a6079711221810049f272c6413315649_JaffaCakes118

resource
a6079711221810049f272c6413315649_JaffaCakes118
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/nsisdl.dll
unpack002/Microsoft.Win32.TaskScheduler.dll
unpack002/x64/7z64.dll
unpack002/x86/7z86.dll
unpack002/x86/rsLggrServer_x86.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/bytefence-installer-5.4.1.13.exe	nsis_installer_1
static1/unpack001/bytefence-installer-5.4.1.13.exe	nsis_installer_2

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 a9a9f83473c54191c5808cbbd750c0c68eff54e1557d03a63eb2221dbb1578cb
MD5 a6079711221810049f272c6413315649
SHA1 3e8b8a2ec3df40d708211b75e33dbcdc3357cdba
SHA512 981bf3872c2bcd9b9e980e3f51f1c6e06faddef708ec99d9d89ad25671b4e96a397d1889da633aaf8c1ad80d4df0d5fe7412bea5ea4d4ea9dc48ef6661cb457c
SSDEEP 393216:EDvAneSUpG/EvZdFf9Rz1GykEGmeZoLTIm1GQv:EDYnrmGshv9J1ReK91GQv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

InstallTools.exe

IMPHASH fa77b30021c486d95b700f08e9e362d3
SHA256 d7ffd96c98cdcd1bacbe7542b403d60a8b700ab8305de02738f1f1c2d98aa71f
MD5 7bfcafbcc8ee124ce3ea6b098105865a
SHA1 f404c9a50e0740e465106321012c3b7859c999dc
SHA512 02b873be813abc8a50b882bed60ad2c57ad6cba8f83984c30d2ca0b5dba6c5b6427d44626bd2689e179bff539160b78b3ff6b604d1d134a147e41c9861b1600c
SSDEEP 3072:0l7g2UXc+gHjgXqJV0BhZ1hgC5VQ+dVg6tsH3kksA7XDCEtXFD:SkxM+gE607ZEC5VFgkks4Xx9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

9c:b8:95:b5:5c:d3:80:52:2f:d3:9d:b9:fe:26:8d:41:11:d7:9d:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Aug 2, 2018

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

1

Major OS version

5

Entry point

35312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repository\InstallerTools\Release\InstallerHelper.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetLastError lstrlenW WriteConsoleW SetEndOfFile HeapReAlloc HeapSize GetConsoleCP FlushFileBuffers CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW SetLastError RtlUnwind ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetACP HeapFree HeapAlloc SetFilePointerEx GetFileType GetConsoleMode ReadConsoleW LCMapStringW GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo DecodePointer

advapi32

RegQueryValueExA RegGetValueW RegOpenKeyExW RegCloseKey RegSetValueExA RegCreateKeyExA

shell32

CommandLineToArgvW

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpCloseHandle WinHttpReadData WinHttpConnect

Name

.text

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bytefence-installer-5.4.1.13.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 d0e366ae735c42b36783721309da2ff9fbb339f2dc3820493ee446dab380f97a
MD5 c96d3b8cc1f44bea02ce7e0597e08e91
SHA1 243917df14fee3f31bbe0f767e3ab330b35136de
SHA512 961f4c82d8900f6b3b4ddcccd5fc8d95cdacadab0a7ad45a524ffb67b09d0f4c71d79384d9d05dbc94fbf5bf8945efb74d54ffa7470918c3c87ce0a3df81a70d
SSDEEP 393216:OvAneSUpG/EvZdFf9Rz1GykEGmeZoLTIm1GQvH:OYnrmGshv9J1ReK91GQvH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ef:9b:37:51:5a:b7:ef:aa:12:2b:14:3d:e6:b3:06:f0:a3:c1:ac:cf:21:9b:af:56:ff:ee:f1:fd:83:f1:fb:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

23:02:9c:26:0e:d3:a8:b4:7d:5b:1a:83:af:31:76:0f:8a:b7:ca:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 5604f656590451d28d1653ad5c5d385fba1dce76b39c14f917c6aaad08f96b89
MD5 47c5cd0b09846144fba0da4c044e894f
SHA1 f8781bf78218064c60312587d7875b203046593e
SHA512 e151b7592ef6c992bf6bf41054d0a6e969eb3fa3325a4c7a0b71b0cebbfd6d587fcca644a177231a0534cb9cbfe1561e0c4ceae2e1229b067f5f3ddb5136d41a
SSDEEP 96:e0qjdBjka7yVNTSWg2zfwuiNOlGmBDV5nHzfygr72:e3bD7yVN5gqfviMl9DV5TW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 282b94f02f605a667f0fc5c6dbdc6c9ddeb8048d811826fcf7e956ed263b7ee0
MD5 0a3789bd73553a4e0f37022cf348653f
SHA1 ed29a8dbec208d15db69a3c65ab0b858bcfc9dc2
SHA512 2337acbb34a3548990e1381f823411f411a4e453331f97d12b43688d4539d6eaf424051fe1f2046aa4edb6ebc8d5db517c0cec36a3a57887edf2b2fd6ef48418
SSDEEP 384:QfTi4axP8AB8MA7LBhMQLALlYLSL3LHLlLc21hh:4+1xkABPAfBhM2mMQbrJc21hh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ddbd50fe6279559edf7d1f1d89b42c2c
SHA256 062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
MD5 eac1c3707970fe7c71b2d760c34763fa
SHA1 f275e659ad7798994361f6ccb1481050aba30ff8
SHA512 3415bd555cf47407c0ae62be0dbcba7173d2b33a371bf083ce908fc901811adb888b7787d11eb9d99a1a739cbd9d1c66e565db6cd678bdadaf753fbda14ffd09
SSDEEP 96:oXHqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4AqndYHnxss:oXHq+CP3uKrpyREs06YxcdGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
MD5 1f49d8af9be9e915d54b2441c4a79adf
SHA1 1ee4f809c693e31f34bc6d8153664a6dc2c3e499
SHA512 c60827e322e3168a79795ffd4beb0b0039842128255100d6b005d261402d2ff570f3866f441f3d3c063097c71d44bc5ae80d177fa91ef4e46fc8c2d97de27aa4
SSDEEP 96:67GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNo3e:kXhHR0aTQN4gRHdMqJVgNv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 a1e09fb1739ef7557d18104b0d6a4c7725e1ec293f5404c80402f57ff9ebb9d0
MD5 a95c7af96416b2cd084fed4c07c8c291
SHA1 0c62c2fd843ccb59784404ed36369784dc557671
SHA512 427ef14b116b574c5558cc6bb0ce03ab37f891f2d7ab0f130e3cddd0265e6bd269c598ce93230e56cd41bb9d2649bbbaa2fa2c654d8116c0c6f79a6f3419d1dc
SSDEEP 384:9ck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2NE:9ck76gibLCMLDLCx04HNVNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ByteFence.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0ebf985309d2989a589f0a1e742a1691e4e77ac15a5935233fe2bff74877be78
MD5 bceffc9df771548686617241bdb759cc
SHA1 e8fb049b5330e8001eb9bc029185eedf48952441
SHA512 6f934af07f4305a499954977ceb97bdeb4d683c53d013edaaa4af6b62807529265baabf7b7eae236fea2c4aeb1af449adda09e18bb0856cb6bc5b6a0217bcb7b
SSDEEP 98304:W7EEyAk+mz9Lsl8OnfBuwOYMGl5qoN9ahlqOpq:WQek+mzdsl8kkwO74qoN9anqWq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7f:0f:82:24:03:92:5e:fe:37:62:88:2a:f2:4f:7b:fa:54:9a:c4:c8:a7:b8:cb:a9:db:7d:45:c3:9c:dd:c8:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

90:4b:2f:7e:46:f9:d8:1d:d1:b3:bf:39:de:28:31:e3:78:ab:92:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

3785358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ByteFence.pdb

ByteFence.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

ByteFenceGUI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8730b39c35b36ae6af9e650bb7df68ace0167b1a60bcd36ffccc84c24301f2a4
MD5 19f9aa3eba875674fe706d221efebaeb
SHA1 a943850b856a6fcca15ec46a07a2fcfce6192d55
SHA512 b09fcbfa37bb658666790fc6ef48caff022edba0ddf6bc33e764f66b163d6a7bebcef0c8cb7ec9532e7a531820d520cd61549c3775b8ed3be3c385072fccea2e
SSDEEP 12288:ETexsS8aSm7OH9OwrHLbYS/glb6uBt86TtyWFV:ETeX8aSm8trrbYHTt86AWFV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

09:d9:09:42:04:50:29:e7:32:0b:5c:84:af:2d:d7:98:82:d6:48:c0:43:3a:fb:10:18:75:01:ca:a6:65:5e:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

09:e0:c4:f0:76:4b:8a:91:31:7d:50:40:7f:05:6d:20:1a:fa:70:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

845726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ByteFenceGUI.pdb

ByteFenceScan.exe

IMPHASH ee15a651b9ba7da7b305f5366d8836d6
SHA256 abf213902b88e6c813b632bfd00ff2e974b07d2425b4a7c2d70c9c9a4ab324e7
MD5 70a15f02c98680907c60ae911d94c348
SHA1 c88e508433fa1faa37430dc23a60d754cba662d8
SHA512 49a1a7a66b92dd609fa62b959e16610ee9f15f3196e97032e0a4eb8b2f273c702205be921f3c2fb9acf33e5fc559e7e86bd073e46f0fb99265402622f5ab7638
SSDEEP 24576:h8OYQ9mPJRqf3pClRMz8+bo9m6SfGquqf8O:hvYxo5kGzvbmm6SPuS8O
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

e9:90:e8:32:04:e6:50:1d:3b:0a:49:66:23:f0:0e:d2:3f:66:3c:42:3b:ac:b6:e7:10:01:21:b0:a4:f6:59:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

ea:6b:49:ef:7d:bd:99:3d:41:69:10:69:85:aa:04:ec:bb:af:19:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

6

Entry point

308068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\client-products-build\ByteFence\CppUpdater\Release\ByteFenceScan.pdb

ole32

CoCreateGuid

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shlwapi

PathFileExistsW UrlEscapeW

shell32

ShellExecuteExW CommandLineToArgvW

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect

urlmon

URLDownloadToCacheFileW

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegGetValueW RegQueryValueExW OpenProcessToken

kernel32

HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetTickCount WriteFile WaitForSingleObject CreateFileW CreateEventW SetEvent CloseHandle WideCharToMultiByte VirtualFree VirtualAlloc GetCommandLineW GetCurrentProcess GetModuleFileNameW GetVersionExW GetLastError SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx MultiByteToWideChar FormatMessageW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW HeapFree RtlUnwind RaiseException ReadFile GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW DeleteFileW RemoveDirectoryW MoveFileExW ExitProcess GetACP FlushFileBuffers GetConsoleCP GetConsoleMode

ByteFenceService.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 14c8cf137a85c622f5a7f08401fa5fafaa2b1a1e6aaebc583731595aa6432f44
MD5 aea173e42952735ccbd7c1f69e7b0c5a
SHA1 2c23c5bd0fe131e59600190916fdd56e1ca60dee
SHA512 62e70246029079c554bcd2fa2a5784f53842abdfd42587375d656054dcce33d8f73914e23567e6b2ba5f8da3a441ed7693f447953ae99541f6a03b1591094985
SSDEEP 3072:wyOq+XsqVWHYY6xmaSbNdo9IFHmdNoelstL1n7fgrJmg+aY:wNXYYYHFHm8eStqjW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

09:02:37:60:f4:c7:89:e5:d9:48:5f:e0:50:13:4a:69:65:3c:9b:75:22:3b:9a:64:a2:5e:4a:0f:11:ea:5f:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

6f:86:a4:78:ec:1c:54:a3:1f:e5:f0:55:6e:02:24:4a:52:56:fb:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Jan 8, 2019

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

146766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ByteFenceService.pdb

ByteFenceService.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

EULA.txt

SHA256 b01dbdcc34869e07c9a31a471cfee23d82e03bb924165cffd54540593558a692
MD5 e6e5ede5509c3806949c67b0c9a3ef7f
SHA1 a3dc123ec546020085638b56cb238d3b359b0241
SHA512 4eac9c1acf107c336296f49ea01095578356c73f7d18864a8efbee92907f780441a9809a5dccdde8f8746df1247ebea0a3a2348478d87ff782e8c6f309b56222
SSDEEP 768:axg/n78aQJALyI/uTvRNKrdf6GfwpyCRtPEIvRE305T5fTTgTuoR1JwTzBGs:axw75QJkyI2NN8B6GopyWlEM625Wd1Ju
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Microsoft.Diagnostics.Tracing.TraceEvent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6f8a2f1d045efb952c1ea9988bb5dcc72555eccafe9b32c2c51b439ea1f28453
MD5 d09b4a4509907f75f506b996a5ff7554
SHA1 bdb299cf617da297cbcfea321879f669e465069a
SHA512 ea29579f19aa55429e7254a7a6953f127a7520c43ad1e15dad7e4b25d17a167218997fe98d3096606164284616963c81a53f10eeaada7163472a6102e66de478
SSDEEP 12288:Y+TaIGsAE3CBF4vgwWNjVYUQjwciLzR3Sx+1FfNJyPnKrA:ZT2VESLEUQjXiLXNJy/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9b:60:1f:6a:d2:c5:e6:72:b9:3a:91:d8:b7:47:c9:c8:05:50:0f:d3:d2:e9:e6:67:c6:d7:7b:be:0a:b8:dd:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

PE Signature issue

Digest

0a:5b:c2:33:7e:5b:16:2e:f5:66:4e:07:5c:c6:eb:fb:ff:82:f6:28

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 3, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

998302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4745\2343\src\intermediate\TraceEvent.v35.csproj_476a578a\Release\Microsoft.Diagnostics.Tracing.TraceEvent.pdb

Microsoft.Win32.TaskScheduler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc6c472f666239ed270cc3754852f536b8981d6fd22e4ad1ee15a1aa788a3ba9
MD5 1802e6df96046cfee62c63c4c8469a3e
SHA1 c5d6444fcd8f46e1832c99614f5e71adff582f6d
SHA512 339f5b917c4afbc25175bd173cebefdd8f4671e157ecfb8a9c21b78db9d34fd9757787c231575e8849509cac59162c6c67fb32af6febd6903ec285e21c0fd304
SSDEEP 6144:pSNrAMLv8oXq9/7hbTD9S9XFiU5xsM2N0b9tCud+FrXSaG5rcfFr79E:CH8oXq9Dhb49ViU5xsTQd+FrXSJ5eFrZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

316134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net35\Microsoft.Win32.TaskScheduler.pdb

Signatures.dat

SHA256 91a803a30b82888c437c9f5c1f6579b4ce070625b4e1664e14105156b360ab17
MD5 f0f375247de1b9e526c4017f2fadeffb
SHA1 9517426f632818af694335abe475b9e7852ca4b1
SHA512 e532f9fe55952e26fe315d16a2e676e233f3bae35629f4b977e17ac3ca96c6b280c39f1854d175a81811c5aa5042d86367b31f7844c99239a0f074e2458239b2
SSDEEP 24576:1CPfB3KpxRYkArLAWbw17oegPHbjvXn+h1CUfEPmBr6r:wP9K/f+H3PI/fEf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

WhiteList.dat

SHA256 0f9ac436356203842c619d27b8b805e034cfa420e94495170d089629e52038a9
MD5 899c70dd0bdda61514bff5c51a4a0a20
SHA1 0fff58ba69a11d1e01c6e2704e553abec1352ce9
SHA512 b13691ad0d3768eb6a9e4ea30e9a2ceabdaa1d13730cdda81f18696412ebb4589ee859f422ccf9b01c3399b5dbbcb317e0d6aee91cad10a7985ea8e87148ed9f
SSDEEP 6144:I60//Q7L0QTk1o7lUphQUxnwd4Lp8jtHIJitHeVFBDSP9NHqX:I60/4JySye4mGitHGFZyKX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

amd64/KernelTraceControl.dll

IMPHASH 387fc16f93041e1ac75f32e2095b58d7
SHA256 2005f94acc7c541771066ed98aff6321b911d10c59d2544b853446dbe91f25a5
MD5 23ff4b3eadf12465e19f39b0c19c4361
SHA1 ce0f61dfc428532dc645d2aaed9153d79dbd27d5
SHA512 cc618b926c22cabeb2156fe9d82dfa0a181e9bb03e9f1d823f68f656a72fa56fecb92fafbe84ec3712805ec0bd5a903fde6ea33cd05dfc57027800bc516c7538
SSDEEP 3072:nX5gE72vcK8s7pTxEl7Onygi9wDO4z4WSYB0JuPr8AjT//PqLVFUYYBHoC:nXX20y7HNz14RU0J1ALqDUBHoC
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

1c:ef:4f:92:07:0e:72:8a:89:04:69:b1:b5:fe:a5:67:f5:b4:41:92:6a:c2:96:52:db:71:f9:9e:ad:55:1b:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=FSS,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

Minor OS version

0

Major OS version

10

Entry point

149648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

KernelTraceControl.pdb

msvcrt

malloc free ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ memchr memmove_s wcsstr _stricmp ?terminate@@YAXXZ ldiv memmove _vsnwprintf wcschr wcsncmp _vscwprintf _wcsicmp _gmtime64 _purecall ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@XZ _callnewh ??0exception@@QEAA@AEBQEBDH@Z _CxxThrowException memset calloc _memicmp towlower wcstol iswdigit memcpy _wcsnicmp _wcslwr_s wcscspn strrchr wcsspn realloc _errno _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ __C_specific_handler _initterm _amsg_exit _XcptFilter __CxxFrameHandler3 wcscpy_s wcslen vswprintf_s wcsrchr memcpy_s wcscmp

user32

UnregisterClassA

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2 CoCreateGuid

oleaut32

SysFreeString SysAllocString

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlGetVersion

kernel32

InterlockedPushEntrySList VirtualAlloc InterlockedPopEntrySList VirtualFree SetFilePointer ReadFile GetModuleFileNameA GetModuleHandleExW GetWindowsDirectoryW FindClose FindNextFileW GetFileSize FindFirstFileW GetTempFileNameW GetTempPathW WriteFile DeleteFileW FindResourceExW LoadLibraryExW GetExitCodeProcess WaitForSingleObject CreateProcessW CopyFileW CreateDirectoryW CreateFileW CreateFileMappingW GetDllDirectoryW SetDllDirectoryW GetSystemInfo GetModuleFileNameW DeleteCriticalSection RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVersionExW VirtualQuery FreeLibrary HeapAlloc HeapFree ReleaseSRWLockExclusive GetProcessHeap AcquireSRWLockExclusive GetLastError GetProcAddress LoadLibraryExA VirtualProtect HeapSize HeapReAlloc HeapDestroy GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringA MapViewOfFileEx UnmapViewOfFile CloseHandle FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW GetSystemWindowsDirectoryW FindFirstVolumeW GetVolumePathNamesForVolumeNameW QueryDosDeviceW FindNextVolumeW FindVolumeClose LoadLibraryW SystemTimeToFileTime GetCurrentThread GetModuleHandleW FlushInstructionCache

advapi32

EnableTraceEx CloseTrace UnregisterTraceGuids RegisterTraceGuidsW ProcessTrace TraceEvent EventWrite ControlTraceW OpenTraceW StartTraceW RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumKeyExW

bcrypt

BCryptGetProperty BCryptFinishHash BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

Name

.text

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

932B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

amd64/msdia140.dll

IMPHASH 4ffb46397be88428dc9b52b857d964e5
SHA256 25a17a77163d1f18d780b06546dbe53c49d184c08cae60598b81cce655c53e34
MD5 c241e5b86b651da6e2b8fd9b07660635
SHA1 bc7317c284770245116b4a77c6d454970625fd19
SHA512 1b8e06fc562413b110f2ed8ee752f704948a77c4f4b8d855d1f14a91f9d3cbaaeead625b11d82d655613e89b7345c3299ddadc0fa9bcdad400068916587894be
SSDEEP 12288:Ppo5lxPC6r9vjOqfmX/yyOZWS6ggBwCX0dX007AedX0oHQUcV8gv2MQo0pzx:xo5lxdoz/yl4rEdE0cedrQPV8gut7x
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

37:15:65:4a:7a:2e:e5:34:11:4f:4e:57:f1:39:5f:bf:97:2e:38:cb:c0:09:4d:7d:3d:b5:d4:86:d1:d9:ab:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

PE Signature issue

Digest

4c:9a:1f:4a:d7:0e:66:60:16:3f:69:b3:e9:69:6a:68:4b:04:df:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

561704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

msdia140.pdb

kernel32

SetLastError FindResourceExW LoadResource LockResource SizeofResource MultiByteToWideChar LoadLibraryExW GetProcAddress LocalAlloc LocalFree GetModuleFileNameW GetLastError GetSystemInfo InitializeCriticalSection DeleteCriticalSection LCMapStringW EnterCriticalSection LeaveCriticalSection CreateFileW GetFileSize CreateFileMappingW MapViewOfFile CloseHandle UnmapViewOfFile RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW LoadLibraryExA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList SetStdHandle GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW ExitProcess GetModuleHandleExW WideCharToMultiByte HeapFree HeapAlloc GetACP GetStdHandle GetStringTypeW WriteFile CompareStringW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCommandLineA GetCommandLineW FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetFileAttributesW SetFileAttributesW VirtualAlloc VirtualFree DeleteFileW DeviceIoControl ExpandEnvironmentStringsW GetFullPathNameW GetDriveTypeW SetFilePointer MapViewOfFileEx FlushViewOfFile GetCurrentDirectoryW

Name

.text

Size

942KB

Virtual Size

941KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6cad8c254404466afc57402bf9c69f92dcce2f76cdba19784cc1057e85e000f
MD5 769d127c68a3610c54927317035ab647
SHA1 f1c3cd0eecbde4e506ec17fe3e63062d704978c6
SHA512 23350def1e9c76f6d7d797674f07157ef3e6a1808bf19023737f5919ef6cced8ea071625dfcc34c0ad7b1a3e6605da71e6559e88ac6397f79e77b2a4293159c6
SSDEEP 3072:fDS6s11CNtSu01ck48ChK8CShUlNIUAQwXaQ5edod9hoiexKcMva3rdY07c8cC:mzWMGN8CckUnAt5edod9hoisKbvydvwC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ca:7f:3b:34:61:47:aa:48:4a:cd:33:bb:f4:1e:0d:32:31:2a:bb:2f:7e:6a:77:fc:2a:07:0b:c1:7b:d4:cf:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

6a:a2:93:e1:1c:32:0d:9d:95:1e:0b:9f:c5:ab:f8:59:7b:cd:3e:97

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

203390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Dev\protobuf-net\protobuf-net\obj\Release\protobuf-net.pdb

rsEngine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 284b7b5340954a1c4cc8c43d2ff360aae111fd8f206449e6393cd540008bb73b
MD5 8b654a0708cf9745b23d15ea14f6edcd
SHA1 fdc0887902c11aefa9e8101d79c18b259c302cc9
SHA512 168e230e3c9541778bbc95b5a099e352ceb88fe60a8894c75aef9bc40f3c03e69d18b7a8e08ae7eebd375e169e96e378da176dda120cb284c3f2c813b732ecb9
SSDEEP 98304:zZidNdPBTNSX7N0mgyUpkBx4wYzt8FQxlgmZyFyUmh:FidNhBTAmm5UpkBx4VS/4y5mh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

cf:38:19:a1:19:9b:0d:f7:14:22:e6:8d:0a:a0:e0:e1:be:e8:3f:d9:53:d8:40:9a:92:8b:55:8a:70:f9:fb:48

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

94:a7:11:35:59:bd:03:d1:78:7b:26:2c:24:1b:52:ea:b0:1b:02:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

5409134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsEngine.pdb

rsEngineHelper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9ff1044e98dda446288cb66a8be658f788d0d549603ec396165b8d8711badbce
MD5 d7832b318e3157867e0816ae9d2863d0
SHA1 d722aaec7dff72bbc6009fdd9da3f2159f3270fb
SHA512 4f983d0242b9f70fdd3a575df1da6440d35cf3d982f5b2ef31e054c601af3e23694a3b06de265d22e8ff3353d3046518d77d61ad3856463ed77e55d3555330ec
SSDEEP 3072:+QANP8qyB/E4w4VT3ezu5iIOszEqv9CR/WR6M7TOVaR4mwmdzmAq:+QKEPXHFJOy7vw9WR2STwmd8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e1:a3:66:ef:75:f5:15:3a:cb:94:ed:5e:42:f9:d6:e8:ae:89:a2:7a:52:aa:87:23:a9:94:88:ad:5f:c0:7a:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

35:58:72:08:0d:84:69:6d:4c:67:60:86:41:88:c0:19:1f:0a:7f:e1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

156174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

rsEngineHelper.pdb

rsEngineHelper.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

rsMessages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 524cfd284095e82ba88be8e314cb885c31e070e457c855e18d887a6cf1f4c138
MD5 004863838ba1cc3c1b7d7813c49dc982
SHA1 6f79fddb7e90036573326dc1beefb70e1edb23bb
SHA512 e6f8766069c7c6fb9c28e2daa70fdfb273700461d918d689d26397ebfb6394ec3380f954c7a3a757e16572225396552bf27edb3047fb85f5438da4f9aa89e10c
SSDEEP 3072:V/d0FBdGm8bHsbAIr77AF4W6MkqGaQvjeUpPCKCICmbNK4Ch47Yv7:1dsBdi+ASC4qkFreaHNbN6X7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

80:18:bf:1e:fd:14:c5:40:34:7e:ea:bb:43:b3:40:38:ef:93:39:d9:0e:a1:90:d4:f2:bd:63:19:b4:1c:85:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

db:51:8e:cb:bb:5f:d6:b4:45:24:79:1b:78:11:7b:94:64:93:6e:a9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

225182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsUtils.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bf43db06565a3c2be6674798c1d25deabf1d2ef512448c2d1e5849d0c599bcc
MD5 d81a2e71b49ee65c6e1cbf50884f8d2d
SHA1 c62c780e49f3f6bacc9393c25eae95a4515ca84c
SHA512 c50c69b0acd0cb6f31b4409da446da91046e2190bbe0d095591b58691d7d1a2a2b3e2cf0d29ed438137c4f09fc295a5815ce3b4a1c7d5129ad92e74ebeb39223
SSDEEP 3072:4mr0sEDIsXbuw42+GGZyj++a9x2bFudiRSvtaHcyv/TLNjmqNEBlG1oT76RSxvTY:4mrExuw42iZyj+d9xF4gkTB6qaiZIxwL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9a:9f:f9:84:c0:69:39:24:ce:c1:78:95:a7:d4:2f:e8:7e:03:d2:76:35:98:22:a0:5e:c5:75:09:6b:24:66:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

3e:9f:76:3b:b9:c4:34:f9:59:94:bf:d8:b0:13:8d:1b:b6:67:13:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

212606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsUtils.pdb

websocket-sharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad2198980710144c2a0ac307aaa64fca40a9c61ad8f9053ecb9a98e51b8b2903
MD5 754230b48d13302829cea23478d3d37a
SHA1 2a14f33d38dc75c94bdf4d7184d8e32361abb865
SHA512 c0b7c1f420e69d9bb55b89ae0553d869983164fe9aa2b8fb227cebe55fa14d513e269fa069761a15b4db6406ca28c12ee631a901568fdba478e562065c3b2644
SSDEEP 3072:dLixO6zz8t4OXDegbQy058MP2pZrCmrrDse0ecdfF7b2gqEiyDvSmqtNlVusC51v:On8nDenoRXoJF3bqEiyzZ5m1FsgUbB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

dc:d8:82:a7:65:90:9e:36:34:e1:49:6f:6f:9b:5d:e4:40:25:e2:22:4b:fe:38:4c:28:94:0d:ce:85:7f:a9:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

24:7a:e3:11:35:fa:c5:20:7d:9f:6d:44:33:d7:49:42:ca:a4:0b:f7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Sep 6, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

256382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

x64/7z64.dll

IMPHASH 6d89e7e08f512aa455dc1d1f650e3a43
SHA256 aab74d4dafcdf1e79af4e890ff5bac699054be47369e9c0e54de099300ae2475
MD5 d520af083b507c0300895b2b970a31e0
SHA1 8825006b8ad201f8c8efb1c73b7b602db00d8d13
SHA512 0a1345cfe442e5bbe89da52e34483fd336df93c70e31c3a6869ee44b33d5cfb31fef4e9330daa9dd88ae4f2a72a7ee8d9afb252c36329078980c449e415cc0fa
SSDEEP 24576:oypThlU0gui35R/T/cLa2vzVbkjEwRPCJlothl3A5v7Yt:npTBgui35VoeEqPWEhpA5U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1142608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

oleaut32

SysStringLen VariantClear VariantCopy SysAllocString SysAllocStringByteLen SysFreeString SysAllocStringLen

user32

CharUpperW CharPrevExA

msvcrt

strcpy memset realloc free malloc __CxxFrameHandler strlen strcat strstr _CxxThrowException wcscmp strcmp memmove memcpy memcmp _purecall strchr __C_specific_handler _beginthreadex ??1type_info@@UEAA@XZ ?terminate@@YAXXZ __dllonexit _onexit _initterm

kernel32

GetProcAddress Sleep InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject VirtualFree VirtualAlloc QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection LocalFileTimeToFileTime WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatusEx GetSystemInfo GetCurrentProcess GetProcessAffinityMask CompareFileTime WriteFile ReadFile GetFileAttributesW GetModuleHandleA FindFirstFileW GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle CreateFileW SetFileAttributesW GetModuleHandleW CreateDirectoryW DeleteFileW GetTempPathW SetLastError GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose

x64/System.Data.SQLite.dll

IMPHASH 2a50915b9efde2a35c3cafb7dfe4efd3
SHA256 96e8dad51e66b3ee02a5ff00a310fdbfa1d7946d1c92b40fd65acc55de10a738
MD5 e83262d8b431e2fe508bc4a113baff16
SHA1 45f849fa7471b6803c721d7c115a301e7d01ee3d
SHA512 15e8e9f4acf2bc0456ae273d4e52243ebdc3dd6074fc20b2524b54b7aad436cd803c5618fa105464040c96acabf0b40cda15c98a2b78d28d3251cbbc3acf22ae
SSDEEP 24576:FA7R6v03fXL/A15KUIBL53oDAdDliZy46NWzrVtZ4dQTN:FTvczkLIBLRoDAd6iwtZ2QTN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

Digest

9e:6b:da:30:5c:55:8d:34:0f:f3:cc:05:40:6e:23:04:00:a9:97:25:f5:1f:2a:1d:b5:94:ef:25:35:c7:77:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

90:d4:b1:dc:61:a4:ac:f9:8e:e2:44:e0:9e:b6:45:2f:8f:4c:16:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

2

Major OS version

5

Entry point

1199312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\bin\2008\x64\Release\System.Data.SQLite.pdb

kernel32

UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate MapViewOfFile ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA GetFullPathNameW TryEnterCriticalSection SetFilePointer HeapCompact CreateMutexW GetFileSize CreateFileA HeapReAlloc GetFullPathNameA GetFileAttributesW DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess

advapi32

CryptAcquireContextW CryptHashData CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptDeriveKey

msvcr90

tolower _beginthreadex strncpy isalpha rand_s toupper _encode_pointer _malloc_crt _initterm _initterm_e _encoded_null _decode_pointer _amsg_exit __C_specific_handler __CppXcptFilter __crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _endthreadex _errno strerror _localtime64_s qsort calloc free strncmp memmove memset memcpy memcmp tanh tan log sqrt atan2 floor ceil pow exp log10 cosh sinh cos sin atan asin acos

mscoree

_CorDllMain

interop_compileoption_get interop_compileoption_used interop_libversion interop_sourceid sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_finish_interop sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_double_interop sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_int64_interop sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_parameter_name_interop sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_close_interop sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_changes_interop sqlite3_clear_bindings sqlite3_close sqlite3_close_interop sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_database_name16_interop sqlite3_column_database_name_interop sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_decltype16_interop sqlite3_column_decltype_interop sqlite3_column_double sqlite3_column_double_interop sqlite3_column_int sqlite3_column_int64 sqlite3_column_int64_interop sqlite3_column_name sqlite3_column_name16 sqlite3_column_name16_interop sqlite3_column_name_interop sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_origin_name16_interop sqlite3_column_origin_name_interop sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_table_name16_interop sqlite3_column_table_name_interop sqlite3_column_text sqlite3_column_text16 sqlite3_column_text16_interop sqlite3_column_text_interop sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_collcompare_interop sqlite3_context_collseq_interop sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_disposable_module_interop sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_interop sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_cursor_rowid_interop sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errmsg_interop sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_finalize_interop sqlite3_free sqlite3_free_table sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_index_column_info_interop sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_last_insert_rowid_interop sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_malloc_size_interop sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_highwater_interop sqlite3_memory_used sqlite3_memory_used_interop sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open16_interop sqlite3_open_interop sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_interop sqlite3_prepare16_v2 sqlite3_prepare_interop sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_reset_interop sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_double_interop sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_int64_interop sqlite3_result_null sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_table_column_metadata_interop sqlite3_table_cursor_interop sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_double_interop sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_int64_interop sqlite3_value_numeric_type sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16_interop sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_text_interop sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

x64/ext_x64.dll

IMPHASH 4b7c40598d9f35ed158d6be672b11e32
SHA256 62565d578673e67c39781b0fb30eaa664e0c102d3e8f74cb01d2f25d81fb78df
MD5 710437238afd49535c6e8e68fed595fe
SHA1 6dd04a3669ec8f5ffd9a430513afede1f284f074
SHA512 cf2a2b1043977bfe7759af999690dde96023bf6ec26c2a0322244eb5c04c94cf996a3f297efc9ac68c95b6d72e847576068d24c7f89922502c82f13570c6e296
SSDEEP 6144:MBYqz/61Z2lKHQM/QX1ahKrJQRB2XHbV7iFGrwGav4VohWrtdmeG:MJ/UIwQM/qo4rGREXH1o8zG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

4b:a0:15:8a:1b:ca:77:54:6e:75:fd:65:cb:e5:e9:a0:81:ab:54:58:0f:05:60:81:38:5f:de:4c:3f:58:40:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

21:19:e9:64:2d:1f:79:99:3f:70:77:be:5d:c8:c9:c5:2e:f4:84:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

90272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Documents\Visual Studio 2015\Projects\Chrome extensions removal\x64\Release\Native.pdb

kernel32

GetComputerNameW GetCurrentProcessId LocalFree CloseHandle GetLastError GetCommandLineW WideCharToMultiByte GetVolumeInformationW SetEndOfFile EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlPcToFileHeader RaiseException FreeLibrary LoadLibraryExW RtlUnwindEx InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile SetFilePointerEx FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW

advapi32

CryptCreateHash CryptHashData CryptDestroyHash ConvertSidToStringSidW CryptGetHashParam LookupAccountNameW CryptReleaseContext CryptAcquireContextW

shell32

SHGetFolderPathW

Name

.text

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/lz4_x64.dll

IMPHASH 56a12c5117bc05a7f10f116be39e1875
SHA256 3f022e4c52a61751b5fed98cda2ca8bbcb6bf39f7e47bb40fc17becbb67101a1
MD5 3d92f66ee9e49cedd6316f8fbbeeb3c8
SHA1 ae9fb8a1e1205d8de1541b180dee226be6ed35c1
SHA512 9e7b408d5b9f1725402ebacea323614a81ab2ecb8e45cd7dd5a788c7f11cedc4f2ca10b381a689b78ba6f8c95c3cde2294578a2bba7482bca731446996a14324
SSDEEP 3072:dvysFz2cyiAtLfc57mfngv6ALQ09tNdUNtDfBv5XvEX6cSYAUL:dvy6z2GAtLfcCgv6ALehJcN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

3b:ef:f8:73:c7:43:7c:a5:b9:3d:02:b8:6c:82:f1:43:8f:32:42:da:21:b7:be:97:a7:6c:18:73:51:45:d3:5d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

5c:ab:4b:53:ea:b0:1f:7f:19:43:b0:a3:59:b5:71:64:62:2d:f3:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

12100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\source\repos\FFHelper\x64\Release\FFHelper.pdb

x64/rsEngineFW_x64.dll

IMPHASH c042f48bb3a63d2b5f2cbb0f0010de7d
SHA256 8a1eff4a86e223dbe808bde5d728367b03e7593b514f5cd9c49387e6ac4b57c5
MD5 a82484553da1a7a4ce4f5eda236b7207
SHA1 3e56d504d2283653165d78a238c97469a28e5de2
SHA512 03d193de85c8022c746e9f99a0e989cc42445d67fe32a31093e66b4e5e9dd25a4103fbb2e93ffc54401d99d40c3ae519dff7db999d64bc7f3cf0af59d82f3681
SSDEEP 3072:IRIyAKjZ/ouxZ4PqYC5u7mhQajGGpRsBQQ8lGBKEtjotdFw:O4KjZh4PqYC5uo2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

c9:f1:62:12:48:b8:aa:4b:83:26:e3:03:ad:7f:13:c1:77:5c:f1:85:72:03:25:75:d2:38:78:55:a5:40:0c:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

37:da:d5:bb:44:f8:b8:f2:e0:77:42:53:81:e7:19:c4:35:f8:21:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

6212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\USN-journal-lib\x64\Release\USNJournal.pdb

x64/rsEnginePM_x64.dll

IMPHASH 3cc050d3ea3cbea4f3fbdec2dfd74bb9
SHA256 a4d7f4259cf04e7299f5ab6fe2ceb95680e35427d613aff26dc27d954b8311c2
MD5 15cf59afcaff08b12d37f2d7c9f6ed81
SHA1 1d0464d1f13ffe71ff12556c433d95f168a1cfb2
SHA512 e35196ae1367a7cae677f1c90dff7a186a03a95a9b7ede67e1c2d5c98db03d1b6e2ae868efae0c8ee12ee8b4067d0fa36139cb514d7d01982f756c0c6db47629
SSDEEP 6144:JO5qSSjpZlPl9BPMrGfmkWh68nk/mXdhohHCbs:k5ojpZlPyrGfmF6gdhoxX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

23:8c:6e:be:1d:72:de:77:6e:cd:a5:3a:b8:4c:07:6f:6a:52:ed:c8:03:4e:39:33:4b:54:71:16:2d:a2:49:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

8c:66:b1:75:a0:a5:ea:79:2d:c6:70:6a:9e:43:93:06:f0:6d:66:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

20380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\PatternMatcher\x64\Release\PatternMatcher.pdb

kernel32

WriteConsoleW CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte GetLastError EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwindEx FreeLibrary LoadLibraryExW RtlPcToFileHeader RaiseException InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap ReadConsoleW SetStdHandle HeapSize CreateFileW

x64/rsLggrServer_x64.dll

IMPHASH c2d3ec8558156bc03731e57c3c3be59a
SHA256 d67999fe774e5e0f1c18cd5a4da7d6518faa00b8e950e41737e225b615a1b4f5
MD5 27236a42b9810c5db8490693c158c838
SHA1 3cb8d0f4b818f120afe2447c9b01af674af3a9f2
SHA512 97e9c8921caeecbe144ba11be3675365b5bbd92bf45bbe91e9a37c472fe2153f1f250e8e5b8a37d927605a0897d997228d7351476bbc40f9647737c14022411f
SSDEEP 24576:PB/RLBgBU017cs1yj9ur5MpB6bsq3v15y2U:PB/xB0TQXu+Cyn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

Digest

57:5e:ea:07:f0:b8:e2:6b:7d:37:e7:80:c3:4b:ac:f7:ff:6d:36:60:2b:01:ef:55:d0:cd:ae:8d:ae:dd:1c:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 22, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

e4:c4:1b:c0:c9:07:d2:65:a9:76:7e:5e:45:42:83:8d:53:df:f7:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 22, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

2

Major OS version

5

Entry point

247608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\logger as dll\cpp-logs-lib\Logger\x64\Release\Logger.pdb

kernel32

GetFileSizeEx InitOnceExecuteOnce EnterCriticalSection FindNextFileW ReleaseSemaphore RemoveDirectoryW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetEndOfFile GetTempPathW FindClose WaitForSingleObject CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA QueueUserWorkItem MultiByteToWideChar Sleep FormatMessageW GetLastError FlushViewOfFile DeleteFileW CloseHandle GetSystemInfo FindFirstFileW SetFilePointerEx CreateFileMappingA LocalFree DeleteCriticalSection GetModuleHandleW CreateSemaphoreW WideCharToMultiByte MapViewOfFile GetTickCount MoveFileW FlushFileBuffers GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetProcessTimes CreateEventW SetEvent ResetEvent GetMailslotInfo CreateMailslotW GetCommandLineW lstrlenW GetModuleFileNameA GetLocalTime ReadFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetProcessHeap ReadConsoleW SetStdHandle DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlPcToFileHeader RaiseException RtlUnwindEx ExitProcess GetModuleHandleExW ExitThread ResumeThread GetStdHandle GetFileType WriteConsoleW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteFile GetConsoleCP GetConsoleMode GetACP

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shlwapi

PathFileExistsW

dbghelp

MakeSureDirectoryPathExists

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

514KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/7z86.dll

IMPHASH 77f306126855a0e2b18a1df504ca2a48
SHA256 25a52dd0a38f58001779b12e84c2937aa52a922a4db9c43fa89214f11a3f4766
MD5 a8f57d77bac092272792730872a1d8f7
SHA1 e85d4eb97ed735bbf209c7fbcc8f6d37d70fcb36
SHA512 bfba966b23292adfe38d2bbc36cae6fce8465ba4f30a7fd8fb4e51aaef5126363b11bc3e352ad267a9a64b18ea083974ce94e431b4cc40238951f9015df4578d
SSDEEP 24576:Oi6tfenkDGFiGi/7KQNLjoonYynrnJUTqrbL44HdvWZX:O/zDGwGi/7KBynrnaGvn9vWZX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

821785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocStringByteLen SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantCopy VariantClear

user32

CharPrevExA CharUpperW

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex strchr strcat strcpy memset realloc free malloc strlen wcscmp strcmp strstr _CxxThrowException memmove memcpy memcmp _purecall __CxxFrameHandler

kernel32

GetModuleHandleW InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject InterlockedIncrement VirtualFree VirtualAlloc QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection GetVersionExW LocalFileTimeToFileTime WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask CompareFileTime WriteFile ReadFile GetFileAttributesW GetModuleHandleA GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle CreateFileW SetFileAttributesW GetProcAddress CreateDirectoryW DeleteFileW SetLastError GetTempPathW GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW

Name

.text

Size

837KB

Virtual Size

837KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/KernelTraceControl.dll

IMPHASH 7aa3e418f32a7883636527cd6670389d
SHA256 34025caa3a4b8b367ecfdf8f9089da88b8513ef81cce173251632b6e623efcc2
MD5 d477038336c4f2f1d2aee9536abc4253
SHA1 9d89bbdf1374b16364485dd3a7e418021806c8e6
SHA512 e2b5b3d6dc31a0ce636c5bbeb4a521edc684d344d5cc44650abb633d4249bd045ad602698681e95cc687f45cd105cde9237f8ed29dbbd3a7b624ef026cc46c8a
SSDEEP 3072:1EB80UdbtqrPRsWDkoNcKbnqqsR2jO1eDbNMU4AjHNys4VW0cWBHoa:1EBJUdbGHb5rz5KJHoa
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a6:03:bb:c5:f6:f5:8c:47:91:73:15:22:bf:5e:4b:02:e5:a1:9f:61:a3:73:91:bf:50:f8:5a:fb:ec:42:bc:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=FSS,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

Minor OS version

0

Major OS version

10

Entry point

129280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

KernelTraceControl.pdb

msvcrt

free malloc wcstol iswdigit _wcsnicmp _wcslwr_s wcscspn ?terminate@@YAXXZ wcsstr ??0exception@@QAE@ABV0@@Z towlower ldiv memmove _vsnwprintf wcsncmp _vscwprintf vswprintf_s _wcsicmp ??1exception@@UAE@XZ _purecall ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@XZ _callnewh _CxxThrowException memset calloc _memicmp ?what@exception@@UBEPBDXZ strrchr memchr wcsspn _stricmp _except_handler4_common realloc _errno _onexit __dllonexit _unlock _lock ??1type_info@@UAE@XZ _initterm _amsg_exit _XcptFilter __CxxFrameHandler3 wcscpy_s wcslen wcschr memmove_s wcsrchr _gmtime64 memcpy_s memcpy

user32

UnregisterClassA

ole32

CoUninitialize CoCreateGuid CoCreateInstance StringFromGUID2 CoInitializeEx

oleaut32

SysFreeString SysAllocString

kernel32

InterlockedPushEntrySList VirtualAlloc IsProcessorFeaturePresent InterlockedPopEntrySList VirtualFree SetFilePointer ReadFile GetModuleFileNameA GetModuleHandleExW GetWindowsDirectoryW FindClose FindNextFileW GetFileSize FindFirstFileW GetTempFileNameW GetTempPathW WriteFile DeleteFileW FindResourceExW LoadLibraryExW GetExitCodeProcess GetDllDirectoryW SetDllDirectoryW GetSystemInfo GetModuleFileNameW DeleteCriticalSection RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVersionExW VirtualQuery FreeLibrary HeapAlloc HeapFree ReleaseSRWLockExclusive GetProcessHeap AcquireSRWLockExclusive GetLastError GetProcAddress LoadLibraryExA VirtualProtect HeapSize HeapReAlloc HeapDestroy GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringA WaitForSingleObject CreateProcessW CopyFileW CreateDirectoryW CreateFileW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile CloseHandle FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW GetSystemWindowsDirectoryW FindFirstVolumeW GetVolumePathNamesForVolumeNameW QueryDosDeviceW FindNextVolumeW FindVolumeClose LoadLibraryW SystemTimeToFileTime GetCurrentThread GetModuleHandleW FlushInstructionCache

advapi32

RegisterTraceGuidsW OpenTraceW CloseTrace ProcessTrace TraceEvent EventWrite RegEnumKeyExW UnregisterTraceGuids ControlTraceW EnableTraceEx StartTraceW RegQueryValueExW RegOpenKeyExW RegCloseKey

bcrypt

BCryptGetProperty BCryptCreateHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider

ntdll

RtlGetVersion

version

VerQueryValueW GetFileVersionInfoSizeExW GetFileVersionInfoExW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/System.Data.SQLite.dll

IMPHASH 846757f2893c6a863034e9ea1604929d
SHA256 5a48670db25702d8d96f77b7b039d08a3eb18d392fa80b066b8f30e44c80f5fc
MD5 36482f3132134178267ec1e8611f83ed
SHA1 81600eea36a05b9e0bbebeabdd130c2e277f5889
SHA512 2ca50791ff42388d026d3d804fe4cfc70ede7d93edb88e89bf7d39e7819ce8d6b33ce170832bed674b75cd168f1cd092d9a91fe487eeb834cd32af1196e3db35
SSDEEP 12288:L9bc1JlpgLoZiGoguR57hgen17v8mV14o5IcMCq6X7w+Z/1SrOfMXpeWGepLMrmQ:2NFZFQRrgO7SGMkFFkqueWzZoxqJ4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

5d:bf:19:be:9c:bd:cf:9c:b4:52:e5:d5:84:10:a2:d9:16:7a:94:ef:bb:9f:13:e2:b5:f2:c2:30:4f:62:fe:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a2:02:d9:74:66:e4:6b:a9:5f:94:4d:b1:f7:7d:52:9c:33:06:59:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

0

Major OS version

5

Entry point

896634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\bin\2008\Win32\Release\System.Data.SQLite.pdb

kernel32

UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate MapViewOfFile GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA TryEnterCriticalSection SetFilePointer HeapCompact CreateMutexW GetFileSize CreateFileA HeapReAlloc GetFullPathNameA HeapValidate GetFullPathNameW DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedExchange

advapi32

CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptDeriveKey CryptAcquireContextW CryptHashData

msvcr90

strerror _errno _endthreadex tolower _beginthreadex strncpy isalpha rand_s toupper _encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common _localtime64_s qsort calloc free ceil strncmp memmove memset memcpy _CItanh _CItan _CIlog _CIsqrt _CIatan2 floor _CIpow _CIexp _CIlog10 _CIcosh _CIsinh _CIcos _CIsin _CIatan _CIasin _CIacos

mscoree

_CorDllMain

_interop_compileoption_get@4 _interop_compileoption_used@4 _interop_libversion@0 _interop_sourceid@0 _sqlite3_backup_finish_interop@4 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_parameter_name_interop@12 _sqlite3_blob_close_interop@4 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_context_collcompare_interop@20 _sqlite3_context_collseq_interop@16 _sqlite3_create_disposable_module_interop@112 _sqlite3_create_function_interop@36 _sqlite3_cursor_rowid_interop@12 _sqlite3_errmsg_interop@8 _sqlite3_finalize_interop@4 _sqlite3_index_column_info_interop@32 _sqlite3_last_insert_rowid_interop@8 _sqlite3_malloc_size_interop@4 _sqlite3_memory_highwater_interop@8 _sqlite3_memory_used_interop@4 _sqlite3_open16_interop@20 _sqlite3_open_interop@20 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_reset_interop@4 _sqlite3_result_double_interop@8 _sqlite3_result_int64_interop@8 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor_interop@12 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

x86/ext_x86.dll

IMPHASH 080fee03f4d4d9faf1aaa3e7c31f55ff
SHA256 c0b435df63dad920cf9c2645174c1a52ec640d267a7bf1bf1ae049f985aea219
MD5 5627ce03cda5546a942d264c76d6e49f
SHA1 54f22e629c9ffe61cd2a924ee79a7a5134d0d0f0
SHA512 9728bb25e88fbd44f3373e9a861c42570dda9d84d5762d0fd5ffae5439f9b80f0113f0529a2d8ef8cd6dd0d2b0ac612358cd64a95604234f092214f527511c48
SSDEEP 3072:s+MW9X+GarEJo/GdTg9IK9x9/XyRaTITqRWChmhdNdLGCPIAmAg0FujoX2xVKTmZ:F9baQfdB0xlyeRWChmadAOODic5k
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4b:73:4a:aa:2a:97:12:96:84:63:1f:12:db:35:eb:00:54:4d:71:91:de:68:46:4d:1d:44:6e:7c:cd:c7:9a:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

9c:99:ea:a8:34:d3:03:69:86:18:0d:9e:f2:d5:c3:01:03:21:dc:18

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

51759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Documents\Visual Studio 2015\Projects\Chrome extensions removal\Release\Native.pdb

kernel32

GetComputerNameW GetCurrentProcessId LocalFree CloseHandle GetLastError GetCommandLineW WideCharToMultiByte GetVolumeInformationW SetEndOfFile EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FreeLibrary LoadLibraryExW RaiseException InterlockedFlushSList RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile SetFilePointerEx FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW

advapi32

CryptCreateHash CryptHashData CryptDestroyHash ConvertSidToStringSidW CryptGetHashParam LookupAccountNameW CryptReleaseContext CryptAcquireContextW

shell32

SHGetFolderPathW

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

596B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/lz4_x86.dll

IMPHASH 8013a2893be8dab7d66fddd13005e905
SHA256 77eaeebfcbf6cedd3069f28678c8276d1f9fe7afbe4ece41d4bab8aafd7f5c94
MD5 ca299e8c7c0292102a144c9f6bf4ac89
SHA1 8142e54e5ebd661ff1ba5d9a5f93786166389cfd
SHA512 97f17146d18a7504eac4ce6f0942f76dfc307aa5298fdee2789b866ba323ae5927e1186f6f4ce3c7d0bd9402d3f5436b66052962d5e55d743e5bef8d6b40269d
SSDEEP 1536:b/j45ZAG6fcsGSYfiycPgmhNMF1BAsuLSsWgcdWpzP/ag3X13XSghn:b8nV4ISqiFPNNnjLOWpzPiuJD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ec:e6:df:7e:f9:f2:2a:ba:5d:16:93:fb:2d:6d:b4:bb:4d:21:30:d9:ea:3f:d6:de:b0:48:b9:77:45:1c:3d:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

51:ab:bc:0e:cc:94:c2:74:d3:84:2f:c2:17:94:78:34:52:cb:0d:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

11576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\source\repos\FFHelper\Release\FFHelper.pdb

x86/msdia140.dll

IMPHASH eac4915c289cf0d5ad198e365faf0f5e
SHA256 00721b85bca70226d4d6f756c7527d71b526c949a0b603c3c17a4c3da4612bb1
MD5 ddc85eff55a22dc0992cbf5a1ea82aaf
SHA1 16c197deb0deab617a2752e0be832f9795a998f0
SHA512 ee2319732d83466afaa6772e126e5ddc8ec9f37c78a5c0402cb2000887006936a8b13e68bb4cf549ec4107995cc93f08fd1cea46d97cf5676a2b076bcc6008c7
SSDEEP 24576:vJvWSoylP9NIiD9PrN4zRSSw6quolZQ1y6rQ3ZvEHIFxT/u:vD4TwBjQ866EHIF1/u
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

dc:ab:8f:a6:52:35:e7:c8:5e:47:62:89:6c:56:6a:83:37:c3:30:fe:49:fe:5c:a1:28:a8:54:53:5a:b2:5b:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

PE Signature issue

Digest

18:35:89:8b:e6:f0:7a:75:66:83:c0:83:b9:f2:de:32:4e:ca:44:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

585407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msdia140.pdb

kernel32

SetLastError FindResourceExW LoadResource LockResource SizeofResource MultiByteToWideChar LoadLibraryExW GetProcAddress LocalAlloc LocalFree GetModuleFileNameW GetLastError GetSystemInfo InitializeCriticalSection DeleteCriticalSection LCMapStringW EnterCriticalSection LeaveCriticalSection CreateFileW GetFileSize CreateFileMappingW MapViewOfFile CloseHandle UnmapViewOfFile RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW LoadLibraryExA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList RtlUnwind SetStdHandle GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW ExitProcess GetModuleHandleExW WideCharToMultiByte HeapFree HeapAlloc GetACP GetStdHandle GetStringTypeW WriteFile CompareStringW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCommandLineA GetCommandLineW FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DecodePointer GetFileAttributesW SetFileAttributesW VirtualAlloc VirtualFree DeleteFileW DeviceIoControl ExpandEnvironmentStringsW GetFullPathNameW GetDriveTypeW SetFilePointer MapViewOfFileEx FlushViewOfFile GetCurrentDirectoryW

Name

.text

Size

920KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/rsEngineFW_x86.dll

IMPHASH 51b6094a35d95093b4849e80d78b09d3
SHA256 7aec33b0c3c6a8edb0fe88e459734ef00e9c2f537bb9be0cace1286b00dec6a2
MD5 9f0f9cf8d69f2bc4d7e19fdb038b91bf
SHA1 840b81683f836fb1400501a5f0299de7f3a64819
SHA512 23789d380f68bf22cc17bf098d47951df1ef13212c2949d67e967d20696cc4eaf703913cd1a653d67cc8d5589e3c95c4e56662be93ba8be746fdb85924ebc43f
SSDEEP 1536:NoLCs7Du4gsAh/aVcDsu00/sWTcdSWKiPjmzCv4/0f3XP3XFghz:CrDumAh/PjmSdOjmjcfvu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

70:86:02:c7:1f:6a:5d:d8:cc:5c:c5:5c:58:57:a1:3e:1a:a1:13:aa:0e:49:42:69:99:0e:52:18:40:a6:44:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

dc:b1:55:17:45:4e:46:44:a0:c2:39:c0:14:f0:a1:36:26:3b:86:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

6111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\USN-journal-lib\Release\USNJournal.pdb

x86/rsEnginePM_x86.dll

IMPHASH 0774345fc5653b9904b9ba24f99301e3
SHA256 789faa954b4a18704f863449cc164d9bf010004e5a76da1a12e630327985d553
MD5 2fa41415a9fcec04f6e8073bc984da06
SHA1 1a30b3b35d9a02e3e904d0f8f46449ec96d85800
SHA512 d869cd9995d9a43dc4afdcdf49e74fb32253e97c8d49c4310e4742bc07ec10e077da91f64551d81fecb7e63d42b8a8f75237156df858e5a09ca988e39c86ad16
SSDEEP 3072:WavAeaeomVFEMPZejYAugq5pps99+0LX79HAg0Fujo8urkhWYje+W:WavApYEGZej/q6AO9uw4Y+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

77:71:2b:0f:41:a2:4a:e0:16:b9:dd:da:2e:f7:07:5e:47:cf:b6:a3:25:af:ce:f4:32:52:74:71:f8:70:e0:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

7e:7b:5f:81:c5:2d:a2:0a:ff:9b:a9:0a:1c:28:dc:a8:38:86:fc:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

19535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\PatternMatcher\Release\PatternMatcher.pdb

kernel32

WriteConsoleW CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte GetLastError EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind FreeLibrary LoadLibraryExW RaiseException InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap ReadConsoleW SetStdHandle HeapSize CreateFileW

x86/rsLggrServer_x86.dll

IMPHASH b9a0aeaebe0a5e27046e1187d9c753eb
SHA256 d8312f0c4c72e8cf79e6117f857f4a8b869bd23f649b8378c39de837fbd68586
MD5 9733a6cfafbdb6f0ff1e0b01c8391cf4
SHA1 57cafea144217fded83f6cb5b2b1834e6cc8be9c
SHA512 9d03b1456147835a3b905dce10945fc9cb515f72d949dc638ad8e96a5de5554d920d239ab64864762da90903c1e621e5fb0e93364dfd3b69b6861c8970bce0eb
SSDEEP 12288:PXnfmjOHHMVlWhsIEB1iTTdxji5qTLbFEKpfvBPyo+8cAQh7x4a:PXfmKnM+h6B1ilxjHOCfvBqo1m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

146431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\logger as dll\cpp-logs-lib\Logger\Release\Logger.pdb

kernel32

GetFileSizeEx InitOnceExecuteOnce EnterCriticalSection FindNextFileW ReleaseSemaphore RemoveDirectoryW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetEndOfFile GetTempPathW FindClose WaitForSingleObject CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA QueueUserWorkItem MultiByteToWideChar Sleep FormatMessageW GetLastError FlushViewOfFile DeleteFileW CloseHandle GetSystemInfo FindFirstFileW SetFilePointerEx CreateFileMappingA LocalFree DeleteCriticalSection GetModuleHandleW CreateSemaphoreW WideCharToMultiByte MapViewOfFile GetTickCount MoveFileW FlushFileBuffers GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetProcessTimes CreateEventW SetEvent ResetEvent GetMailslotInfo CreateMailslotW GetCommandLineW lstrlenW GetModuleFileNameA GetLocalTime ReadFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetProcessHeap ReadConsoleW SetStdHandle DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException ExitProcess GetModuleHandleExW ExitThread ResumeThread GetStdHandle GetFileType WriteConsoleW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteFile GetConsoleCP GetConsoleMode GetACP

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shlwapi

PathFileExistsW

dbghelp

MakeSureDirectoryPathExists

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer