU28UJjyFygZ7gYU8ud/WiaGWM:dSWO86zgm0qfUTMuY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91be5d8e169d4e809d077108827c041988018f37924c312dcf3c3c77264eaa7c
MD5 d29ef3e603946cdd964ded903c205d62
SHA1 959896475fe1dd758adf857b72bea25cdcd405cd
SHA512 3f82b58932bbe771fd102065399e36822f061c769a211b85661d4b0575cbca90cd18ae92d76101e2219f22bc247a163ba95718a4303a6d43784723437f7b88cc
SSDEEP 384:/dfVJtVnucJYXVJig3xLm+NMsTks7WK4WJeVWWM:FtluT31Ugi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1663be664cb7a7afa5786dc9f071fca8aeac3737fe8e29153f29223c8ab1608f
MD5 1cca6bb1ef856aed16e29b17b92ea225
SHA1 59bcdfef44880db1daf87951619cbc776a22746d
SHA512 6daea2c19e873594e8486ee09ab0cb9d30e4f76a1ba51fd3c2a40ac5c27c870e1e7b533247c17b8386c9016103d1423cd886efbf1256e89ca2a8b99f0d2d57fd
SSDEEP 768:jwd02Ew1NODPOlwlwlwlwlNm/ST5T1yEf:jwd02EacZ/mJz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

32878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21d64f47e3d226854b93ec5b1f94d3b8ecabb0000a5b759decd96507789c307c
MD5 692c5f999645b4e9babc2e830a2534e5
SHA1 da1ce989d55ef32809a4c0471be5ae9e5614e483
SHA512 ee6da0eeb5617b6b0ddb754cdced46a68a4aa95e5127ed94090f3640d4d0df3f003135ca84e5b4870679b0972e3c4f6b8059bd8a9c870ce8c5237cb0930235d7
SSDEEP 1536:CPkLGoLSeeeJHlFDj4aQsxYZiKdD4Zfg+:Q+XHzjeN4ZfD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 971a367da28ccca459fe2f7d755f0cea978310fdd064f6368fb8c8af814d74fd
MD5 613442a0e2cd90d79c3401554b8fba9e
SHA1 380df211e2bada028536a6c55bc8f33495bce1a2
SHA512 ef9a5696774f111a7ec99a6cc96d976e761faee4e128510f278a6f606de3f898413808f4c53cd19d27e83a46a1adef945c60d4bdc41f2aef70f710027c6bac87
SSDEEP 768:qwHqGdhpezbPK/QN8jmN8CduUNxYci62wyq/:T3dv6eAuUocywyi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30f4630b82b19f77abf33c8287cf4a00e8285aa71df1bb3fc05b7abf9026841b
MD5 1649856f9ae8ea8aa53b5aaa04da894d
SHA1 03574a2e9baf4edab20375bbf968228ca717ce8b
SHA512 20dda82a3c9501c7de052c86c09dafe4251042011305a7224bdd7bbf99f7b705cf6f5992f9fc27fdd5526dcbb3fd6caf6fe2128631c769c59fbbd5c639dbfc17
SSDEEP 384:uUNoqS641Wkrb90zrAj1+dOECTEPC5nnAKacrWYrqpWraVWM:uS/SkkrbqxdOEQ3AFchr+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1332dfbef2bb538faed7c85ae6f6c26d64333eed95486e3f81c9f2c1af5b9f33
MD5 e80731180d3f61c207d1e759b5e422fd
SHA1 c9a8989cdb44ae95f6f6404a6618bd001ddf95fe
SHA512 da74e650dbe60705e02882e7877cf0f5e7f08c1a17b3da5cd892b9a66fc06dfc7be8e324c13d8df17f7bc9898f22b399e0e81808c76e1274f70b6b1f58564a82
SSDEEP 768:JmOSgq1fwDct4Ipp8nV485AoX5R9iV+Wml9lblyMbWndaM:O1fwDct4+YJA0R9I+X5bo8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b6ee44d0555b3b49a5bea3cec1ccff14944bc947cf2e119a8670dee84c7ad78
MD5 a5658cc4878088965ef9f46850739a17
SHA1 ae66d1f7ce17650a72adf2f59b80cceda2360a74
SHA512 1e9be8af61815f87000971fc5624f95d0fd18483dc9b5c32470ab7840ab08236cf7da918ab02e3ae89d35cfccf23966305169e8a93502f3d31f313891fa99750
SSDEEP 768:o3/GX+hgQVTGdJS6CPIUqOF0vWusFQaui4m1/LcfJOVwAMxkEg:m/GX+BVTGbfi9qOF0v3sqauiJkJOEx0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0e:2f:1e:b1:81:a8:66:ae:e6:21:7a:ae:98:18:04:d0:18:a6:01:7b:5f:5c:2c:86:de:cc:c7:45:35:70:02:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

34190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Toolkit.Uwp.Notifications.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b14999bfdbb2a55f335ed3e9da022a73e9ff6e96ba341ffef22637a6f1826188
MD5 71829de02b099241bad4ef0efba785cf
SHA1 625aca08f1b7020456303794543cc669853003a3
SHA512 dc5248ec12ff04db6722d6640ce2eab8dbf154ceaecbcb5f473e4ca869f60ada4bd136d849db82524743c652f2bb27d08870d28e2d54977c717b73fc853d6557
SSDEEP 1536:I3FYVCl7jqFaTsU6+QFBwkGKXX/3+fibJ+zGgr6j0tdISOUpUfZ:ooClnxsU6+QFtxXX/3+2+3r/c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a8:a5:6f:e0:19:7c:75:8d:62:66:2b:14:a6:cc:fd:85:59:5d:68:92:91:b7:62:e7:c1:3c:d2:db:5e:d0:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Chains

Aug 12, 2020

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Serial Number

0e:71:58:6e:7d:8a:28:36:54:3d:5e:15:d2:b4:5d:e4

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 11, 2018 - Jun 15, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

109974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Microsoft.Toolkit.Uwp.Notifications/obj/Release/netcoreapp3.0/Microsoft.Toolkit.Uwp.Notifications.pdb

Microsoft.VisualBasic.Core.dll

SHA256 e0864f46e0f0ca66143b43c12a4b37dbe2fbe8fd138d5da59326fd632d6a3571
MD5 4ca0c139b698ff4b1a4fbaf653d8b607
SHA1 4881028e15d3fe3e52a6e0e8a10a3d926f3400d3
SHA512 db0e1eea47f75bde5427234888d88829fb184e31be0aefcf687e2dd4e351d9daa7cd5fdc5457ac445f17c5f784f4602f48fa8f49faa2c22c511729c5f550b93f
SSDEEP 24576:92o6FIAG8DgwIB0RLQh71gPOpxEDoQt7g8m:f6FjDgwAps2Itto
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:e2:c1:63:bc:69:df:61:1d:7e:fa:fc:f8:d6:62:f7:2d:79:1a:c8:da:00:2f:6f:49:16:cd:5c:96:7d:8e:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.Core.ni.pdb Microsoft.VisualBasic.Core.pdb

Microsoft.VisualBasic.dll

SHA256 89896b1dfdac9c395ef24e7e032f9b746ccc331bc0c9d791de3e5d2b357f1185
MD5 54427033e0d65a39722a76e07e430eb8
SHA1 7b83a4fe9997310c77aeaa5868b01b2b5a7b7c84
SHA512 b6304ec9042eee9d4c9e5f866fe9fa92582fe24dd3ba8f82374a17a7b87cc84e5f9608149269cc4c8e64cdc2c7b5ad7ac228070fe5cdd66da5b3bb9f00dfcb19
SSDEEP 384:JxWmH6L9QKWwQ3cgznLIqddm7HRN7d7EHR9zcIX:Y5QMgznLIkKd7Ex9zH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c2:b3:d2:9f:88:41:0d:3f:2c:f7:2c:87:ac:f0:24:2d:67:d0:8c:e9:45:d1:85:52:41:ce:e7:5b:4b:c1:ac:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.ni.pdb Microsoft.VisualBasic.pdb

Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 85c9a4fac07761d259bd91c669e4e1c10cf79d0939e64ee96e32abdcce51c86c
MD5 8607bdfc638e4fa1d8e716486a9c6475
SHA1 9e246a9f462097de2b3b2472950eb6273e874efc
SHA512 91314554e0937194f74c802c695090582e9a6b857da72026ccf5432f5ad960547b4f4e2235f0a56108a63cbb40d60fb7d7bbb30b39f1851606a09bcf34371c5a
SSDEEP 96:/0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+qxv87xbO+XDS8PODxVWhPIeWE:8spQgrpnkeQwRUOKlxEdr50WhPIeW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1af18aa247c88bdfa1dbee361b6b901e541c0f7a0c1c31336d65ed5176b13e39
MD5 47c158136040881155f35b4877460849
SHA1 a60ab328c456cdcb7f71e14358a0ac202287a534
SHA512 14ff78a7029229c046117afc1292c3a4712dc3a4e3c4ce735781deab842b41a9bbb5fb516f19eb614299199074bc1da583d903bc08dacda6b8eb969f1bb78525
SSDEEP 96:MUhxTU0KDgJtLuWcL1v8Pcir4c2+qR3nsluxvbo+mDmDBEbKWFF3a9wxW:MOKDYrcL1cc1UsXxhfWFlscW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d72bbe2fe0fbc2177dd211308ae7331504ba0317aae60761e94817dc8856580a
MD5 90ce1c7910d0f504b2e3787e1ba199f1
SHA1 3acb3b6dec3b9c51e887f6a750035357bea5ee5e
SHA512 da7f23717e9341565d36bfaa90ec1e37d7d1ec59df91e495c607d404b00324d7e1c8d216e7adb64ba4bf7973888342098debbb8b8a4a95019200e1735b5204d5
SSDEEP 768:anNkMiBZdxRhmlhOPXwYMIKNwqSAVi2jsd/v:qkBZFhmlMPXJpkIAViWs5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.SystemEvents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f05110e122fa7c73ac3571b82a0bfd5a8462a4b42b0b945c4f901928a29f3fc
MD5 fa51d1d280c2114a1de24feb9be14a32
SHA1 aa0916a3b709e2a19b7d3a55d2fdcb9cac333f88
SHA512 25c35857c79e03538825ccd6b87cee1d4a569d871889fd256fa413d69585a8e50340a0ececcf1824cac4ea976e15a3eff6ab367b0c4846f66593e0f67d233921
SSDEEP 768:Q8lYXXu7a7jtvp4VM7/9f+5KOo4KD2lJzPIsFPbPDT+9NWIc5YlL3qj:QyYXXu7a7jtvp4VM7/tSKO3KD8IsFr+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ea613cfa8e489c15d44bc1360e11be1d321de2d0327386df657425db4ebd847
MD5 2520a5a2506531cf6f8b4f2a733957bb
SHA1 202e824c042d89400c856a64624db4bd98e51f52
SHA512 8a95c483023177a8a88a1ebcdf8e00577f14a7b8603b722896ba1c714b2cc10477a74a0ff0bf7ffb70aba7e51327e54d07ee5dff6bfaffbb0ef51f08fe9adfac
SSDEEP 768:jOwA4HYdvQRXNJThTFYZSRcxEpZL5BWo1J8Bm5LhPUEfTZ75QluC9cjQvU+FlsLv:jOJ8PXNB5FZPL5BmBi8Ex+lbjkv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 839a8f2b052dadd685a7222f69c42c11edf9f1e06964dfddec61320e9f359a98
MD5 94b6fa3995eb2ba34afa532b9fab39a9
SHA1 42480243477d813498bd83839cd16f6b7b828e96
SHA512 3bc4eeead6053cbf09d48297b75e270117b52562ba21a71d8163e7dc932f02c837fed47a813d6dd3efd43812faf1c9cd934e43bd482d8664fbc5191437bb6d90
SSDEEP 48:6xJk1fkEdDhOGGmntavItLNMwxLFvLmehCZutd22JMKM6ER5MtR5MPTHX:4SkEdDaOXv3Jv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NamedPipeServerStream.NetFrameworkVersion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 463e1a53996e8de4d2ff2a7b3919e24358c1895da120060d32c1bf4f9462bc83
MD5 f8d4f30967bf2a130721f2ebc084cc7a
SHA1 14d81ae3e20c321636262cfca5c2fd6caa59fb9c
SHA512 a9cdf2ae64e408349e321a69fe609f7b9e7d14505468c9d986bf46fd9ac77d5c79bb14eefe67f6b977705150a2787a41b74e685545240d7d60c524b3bfbbcbca
SSDEEP 768:g/VWCKBOs3a0k/c6sYB3zYD0DvlRGh/D/QPi:6WXBK0c13Bu/Ai
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netlib.dll

IMPHASH f68acbcd9b68ea2a855ac109b1fca5e9
SHA256 9b33915254ff7c566937b73c0c98e579547fd50b65e4483277159d5c7eb44549
MD5 822cc56add5d97691b993f64b11f9847
SHA1 42b92efd9348f2306315274e34827953b8b26814
SHA512 a3c2e95bddeec26ae516e3b0cfa69a44ccd22f3930a692dd6e90fd4869676f5213781bc5523c15534eaaf3be5a949be07c0f5da4d6b2edf762b457363528f97e
SSDEEP 3072:GoC7RcDXGZYcS+sWv42+qct9iywOw174uXl8N:jc8uS+V42HcT/CXeN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Netlib.pdb

fwpuclnt

FwpmSubLayerAdd0 FwpmEngineClose0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmEngineOpen0 FwpmFilterGetByKey0 FwpmSubLayerDeleteByKey0 FwpmGetAppIdFromFileName0

ws2_32

htonl inet_pton inet_addr

iphlpapi

ConvertInterfaceIndexToLuid

rasapi32

RasGetEntryDialParamsW RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryPropertiesW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW

kernel32

WriteConsoleW CreateFileW DecodePointer HeapSize GetStringTypeW SetFilePointerEx SetStdHandle GetConsoleMode CloseHandle TlsAlloc GetConsoleOutputCP WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetOEMCP TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetCPInfo

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74deaa342747cf77f6efac6bee1cb6da2e7fa31988b3f1304eb1d01d621ba4ee
MD5 3c88cafb11eb9ee403dc2980edfaed36
SHA1 b9664b423200e28882a8e543cfdb8bca5ebe25de
SHA512 c5044bcc98bbb639c40cac5b5333c890feb4afb2d54b55d5d702ee7f83d86d3aa329303f88c70683f89658d7fca279104bd2c94ef3641a6fde522716c8365dd6
SSDEEP 12288:7QXc8tdRz3R5TzIQ/cVEfH9LbCtubHkttbXBfGpYoC:kXX33R54Q/XbCtuWhXBfGpYoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

688574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14e949e8c2eff5bc7afda30804bdab15e293fde2c9f573c8d52ece54bb21c2a0
MD5 49add3e0dae1181cffc0d4dcde4e9502
SHA1 d2941dd7672b7e1d20ffe3d70dad84a71fb33852
SHA512 daa90a6db7cc28f4759deb2ffd3dd8c8f981839a8cca1299ebd558b41488ab0d9c56bda336396e7c6f46af192ca0fb02afb5851b66c65c47e3e39604fcdbf8d4
SSDEEP 384:iHd+/aJB+7+atTbuKE6CY+CTbkKM5E9P7EljEeDFkoFhx:i9SSaJ6KEpdBdrzx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Coordination.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe34dfb558d65d8b072f466021a0d15de8d202513b1f13a7b45ffc3e9125b588
MD5 805c7a0a6c838cd2e96b402417638ee9
SHA1 843ae9a6129c73f17df1a91ec09c4ac2a06099c6
SHA512 ccd6383841af4188b448d1ba153672b5861814ea8570d29ced77cffc10346c403a6f37bbf2d003b705f7a50a9c008e3a5e45a6bc30f617d9a34f64e0bc103e55
SSDEEP 768:m5MwEXdl+dbSMyWJ9TFOOo8pufD1oq2UcgFixdHGIcxCJVENySzWi+G:m5MIOEwJoDU1ixdCa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Interop.WaitHandles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f6c3af2124d0a7385ec595093062ae203573167332473c0dd6af323a8010190
MD5 a4a934cb7cda9fe457e751f43946b47d
SHA1 4cce8c0d38247450b158de3abd320003da9a4844
SHA512 15862a759007cf6211e0062e5257468e86f99868901c6565c08e6c401f9035ee86e2e639ceb8843ed4162adff35b3048c222948565a46e1df25b604254d9aa2f
SSDEEP 96:QH+IoX50CwqlKA2ANwIIv/GWnNwAh4TqBQBT+mu2hDOLFio1Xr5vKDAl:QpovZz9cGWiwBOa2hDOLFiWVl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Oop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75a30af7c9e46e45e6c2b11a8284d5eaf681b8d71e531200d4b480fc66b0f65e
MD5 73c77e64e8e1f0f010fc4158a1a7060f
SHA1 ed7a2e982f5475d4479467aa248e1e6cc4adb455
SHA512 0fbfa1d573da283c5898e9222349c523cb9c8b22f650af24b6980ab9202249020ee74e079acb6ed9ea3c1a74debef2aa70d33448d1012fc66868fe2f8db32c77
SSDEEP 96:zfaZaAMFhVyhCEvX7O+pqCbS0X1V0TzCw1:TAQ7QX/KCqz8eF1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edef045c965f1dc14805cd66e2a0b2cae2bb34aa2c8e80468f34c34446906d0d
MD5 17f57e0d9b7c5cc602553301cd7b1607
SHA1 cd7567d67967684e72ba10d24c47e3d5c0eaedbd
SHA512 759fcc7914add3c80080c6ed9da94e9fa5e2af91752f5d7846b8cf01cc261b1eb76ba59188b1391d04a61f7ffffab7b68e0d8ce3f4b5b81fc4ff53c4aed78bef
SSDEEP 384:ardaj8E2h7/D8tg1a3FLF/pNw2QNmtMdIDToMiOrS6U07dYdt0EYP8R0OekBVg2B:Jj8E6oflfOtdgTo+/Ugd6R0UVk4m6z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Cancellation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f905ec7901dd2b3e59ec23142518996769b3c6916075776319a1c960fbddef08
MD5 df073384d167ac9baf66b991ecd6df79
SHA1 1278cb3cb7fbca5736fc386ff5e72053c6eb0f28
SHA512 5d06ca462cdcfbf4223c1b354c3578a8074e15ce850b91861f642c1d9cb29ad31fff9c16144dd2e34c289788b678296a7fc3a664c4b27e655d39415923432330
SSDEEP 192:VE6Vnko3LO0Gnr1CPkjMD1oE8jEXXwgRh:VHHO3nWkjMD1oE8jEXgah
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Collections.Deque.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 570f6df8ea487a9977c23cca5ce9ae582f645f057015ef779bb1c75afc208052
MD5 f37027e4b63b3f6468fd37332684d105
SHA1 68c3e376ba053990875dabf222fbb320b2495a8d
SHA512 ca8c0eb8a5b884d015131de216d97045a5b7e7ab457901db231b28a289d829803adfe18f58ccd26b153ebff64bb542cc8a7cf0c5f628e7108aa02196933461d5
SSDEEP 384:WRLkjeUXeOVXGAUbDYNt93FLr+hK9oY7W++wj8a7WwF5LMmXU5rGoMjnJX6eP6+3:WNOVYbo93FLr+gnEz01/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Disposables.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36be2376633d785adec9031ea49b2f578f50d5d2c74babf86f44566b903b4197
MD5 e4f25b163ce2b0cfdd30e22d2fed7e07
SHA1 16ca226a1380d219ba511a872eaea47c51818d76
SHA512 5afb2c7b8aaf67eb40964bb0fecd50a9522aeedbe18fcaa3fa02c7305ac3815f49a1e17732fa6a3f08f79507b0f2e19e1bb3cd0246ec3c95a247f7c789c3deec
SSDEEP 192:w3zvRqpaQjjXdct0MDxRYJEHrlBqw16ho:Qzv4LAuJExf8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PasswordExtension.Win.deps.json

SHA256 7b34d7ea90a9664a8f6370c3b0e98ac3114eb96f0ee9edab6c669d86c2c3cdc1
MD5 cb9268125c592ca792954257032bd7ec
SHA1 6b2f1f5b425639aabc73dd0c0b119a1a51fe5549
SHA512 0ed3ac6039d742768ad3eeede207d96abb393780a431330cca8c27561a8dc79777ed11174890513ba7ef71cefe79cb1e3e54e7dab11b9208cedfb754b2ef389b
SSDEEP 3072:dsA5agPSxot1Y9Im07R1ARkgT9ueGtHZqeag6K7gn9U:a9W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

PasswordExtension.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 52406c2925c8579d86b54e340213cf3c751d13956cb1185624353ddff9cbd750
MD5 136e8316a820b71b0e6fcf783fbfdd11
SHA1 d1c4ca05d8628dffdecb42f1ba72f77649063c73
SHA512 4023f272c27237c8440a51fa5ce73b0785b69b1e69e63483249fe6a096fa25ccecf37b8be0fd4445008bb83b7b7c00d373b14b017780b3c662676181e6fff25b
SSDEEP 1536:SkYuTKG4tSaSsqnOcizwuAyZEpjZgxM9Na6WATrKpRF1EjniN7gmFOXrhOLvgq9Y:xYpxgfnqXZEpjZgxM9NZWATrKpRF1Ej9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

76:01:98:dc:ee:de:4a:2e:de:74:94:b9:81:12:b2:f1:e6:af:20:e9:8c:89:7f:6d:3f:b1:1f:32:d9:42:5f:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

82206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PasswordExtension.Win.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 d4dfa260d8b77a72546d38e42b3eb91de5bf78ce3c578f1e4cffb65e0226bbd8
MD5 7ffef817a5aec60afdadf17b6de7b4f7
SHA1 d5be7333f8dc54057f01d13e73258d42f3b4e5d1
SHA512 e1eae28cd9ed312428609a13e5cdf73d6189e5497db9ec6ee869f12001a5faaa5b5eb4d7273eaefff3bab170e55ae9fde70238b666d09d24bfd8f60c62ea2e48
SSDEEP 6144:gQPq1nKLOxCM4A2Xv2yL9Xhaz00/YbA2MfMPb0VBnkAIYf0Rq:ghl0Mw/Yf0Rq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4b:dd:0d:1a:c9:3e:52:57:5c:9c:2c:d6:0a:e8:85:95:22:e1:9d:04:21:58:9c:3b:f0:1f:0b:c3:2d:2c:0c:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

PasswordExtension.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

PenImc_cor3.dll

IMPHASH 897d4b325f4d1ecbf05e1d417468dc0f
SHA256 3002b51d51172b402fdb20cb6f87a6c9c0abe8a4a8feab3d2bc4b82f1216e5e9
MD5 7560e528fcc8df6c4d4bbd86e0749c0d
SHA1 df3fee25640fb715b7ec590aba394e0457a612de
SHA512 c1871aa76e7ab34ab0e0a7ad9540b306ee45bded1e0e5cb0c9f031da6f69f057d34e0b4a386a0d1e31aab8ba17bd2e0d564e327b828e33dc4eb828eaf00b0a81
SSDEEP 3072:9/TNcQAdQk1RaV6tS/vfAcdtMUqfY4AvdhFXk:UQA+QSPATLA0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1e:8b:ae:78:77:81:91:fb:d5:1b:b9:f6:e9:be:e5:60:4a:b0:05:5e:ea:ec:21:fd:2a:3b:5a:30:f9:ad:68:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

6

Entry point

68928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PenImc\Win32\Release\PenImc_cor3.pdb

kernel32

GetThreadLocale SetThreadLocale DeleteCriticalSection DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateEventW GetCurrentProcessId OpenEventW OpenMutexW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetEvent LocalFree SignalObjectAndWait IsWow64Process GetCurrentProcess OutputDebugStringW CreateMutexW CreateThread QueueUserAPC SetWaitableTimer CancelWaitableTimer CreateActCtxW ActivateActCtx VerSetConditionMask LoadLibraryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedFlushSList TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CreateWaitableTimerW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind GetCurrentThreadId

user32

MsgWaitForMultipleObjectsEx CharNextW GetWindowRect EqualRect CallNextHookEx IsWindow SetWindowsHookExW MonitorFromWindow GetParent GetDesktopWindow GetWindowThreadProcessId PeekMessageW GetMonitorInfoW UnhookWindowsHookEx GetSystemMetrics GetWindow

advapi32

ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW

ole32

CoLockObjectExternal CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoGetApartmentType

oleaut32

SysStringLen RegisterTypeLi SysFreeString LoadTypeLi SysAllocString VarUI4FromStr UnRegisterTypeLi

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncpy_s wcscat_s wcscpy_s memset wcsncmp

api-ms-win-crt-heap-l1-1-0

_recalloc realloc calloc free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table abort _invalid_parameter_noinfo _errno _initterm_e _initterm _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _seh_filter_dll _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

rpcrt4

CStdStubBuffer_AddRef IUnknown_Release_Proxy NdrDllUnregisterProxy NdrOleFree CStdStubBuffer_DebugServerQueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_Invoke CStdStubBuffer_QueryInterface NdrOleAllocate CStdStubBuffer_DebugServerRelease NdrDllRegisterProxy NdrDllGetClassObject CStdStubBuffer_Disconnect IUnknown_QueryInterface_Proxy CStdStubBuffer_IsIIDSupported NdrDllCanUnloadNow CStdStubBuffer_Connect NdrCStdStubBuffer_Release CStdStubBuffer_CountRefs

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PresentationCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9a711c29f615b2f292851650cb12cd64b6074913c29125ffc399ed760c853ad3
MD5 00bd4ac73d8c20b14e9887f45454e381
SHA1 a24ac293000375ca862376b5d397a0c3b2911067
SHA512 db32923fec19ec450b21e8b2380d06bcf9d562ee05559c53ba47c208d91d89ebe1fb0492329ba6ef072c47ce4c65fe8e7673dbd16307fc74e2c4a7e67d25ad9e
SSDEEP 49152:X1BB4con0YW9r81922/V6nOrB89rXintYP2H5msUIc4:FBB4cg0Yqc922/V2F
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3415742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ec952a95cb5f7102bd63c59dfdd0491b7948287f2c64d75a57cbb3ea5ffc89c
MD5 3d59b212dff3c0fa45214c6291a9a330
SHA1 87311de58423e64b75a91b6319e2a4ae666e011c
SHA512 bcbda26622427ecf3a6906821c8d74a97d180adcae6ca168bca73774a898e65f80b10824a1cdd1a578b533d1f3e4a9c2f64417f7e68d7727e70ab315e8b6e1ee
SSDEEP 96:18eLal55RmWyfkmgE5/a4Mr+A5onJY7h2mziS+Df0v3sGK1NQcXP+3zkuGD/D6W1:TKzFyDCK8onJAZv+bR7f+3dWEc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemData.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 92abd19ddce03e86f9c884325f615976d7578a5b4d9607d9871290a588c9e809
MD5 dff4cee2431337eeea633854d81fc38d
SHA1 eb138c089ea3da756c847cfaaac595586734a098
SHA512 adfb1077cad4308a4547e8cce9d489c3c4822595feeefe1cd54ea716d77ad5952101c51807fd4a2413a7938f6268c8aea12e129e05731d69006fba2a68cef8ec
SSDEEP 192:daA9pDysNjR05zgo5f80zup/WKZWbzPWks:9bPRRvo5kaVK0Wks
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemDrawing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a167a15ce94ebdf4c627fb651e05c694fadeb6bb00e5814db13b2e7dd33cbeb
MD5 9dd4e7e817c6c220f7abe2db522a9578
SHA1 0671ebba04cf1a4b003f821cb43dd159b3373b2e
SHA512 33a5fd207225c54710c027ce966f7abbf3a3c91622c68cdc4f8efa99a5e6f5ae6f3eaa98edeb894779ca3d383e08de804c5da6ebaaece17ad47e2cf515decd36
SSDEEP 96:TMF4vTAt+hsY5RypreziMit/ziozRoNH7+sGD/D6HY+Ub7W5b:IF479urqJK9RoNHSdW5b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e63047da788d63ba9967157fab4a441bc83bab628e00abf6dd044e5d1969688
MD5 f9ab7399b269797a093d268b1a71bac5
SHA1 6263304ea5c307c54ef35479aeb6d1564036b928
SHA512 3442a2a8b8af5960a2aa4a4db1771ccd4f5cf48da4eb7364b1c8ce9bd465ea20defdb1ba5aedd59dcdc7efd60db92f3ffc417ffd6d837b8e6db4c71ed3f8270f
SSDEEP 192:gpZRDlQ/LIw+zsT1tTTtfDo++DGjITBYWNH:gpDh+L3+Ut1fDo4jITBYWNH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXmlLinq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d9bb8146142744b5514ac1ad82306961cf594b6f0b75adcbdb61241d2e02d76
MD5 a0a471e2ca1ab5cdb84165223aa1ac93
SHA1 9190b6b20445bb109aea2bd135d11103c8f71306
SHA512 5b4a5892ab3323138bd455b626d2ec540c73eae89c2aa4b3b639ba1e6d9946c50d557f5059483c71b6def344a9d31c4ade9026f049358c5ebfcd43b487f178bc
SSDEEP 96:n6w2ETNHQziY1qGuuTxWzGD/D6s2Y+Ub7Wp7:n6wfH0t1qGuuTxWwjWp7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 54411e1de691917d2ff59be6551af95fa3a20556e5f8058bcf49b0cc1bcf68f6
MD5 74026ffe0933b4afe3fe8810e950763d
SHA1 b8813272fd54b2f67e65715f4b7374568dca163a
SHA512 8887dd784d071b6b28f0e54ef0dba9488a741f2c109d46aa5d074121aa5c7d1f1ca2e79aefab8b53f7de9a7369352853c6f5ec6aadcb5b068c94da69017a7e78
SSDEEP 3072:ihFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZW8WUnkXFuW6xu5FyTMR:/aojguW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

241534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 24e62ac897f6af99631940184a2d26e1f18d6949dc2a1b00fef5a5fe9d98b37c
MD5 59fff35603af5369086a2dcc69517236
SHA1 b03b644518e87b234bdc488daa7567d380e74c6c
SHA512 f7484b2aa9acbc2934723077e46a77f6930918ef8bd5f4c93e75f2322fc135089464d56504c29a769c393174e6e03d8323e1319d632626417e2949cd50af377f
SSDEEP 3072:QhFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZPGUnVHiFcAaQImTTl:haSUnVEPaQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

247598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.AeroLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 82c55e4e8d7c81cbacea3b7042a3bd6ceb7064b66bfa3d63477784b01e02a609
MD5 2a37a62d650f02344025a450e343bd1f
SHA1 c65d91b21db6823ae36273712e01d4bee1a019a6
SHA512 5460b87607ea14f5652b468e4b2d61fb8960f8d31d6b9cbf275cf9fe9b99e3d59396ba3c3c2baf1111d574fff92ed3328ffc1404933b505c8f5e34d473600d0d
SSDEEP 1536:QoauV8x9p/uvS++D1k9T7DwVNSPoV66yEKMtqWC6XOz9MFhpLBS+FN6LsbPCXbPp:QoauSr0K9K2SwFhZStsk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

173662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Classic.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e061162ee7263fdfc72db682b71e220e8108f1c523dbf634ef630a2393522535
MD5 7bf91a2c218036feb7f66c043d12bfb0
SHA1 ab29704c24f7b394ddc716f17d9bbcf97ba151a9
SHA512 61cc8a77cf28daf38f9b782f8fa1e914f310f9ad16adc7d6af8ac49708a12b97164304ecaa370cb5b3c4a73677584059ca77a636d3ded9c672cb91f6181ff53f
SSDEEP 1536:9txgsnh7pkcLCX4fSFl5UXEUlFCpHVpltqznYqafevHnfFtJxN5zJf81OSmOHOLF:7x3h9cXxFlquptRHU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

183422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Luna.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 737477e6150f9f5fb6b63456883df87b5cc0ec59ddc75de8c8cf69749ef41229
MD5 28c01af7048caa566bc544843e666b14
SHA1 362be72687fb1e98e5669a17230efdf5c6e393ab
SHA512 78a910c1e616e5d9a5e9d8aa9307ddd00879efe452adbc0b69c541ab0adcec9c9a8825e1cdaba4d7b0deef6f127f20cae589cdb771583ad84c5f13df2a788dd4
SSDEEP 3072:Uepl3sO85wLbfp3G/uqv2tXFq278biT2SmDu1vqylFYNrySbjJfrLqiuqvOfmFqZ:tnfQ/uqQB7Miahu1puryejxrruqfd77
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

492686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Royale.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 105a980b2fcbd8fbc3262b87a5d97890f8612158f95f9cbffa23b238e0acc729
MD5 b576e7f9cebd41b158174153d91fe0db
SHA1 84d7c508b3ad1646bbf5b5fb6e2f249db5723188
SHA512 99a14743bafb174b85fc4062ae21fef86a689dc5ff0cc7435784abcf6d5245430b7634e8141695c4dee5600a3e086633c1ae363fe4296a81d05c76dfdd44a31e
SSDEEP 1536:MgSAnQHC9yhfbLH3zPvcut4Xs892JXcfMChHhvG0gd8LxmEEbk0qdBw3jFdENYGK:MgSAQHUILvK96Xcfb81vFdqhGkdg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

204750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 73e08d9f4afc20be63c3309c6aec1b840df189f9c22018a7b44665184004d1da
MD5 03c9a4de00b3f8835146b5a364ecd065
SHA1 d390564ace7f72818f69c9b0d9eb58c1ab8fd182
SHA512 2e5217b52a61b966acc233091f44cecf97b8703a5ec77fcab10f9467505d5da209199b47959f1383ad4f6d8c6aefbcf2ce8e7fa33fda04f2cb9f428a58e0c611
SSDEEP 49152:OBf1XN6xcqFQaU4LxamTnQ5iw3AJzGpEUzbH/loQcI1fDyqzO:OBfFN6xRFQaJWpb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5802638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationNative_cor3.dll

IMPHASH 1ba17ed539f0828d6eb789fa20855dd9
SHA256 5a71ba70796a1d679ba83f28cfe0cdd44eaa1778e2084cc6bf2785682e6d9447
MD5 80df7c9c106dcbb1d7ee2cacfca143cd
SHA1 997c002394d0c7e818bd3068a26afa2dbf6beb58
SHA512 81911a29b4e21302414ea632a2ce6ba58fd6b889ca202f5a73f582a5e8dbe9f473a593ad19230b97fc2c37e5654d7026b7915183c357f302dd75a388a7b205f3
SSDEEP 24576:1FDj94E+ReeC/xOFX/yQv6QjLDWnL+pzfqPa25ljGVgH+ZPZQlEA:1Fj94E+ReewyPyQCQTwAzqPaylA1OlD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

48:14:cc:e4:73:d9:ea:d8:18:98:f1:c7:60:a4:63:28:fe:df:ca:7a:1e:32:7d:0a:6e:40:c5:ca:b8:35:fd:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 26, 2024

Minor OS version

0

Major OS version

6

Entry point

5568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PresentationNative\Win32\Release\PresentationNative_cor3.pdb

kernel32

TerminateProcess IsProcessorFeaturePresent LoadLibraryW GetProcAddress VerSetConditionMask SetUnhandledExceptionFilter GetProcessHeap HeapAlloc HeapFree HeapReAlloc UnhandledExceptionFilter GetCurrentProcess DeleteCriticalSection DisableThreadLibraryCalls FreeLibrary InitializeCriticalSection OutputDebugStringW GetCurrentThread TerminateThread InitializeCriticalSectionEx GlobalDeleteAtom OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection RaiseException InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError GetLastError

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit abort terminate

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct wcsncmp strcpy_s memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

ntdll

NtQuerySystemInformation DbgPrintEx DbgPrompt DbgBreakPoint RtlUnwind

user32

GetMenuBarInfo SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongW GetWindow GetParent GetKeyboardLayoutList GetAncestor FindWindowExW EnableWindow

gdi32

GetTextExtentPoint32W

ole32

CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString VariantInit VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper

PresentationUI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b77e0b332b763360827c9d76371015cb50b46ce1a611e5ececfa0601c6ff94e9
MD5 4af1178bebfd8b52ff646b10130d7057
SHA1 91685be41b4e616c6b0cb480b52b9eaa951b65f5
SHA512 b62bb3aac73ae66c8d8e632d4d02384ae2281d68ec259f54cb71dee784bab4f11fa4d548bc6ba44e3e2d964be427c36d6d58585e8fb97b2fc68b356ba2090dd8
SSDEEP 6144:qJEFeOBKsz8cSUvVBjtTWPGgoDTcS/TXIjVQfoVGd3HyG2KusN2qoKl4vVIL9Ioa:1FTJwwGlyTcssQfoVGd3HyGNuwU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

834046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PropertyChanged.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52ec64563ea08f61ef3f568699fd8a66eb5e532d5f7fc342ad46a69ccdf81ae3
MD5 4826da1d501c41bf5869823d4540cbab
SHA1 311cabfeb0aeeeda3495af1f529e5427b0241a14
SHA512 ba7475503aabb5b602ab1d748cf5ff4e55fb3a6d0ea3b67dc3c1d6142c9f87f88e814b9cd819f66cdcf2c387b3e79cddd1314a6c32906e9e71c0ce0d93ca202f
SSDEEP 96:SI/1qHR6SLIrUVGYK5wVWRyLdYag/GDC5F9:Si1qHRnkgVGneVWRyJaB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertychanged\PropertyChanged\obj\Release\netstandard2.0\PropertyChanged.pdb

ProtectedAPC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7f836ca5ba7b282712c7e5972855cca616d53956b144be1576f83ea44be9743
MD5 ec918ed1f2f603ba94a2507227d39f26
SHA1 ecad966014ff84d553203ae02a84b8e23e225550
SHA512 f2fe12e9f7c81aa25122b0c28e90366a8d23170e476f644d111b602417ba5d531a6c6de5a7e0c9b37fc68f86154f9ae82bcd3a69aa1454e25f24a86526815524
SSDEEP 384:SLm5VUtFAhV707OF7GH1CPBMmvjztR5mDzqQzfDeIw2kPtWa:koVUtFGFCH1OBlvjztREeYdwlPtWa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

27758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ProtocolFilters.dll

IMPHASH 0c3f6577c4dea6e1634d3e32a034907a
SHA256 7311adbd771f2b23eda9115f7d9a8264d97dbf116af1cde8966643785b130b17
MD5 0fb2984e68bd1d957a8cadb52eb5e87d
SHA1 8e77e76d9691064aa9b059d4164b7da91dfd8ce2
SHA512 9167e4f05e97fd24f6185a047e297974b35d79a59b40026052b0c7ea25faebb1de422ce1b907eaf24ba6610b71578b80bd3ef3f1654d60fd0e2665324c62c351
SSDEEP 12288:PBELhX3eiRFvy4z6uZxE+j7tWZmTgmkMVeJDi9LPDMwn4jzpp7U7RwM5xXrMkmHG:JoKcxEWtWZmLVegBnKX/Mg4OOFf2Taqy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

d4:84:e8:ea:6c:f6:ce:bc:d6:49:30:8c:47:03:bd:e3:34:c1:9f:ba:ed:82:7f:9d:b7:2e:89:0d:32:5d:ce:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

358094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_c_api\win32\protocolfilters.pdb

kernel32

ProcessIdToSessionId FreeLibrary GetVersion LoadLibraryA CreateEventA CreateMutexA SetEvent GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection OpenProcess QueryPerformanceFrequency QueryPerformanceCounter GetTempFileNameW CreateProcessW WaitForSingleObject LeaveCriticalSection EnterCriticalSection CloseHandle GetShortPathNameW FindNextFileW FindFirstFileW FindClose GetProcAddress ExpandEnvironmentStringsW SetConsoleCtrlHandler LoadLibraryW OutputDebugStringW CreateFileW WriteConsoleW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA FlushFileBuffers HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess SetStdHandle GetCurrentProcessId GetModuleFileNameW GetConsoleCP WideCharToMultiByte WriteFile GetFileType GetStdHandle SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThread CreateSemaphoreW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter FatalAppExitA InitializeCriticalSectionAndSpinCount GetCommandLineA GetSystemTimeAsFileTime LoadLibraryExW ExitThread GetCurrentThreadId CreateThread HeapReAlloc GetProcessHeap HeapFree HeapAlloc SetEndOfFile GetTempPathA DecodePointer EncodePointer ReadFile MultiByteToWideChar IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind RaiseException InterlockedExchange Sleep GetFileAttributesExW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation LookupAccountSidA LookupAccountSidW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegEnumKeyExW

crypt32

CertCloseStore CertFreeCertificateContext CertAddEncodedCertificateToStore CertEnumCertificatesInStore CertSetCertificateContextProperty CertOpenSystemStoreA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertFindCertificateInStore CertAddCertificateContextToStore CertOpenStore PFXExportCertStoreEx

libssl-1_1

SSL_set_accept_state SSL_set_connect_state TLS_client_method TLS_server_method SSL_free SSL_new SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_default_passwd_cb SSL_CTX_use_certificate SSL_CTX_use_PrivateKey SSL_set_bio SSL_CTX_free SSL_CTX_new SSL_CTX_set_options SSL_get_session SSL_version SSL_get_shutdown SSL_shutdown SSL_renegotiate_pending SSL_renegotiate SSL_do_handshake SSL_get_ciphers SSL_get_error SSL_CTX_callback_ctrl SSL_CTX_ctrl SSL_ctrl SSL_write SSL_read SSL_connect SSL_accept SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_set_session SSL_set_verify SSL_set_cipher_list SSL_CIPHER_get_name SSL_CTX_set_cipher_list SSL_is_init_finished SSL_get_servername SSL_get0_alpn_selected SSL_CTX_set_alpn_select_cb SSL_set_alpn_protos SSL_select_next_proto SSL_CTX_set_client_cert_cb OPENSSL_init_ssl SSL_get1_session SSL_SESSION_free

libcrypto-1_1

X509_STORE_CTX_free X509_STORE_CTX_init X509_STORE_add_cert X509_STORE_load_locations X509_STORE_CTX_get_error X509_verify_cert_error_string X509_sign X509_digest X509_cmp_time X509_gmtime_adj X509_EXTENSION_free EVP_PKEY_new i2d_X509 X509_get_signature_nid X509_NAME_oneline X509_set_version X509_set_serialNumber X509_get_serialNumber X509_set_issuer_name X509_get_issuer_name X509_set_subject_name X509_get_subject_name X509_getm_notBefore X509_set1_notBefore X509_getm_notAfter X509_set1_notAfter X509_set_pubkey X509_NAME_get_index_by_NID X509_NAME_get_entry X509_NAME_delete_entry X509_NAME_add_entry_by_txt X509_NAME_ENTRY_get_data X509_get_ext_by_NID X509_get_ext X509_delete_ext X509_add_ext X509_get_ext_d2i X509_verify_cert X509_find_by_subject X509_STORE_CTX_new X509V3_set_ctx AES_set_encrypt_key AES_set_decrypt_key AES_cbc_encrypt OCSP_cert_to_id OCSP_response_status OCSP_response_get1_basic OCSP_resp_get0_certs OCSP_resp_find_status OCSP_check_validity OCSP_basic_add1_cert OCSP_BASICRESP_free OCSP_basic_verify OPENSSL_sk_pop_free BIO_write OBJ_obj2nid EVP_PKEY_id EVP_PKEY_bits PKCS7_free X509_NAME_get_text_by_NID PKCS8_PRIV_KEY_INFO_free EVP_PKCS82PKEY ERR_get_error PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_p8inf PKCS12_decrypt_skey PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_unpack_authsafes PKCS12_free PKCS12_SAFEBAG_free d2i_PKCS12_bio BIO_f_buffer PEM_read_bio_X509 PEM_read_bio_PrivateKey X509_STORE_free X509_STORE_new RSA_generate_key i2d_PrivateKey d2i_AutoPrivateKey X509V3_EXT_conf_nid EVP_PKEY_free EVP_PKEY_assign EVP_get_digestbyname EVP_sha256 EVP_sha1 OBJ_nid2sn ASN1_STRING_to_UTF8 BN_to_ASN1_INTEGER i2a_ASN1_INTEGER BN_free BN_new BN_pseudo_rand OPENSSL_init_crypto CRYPTO_free CRYPTO_malloc OPENSSL_sk_push OPENSSL_sk_free OPENSSL_sk_new_null OPENSSL_sk_value OPENSSL_sk_num PEM_write_bio_X509 d2i_X509 X509_free BIO_s_mem BIO_ctrl BIO_read BIO_free BIO_new X509_new

ws2_32

WSAStartup ntohs ntohl htons WSAAddressToStringA WSACleanup

Name

.text

Size

526KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ReachFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d6192a62168a5ee42b45eefb3abaae9cbaf0fd46e2b4ab64a612b6efe8a4c8e
MD5 948cb84290473e06b8f69bed5a38ffaa
SHA1 61acb3f2aafd33d9c40ff848ed02e91995d02986
SHA512 69ef93290fe2b1f180a78fcf99c9fe9871d4f29361493649e1ead42fb032af6c0b9ec0ecbfb46af64a2aefdfa5202b67a16a86e16e9b4d0a6c61ec2f307e94e4
SSDEEP 12288:83Ovqr3RAN/d3z9A+lt34Dv672/Z5YQMmV1K1UzlZuwR4rcf7E4F6:83Ovqj+N/dFltIF5YQMS1K1UzlZu84rE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

627438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SOS_README.md

SHA256 72bab8ad57ae20824c84aaf9fe2e0e305b2108286e066545e6bac14ac7af1450
MD5 afdf90f86dd5c98ccee0be65cbb99f0a
SHA1 dd66bbff9bcc51522b0985d0f42b34277fa3ae6d
SHA512 bc06ebe3b83956aa78190b543134d89112bbf33dac89faad71830cf24a872aa1982ded9d03cb38b969727502d26b7b9154781940f0682d5a7c7d330531a137f7
MD5 SHA1 SHA512

NSIS installer

installer

SQLite.Interop.dll

SHA256 72473852a06449121b41a07fe1db8f7fc36457e83d35f69953aaa54499f7f9a3
MD5 8bd89aae2bbb7f5d40158a9732da0d87
SHA1 e718a55c06edb0bbed4086d2059b20c176fab32e
SHA512 7634fa8d12e3dc76e893059133f57d43a119d45e14c3e25b5f81d9d60d218330ca2f1fdb21f139314ec7e43d90e994deb47f624a18b6f0598981f041068137be
SSDEEP 12288:W4QYrTvF7HegZfiPpUqu0Yu3QUqpmy/Agq818AEk:W4QYrTvFVZfiPaD0Yfvpmy/tabk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

5792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SecurityService.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

Errors

General

Malware Config

Signatures

File Explorer

a831ab76dcd785734393b7f95d84a7ac6682823bcd4886560b2b4c1782b82709

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/SysRestore.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

API-MS-Win-core-xstate-l2-1-0.dll

PE Signature issue

generic

Accessibility.dll

mscoree

dotnet

AviraLib.dll

mscoree

dotnet

AviraLib.dll.config

BouncyCastle.Crypto.dll

mscoree

dotnet

Branding.Desktop.dll

mscoree

dotnet

D3DCompiler_47_cor3.dll

PE Signature issue

kernel32

advapi32

rpcrt4

generic

DirectWriteForwarder.dll

PE Signature issue

generic

DotNetZip.dll

mscoree

dotnet

Engine.Win.dll

mscoree

dotnet

EntityFramework.SqlServer.dll

mscoree

dotnet

EntityFramework.dll