EPP_update[.]exe | Triage™

resource
unpack001/$0/cs-CZ/RavStub.resources.dll
unpack001/$0/da-DK/RavStub.resources.dll
unpack001/$0/de-DE/RavStub.resources.dll
unpack001/$0/de/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/el-GR/RavStub.resources.dll
unpack001/$0/es-ES/RavStub.resources.dll
unpack001/$0/es/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/fi-FI/RavStub.resources.dll
unpack001/$0/fil-PH/RavStub.resources.dll
unpack001/$0/fr-FR/RavStub.resources.dll
unpack001/$0/fr/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/hi-IN/RavStub.resources.dll
unpack001/$0/hr-HR/RavStub.resources.dll
unpack001/$0/hu-HU/RavStub.resources.dll
unpack001/$0/id-ID/RavStub.resources.dll
unpack001/$0/it-IT/RavStub.resources.dll
unpack001/$0/it/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/ja-JP/RavStub.resources.dll
unpack001/$0/ko-KR/RavStub.resources.dll
unpack001/$0/nb-NO/RavStub.resources.dll
unpack001/$0/nl-NL/RavStub.resources.dll
unpack001/$0/pl-PL/RavStub.resources.dll
unpack001/$0/pl/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/pt-BR/RavStub.resources.dll
unpack001/$0/pt-PT/RavStub.resources.dll
unpack001/$0/pt/RavStub.resources.dll
unpack001/$0/ro-RO/RavStub.resources.dll
unpack001/$0/ru-RU/RavStub.resources.dll
unpack001/$0/ru/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/sk-SK/RavStub.resources.dll
unpack001/$0/sl-SI/RavStub.resources.dll
unpack001/$0/sl/RavStub.resources.dll
unpack001/$0/sv-SE/RavStub.resources.dll
unpack001/$0/th-TH/RavStub.resources.dll
unpack001/$0/tr-TR/RavStub.resources.dll
unpack001/$0/vi-VN/RavStub.resources.dll
unpack001/$0/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/zh-CN/RavStub.resources.dll
unpack001/$0/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/zh-TW/RavStub.resources.dll
unpack001/$PLUGINSDIR/System.dll

EPP_update.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 e4f87265a2313a019b26b50103bc6619df73b3813fd1f43ef40b38899a66211e
MD5 cfc1ec9ad30c484e30fe8379978294bd
SHA1 5e13a615c294b6c988f0fb0d90bf10d525b33fed
SHA512 7a70511bc4b38de219edec57f1f1cfa0b780ffe387ea37893d173769e78a8cef166ae96aca2ca673f99f5ce59dcab1988a50cee96e662c32063bcb9cd60cf69d
SSDEEP 49152:ndlczrfrH0aJTylWcs5IP63tFOzfitt2Yiu9:ndlcvTWlZ6IP63tifi7Lb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$0/ArchiveUtilityx64.dll

IMPHASH cb2522c235c4b2b8d93d6f45fce93571
SHA256 6e2673687ba029074657f0d1c4410691ee013eff2223d0c7695dfe4f70c62f1c
MD5 3351152f6ee87e97682a0a7c459ef614
SHA1 5312f9da67fcfd573dc5e45f6a7cc35fa463af89
SHA512 2b7ecb22746bf907ae4da891e170226da4f180ade27e41a16e1ef9e11f39e5e35b9eac3fcfff520dbb8a8888a1dbd1ca2459ab58ce8dc44a424c5de7b8132de6
SSDEEP 3072:DAZpz3eQkXBlJ6pM91zgrn4oul5ntwcfsOct7BjWSP8B:DAvzD6l0+1grn4otBWSUB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

36400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\rsStub\rsStub\x64\Release\ArchiveUtility.pdb

kernel32

CreateDirectoryW GetLastError WriteFile ReadFile SetFilePointer CloseHandle CreateFileW WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$0/Microsoft.Win32.TaskScheduler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6b8f51508240af3b07a8d0b2dc873cedc3d5d9cb25e57ea1d55626742d1f9149
MD5 a09decc59b2c2f715563bb035ee4241e
SHA1 c84f5e2e0f71feef437cf173afeb13fe525a0fea
SHA512 1992c8e1f7e37a58bbf486f76d1320da8e1757d6296c8a7631f35ba2e376de215c65000612364c91508aa3ddf72841f6b823fa60a2b29415a07c74c2e830212b
SSDEEP 3072:81sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5Dfk:81sSmRIt/xhtsOju1DH5NXnIKAc4NU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

339330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb

$0/RAVEndPointProtection-installer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8592bae7b6806e5b30a80892004a7b79f645a16c0f1b85b4b8df809bdb6cf365
MD5 41a3c2a1777527a41ddd747072ee3efd
SHA1 44b70207d0883ec1848c3c65c57d8c14fd70e2c3
SHA512 14df28cc7769cf78b24ab331bd63da896131a2f0fbb29b10199016aef935d376493e937874eb94faf52b06a98e1678a5cf2c2d0d442c31297a9c0996205ed869
SSDEEP 12288:vZtZVgIQtZM1A0+Nwhq3drt0ZAPKYZzrOZW4mlKhl:vZf661A0ue8lCZAPHZzrOZW4mlol
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

363230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\rsStub\rsStub\RavStub\obj\Release\RavStub.pdb

$0/System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 788450452b0459c83e13da4dd32f6217bfb53a83bd5f04b539000b61d24fd049
MD5 42e6e9081edd7a49c4103292725b68e2
SHA1 62f73c44ee1aba1f7684b684108fe3b0332e6e66
SHA512 99eab89bf6297fda549c0b882c097cd4b59fd0595ff2d0c40d1767f66fa45172ca5b9693dbf650d7103353f1e1fb8e5259bbcde3dfa286dee098533a4a776e8b
SSDEEP 6144:7ruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmb:GNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

360554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb

$0/System.ValueTuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc9bf1feeab1d76221508d6cc98e8bdc1603d5c600c5ed09c108e31b8bd3a6a2
MD5 29e6ae1a1af7fc943752a097ec59c59c
SHA1 6d5c910c0b9a3e0876e2e2bbbce9b663f9edc436
SHA512 cc6d55e5fd23c89d73ecbddfa92c102f47f8fb93f2f6a41d2e79708e6a8d7c13c1961dcd07810db3135d2f8ddcbf3535fb3ea3d1fc31c617ca9b10f6b867f9a5
SSDEEP 1536:f784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAU9bP8F9x/:f7NV8v36tI0XCKAmbP8x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

68354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb

$0/cs-CZ/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2b2be36b51272b6f0117a40320ac48cd0e415afe2ef4fba3af06a7ec166a949d
MD5 ee2e523bbfb65e138b64eafd223de12e
SHA1 7f3fb82a3f6643963c0f4f2903f35389ee3ab775
SHA512 2daaa1bb06ddfaac09328d06e239a9c518b7d3f462ba4c075d7df71a23bbd7255c75c2a5b28b8238919fbf587c704e35580bb3533ce5730bc21a561ac8441490
SSDEEP 192:lIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YVO:l3pQ8vQToxMi5emzUA8rYgLIOrnz8uuI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/da-DK/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da0e42edf577c58cb729c8925860afec61e95cc355b40efd8fa61993766733af
MD5 f2317fef5cdce4a19e6e7216daa0624c
SHA1 bdb39ea1300b158fcd76204add8f9f1f7ea0f2e9
SHA512 b7a16f4bb5e20d2fb1ff76991bc3c917e65baa60507676845e1bbfc68d800cc061af97d325b67dc1a2aeec02fdb289bb8bb716270a7c2044b3993b326556985d
SSDEEP 192:hIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHl:hXN3EsVfvVx8rUrb+M0lIVixNqiomyJx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/de-DE/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f45ef000dbec7c4e8fc8ad12f32538515711b78f593f5bc650026c43b6f9a66
MD5 9804dd2dccdec91872fbad3eda445c64
SHA1 5689b6214c5bf0205ab7cbf437e4e2abebdeeeef
SHA512 74c30df986733898481a1abe11c492476a524ecd06ba3b6020333f2c7d1b9961563abe92e2b1413af9dbf5c05fdb17b1b16763fc0419d2f95c8717d1f3eac6e1
SSDEEP 384:s5rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndZ3s8i:hPAKtnHOdvPhO2dmyndZ3s8i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/de/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6909a1c134d0285fba2422a40ea0e65c1f0ca3c3ef2b94a1166015af2a87780f
MD5 f83d720b236576c7d1f9f55d3bb988f9
SHA1 105a4993e92646b5dbb50518187abe07ca473276
SHA512 fd8a464f2bc9d5b6c2efa80348c3a9362f7473d4d632b2addad8c272e8874e7e67c15b99b67e6515906b86d01d57cd42f9f0f1e9251c0af93a9391ccc30e3202
SSDEEP 192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/el-GR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da24d2e2396eef6fbb6e775a16ee87f1e4ca4afec25563ad43d4026f5a091e25
MD5 85b95be9a2fbae4a187277a3fbb337ad
SHA1 9508c5fb5554e3792813d1710d9d244072a87a7d
SHA512 a9380494fa34ec315cc46d7eb5d5edb7a9f6f483bfd8d8935e915dda98215236147e81ffd36464625b2ea4513a094dd51c512b5487fd8790e148f0d455c1348b
SSDEEP 384:+npUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozTX3s8o:8Js5xEGzfOPMvMb3s8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/es-ES/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27ef93d50bfa2053af7c6a765204ee3e22c2d18123fa07ed453f3c8a45949c5e
MD5 8e236ad6a968f834ec829b984b362304
SHA1 719425a2cd4d6ae97a42034a095d1eba25e6c2f2
SHA512 fb54ef07d6c0c565685ee8c628219d6e7f0a4ab0bbd4ae1738addd1fd459f90be1a015c9beed5937266dec6e0ffeb3e6a728bfb38030d3e96a84863f0ea1b0cb
SSDEEP 192:KIYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7l:KuGe/V0ni6wxCjfpzocEs5dMvkcDqPDz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/es/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e893c6907da8d68c03b1a10e68b554ad5a8c0533f15912106f32e925f2beabf0
MD5 15db634b70d6d9d6cd41baae3f02eb14
SHA1 1456ffe09df896271a746f9cb40a230f188ad397
SHA512 1230e5368d4dab9776d57056993669327e95fe72e262efa541ed5d43abc1bcd3618db13b6bd6b3a27da053c103e3fb647eae759ccaeb443f7d9ffd1ecaa1122b
SSDEEP 192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fi-FI/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f0c64e62d5583ab132eeef816cbb119c5ea436656cec96ccdc2bef4dccc46ac
MD5 314ff54c08f9c461d7d5f01849e98a26
SHA1 2344d2e9596a2a49f2950ed71e58c4413ccdf3cb
SHA512 433ef0d73a7cfd70244afdab2ae401c36a1dd247472bd51280a03e428702a1af37cbfdf54af554d12eab068f88f568067bcada5c6dcf20a9afec6852f75a3ad3
SSDEEP 192:IxIYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUiH:IxRkNcDtxJMxAM2+9Ul/laxRe8ZGGWgC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fil-PH/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a924b53a87704120ce886f05cd94569def1b6aabf201ec22c8d4cda547988619
MD5 4f631aaeb5ae030730dea6914e2d1f7d
SHA1 b7067aaadf75f56ee975e7aca675d1b8c08dc8d8
SHA512 4ca227913b238db98cb866a4738f38195dc06adbe7452d79aa077a817479e657dbf1d10e9a300bdd35d0dc6dcf72c013df5a3d8e5c1118c09f586260c35f1003
SSDEEP 192:O0Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmH:O0Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fr-FR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e59969a07f3aecc9303a8add6d1f36c058472342a98b1db274a1fd8e0ef6ca74
MD5 3b5352ca4cb06dad6c6ce7f15b757810
SHA1 7ecb52ec5909fc6e9df2bf591d1a12cc33f8e842
SHA512 d808f61552f1f59080e4a027075f4bc66afecdd78dd970fbf8dd25cfac65bc5c619d964dd14e41a5f6209154d1ea7a5d4943fe35c12f4e0892fe1267e47dcf12
SSDEEP 384:cY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXJ3s8D:CBImyDM5DtyXwGY7uXJ3s8D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fr/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e3ee50e08124a7603be7d996dcf596eb0d3f9c603768e86e003f7b942d7097f3
MD5 3b4621370addcf4306669c9e7e45c865
SHA1 ea1ab3c499e946e152c1fc4a63fa99e1f9be94b4
SHA512 586755f32d16afd937bfc1fe3c52210ab815d5d4c904de101150fa052a94babfcbdc465669ff8c2537b782474658d7912037ddb76d8c9a8fd34715d1fe7b2857
SSDEEP 192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hi-IN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2e56643c064050de5f6061b8c3e507b819d28bdc952647cb8a6b966ad6e3ffbe
MD5 07261269f0355cb5b8c000da3566b6e5
SHA1 891b18a58432d46c0c943239a2ebe51007f982e7
SHA512 2a958d567f0d95f270f9dba7d6ae88f10279c0da073e6f008dd2e0118324386e52875bae4f506dbdaa0c45bd6ff1cea70276ebe5cc22d4cae7214fceafd764ce
SSDEEP 384:VME5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac753E:BXJsO57hOt9AZnttxKqz3s8Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hr-HR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6635270a0420cacb869fde826e72e96e94636473369cfdcb09280fddd4ecafe
MD5 d43fd55d52a82bad6c98008801d90207
SHA1 50b9ee0cc11b0c29022a3b4efd928284e846b6c8
SHA512 9eff61089b7b8156ab78d50f3bb82498c2812be64955353a5fe4a143f96df79620df8911125dec00bd124484ea00e39a4157e3f87f6ec9c9b52fa13016e17aeb
SSDEEP 192:yIYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWE:y1DpBwSkoZPxZlrPY92kGetEQII2oANF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hu-HU/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4326509ef689f63a130756228e348eb45940ba09a22212f7c826c17240e4eba
MD5 0dec5c4c1c673a7ca6f1e9bef8daa9f5
SHA1 9296735372a36c4b84f98563a2661928ea586773
SHA512 5abba62a4062697afb673bef5f92544619fa242bd014508a6ccf5617b40168042409e543cc2e5cca009dc2ae342b61fbe0d4c5594c1d52b2e756302aceb30a43
SSDEEP 384:ndpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfU3s8Z:t4gNrBnOVlgcekILfpltc3s8Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/id-ID/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb211a058273c109746cd00f96e0ba02d24c9ccc49315faf036b580238f65f0e
MD5 5e34215e6294d9382d0a51323f976b63
SHA1 a161cb06fee5e2669fc004178c230cacdaea462f
SHA512 1b0e3d83afd4da4dba5a212c02181f99e4cae904174c587255263d52b7ec40c02e080f19646e5c0d6066f577c6e00b37db94c980788964c4fb7c128f8e8ba139
SSDEEP 192:sqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGCy:sqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2S4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/it-IT/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36294fb621e9d99711f4d906afd25f2397507f0e39fd07ad646d17cb2a3b0375
MD5 441ac1c5155182d0bfdba377a858fe74
SHA1 b4dde792e5833352cde944bda57c0cfd3f1c985d
SHA512 d9f81ac33e863dba1bf03d59a739e6f3f6dcae6836ff1f3565771475232c1d311925e2a02a60110f2b4dd902c52d38557f9b28d86cf97a2792d2a9b28fb46c99
SSDEEP 192:aIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIpI:a3kupX/GSQxZdNYBRXvujVf9UOwGvwwH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/it/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d0493e38d8b3fcc7efa4916fea1eea69ee6449bf435e1869c1bc3f54d4090c5
MD5 1c331da4bce2809e16913c02e385576e
SHA1 cf8e71e030347749596a53d1b13b9e9583ec0527
SHA512 2871119690f3df0f244384a3f5f65ffe7cf17f1f00f6b530512aedeb8397c9e357079e8fba76d2a5bf6be4e2b18e4ac1ac104ea2d29f8f40cef6f30a905ecf83
SSDEEP 192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ja-JP/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0c4368ace35825b6ba54d83f04e787a20ba7998ee8592feed51787b1f053b99
MD5 491e0bb03970bcd681c264675e65dfb4
SHA1 f4245f334c084d45dc9ff6b63ed4b50355fd6d73
SHA512 599c77e40a174ba3c0a3003b32a6ad0b1c8dd2beeebc977de16eae9c8686c77996458e89983e955c4a9dbd1c9e54ee275848a09cc2c697f575e013e6b9389886
SSDEEP 384:OxwAHD6CkxQdCnvRl/oRHx8asale681v/V3s8V:xCkSdK0t81vd3s8V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ko-KR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aff47caf8450ab56e3cead10f4c6cd746dac2d97a745114ff9197d4c413285eb
MD5 ae60d61e47219aed36f791d067f3037a
SHA1 a0c3173b5034c187f8ee05a2c2d119bd773c079f
SHA512 b98b91ac5a9ed0ea50bc9bef999fa41a262fae7ac228f088a7b1e56645be5b566c0154297a1f048c5ded6a4fc438a3ba6bdcbd0965057b8879ad7fd775d603bf
SSDEEP 384:+FWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDm3s8r:FdKv+WqV2ZLToU9wXi/uK3s8r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/nb-NO/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3ce83301dc7273eed3fcd302e7c3b048c86454c949e1625bf9076097a95f5c9f
MD5 5a6f72260b46a5d10d9c0a779a296b82
SHA1 c8ea84bf62a5f28b5549902cd5e2c13021edd3ba
SHA512 ef8fc330e14b6bc0aa78805138e797201bc4115b915f12a26f7a3a2ce87457679015effbabc681da7fea529b031ef1e5c0a2e5b688033402028513be35b799d8
SSDEEP 192:DIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEY:DZsK6epv3qxh7EFBYn1p4hVYTqhTAEGt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/nl-NL/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b0be52f2b312847ad47dab37c2732837529afef79dd7f970f675ec2827186787
MD5 d4a8ddf5309e7ea0a4c1eaa2b46b72fd
SHA1 fefadfba4f8134683dd6719d0aa425b695074bf3
SHA512 e0547185d6b0e5c3b491e9959e2a5e1b0d95028668ae9a50d02027767b1918afeb3755db5b07e1b5f6ec71af4aa4e592e73a2c5c214262e3c6117d7a0d836abc
SSDEEP 192:htIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZw:3TN1X2HQTxklOVylzyOl/dEf80OCQPAB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pl-PL/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c21e2dc26bd0cf8591453cfbdfcc7479a74c82853e0860fee64b653c3e7b22a4
MD5 43eeaca65e1a59d947175491eab013f6
SHA1 9e3f6edc0bbb9e9bfbddd4af7db6118a6c850671
SHA512 eab0b44acbdad127682426d9ffea0c6d76f14a9b2f8be0284e3e54e004bb32a7766f1d382aea3a7bfcdbbfabdb29c225a64fcec3442d062511d3f77a5092be7b
SSDEEP 192:3IYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsj:3Zp3Dcr2NAcLxE6oMy50rtbxn/Xi9WdX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pl/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6e58d86c42b61226dd7af35d7c9432ce6f0982d1d0d5a2f4120e8abc5c787a02
MD5 b60817a69e314b22f746917c826da53e
SHA1 7d2785a6d1a53a0717c986b959af67de6f9300e4
SHA512 9a8f029329ce105b3f72fee623e3ab8c88e1af45f86fab61f81be418b2d70f83e4c0466010d312240a01e1ef8f9b9926ebf43e25bdc3c364c2d28ab9b0e5f6fc
SSDEEP 192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt-BR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 33938dbb2db55bb6df6d7671e1a57a07022e17437dea0cdfae79bb164cc2a372
MD5 f86231c09fe30f3b630f2b066abc0b7d
SHA1 b3f8d8a213c5198f1779a589eff3c77e181def72
SHA512 28fa420813634464e12a6f2f477a0c118876e455422c49749d3d503519f515b529f076a2aefdd18cb3b0ef4abde229a3c4d348e5f56d098679c3107348f2dc1c
SSDEEP 192:bIY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afkq:brnlNK/xIDx+sQ0Y4EQujHOVZgdBtofc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt-PT/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 33c96b6f6f830bb4717956b0d89f780837389ab2af4564f6caccc360b2c3059b
MD5 7a0e351f6b323dd69619208a03a1b878
SHA1 54cca58c4d6e315c15d9ca76b8de06f1f66889fa
SHA512 4f57222f9f8e76a571fb2b95839e8cf29908509dc376ae9c5553b48be8407305cc8cd41af55fc5913cf1bad9b9efb4879646d74fd9b622ca6d0220caf0fd3382
SSDEEP 192:IIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4O:IrnlNKNu7xKgUOVBQ6Bo19sPTLM80ao7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b4d398cc97a2ba0b4f83e3bda159c8b6712d7039c88c5a6e2374b6c83d296cc
MD5 d192c04626f6408ae49827c844423a97
SHA1 020f0129b5f3833743faa0d406c1b0d12f0875a6
SHA512 118961f9ed1196d25e311532fb533fc7d266f33192c3ebc8d62df91dd7c1de3b3521dd8c092049def5e31c36a972991fadc243b50087ffdcc61cbe0e60554425
SSDEEP 192:sIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4n:srnlNKNu7xKgUOVBQ6Bo19sPTLM80aoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ro-RO/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6818ffc05046738148318630d550130360857ba272577563163b466a1b2ea8bf
MD5 6925b8d93f81214e569ab80029ae9ffd
SHA1 ad318591acc6dbd6c34acb8529be01de9c4dde86
SHA512 7492c29d630a9fa9f4ab41a96aff08a38c0fc2ec284b92475abf30343d5346958b5d804539602feeffe204a882780d391007abf920f98849f6d65c2f514f62c3
SSDEEP 192:2xIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOB5:IapuUhg7sJxWgAm/45t6lSertvHrDapm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/rsAtom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 02a42d2403f0a61c3a52138c407b41883fa27d9128ecc885cf1d35e4edd6d6b9
MD5 9deba7281d8eceefd760874434bd4e91
SHA1 553e6c86efdda04beacee98bcee48a0b0dba6e75
SHA512 7a82fbac4ade3a9a29cb877cc716bc8f51b821b533f31f5e0979f0e9aca365b0353e93cc5352a21fbd29df8fc0f9a2025351453032942d580b532ab16acaa306
SSDEEP 3072:n6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUkP8f:n6lrhISL9e1oWE56ndQ19aY9FjJUf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

151742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsAtom.pdb

$0/rsDatabase.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c82540979384cdcadf878a2bd5cbe70b79c279182e2896dbdf6999ba88a342c1
MD5 d9cd9c6486fa53d41949420d429c59f4
SHA1 784ac204d01b442eae48d732e2f8c901346bc310
SHA512 b37e365b233727b8eb11eb0520091d2ecd631d43a5969eaeb9120ebd9bef68c224e1891dd3bac5ec51feb2aee6bec4b0736f90571b33f4af59e73ddee7d1e2ad
SSDEEP 3072:/R761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555k:U1TcpihOk0KvvvvnPPH6Gi5tPArrYeix
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

161822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsDatabase.pdb

$0/rsJSON.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 221bb12d3f9b2aa40ee21d2d141a8d12e893a8eabc97a04d159aa46aecfa5d3e
MD5 f8978087767d0006680c2ec43bda6f34
SHA1 755f1357795cb833f0f271c7c87109e719aa4f32
SHA512 54f48c6f94659c88d947a366691fbaef3258ed9d63858e64ae007c6f8782f90ede5c9ab423328062c746bc4ba1e8d30887c97015a5e3e52a432a9caa02bb6955
SSDEEP 6144:cqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dtvU:cQYLlw2cB4Y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

214270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsJSON.pdb

$0/rsLogger.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ec0a8c14a12fdf8d637408f55e6346da1c64efdd00cc8921f423b1a2c63d3312
MD5 83ad54079827e94479963ba4465a85d7
SHA1 d33efd0f5e59d1ef30c59d74772b4c43162dc6b7
SHA512 c294fb8ac2a90c6125f8674ca06593b73b884523737692af3ccaa920851fc283a43c9e2dc928884f97b08fc8974919ec603d1afb5c178acd0c2ebd6746a737e1
SSDEEP 3072:40AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3lP8FU:3RkD/0Q7IMCP3ePOUBRqKep5jVUFU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

172702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsLogger.pdb

$0/rsStubLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a
MD5 a16602aad0a611d228af718448ed7cbd
SHA1 ddd9b80306860ae0b126d3e834828091c3720ac5
SHA512 305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511
SSDEEP 6144:peGOfaXMwabVZN5rGSFF5qFky5Jb74HthVqbvIy8WvewjLbqzm9iVgUz:sfacB5rJFFh5qb3bmwnliLz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

245438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb

$0/rsSyncSvc.exe

IMPHASH 0e997e653cae4b1b321d2d1e22c31054
SHA256 c113072678d5fa03b02d750a5911848ab0e247c4b28cf7b152a858c4b24901b3
MD5 ded746a9d2d7b7afcb3abe1a24dd3163
SHA1 a074c9e981491ff566cd45b912e743bd1266c4ae
SHA512 2c273bf79988df13f9da4019f8071cf3b4480ecd814d3df44b83958f52f49bb668dd2f568293c29ef3545018fea15c9d5902ef88e0ecfebaf60458333fcaa91b
SSDEEP 12288:1kaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1O7:/Jll87GY2q61llaOZBjKt5qquO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

403608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

GetProcessHeap GetModuleHandleW WTSGetActiveConsoleSessionId GetProcAddress Process32FirstW Process32NextW ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess GetSystemPowerStatus GetLocaleInfoEx GetModuleFileNameA CloseHandle SetEvent CreateEventW WaitForSingleObject GetModuleFileNameW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP OutputDebugStringW LocalFree GetLastError LocalAlloc SetStdHandle HeapSize WriteConsoleW QueryPerformanceFrequency FlushFileBuffers GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle FormatMessageA WideCharToMultiByte GetCurrentDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx MultiByteToWideChar QueryPerformanceCounter RtlUnwind GetStringTypeW GetCurrentThreadId Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess

advapi32

OpenServiceW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegQueryInfoKeyW RegCloseKey OpenProcessToken CreateProcessAsUserW DuplicateTokenEx RegisterServiceCtrlHandlerExW CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W DeleteService ControlService StartServiceW StartServiceCtrlDispatcherW RegCreateKeyExW

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantClear SysAllocString

crypt32

CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

urlmon

URLDownloadToFileA

powrprof

GetPwrCapabilities

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSendRequest WinHttpConnect

Name

.text

Size

599KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$0/rsTime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 13ca35c619e64a912b972eb89433087cb5b44e947b22a392972d99084f214041
MD5 f1e592a7636df187e89b2139922c609e
SHA1 301a6e257fefaa69e41c590785222f74fdb344f8
SHA512 e5d79a08ea2df8d7df0ad94362fda692a9b91f6eda1e769bc20088ef3c0799aeabf7eb8bd64b4813716962175e6e178b803124dc11cc7c451b6da7f406f38815
SSDEEP 3072:3WGjyLgosGplJLT7AwoTFGmrY6sW5P8+G:3wgBGplJX7AHGm8AU+G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

124142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsTime.pdb

$0/ru-RU/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 109ab83379877db1a8177f610ec484538648fb626c191de3824ec6fd7a3a7f8f
MD5 a1debf02ecbf636e3407da5287ff7bf2
SHA1 2542f8351605030125ba48361a3cb54ea69d6bc2
SHA512 53ecc815c9868828df33b4289cf32f22b99ceb67269b9553429717c91cbf912728c4b3d7aaabd802087480b9aec56ad8fc65fcf1ffdc8267a07217fc748dd589
SSDEEP 384:HZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7ji63s8E:paL88/sd0QF7ji63s8E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ru/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a1d5fdac027144bcaa0e8110f4de717e80944420c59708b3dd8e2bd31bc7ed4
MD5 dade13e423762bdae745d57ca3dc86ef
SHA1 7b4122cbef771c5548a7cb5641b6db6743c8c3f6
SHA512 77f5050ba87e8abeb92298d16897d6cec087ffb7b4c38442c854a0993b398de529c15b5674adaacfb3e39ce05165f05a38337b2dbd41e8a7d806751542f6e8d3
SSDEEP 192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sk-SK/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c44b548ece47d3e7d9e26c1d31f0e3bdb0d3c73acfea688ab2cd67747eb103c
MD5 bc75574131447eb445eeb1232ae357b5
SHA1 ec92577f6d83dfe15b77253df3b421661e22c499
SHA512 b987dbfbdcbd4443a76ef685d36d460373ab167c79dee2ad719b9d3f42c9d4c033188a99c8887aaf6593e17f3b3b9e8facc9e27bf9413a65aed69f866578e1ad
SSDEEP 192:DIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2s:D41uOKl7hx9mX+41CLUMZc/ZOPVYJN6Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sl-SI/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 06df84339b108e76478be1bf35b70a7dcd4dd927fba2bb70182173aea8ad7640
MD5 f682f4101f06cf1b5cadbeb09dfcfe53
SHA1 b390dd47fa852e9e1c3a382da65364fc7566c4b3
SHA512 f1c8f25511da1a875a6969bc744fdbe37b713bf23971fe2a6e0e8d0b36531510f6dc1d470fe6455f710e7f8633182061d96aa56ee23147278576064c11597a52
SSDEEP 192:bIYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZy:bTAGeXyuMxUY+iZWBei3gW0dFOaEe3CT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sl/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e0a25e82882d41b3ca99b6736238a1ccf1af50e67240ae8d234ff6919bfea96
MD5 aa8990aa3d13e0e776f552dce5b669db
SHA1 f0babc7f79489bd143d06d683182457642eb8945
SHA512 36c75251f411743fa7f15bfa6109e0caa86d725e8f2917830b0b1c19b4fc3eaf307bb8f8cc3547f24f1143749e0ab445ae1fe908b22cb40b265590e77765c856
SSDEEP 192:QIYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZk:QTAGeXyuMxUY+iZWBei3gW0dFOaEe3Cp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sv-SE/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 af9f0bad5cbf7bccff0f059749d9058de4ce69fa6f7f7238db0f24a0d237b6be
MD5 aa3066a11238ce14299004df5f0e366a
SHA1 bfc81509d815e85cfb67409979e0e2b5522381b8
SHA512 6eabdf452f7f8a04976c0f97a7d29de4f411f8572556bae55d2a6e55c600a356c5833b79c91b64c7a081f73e0a7e17063be461b6ebed19f9ca91c1e64d8cc964
SSDEEP 192:BhIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvD:BhUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/th-TH/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff46247751a2e5135fc6b510bbd51b4d1a4fb902e45a7792afd9fad035b52558
MD5 db774c5850ff8e482e04ae26ee79eec6
SHA1 ffae380534e984ec9a336f444351124a46d440fc
SHA512 7c2c15883647b64a849f4c3703c29ec121b760ccebb3f5fae7228cc5ffd0eeaa5f707ead790d44154b7fc05affc54fb00fa1edd0b1293543df28cf326a8ca238
SSDEEP 384:iWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooy:I7LHDFGh0EJviNhsFx55n5z5OPMuQ5mD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/tr-TR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dc80276c4527961a313eb2d20391f48275bc1c15035dfe1b4c859387179d6415
MD5 f93255f24064a092a60c47999048f56f
SHA1 ac07c75c7ddbd03140b5969f46c425d6eab68b82
SHA512 68878cf0acaff941df14f33688b1c5cef448a4062d03d8d6dd477f0d4247ee416d58e801e07055bbcdce79acb146004d672d508c493422926685595cfa564d56
SSDEEP 192:JIY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oc:JKkciiwISxvnmkYsPV+tIqMvhBZYquLp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/uninstall-epp.ico

SHA256 0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058
MD5 af1c23b1e641e56b3de26f5f643eb7d9
SHA1 6c23deb9b7b0c930533fdbeea0863173d99cf323
SHA512 0c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4
SSDEEP 384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5 SHA1 SHA512 SSDEEP

$0/vi-VN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 48a343d29f16ad2df477aee852853ba87618a939412c47e22b186dd9e6fe2797
MD5 258b536a66a461fa66bf1b22a828fef7
SHA1 05ac6cdaa5308e494c864c6a52d429b53b7b03c4
SHA512 e4da0439162bef082f106ff47724c6677eb8e643c2d3484c181bd3ccdfe99e3b9d8016f24105176e35c33273e1aaf656bf1bc2393701e081f55c4ca06c0eabb2
SSDEEP 384:Pp4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2MJ3s8V:gblbzC5jmtNeRN2w3s8V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aafbe48966dbc5372a308ab9501245ce261d2715f336ad1908c799d354c981a2
MD5 3cefec17baac089c54c8102a4cfd160c
SHA1 a54cd9bd4181a591937a99be88beb006279837de
SHA512 2d45193662c7ce2854ce2d3ee53ae199e094d09bc76d8d8a8e36b24ea60400a5f064ca16ce0078fe6cbdf4117c22565c04e47b99cd99868254c915db6d18700f
SSDEEP 192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-CN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a363d4e4940e7243f0d19c2e4beadc06e545b9b33d3d12b485b2ff8d6954e767
MD5 4d014bb25f1423430572433e7cef9ac9
SHA1 f6ee46387d8ef7505bc39dfdc43172951e85e3be
SHA512 41b3265945340d7bf7bb8e757612990fd2f93b94dbc2992bbc404cfa233aefc872068de5e717d43c34d211313b5238e9160edff63399a8bf1bd9c3e93246dffc
SSDEEP 192:hIYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenTj:hRbXbaQixwYxzJSKqdy6eY5Rt/A7c+hY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f8c769a357e6cd27452835e5288fe515fb50bfeec83ef3969975171174b467e5
MD5 833f269ba6f0c34f49273da7fbd7dce7
SHA1 d0253d322dcdf7f54e37c7e8911a8b77670d2967
SHA512 4fa315e23d985affb46f6536cdf2ddc1b882f47098ee2d5a4b954ddeeb8904d1c83182b1598e4948a59728339945307b699a147ecd813c0f91986d95bdc57184
SSDEEP 192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-TW/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5ac7a5cf8841161701e33c27859269a9da61c8c6a9184f3e0e9441b6e6fe5d23
MD5 f6743dfcdce11d9a4715da9a755eb8f1
SHA1 b0fae08687cbef60bd68b8baa5c0ad34c5deec78
SHA512 ee486e82d51c3fa717ac99052cab52d8beb179e81119ef05c383c8a64e3aa844dca3710373a619f7971d2a3fa52e54f93d5dfe1dfe077326ab860f8144817d4c
SSDEEP 192:BIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXh:Bw6Y9TEVWxzJS9gSKiLwhcSSqgwmMGxJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

EPP_update.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$0/ArchiveUtilityx64.dll

PE Signature issue

kernel32

generic

$0/Microsoft.Win32.TaskScheduler.dll

PE Signature issue

mscoree

dotnet

$0/RAVEndPointProtection-installer.exe

PE Signature issue

mscoree

dotnet

$0/System.Data.SQLite.dll

PE Signature issue

mscoree

dotnet

$0/System.ValueTuple.dll

PE Signature issue

mscoree

dotnet

$0/cs-CZ/RavStub.resources.dll

mscoree

dotnet

$0/da-DK/RavStub.resources.dll

mscoree

dotnet

$0/de-DE/RavStub.resources.dll

mscoree

dotnet

$0/de/Microsoft.Win32.TaskScheduler.resources.dll

mscoree

dotnet

$0/el-GR/RavStub.resources.dll

mscoree

dotnet

$0/es-ES/RavStub.resources.dll

mscoree

dotnet

$0/es/Microsoft.Win32.TaskScheduler.resources.dll

mscoree

dotnet

$0/fi-FI/RavStub.resources.dll

mscoree

dotnet

$0/fil-PH/RavStub.resources.dll

mscoree

dotnet

$0/fr-FR/RavStub.resources.dll

mscoree

dotnet

$0/fr/Microsoft.Win32.TaskScheduler.resources.dll

mscoree

dotnet

$0/hi-IN/RavStub.resources.dll

mscoree

dotnet

$0/hr-HR/RavStub.resources.dll

mscoree

dotnet

$0/hu-HU/RavStub.resources.dll

mscoree

dotnet

$0/id-ID/RavStub.resources.dll

mscoree

dotnet