bcacbdfa9aec6485e43dcbcb1e24d2a8_JaffaCakes118

resource
bcacbdfa9aec6485e43dcbcb1e24d2a8_JaffaCakes118
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/nsisdl.dll
unpack002/ByteFenceGUI.dll
unpack002/Microsoft.Win32.TaskScheduler.dll
unpack002/x64/7z64.dll
unpack002/x86/7z86.dll
unpack002/x86/rsLggrServer_x86.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/bytefence-installer-5.5.0.7.exe	nsis_installer_1
static1/unpack001/bytefence-installer-5.5.0.7.exe	nsis_installer_2

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 c0ea4bedcce6ebff557298ae4015a010af1fc7e9dc5b40670b441c1a66f42de8
MD5 bcacbdfa9aec6485e43dcbcb1e24d2a8
SHA1 a30cc14f54d7c319c868868ca5676cbcad66480d
SHA512 d93a8fbbade22a6e5bc4705b43da346f37917c0a21c4a169f2d573bee6dd7ca10c4bfbd6bfbf50e367148fc946c6bc48c2b2aebf0960c6d6ba2145ddc2aa949b
SSDEEP 393216:FpAzXLKi/KForUnnXFwtAdPUqJyBTIm1GQvO:FpAfnlAnXFBdPU4yT1GQvO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

InstallTools.exe

IMPHASH fa77b30021c486d95b700f08e9e362d3
SHA256 d7ffd96c98cdcd1bacbe7542b403d60a8b700ab8305de02738f1f1c2d98aa71f
MD5 7bfcafbcc8ee124ce3ea6b098105865a
SHA1 f404c9a50e0740e465106321012c3b7859c999dc
SHA512 02b873be813abc8a50b882bed60ad2c57ad6cba8f83984c30d2ca0b5dba6c5b6427d44626bd2689e179bff539160b78b3ff6b604d1d134a147e41c9861b1600c
SSDEEP 3072:0l7g2UXc+gHjgXqJV0BhZ1hgC5VQ+dVg6tsH3kksA7XDCEtXFD:SkxM+gE607ZEC5VFgkks4Xx9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

9c:b8:95:b5:5c:d3:80:52:2f:d3:9d:b9:fe:26:8d:41:11:d7:9d:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Aug 2, 2018

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

1

Major OS version

5

Entry point

35312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repository\InstallerTools\Release\InstallerHelper.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetCommandLineW GetLastError lstrlenW WriteConsoleW SetEndOfFile HeapReAlloc HeapSize GetConsoleCP FlushFileBuffers CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW SetLastError RtlUnwind ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetACP HeapFree HeapAlloc SetFilePointerEx GetFileType GetConsoleMode ReadConsoleW LCMapStringW GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo DecodePointer

advapi32

RegQueryValueExA RegGetValueW RegOpenKeyExW RegCloseKey RegSetValueExA RegCreateKeyExA

shell32

CommandLineToArgvW

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpCloseHandle WinHttpReadData WinHttpConnect

Name

.text

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bytefence-installer-5.5.0.7.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 223ab46425284dd4ae73f8e7ad478eca6a0dcb4902cbc2f203b73b7cfe0da90b
MD5 bd660f5e0f39dd05d5eefff4ce65c017
SHA1 956847325b76f4f02c8803f71204f4c747823ea2
SHA512 4fb02afb13c67c3d99cb0b183ca20ede069fb7a92cacd2f9bc73891e05a51bd6bd3ca2988fb71813444f9c9853ab8ad42193b234d5d0a60ca6a63355b51c0469
SSDEEP 393216:TAzXLKi/KForUnnXFwtAdPUqJyBTIm1GQv9:TAfnlAnXFBdPU4yT1GQv9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

3b:f6:f9:68:ef:77:a6:99:fe:6a:e1:07:32:1c:1f:64:41:cb:a2:e9:16:dd:55:94:77:e4:67:90:37:d9:ee:48

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

75:74:b8:27:9c:7c:04:eb:48:db:7a:8f:ed:00:f5:b3:29:6d:ea:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 5604f656590451d28d1653ad5c5d385fba1dce76b39c14f917c6aaad08f96b89
MD5 47c5cd0b09846144fba0da4c044e894f
SHA1 f8781bf78218064c60312587d7875b203046593e
SHA512 e151b7592ef6c992bf6bf41054d0a6e969eb3fa3325a4c7a0b71b0cebbfd6d587fcca644a177231a0534cb9cbfe1561e0c4ceae2e1229b067f5f3ddb5136d41a
SSDEEP 96:e0qjdBjka7yVNTSWg2zfwuiNOlGmBDV5nHzfygr72:e3bD7yVN5gqfviMl9DV5TW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 282b94f02f605a667f0fc5c6dbdc6c9ddeb8048d811826fcf7e956ed263b7ee0
MD5 0a3789bd73553a4e0f37022cf348653f
SHA1 ed29a8dbec208d15db69a3c65ab0b858bcfc9dc2
SHA512 2337acbb34a3548990e1381f823411f411a4e453331f97d12b43688d4539d6eaf424051fe1f2046aa4edb6ebc8d5db517c0cec36a3a57887edf2b2fd6ef48418
SSDEEP 384:QfTi4axP8AB8MA7LBhMQLALlYLSL3LHLlLc21hh:4+1xkABPAfBhM2mMQbrJc21hh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc
MD5 50ba20cad29399e2db9fa75a1324bd1d
SHA1 3850634bb15a112623222972ef554c8d1eca16f4
SHA512 893e053fcb0a2d3742e2b13b869941a3a485b2bda3a92567f84190cb1be170b67d20cc71c6a2cb92f4202140c8afd9c40a358496947d709e0c4b68d43a368754
SSDEEP 96:17GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNT3e:5XhHR0aTQN4gRHdMqJVgNa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 73a1d4339513125be547a038321e26a3de13593df96ed715efd8a1683ccc0665
MD5 732b08d61117e442df209d6e2e4165a4
SHA1 4ced1f43e94800dd08f6c2efc73be978dbca028b
SHA512 f79e75f2637072c07f55f6e2192a1c7a997f184432a8179afde38656034b3167fc3e275755c17f298b9f554c7a20571aa4df165248a42315c5f1a1aa52bedc03
SSDEEP 384:yck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2+E:yck76gibLCMLDLCx04HNV+E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ByteFence.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 16e0d6966e98794aa18719606e41f4d4ae74683d652e81374717282fc8b3239e
MD5 b821cd61e2d66b1ca5c795230f6b1b8e
SHA1 a2e0cea3af916f98233ad73992cbac1dea55b234
SHA512 6f88f403aadb97612bb409bae098bfba28d863a97c4fdb5a69431732251d7a91d3bc76750d30e30db38df1e7d4cf2f633c2b5a09cfef08437d5d1a6cfd55ebd7
SSDEEP 98304:YXrXAQnL22v90UxMwbV1J29H0SF8A9q4er:YTL2mewhn2ddrur
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a1:30:17:d1:e3:0a:e3:cf:b0:a3:9c:c4:77:30:0e:3a:f7:e1:4a:89:b3:fe:32:93:b6:de:84:ea:84:96:51:6f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

78:49:64:62:54:1d:e5:e3:74:99:3f:d6:7b:65:c6:49:e6:57:2e:37

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

3902926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ByteFence.pdb

ByteFence.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

ByteFenceGUI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4653f64b3374bd12df745ed33e46d27c7a33010bc92d0d2a5f4b2e45fb3a2fc2
MD5 64d417dc29e703c1ce96f6883693bb48
SHA1 959cdfea412e43fbf0992a6fec142802148ad2ed
SHA512 5970fff0e2f6ec1ed8835078ef2001f54d0364c846c26a32826d3ae534e368c159e49f16b1f201b8b83b17a34b7f7c16ab7dbef02ceb2b93ad49f0e1863b75e0
SSDEEP 6144:x5UfubKSlfRgMhU+T9DW7X5GX2ypXfC0SYdC:x5J5gz+w7XYXw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

417674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\jenkins\workspace\Migrated\client-products-build_bytefence\ByteFence\ByteFenceGUI\obj\Release\ByteFenceGUI.pdb

ByteFenceScan.exe

IMPHASH ee15a651b9ba7da7b305f5366d8836d6
SHA256 434e30c59249506dde85ce9e22ffacb2dcfbb05625c5853e9e72397c22f2cc53
MD5 6e0e63eb8b8022286b9cceddce76c5dc
SHA1 8bafea55708917c27f98c44920f6d0bc8ca2a37a
SHA512 de73bde33e8f702926bac7c93d681edf545d178b78601e17fa64a751c4c66e771fb12177f46a4d43fda60785e8af7831c4bf5c72ca16f36f0c89a38239bfab65
SSDEEP 12288:qM0Voclkzj2+OeO+OeNhBBhhBB3RauRtg8awP1NGcMWU2g50M341SJ0BGZsGXgs4:qMToiDXtg7wecMFogJ0BAV81suqdpE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

52:f3:74:68:2c:a9:22:c7:f9:77:d9:7b:16:06:34:ee:92:95:6e:53:a4:a2:cf:d9:e7:0a:fb:d7:03:ef:43:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

08:73:a7:17:ee:a0:48:1c:bf:cf:fe:d1:b3:cd:83:c8:e6:d6:22:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

6

Entry point

308080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\Migrated\client-products-build_bytefence\ByteFence\CppUpdater\Release\ByteFenceScan.pdb

ole32

CoCreateGuid

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shlwapi

PathFileExistsW UrlEscapeW

shell32

ShellExecuteExW CommandLineToArgvW

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect

urlmon

URLDownloadToCacheFileW

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegSetValueExW RegGetValueW RegQueryValueExW OpenProcessToken

kernel32

HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetTickCount WriteFile WaitForSingleObject CreateFileW CreateEventW SetEvent CloseHandle WideCharToMultiByte VirtualFree VirtualAlloc GetCommandLineW GetCurrentProcess GetModuleFileNameW GetVersionExW GetLastError SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx MultiByteToWideChar FormatMessageW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId DuplicateHandle WaitForSingleObjectEx Sleep SwitchToThread InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo InitializeSListHead ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualProtect ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW HeapFree RtlUnwind RaiseException ReadFile GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW DeleteFileW RemoveDirectoryW MoveFileExW ExitProcess GetACP FlushFileBuffers GetConsoleCP GetConsoleMode

ByteFenceService.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ee8b257ada017afdec76c7bbaa436afa2d77ac6887c6ff84431866517396a956
MD5 b7748eb9fd8de26917eed1f341e3cd99
SHA1 275ad76abb350fbb0c77050d99fff8c8696b0de3
SHA512 0c343c1a7f7bdff2f5652350e05dfff1f9ae3424c70302d4abdd1693660581414a5ea5db712cfa266f4e35e12a2af7447dd0538186ae6654c4c0e7cc4c83d9e4
SSDEEP 3072:rzUhP2vWKB4IsWyZpiOpEFzsfDuBurPm3/IheRy:nUhOvvyzxpEF8K32
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

90:81:0c:24:46:3e:9e:db:4c:f5:bf:2d:06:e5:0e:ce:ba:8b:f1:27:df:2f:34:c7:c4:28:0d:70:e1:7b:7b:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e4:a8:cf:82:aa:4c:c0:f5:c6:e3:81:60:7d:a7:c7:46:e9:2c:d9:1c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Chains

Mar 18, 2020

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Byte Technologies LLC,O=Byte Technologies LLC,L=Wilmington,ST=Delaware,C=US

Serial Number

0a:4e:35:b7:f9:6b:bf:be:0f:ca:08:81:cc:7d:ef:47

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 23, 2018 - Sep 4, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

150222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ByteFenceService.pdb

ByteFenceService.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

EULA.txt

SHA256 b01dbdcc34869e07c9a31a471cfee23d82e03bb924165cffd54540593558a692
MD5 e6e5ede5509c3806949c67b0c9a3ef7f
SHA1 a3dc123ec546020085638b56cb238d3b359b0241
SHA512 4eac9c1acf107c336296f49ea01095578356c73f7d18864a8efbee92907f780441a9809a5dccdde8f8746df1247ebea0a3a2348478d87ff782e8c6f309b56222
SSDEEP 768:axg/n78aQJALyI/uTvRNKrdf6GfwpyCRtPEIvRE305T5fTTgTuoR1JwTzBGs:axw75QJkyI2NN8B6GopyWlEM625Wd1Ju
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Microsoft.Diagnostics.Tracing.TraceEvent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6f8a2f1d045efb952c1ea9988bb5dcc72555eccafe9b32c2c51b439ea1f28453
MD5 d09b4a4509907f75f506b996a5ff7554
SHA1 bdb299cf617da297cbcfea321879f669e465069a
SHA512 ea29579f19aa55429e7254a7a6953f127a7520c43ad1e15dad7e4b25d17a167218997fe98d3096606164284616963c81a53f10eeaada7163472a6102e66de478
SSDEEP 12288:Y+TaIGsAE3CBF4vgwWNjVYUQjwciLzR3Sx+1FfNJyPnKrA:ZT2VESLEUQjXiLXNJy/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9b:60:1f:6a:d2:c5:e6:72:b9:3a:91:d8:b7:47:c9:c8:05:50:0f:d3:d2:e9:e6:67:c6:d7:7b:be:0a:b8:dd:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

PE Signature issue

Digest

0a:5b:c2:33:7e:5b:16:2e:f5:66:4e:07:5c:c6:eb:fb:ff:82:f6:28

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 3, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:8f:d7:76:15:b9:cd:45:8a:74:00:00:00:00:00:8f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 7, 2015 - Jan 7, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

998302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4745\2343\src\intermediate\TraceEvent.v35.csproj_476a578a\Release\Microsoft.Diagnostics.Tracing.TraceEvent.pdb

Microsoft.Win32.TaskScheduler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc6c472f666239ed270cc3754852f536b8981d6fd22e4ad1ee15a1aa788a3ba9
MD5 1802e6df96046cfee62c63c4c8469a3e
SHA1 c5d6444fcd8f46e1832c99614f5e71adff582f6d
SHA512 339f5b917c4afbc25175bd173cebefdd8f4671e157ecfb8a9c21b78db9d34fd9757787c231575e8849509cac59162c6c67fb32af6febd6903ec285e21c0fd304
SSDEEP 6144:pSNrAMLv8oXq9/7hbTD9S9XFiU5xsM2N0b9tCud+FrXSaG5rcfFr79E:CH8oXq9Dhb49ViU5xsTQd+FrXSJ5eFrZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

316134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net35\Microsoft.Win32.TaskScheduler.pdb

Signatures.dat

SHA256 4ce591f555e06a65e7437f2b611f36e5e92e3146642706580e56453cd409b356
MD5 d8b89d83997ed7d07963c98cf6b81121
SHA1 06be92d859f9f474773bfc11f7c123c43d34672e
SHA512 e6d3856e1302626f730984227cc34820bd0cf2f3268fdb1bf46fe4d01022375b267a0a5a1ce5fb7b64b0c98efbb11dbc8de1f7be689950abf5530ced51f45d9b
SSDEEP 24576:KiyN+imSyJ8kppR7tXUYHcnPZdeAdh9jJ:C+cS7EnP33
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

WhiteList.dat

SHA256 8d1a395eeaee86e12efe56d178ac204bc177c9a46f6b149cf6bf197bf01049bc
MD5 e23a6c6aa701b29ee182144e67aaff01
SHA1 9688351efe7f9103a0389ea70710c73d559c50d9
SHA512 a8def3b9f7658f88d58590168bfb06aae8d8671159e0742bf8a81b82d8c703c25348a386169517b08842f23eaf175a69af4f6bb53a03356e3a9f807b5c333f0a
SSDEEP 6144:eP91e5optA9KO6tsjBqCBfbckr8xtjky/ChfG8y/sIr96l5IheZpIHuv:Qe559F6t2qcfbVr8z/ufGbsn/UeZpIHs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

amd64/KernelTraceControl.dll

IMPHASH 387fc16f93041e1ac75f32e2095b58d7
SHA256 2005f94acc7c541771066ed98aff6321b911d10c59d2544b853446dbe91f25a5
MD5 23ff4b3eadf12465e19f39b0c19c4361
SHA1 ce0f61dfc428532dc645d2aaed9153d79dbd27d5
SHA512 cc618b926c22cabeb2156fe9d82dfa0a181e9bb03e9f1d823f68f656a72fa56fecb92fafbe84ec3712805ec0bd5a903fde6ea33cd05dfc57027800bc516c7538
SSDEEP 3072:nX5gE72vcK8s7pTxEl7Onygi9wDO4z4WSYB0JuPr8AjT//PqLVFUYYBHoC:nXX20y7HNz14RU0J1ALqDUBHoC
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

1c:ef:4f:92:07:0e:72:8a:89:04:69:b1:b5:fe:a5:67:f5:b4:41:92:6a:c2:96:52:db:71:f9:9e:ad:55:1b:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=FSS,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

Minor OS version

0

Major OS version

10

Entry point

149648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

KernelTraceControl.pdb

msvcrt

malloc free ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ memchr memmove_s wcsstr _stricmp ?terminate@@YAXXZ ldiv memmove _vsnwprintf wcschr wcsncmp _vscwprintf _wcsicmp _gmtime64 _purecall ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z ??0exception@@QEAA@XZ _callnewh ??0exception@@QEAA@AEBQEBDH@Z _CxxThrowException memset calloc _memicmp towlower wcstol iswdigit memcpy _wcsnicmp _wcslwr_s wcscspn strrchr wcsspn realloc _errno _onexit __dllonexit _unlock _lock ??1type_info@@UEAA@XZ __C_specific_handler _initterm _amsg_exit _XcptFilter __CxxFrameHandler3 wcscpy_s wcslen vswprintf_s wcsrchr memcpy_s wcscmp

user32

UnregisterClassA

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2 CoCreateGuid

oleaut32

SysFreeString SysAllocString

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlGetVersion

kernel32

InterlockedPushEntrySList VirtualAlloc InterlockedPopEntrySList VirtualFree SetFilePointer ReadFile GetModuleFileNameA GetModuleHandleExW GetWindowsDirectoryW FindClose FindNextFileW GetFileSize FindFirstFileW GetTempFileNameW GetTempPathW WriteFile DeleteFileW FindResourceExW LoadLibraryExW GetExitCodeProcess WaitForSingleObject CreateProcessW CopyFileW CreateDirectoryW CreateFileW CreateFileMappingW GetDllDirectoryW SetDllDirectoryW GetSystemInfo GetModuleFileNameW DeleteCriticalSection RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVersionExW VirtualQuery FreeLibrary HeapAlloc HeapFree ReleaseSRWLockExclusive GetProcessHeap AcquireSRWLockExclusive GetLastError GetProcAddress LoadLibraryExA VirtualProtect HeapSize HeapReAlloc HeapDestroy GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringA MapViewOfFileEx UnmapViewOfFile CloseHandle FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW GetSystemWindowsDirectoryW FindFirstVolumeW GetVolumePathNamesForVolumeNameW QueryDosDeviceW FindNextVolumeW FindVolumeClose LoadLibraryW SystemTimeToFileTime GetCurrentThread GetModuleHandleW FlushInstructionCache

advapi32

EnableTraceEx CloseTrace UnregisterTraceGuids RegisterTraceGuidsW ProcessTrace TraceEvent EventWrite ControlTraceW OpenTraceW StartTraceW RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumKeyExW

bcrypt

BCryptGetProperty BCryptFinishHash BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

Name

.text

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

932B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

amd64/msdia140.dll

IMPHASH 4ffb46397be88428dc9b52b857d964e5
SHA256 25a17a77163d1f18d780b06546dbe53c49d184c08cae60598b81cce655c53e34
MD5 c241e5b86b651da6e2b8fd9b07660635
SHA1 bc7317c284770245116b4a77c6d454970625fd19
SHA512 1b8e06fc562413b110f2ed8ee752f704948a77c4f4b8d855d1f14a91f9d3cbaaeead625b11d82d655613e89b7345c3299ddadc0fa9bcdad400068916587894be
SSDEEP 12288:Ppo5lxPC6r9vjOqfmX/yyOZWS6ggBwCX0dX007AedX0oHQUcV8gv2MQo0pzx:xo5lxdoz/yl4rEdE0cedrQPV8gut7x
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

37:15:65:4a:7a:2e:e5:34:11:4f:4e:57:f1:39:5f:bf:97:2e:38:cb:c0:09:4d:7d:3d:b5:d4:86:d1:d9:ab:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

PE Signature issue

Digest

4c:9a:1f:4a:d7:0e:66:60:16:3f:69:b3:e9:69:6a:68:4b:04:df:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

561704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

msdia140.pdb

kernel32

SetLastError FindResourceExW LoadResource LockResource SizeofResource MultiByteToWideChar LoadLibraryExW GetProcAddress LocalAlloc LocalFree GetModuleFileNameW GetLastError GetSystemInfo InitializeCriticalSection DeleteCriticalSection LCMapStringW EnterCriticalSection LeaveCriticalSection CreateFileW GetFileSize CreateFileMappingW MapViewOfFile CloseHandle UnmapViewOfFile RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW LoadLibraryExA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList SetStdHandle GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW ExitProcess GetModuleHandleExW WideCharToMultiByte HeapFree HeapAlloc GetACP GetStdHandle GetStringTypeW WriteFile CompareStringW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCommandLineA GetCommandLineW FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetFileAttributesW SetFileAttributesW VirtualAlloc VirtualFree DeleteFileW DeviceIoControl ExpandEnvironmentStringsW GetFullPathNameW GetDriveTypeW SetFilePointer MapViewOfFileEx FlushViewOfFile GetCurrentDirectoryW

Name

.text

Size

942KB

Virtual Size

941KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ce817ea26d88d86ab917460039b0bfabb311790cd702285c92f977ca6c293508
MD5 1ef639ae78e59f44b0ef43bbcbb893f4
SHA1 a78cc9f87e611a017080ad9b28d0c344d58bac0e
SHA512 3b7d7e57b2db0a5c68e38ab2494995098d91ed32de4bb092a4947e17cec800c725d879aa8a106b46c714945b2358d2e37e62813d88d772bc4a9c1ee05bc12559
SSDEEP 3072:cDS6s11CNtSu01ck48ChK8CShUlNIUAQwXaQ5edod9hoiexKcMva3rdYg8CUD:zzWMGN8CckUnAt5edod9hoisKbvydDUD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ca:7f:3b:34:61:47:aa:48:4a:cd:33:bb:f4:1e:0d:32:31:2a:bb:2f:7e:6a:77:fc:2a:07:0b:c1:7b:d4:cf:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

6a:a2:93:e1:1c:32:0d:9d:95:1e:0b:9f:c5:ab:f8:59:7b:cd:3e:97

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

203390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Dev\protobuf-net\protobuf-net\obj\Release\protobuf-net.pdb

rsEngine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf7d8e6051c13f8b20f87c11103ab153e692ef26c409fea9893d4f7d5223dac5
MD5 5efe47270e2ad4111ff66f53a0502cb5
SHA1 896ace118b9224eb2bb62e2c1964ea506291f619
SHA512 32782f15ad6491bc358264cc6373ed3e8039fcc428263e3b6498c48c19eff2cea3294d3cb0085418d896a81a27f73f80e7ea85a05bb5ce5aabf35d7db63e8ab1
SSDEEP 98304:MQOQ1D5RJP/WaqS5xJ/9lO2L8qnwIaDpMtDMRmxfMx5qIaB9Ic6:/pFRoat5xV9lJ80a9MCRC0x4IaBR6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

7e:8e:f5:81:70:33:f0:57:8f:1c:56:6f:1d:a9:2d:13:9d:b9:e3:70:45:c4:78:64:df:c0:1c:9f:41:82:06:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

f0:27:84:db:84:32:f1:66:48:88:d6:52:de:73:e6:86:97:ba:5a:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

5548606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsEngine.pdb

rsEngineHelper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2513a9bc4b3b9d197b488897ef99f700074305155a32d89cb080634f96c1bd5e
MD5 187b10ca17e23b5bc0077fd8d5f2d27d
SHA1 67e6c9f6a239c13aea1f5d78306bc3e50646467f
SHA512 d38e6d62ba53ec77a5cbb7bee763786494a35331f7a2b9b2839eafc165af2cc81f21dc5be5e6d434d577e44ad9e98707845a20003fe6c4e574f49ac0ac6591ee
SSDEEP 3072:/Jaq4D448Z0CLeo1Nce8a0/j1o5BSyvU2PFWcJix2dgZf:KD44cL71N18BJo0cWDxn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b9:bc:90:89:dd:2a:14:3b:d9:34:9c:2b:ba:df:a6:d5:fd:0b:f5:44:ae:b8:ef:68:6b:57:f6:6f:a6:91:6a:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

db:d8:e3:41:c1:d0:d2:10:b2:b5:c9:c5:77:88:91:ed:ed:f4:b7:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

153998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

rsEngineHelper.pdb

rsEngineHelper.exe.config

SHA256 827cda24df7876010d5239fe2b8af49472442d899f9c0f6d9ff53b4ff6860946
MD5 e3d5f62b7b28176a510484e465fa0f18
SHA1 d9d4f8875c6d96f57549abf06eb336650595ab5a
SHA512 8c27c69e010d263cb5599a2c38a58b3b9ad61983c512ab4f7d3b46b859393468ad09d6423013ae808c3d243a9b8cb479e499d128539a3959bede78ad145b85be
MD5 SHA1 SHA512

NSIS installer

installer

rsMessages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 38fb35cd57e103c60a2a1e0c5410e3d3b65632451a43356a58cf4a53d34c0221
MD5 0b6b9b54b403b53436810eec277ed252
SHA1 32f80d2e642e49e3daea8954a95fe3b661b166e9
SHA512 85a4a6d0abb4e418a61e28dccc1e499b05addbbceb596f9062e61e41c749461ff2f0e87390e891b9e63647f6e753f425cb9d894f7ce1b21a64518947af874988
SSDEEP 6144:++zx/AGyunueTo6k+c9Cq51D9NLfBICAD:Vt/kK97q7D9NLfa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a5:e8:dd:c7:93:f2:84:db:00:9e:47:f5:38:f6:ed:0e:83:f3:c4:12:46:01:2d:00:d2:85:b0:04:34:07:f3:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a8:58:fd:98:7e:84:95:17:f9:42:7f:84:2c:ec:43:fe:de:e4:4e:f7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

236894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsUtils.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e11c586b88c9f1d6d07d42dc329a83ce5f97e6bc4f3f612a0fa91d74a1d644f
MD5 661c2438f34f57dbe2842abd54866c6e
SHA1 8b3124de7075a860a2a71d22fe128847b7267cbc
SHA512 633b59ef5dd9a95e33dfb110ecedb8220a907d733236d8f5a0de3c53fde97f55329fdeef47f601a31685955827b68f292c3aa1b0ed71b0572c61c789dfb3a355
SSDEEP 6144:jZy5draHze+NYFYdWkxfErvfVL5txaV/T:AdrA9ETfVfxaR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

af:b4:a1:e1:c0:18:9c:20:10:6a:eb:8f:fc:c3:41:08:a1:03:9f:53:03:c6:6f:ec:6d:2c:32:07:80:0a:ec:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a5:fd:eb:f3:61:54:a9:f4:0f:31:23:db:f6:2e:96:56:70:80:c0:0f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 18, 2020

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

213422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsUtils.pdb

websocket-sharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9d406110031ffcd4553b10090c2b4610ac9d3f45b39106ab3eaa9ba4e214a4d7
MD5 b6a8aa955aea810094976a1afccfde5c
SHA1 3b73a09cf7c775a2d83fd51f15e8e2a88684f22f
SHA512 240bc156ac270e6eb3465eacaa8915aeeec39075c7e0e34cb586923ddf592feb54b6e6fe30e792afb4c718549c84a7e276bc0f0e3c3033eec74518af26634044
SSDEEP 3072:LLixO6zz8t4OXDegbQy058MP2pZrCmrrDse0ecdfF7b2gqEiyDvSmqtNlVusC51W:kn8nDenoRXoJF3bqEiyzZ5m1FsgUfI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

dc:d8:82:a7:65:90:9e:36:34:e1:49:6f:6f:9b:5d:e4:40:25:e2:22:4b:fe:38:4c:28:94:0d:ce:85:7f:a9:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

24:7a:e3:11:35:fa:c5:20:7d:9f:6d:44:33:d7:49:42:ca:a4:0b:f7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jun 6, 2019

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

16:92:53:5d:eb:2b:de:fe:27:ad:58:97:47:24:f3:90

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2018 - Nov 8, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

256382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

x64/7z64.dll

IMPHASH 6d89e7e08f512aa455dc1d1f650e3a43
SHA256 aab74d4dafcdf1e79af4e890ff5bac699054be47369e9c0e54de099300ae2475
MD5 d520af083b507c0300895b2b970a31e0
SHA1 8825006b8ad201f8c8efb1c73b7b602db00d8d13
SHA512 0a1345cfe442e5bbe89da52e34483fd336df93c70e31c3a6869ee44b33d5cfb31fef4e9330daa9dd88ae4f2a72a7ee8d9afb252c36329078980c449e415cc0fa
SSDEEP 24576:oypThlU0gui35R/T/cLa2vzVbkjEwRPCJlothl3A5v7Yt:npTBgui35VoeEqPWEhpA5U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1142608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

oleaut32

SysStringLen VariantClear VariantCopy SysAllocString SysAllocStringByteLen SysFreeString SysAllocStringLen

user32

CharUpperW CharPrevExA

msvcrt

strcpy memset realloc free malloc __CxxFrameHandler strlen strcat strstr _CxxThrowException wcscmp strcmp memmove memcpy memcmp _purecall strchr __C_specific_handler _beginthreadex ??1type_info@@UEAA@XZ ?terminate@@YAXXZ __dllonexit _onexit _initterm

kernel32

GetProcAddress Sleep InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject VirtualFree VirtualAlloc QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection LocalFileTimeToFileTime WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatusEx GetSystemInfo GetCurrentProcess GetProcessAffinityMask CompareFileTime WriteFile ReadFile GetFileAttributesW GetModuleHandleA FindFirstFileW GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle CreateFileW SetFileAttributesW GetModuleHandleW CreateDirectoryW DeleteFileW GetTempPathW SetLastError GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose

x64/System.Data.SQLite.dll

IMPHASH 2a50915b9efde2a35c3cafb7dfe4efd3
SHA256 96e8dad51e66b3ee02a5ff00a310fdbfa1d7946d1c92b40fd65acc55de10a738
MD5 e83262d8b431e2fe508bc4a113baff16
SHA1 45f849fa7471b6803c721d7c115a301e7d01ee3d
SHA512 15e8e9f4acf2bc0456ae273d4e52243ebdc3dd6074fc20b2524b54b7aad436cd803c5618fa105464040c96acabf0b40cda15c98a2b78d28d3251cbbc3acf22ae
SSDEEP 24576:FA7R6v03fXL/A15KUIBL53oDAdDliZy46NWzrVtZ4dQTN:FTvczkLIBLRoDAd6iwtZ2QTN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

Digest

9e:6b:da:30:5c:55:8d:34:0f:f3:cc:05:40:6e:23:04:00:a9:97:25:f5:1f:2a:1d:b5:94:ef:25:35:c7:77:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

90:d4:b1:dc:61:a4:ac:f9:8e:e2:44:e0:9e:b6:45:2f:8f:4c:16:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

2

Major OS version

5

Entry point

1199312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\bin\2008\x64\Release\System.Data.SQLite.pdb

kernel32

UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate MapViewOfFile ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA GetFullPathNameW TryEnterCriticalSection SetFilePointer HeapCompact CreateMutexW GetFileSize CreateFileA HeapReAlloc GetFullPathNameA GetFileAttributesW DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess

advapi32

CryptAcquireContextW CryptHashData CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptDeriveKey

msvcr90

tolower _beginthreadex strncpy isalpha rand_s toupper _encode_pointer _malloc_crt _initterm _initterm_e _encoded_null _decode_pointer _amsg_exit __C_specific_handler __CppXcptFilter __crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _endthreadex _errno strerror _localtime64_s qsort calloc free strncmp memmove memset memcpy memcmp tanh tan log sqrt atan2 floor ceil pow exp log10 cosh sinh cos sin atan asin acos

mscoree

_CorDllMain

interop_compileoption_get interop_compileoption_used interop_libversion interop_sourceid sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_finish_interop sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_double_interop sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_int64_interop sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_parameter_name_interop sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_close_interop sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_changes_interop sqlite3_clear_bindings sqlite3_close sqlite3_close_interop sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_database_name16_interop sqlite3_column_database_name_interop sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_decltype16_interop sqlite3_column_decltype_interop sqlite3_column_double sqlite3_column_double_interop sqlite3_column_int sqlite3_column_int64 sqlite3_column_int64_interop sqlite3_column_name sqlite3_column_name16 sqlite3_column_name16_interop sqlite3_column_name_interop sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_origin_name16_interop sqlite3_column_origin_name_interop sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_table_name16_interop sqlite3_column_table_name_interop sqlite3_column_text sqlite3_column_text16 sqlite3_column_text16_interop sqlite3_column_text_interop sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_collcompare_interop sqlite3_context_collseq_interop sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_disposable_module_interop sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_interop sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_cursor_rowid_interop sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errmsg_interop sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_finalize_interop sqlite3_free sqlite3_free_table sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_index_column_info_interop sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_last_insert_rowid_interop sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_malloc_size_interop sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_highwater_interop sqlite3_memory_used sqlite3_memory_used_interop sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open16_interop sqlite3_open_interop sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_interop sqlite3_prepare16_v2 sqlite3_prepare_interop sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_reset_interop sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_double_interop sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_int64_interop sqlite3_result_null sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_table_column_metadata_interop sqlite3_table_cursor_interop sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_double_interop sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_int64_interop sqlite3_value_numeric_type sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16_interop sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_text_interop sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

x64/ext_x64.dll

IMPHASH 4b7c40598d9f35ed158d6be672b11e32
SHA256 62565d578673e67c39781b0fb30eaa664e0c102d3e8f74cb01d2f25d81fb78df
MD5 710437238afd49535c6e8e68fed595fe
SHA1 6dd04a3669ec8f5ffd9a430513afede1f284f074
SHA512 cf2a2b1043977bfe7759af999690dde96023bf6ec26c2a0322244eb5c04c94cf996a3f297efc9ac68c95b6d72e847576068d24c7f89922502c82f13570c6e296
SSDEEP 6144:MBYqz/61Z2lKHQM/QX1ahKrJQRB2XHbV7iFGrwGav4VohWrtdmeG:MJ/UIwQM/qo4rGREXH1o8zG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

4b:a0:15:8a:1b:ca:77:54:6e:75:fd:65:cb:e5:e9:a0:81:ab:54:58:0f:05:60:81:38:5f:de:4c:3f:58:40:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

21:19:e9:64:2d:1f:79:99:3f:70:77:be:5d:c8:c9:c5:2e:f4:84:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

90272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Documents\Visual Studio 2015\Projects\Chrome extensions removal\x64\Release\Native.pdb

kernel32

GetComputerNameW GetCurrentProcessId LocalFree CloseHandle GetLastError GetCommandLineW WideCharToMultiByte GetVolumeInformationW SetEndOfFile EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlPcToFileHeader RaiseException FreeLibrary LoadLibraryExW RtlUnwindEx InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile SetFilePointerEx FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW

advapi32

CryptCreateHash CryptHashData CryptDestroyHash ConvertSidToStringSidW CryptGetHashParam LookupAccountNameW CryptReleaseContext CryptAcquireContextW

shell32

SHGetFolderPathW

Name

.text

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x64/lz4_x64.dll

IMPHASH 56a12c5117bc05a7f10f116be39e1875
SHA256 3f022e4c52a61751b5fed98cda2ca8bbcb6bf39f7e47bb40fc17becbb67101a1
MD5 3d92f66ee9e49cedd6316f8fbbeeb3c8
SHA1 ae9fb8a1e1205d8de1541b180dee226be6ed35c1
SHA512 9e7b408d5b9f1725402ebacea323614a81ab2ecb8e45cd7dd5a788c7f11cedc4f2ca10b381a689b78ba6f8c95c3cde2294578a2bba7482bca731446996a14324
SSDEEP 3072:dvysFz2cyiAtLfc57mfngv6ALQ09tNdUNtDfBv5XvEX6cSYAUL:dvy6z2GAtLfcCgv6ALehJcN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

3b:ef:f8:73:c7:43:7c:a5:b9:3d:02:b8:6c:82:f1:43:8f:32:42:da:21:b7:be:97:a7:6c:18:73:51:45:d3:5d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

5c:ab:4b:53:ea:b0:1f:7f:19:43:b0:a3:59:b5:71:64:62:2d:f3:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

12100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\source\repos\FFHelper\x64\Release\FFHelper.pdb

x64/rsEngineFW_x64.dll

IMPHASH c042f48bb3a63d2b5f2cbb0f0010de7d
SHA256 8a1eff4a86e223dbe808bde5d728367b03e7593b514f5cd9c49387e6ac4b57c5
MD5 a82484553da1a7a4ce4f5eda236b7207
SHA1 3e56d504d2283653165d78a238c97469a28e5de2
SHA512 03d193de85c8022c746e9f99a0e989cc42445d67fe32a31093e66b4e5e9dd25a4103fbb2e93ffc54401d99d40c3ae519dff7db999d64bc7f3cf0af59d82f3681
SSDEEP 3072:IRIyAKjZ/ouxZ4PqYC5u7mhQajGGpRsBQQ8lGBKEtjotdFw:O4KjZh4PqYC5uo2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

c9:f1:62:12:48:b8:aa:4b:83:26:e3:03:ad:7f:13:c1:77:5c:f1:85:72:03:25:75:d2:38:78:55:a5:40:0c:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

37:da:d5:bb:44:f8:b8:f2:e0:77:42:53:81:e7:19:c4:35:f8:21:63

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

6212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\USN-journal-lib\x64\Release\USNJournal.pdb

x64/rsEnginePM_x64.dll

IMPHASH 3cc050d3ea3cbea4f3fbdec2dfd74bb9
SHA256 a4d7f4259cf04e7299f5ab6fe2ceb95680e35427d613aff26dc27d954b8311c2
MD5 15cf59afcaff08b12d37f2d7c9f6ed81
SHA1 1d0464d1f13ffe71ff12556c433d95f168a1cfb2
SHA512 e35196ae1367a7cae677f1c90dff7a186a03a95a9b7ede67e1c2d5c98db03d1b6e2ae868efae0c8ee12ee8b4067d0fa36139cb514d7d01982f756c0c6db47629
SSDEEP 6144:JO5qSSjpZlPl9BPMrGfmkWh68nk/mXdhohHCbs:k5ojpZlPyrGfmF6gdhoxX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

23:8c:6e:be:1d:72:de:77:6e:cd:a5:3a:b8:4c:07:6f:6a:52:ed:c8:03:4e:39:33:4b:54:71:16:2d:a2:49:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

8c:66:b1:75:a0:a5:ea:79:2d:c6:70:6a:9e:43:93:06:f0:6d:66:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

20380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\PatternMatcher\x64\Release\PatternMatcher.pdb

kernel32

WriteConsoleW CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte GetLastError EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwindEx FreeLibrary LoadLibraryExW RtlPcToFileHeader RaiseException InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap ReadConsoleW SetStdHandle HeapSize CreateFileW

x64/rsLggrServer_x64.dll

IMPHASH c2d3ec8558156bc03731e57c3c3be59a
SHA256 d67999fe774e5e0f1c18cd5a4da7d6518faa00b8e950e41737e225b615a1b4f5
MD5 27236a42b9810c5db8490693c158c838
SHA1 3cb8d0f4b818f120afe2447c9b01af674af3a9f2
SHA512 97e9c8921caeecbe144ba11be3675365b5bbd92bf45bbe91e9a37c472fe2153f1f250e8e5b8a37d927605a0897d997228d7351476bbc40f9647737c14022411f
SSDEEP 24576:PB/RLBgBU017cs1yj9ur5MpB6bsq3v15y2U:PB/xB0TQXu+Cyn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

Digest

57:5e:ea:07:f0:b8:e2:6b:7d:37:e7:80:c3:4b:ac:f7:ff:6d:36:60:2b:01:ef:55:d0:cd:ae:8d:ae:dd:1c:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 22, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

e4:c4:1b:c0:c9:07:d2:65:a9:76:7e:5e:45:42:83:8d:53:df:f7:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Mar 22, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

2

Major OS version

5

Entry point

247608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\logger as dll\cpp-logs-lib\Logger\x64\Release\Logger.pdb

kernel32

GetFileSizeEx InitOnceExecuteOnce EnterCriticalSection FindNextFileW ReleaseSemaphore RemoveDirectoryW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetEndOfFile GetTempPathW FindClose WaitForSingleObject CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA QueueUserWorkItem MultiByteToWideChar Sleep FormatMessageW GetLastError FlushViewOfFile DeleteFileW CloseHandle GetSystemInfo FindFirstFileW SetFilePointerEx CreateFileMappingA LocalFree DeleteCriticalSection GetModuleHandleW CreateSemaphoreW WideCharToMultiByte MapViewOfFile GetTickCount MoveFileW FlushFileBuffers GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetProcessTimes CreateEventW SetEvent ResetEvent GetMailslotInfo CreateMailslotW GetCommandLineW lstrlenW GetModuleFileNameA GetLocalTime ReadFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetProcessHeap ReadConsoleW SetStdHandle DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlPcToFileHeader RaiseException RtlUnwindEx ExitProcess GetModuleHandleExW ExitThread ResumeThread GetStdHandle GetFileType WriteConsoleW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteFile GetConsoleCP GetConsoleMode GetACP

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shlwapi

PathFileExistsW

dbghelp

MakeSureDirectoryPathExists

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

514KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/7z86.dll

IMPHASH 77f306126855a0e2b18a1df504ca2a48
SHA256 25a52dd0a38f58001779b12e84c2937aa52a922a4db9c43fa89214f11a3f4766
MD5 a8f57d77bac092272792730872a1d8f7
SHA1 e85d4eb97ed735bbf209c7fbcc8f6d37d70fcb36
SHA512 bfba966b23292adfe38d2bbc36cae6fce8465ba4f30a7fd8fb4e51aaef5126363b11bc3e352ad267a9a64b18ea083974ce94e431b4cc40238951f9015df4578d
SSDEEP 24576:Oi6tfenkDGFiGi/7KQNLjoonYynrnJUTqrbL44HdvWZX:O/zDGwGi/7KBynrnaGvn9vWZX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

821785

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocStringByteLen SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantCopy VariantClear

user32

CharPrevExA CharUpperW

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex strchr strcat strcpy memset realloc free malloc strlen wcscmp strcmp strstr _CxxThrowException memmove memcpy memcmp _purecall __CxxFrameHandler

kernel32

GetModuleHandleW InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject InterlockedIncrement VirtualFree VirtualAlloc QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection GetVersionExW LocalFileTimeToFileTime WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask CompareFileTime WriteFile ReadFile GetFileAttributesW GetModuleHandleA GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle CreateFileW SetFileAttributesW GetProcAddress CreateDirectoryW DeleteFileW SetLastError GetTempPathW GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW

Name

.text

Size

837KB

Virtual Size

837KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/KernelTraceControl.dll

IMPHASH 7aa3e418f32a7883636527cd6670389d
SHA256 34025caa3a4b8b367ecfdf8f9089da88b8513ef81cce173251632b6e623efcc2
MD5 d477038336c4f2f1d2aee9536abc4253
SHA1 9d89bbdf1374b16364485dd3a7e418021806c8e6
SHA512 e2b5b3d6dc31a0ce636c5bbeb4a521edc684d344d5cc44650abb633d4249bd045ad602698681e95cc687f45cd105cde9237f8ed29dbbd3a7b624ef026cc46c8a
SSDEEP 3072:1EB80UdbtqrPRsWDkoNcKbnqqsR2jO1eDbNMU4AjHNys4VW0cWBHoa:1EBJUdbGHb5rz5KJHoa
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a6:03:bb:c5:f6:f5:8c:47:91:73:15:22:bf:5e:4b:02:e5:a1:9f:61:a3:73:91:bf:50:f8:5a:fb:ec:42:bc:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=FSS,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

Minor OS version

0

Major OS version

10

Entry point

129280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

KernelTraceControl.pdb

msvcrt

free malloc wcstol iswdigit _wcsnicmp _wcslwr_s wcscspn ?terminate@@YAXXZ wcsstr ??0exception@@QAE@ABV0@@Z towlower ldiv memmove _vsnwprintf wcsncmp _vscwprintf vswprintf_s _wcsicmp ??1exception@@UAE@XZ _purecall ??0exception@@QAE@ABQBD@Z ??0exception@@QAE@XZ _callnewh _CxxThrowException memset calloc _memicmp ?what@exception@@UBEPBDXZ strrchr memchr wcsspn _stricmp _except_handler4_common realloc _errno _onexit __dllonexit _unlock _lock ??1type_info@@UAE@XZ _initterm _amsg_exit _XcptFilter __CxxFrameHandler3 wcscpy_s wcslen wcschr memmove_s wcsrchr _gmtime64 memcpy_s memcpy

user32

UnregisterClassA

ole32

CoUninitialize CoCreateGuid CoCreateInstance StringFromGUID2 CoInitializeEx

oleaut32

SysFreeString SysAllocString

kernel32

InterlockedPushEntrySList VirtualAlloc IsProcessorFeaturePresent InterlockedPopEntrySList VirtualFree SetFilePointer ReadFile GetModuleFileNameA GetModuleHandleExW GetWindowsDirectoryW FindClose FindNextFileW GetFileSize FindFirstFileW GetTempFileNameW GetTempPathW WriteFile DeleteFileW FindResourceExW LoadLibraryExW GetExitCodeProcess GetDllDirectoryW SetDllDirectoryW GetSystemInfo GetModuleFileNameW DeleteCriticalSection RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetVersionExW VirtualQuery FreeLibrary HeapAlloc HeapFree ReleaseSRWLockExclusive GetProcessHeap AcquireSRWLockExclusive GetLastError GetProcAddress LoadLibraryExA VirtualProtect HeapSize HeapReAlloc HeapDestroy GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar Sleep QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess OutputDebugStringA WaitForSingleObject CreateProcessW CopyFileW CreateDirectoryW CreateFileW CreateFileMappingW MapViewOfFileEx UnmapViewOfFile CloseHandle FindResourceW LoadResource LockResource SizeofResource GetSystemDirectoryW GetSystemWindowsDirectoryW FindFirstVolumeW GetVolumePathNamesForVolumeNameW QueryDosDeviceW FindNextVolumeW FindVolumeClose LoadLibraryW SystemTimeToFileTime GetCurrentThread GetModuleHandleW FlushInstructionCache

advapi32

RegisterTraceGuidsW OpenTraceW CloseTrace ProcessTrace TraceEvent EventWrite RegEnumKeyExW UnregisterTraceGuids ControlTraceW EnableTraceEx StartTraceW RegQueryValueExW RegOpenKeyExW RegCloseKey

bcrypt

BCryptGetProperty BCryptCreateHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider

ntdll

RtlGetVersion

version

VerQueryValueW GetFileVersionInfoSizeExW GetFileVersionInfoExW

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/System.Data.SQLite.dll

IMPHASH 846757f2893c6a863034e9ea1604929d
SHA256 5a48670db25702d8d96f77b7b039d08a3eb18d392fa80b066b8f30e44c80f5fc
MD5 36482f3132134178267ec1e8611f83ed
SHA1 81600eea36a05b9e0bbebeabdd130c2e277f5889
SHA512 2ca50791ff42388d026d3d804fe4cfc70ede7d93edb88e89bf7d39e7819ce8d6b33ce170832bed674b75cd168f1cd092d9a91fe487eeb834cd32af1196e3db35
SSDEEP 12288:L9bc1JlpgLoZiGoguR57hgen17v8mV14o5IcMCq6X7w+Z/1SrOfMXpeWGepLMrmQ:2NFZFQRrgO7SGMkFFkqueWzZoxqJ4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

5d:bf:19:be:9c:bd:cf:9c:b4:52:e5:d5:84:10:a2:d9:16:7a:94:ef:bb:9f:13:e2:b5:f2:c2:30:4f:62:fe:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

a2:02:d9:74:66:e4:6b:a9:5f:94:4d:b1:f7:7d:52:9c:33:06:59:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Nov 16, 2016

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Apr 11, 2027

Minor OS version

0

Major OS version

5

Entry point

896634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\bin\2008\Win32\Release\System.Data.SQLite.pdb

kernel32

UnmapViewOfFile SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject InterlockedCompareExchange UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate MapViewOfFile GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection GetCurrentThreadId OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA TryEnterCriticalSection SetFilePointer HeapCompact CreateMutexW GetFileSize CreateFileA HeapReAlloc GetFullPathNameA HeapValidate GetFullPathNameW DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedExchange

advapi32

CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptDeriveKey CryptAcquireContextW CryptHashData

msvcr90

strerror _errno _endthreadex tolower _beginthreadex strncpy isalpha rand_s toupper _encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common _localtime64_s qsort calloc free ceil strncmp memmove memset memcpy _CItanh _CItan _CIlog _CIsqrt _CIatan2 floor _CIpow _CIexp _CIlog10 _CIcosh _CIsinh _CIcos _CIsin _CIatan _CIasin _CIacos

mscoree

_CorDllMain

_interop_compileoption_get@4 _interop_compileoption_used@4 _interop_libversion@0 _interop_sourceid@0 _sqlite3_backup_finish_interop@4 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_parameter_name_interop@12 _sqlite3_blob_close_interop@4 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_context_collcompare_interop@20 _sqlite3_context_collseq_interop@16 _sqlite3_create_disposable_module_interop@112 _sqlite3_create_function_interop@36 _sqlite3_cursor_rowid_interop@12 _sqlite3_errmsg_interop@8 _sqlite3_finalize_interop@4 _sqlite3_index_column_info_interop@32 _sqlite3_last_insert_rowid_interop@8 _sqlite3_malloc_size_interop@4 _sqlite3_memory_highwater_interop@8 _sqlite3_memory_used_interop@4 _sqlite3_open16_interop@20 _sqlite3_open_interop@20 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_reset_interop@4 _sqlite3_result_double_interop@8 _sqlite3_result_int64_interop@8 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor_interop@12 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

x86/ext_x86.dll

IMPHASH 080fee03f4d4d9faf1aaa3e7c31f55ff
SHA256 c0b435df63dad920cf9c2645174c1a52ec640d267a7bf1bf1ae049f985aea219
MD5 5627ce03cda5546a942d264c76d6e49f
SHA1 54f22e629c9ffe61cd2a924ee79a7a5134d0d0f0
SHA512 9728bb25e88fbd44f3373e9a861c42570dda9d84d5762d0fd5ffae5439f9b80f0113f0529a2d8ef8cd6dd0d2b0ac612358cd64a95604234f092214f527511c48
SSDEEP 3072:s+MW9X+GarEJo/GdTg9IK9x9/XyRaTITqRWChmhdNdLGCPIAmAg0FujoX2xVKTmZ:F9baQfdB0xlyeRWChmadAOODic5k
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4b:73:4a:aa:2a:97:12:96:84:63:1f:12:db:35:eb:00:54:4d:71:91:de:68:46:4d:1d:44:6e:7c:cd:c7:9a:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

9c:99:ea:a8:34:d3:03:69:86:18:0d:9e:f2:d5:c3:01:03:21:dc:18

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jul 5, 2017

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

51759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Documents\Visual Studio 2015\Projects\Chrome extensions removal\Release\Native.pdb

kernel32

GetComputerNameW GetCurrentProcessId LocalFree CloseHandle GetLastError GetCommandLineW WideCharToMultiByte GetVolumeInformationW SetEndOfFile EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo FreeLibrary LoadLibraryExW RaiseException InterlockedFlushSList RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile SetFilePointerEx FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW

advapi32

CryptCreateHash CryptHashData CryptDestroyHash ConvertSidToStringSidW CryptGetHashParam LookupAccountNameW CryptReleaseContext CryptAcquireContextW

shell32

SHGetFolderPathW

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

596B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/lz4_x86.dll

IMPHASH 8013a2893be8dab7d66fddd13005e905
SHA256 77eaeebfcbf6cedd3069f28678c8276d1f9fe7afbe4ece41d4bab8aafd7f5c94
MD5 ca299e8c7c0292102a144c9f6bf4ac89
SHA1 8142e54e5ebd661ff1ba5d9a5f93786166389cfd
SHA512 97f17146d18a7504eac4ce6f0942f76dfc307aa5298fdee2789b866ba323ae5927e1186f6f4ce3c7d0bd9402d3f5436b66052962d5e55d743e5bef8d6b40269d
SSDEEP 1536:b/j45ZAG6fcsGSYfiycPgmhNMF1BAsuLSsWgcdWpzP/ag3X13XSghn:b8nV4ISqiFPNNnjLOWpzPiuJD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ec:e6:df:7e:f9:f2:2a:ba:5d:16:93:fb:2d:6d:b4:bb:4d:21:30:d9:ea:3f:d6:de:b0:48:b9:77:45:1c:3d:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

51:ab:bc:0e:cc:94:c2:74:d3:84:2f:c2:17:94:78:34:52:cb:0d:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 8, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

11576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\source\repos\FFHelper\Release\FFHelper.pdb

x86/msdia140.dll

IMPHASH eac4915c289cf0d5ad198e365faf0f5e
SHA256 00721b85bca70226d4d6f756c7527d71b526c949a0b603c3c17a4c3da4612bb1
MD5 ddc85eff55a22dc0992cbf5a1ea82aaf
SHA1 16c197deb0deab617a2752e0be832f9795a998f0
SHA512 ee2319732d83466afaa6772e126e5ddc8ec9f37c78a5c0402cb2000887006936a8b13e68bb4cf549ec4107995cc93f08fd1cea46d97cf5676a2b076bcc6008c7
SSDEEP 24576:vJvWSoylP9NIiD9PrN4zRSSw6quolZQ1y6rQ3ZvEHIFxT/u:vD4TwBjQ866EHIF1/u
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

dc:ab:8f:a6:52:35:e7:c8:5e:47:62:89:6c:56:6a:83:37:c3:30:fe:49:fe:5c:a1:28:a8:54:53:5a:b2:5b:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 18, 2024

PE Signature issue

Digest

18:35:89:8b:e6:f0:7a:75:66:83:c0:83:b9:f2:de:32:4e:ca:44:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

585407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msdia140.pdb

kernel32

SetLastError FindResourceExW LoadResource LockResource SizeofResource MultiByteToWideChar LoadLibraryExW GetProcAddress LocalAlloc LocalFree GetModuleFileNameW GetLastError GetSystemInfo InitializeCriticalSection DeleteCriticalSection LCMapStringW EnterCriticalSection LeaveCriticalSection CreateFileW GetFileSize CreateFileMappingW MapViewOfFile CloseHandle UnmapViewOfFile RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW LoadLibraryExA SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedFlushSList RtlUnwind SetStdHandle GetFileType SetFilePointerEx ReadFile GetConsoleMode ReadConsoleW ExitProcess GetModuleHandleExW WideCharToMultiByte HeapFree HeapAlloc GetACP GetStdHandle GetStringTypeW WriteFile CompareStringW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCommandLineA GetCommandLineW FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc WriteConsoleW SetEndOfFile DecodePointer GetFileAttributesW SetFileAttributesW VirtualAlloc VirtualFree DeleteFileW DeviceIoControl ExpandEnvironmentStringsW GetFullPathNameW GetDriveTypeW SetFilePointer MapViewOfFileEx FlushViewOfFile GetCurrentDirectoryW

Name

.text

Size

920KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

x86/rsEngineFW_x86.dll

IMPHASH 51b6094a35d95093b4849e80d78b09d3
SHA256 7aec33b0c3c6a8edb0fe88e459734ef00e9c2f537bb9be0cace1286b00dec6a2
MD5 9f0f9cf8d69f2bc4d7e19fdb038b91bf
SHA1 840b81683f836fb1400501a5f0299de7f3a64819
SHA512 23789d380f68bf22cc17bf098d47951df1ef13212c2949d67e967d20696cc4eaf703913cd1a653d67cc8d5589e3c95c4e56662be93ba8be746fdb85924ebc43f
SSDEEP 1536:NoLCs7Du4gsAh/aVcDsu00/sWTcdSWKiPjmzCv4/0f3XP3XFghz:CrDumAh/PjmSdOjmjcfvu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

70:86:02:c7:1f:6a:5d:d8:cc:5c:c5:5c:58:57:a1:3e:1a:a1:13:aa:0e:49:42:69:99:0e:52:18:40:a6:44:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

dc:b1:55:17:45:4e:46:44:a0:c2:39:c0:14:f0:a1:36:26:3b:86:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 3, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

6111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\USN-journal-lib\Release\USNJournal.pdb

x86/rsEnginePM_x86.dll

IMPHASH 0774345fc5653b9904b9ba24f99301e3
SHA256 789faa954b4a18704f863449cc164d9bf010004e5a76da1a12e630327985d553
MD5 2fa41415a9fcec04f6e8073bc984da06
SHA1 1a30b3b35d9a02e3e904d0f8f46449ec96d85800
SHA512 d869cd9995d9a43dc4afdcdf49e74fb32253e97c8d49c4310e4742bc07ec10e077da91f64551d81fecb7e63d42b8a8f75237156df858e5a09ca988e39c86ad16
SSDEEP 3072:WavAeaeomVFEMPZejYAugq5pps99+0LX79HAg0Fujo8urkhWYje+W:WavApYEGZej/q6AO9uw4Y+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

77:71:2b:0f:41:a2:4a:e0:16:b9:dd:da:2e:f7:07:5e:47:cf:b6:a3:25:af:ce:f4:32:52:74:71:f8:70:e0:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

7e:7b:5f:81:c5:2d:a2:0a:ff:9b:a9:0a:1c:28:dc:a8:38:86:fc:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Chains

Jan 4, 2018

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Reason Software Company Inc.,O=Reason Software Company Inc.,L=New York,ST=New York,C=US

Serial Number

43:25:22:fd:ae:21:da:b0:da:93:28:0e:36:83:6c:66

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2016 - Nov 9, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

6

Entry point

19535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\PatternMatcher\Release\PatternMatcher.pdb

kernel32

WriteConsoleW CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte GetLastError EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind FreeLibrary LoadLibraryExW RaiseException InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA HeapAlloc HeapReAlloc HeapFree GetStdHandle GetFileType GetACP FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap ReadConsoleW SetStdHandle HeapSize CreateFileW

x86/rsLggrServer_x86.dll

IMPHASH b9a0aeaebe0a5e27046e1187d9c753eb
SHA256 d8312f0c4c72e8cf79e6117f857f4a8b869bd23f649b8378c39de837fbd68586
MD5 9733a6cfafbdb6f0ff1e0b01c8391cf4
SHA1 57cafea144217fded83f6cb5b2b1834e6cc8be9c
SHA512 9d03b1456147835a3b905dce10945fc9cb515f72d949dc638ad8e96a5de5554d920d239ab64864762da90903c1e621e5fb0e93364dfd3b69b6861c8970bce0eb
SSDEEP 12288:PXnfmjOHHMVlWhsIEB1iTTdxji5qTLbFEKpfvBPyo+8cAQh7x4a:PXfmKnM+h6B1ilxjHOCfvBqo1m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

146431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\davidh\Desktop\logger as dll\cpp-logs-lib\Logger\Release\Logger.pdb

kernel32

GetFileSizeEx InitOnceExecuteOnce EnterCriticalSection FindNextFileW ReleaseSemaphore RemoveDirectoryW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection SetEndOfFile GetTempPathW FindClose WaitForSingleObject CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA QueueUserWorkItem MultiByteToWideChar Sleep FormatMessageW GetLastError FlushViewOfFile DeleteFileW CloseHandle GetSystemInfo FindFirstFileW SetFilePointerEx CreateFileMappingA LocalFree DeleteCriticalSection GetModuleHandleW CreateSemaphoreW WideCharToMultiByte MapViewOfFile GetTickCount MoveFileW FlushFileBuffers GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetProcessTimes CreateEventW SetEvent ResetEvent GetMailslotInfo CreateMailslotW GetCommandLineW lstrlenW GetModuleFileNameA GetLocalTime ReadFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetProcessHeap ReadConsoleW SetStdHandle DuplicateHandle WaitForSingleObjectEx GetCurrentThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait OutputDebugStringW GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualFree VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind RaiseException ExitProcess GetModuleHandleExW ExitThread ResumeThread GetStdHandle GetFileType WriteConsoleW HeapAlloc HeapFree HeapReAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteFile GetConsoleCP GetConsoleMode GetACP

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

shlwapi

PathFileExistsW

dbghelp

MakeSureDirectoryPathExists

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

375KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer