CS2RED_Checker.zip
- SHA256 e1eedf9077fe9a2532130dc80fcd13878835490f5eae82295805b7eb67691a82
Behavioral task
behavioral1
Sample
CS2RED_Checker.zip
Resource
win10v2004-20240611-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target CS2RED_Checker.zip
- Size 18.1MB
- Sample240703-rppryssdrg
- SHA256 e1eedf9077fe9a2532130dc80fcd13878835490f5eae82295805b7eb67691a82
- MD5 5845377259e765b722b1a20c48b5bc7d
- SHA1 aea4c56e80f7b7e229bfc15ba7cdc15f604d6e46
- SHA512 8f42eefe99bfa073f3ebb23ba3ce4138e1a9dec94e556a86a0ab26bfe7dd2dc5fe4511e5a80565cec8e70d221676d640b0b7d161d8646af373a1a2f043a1fac0
- SSDEEP 393216:89j/EL3W7bU5wSD5vIxbklXGWI6r6nrrPivuaJlSSPQvPuja94MwNYz:89UWM57D6xgWz6r8/yu0dhUeYz
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
umbral
C2
-
https://discord.com/api/webhooks/1257834381473747065/A4PdBtqpeMQGdn1UQ02Bvb8Scj6VK16zOyUctn2SFAznIBMMfKXT9QsfPt39umhw0A8L
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/CS2RED' Programs/CS2REDСhecker.exe family_umbral - Nirsoft 1 IoCs
resource yara_rule static1/unpack001/CS2RED' Programs/LastActivityView.exe Nirsoft - Umbral family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CS2RED' Programs/CS2REDСhecker.exe
File Explorer
-
CS2RED_Checker.zip.zip 18.1MB
-
CS2RED' Programs/CS2REDСhecker.exe.exe 229KB
-
CS2RED' Programs/Everything.exe.exe 2.2MB
-
CS2RED' Programs/Everything.lng912KB
-
CS2RED' Programs/LastActivityView.exe.exe 130KB
-
CS2RED' Programs/SC INSTALLER.exe.exe 17.6MB
-
CS2RED' Programs/shellbag_analyzer_cleaner.exe.exe 1.6MB
-
CS2RED' Programs/tsc.txt411B
CS2RED' Programs/CS2REDСhecker.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d7a96d169d8c99e83b7a4eb920b8934cedeaa0ce1619d0cc677a83e0556ca2c2
- MD5 8171222317c30d31448205d70bca990f
- SHA1 574d07820d3cb49c60a29defe88675072b9ae977
- SHA512 3a7f30a04f843294775b2501b9f51e4f2d2af4a834fa573791dcb2556526f4b834ac019bebab3fb9f062dd3012328cc2ea75db87df32d9b23346e2c495267e80
- SSDEEP 6144:lloZM+rIkd8g+EtXHkv/iD45S4Uhv0IH+2PxM4d5Zb8e1m4i:noZtL+EP85S4Uhv0IH+2PxM4dLq
- MD5 SHA1 SHA512 SSDEEP
-
Detect Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
240254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CS2RED' Programs/Everything.exe
- IMPHASH d67c7cffdc58fd075aa466c7917d6010
- SHA256 35cefe4bc4a98ad73dda4444c700aac9f749efde8f9de6a643a57a5b605bd4e7
- MD5 0170601e27117e9639851a969240b959
- SHA1 7a4aee1910b84c6715c465277229740dfc73fa39
- SHA512 3c24fa02621b78c5ddaf1ad9523045e9fa7ccc02d85a0342e8faafc31be2a3154558d3cefcd9ae8721973fb01450ab36e6bb75a1b95fcc485a4b919f20a2202f
- SSDEEP 49152:GQdoNDZW77g1h0lv3o4MyTW+sWxXigRRlmrK:GQf75A4P9Fo+
- MD5 SHA1 SHA512 SSDEEP
Digest
4b:dd:dc:90:28:fb:53:b2:c7:4b:ac:95:5f:6d:b0:5a:a2:a6:13:8a:51:6b:dd:75:0c:d0:7a:46:4d:3d:4c:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU
Chains
May 26, 2023
CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU
Serial Number
03:0f:a0:91:94:b2:2d:c5:1d:00:65:31:c9:c1:61:04
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 21, 2021 - Mar 17, 2025
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1744112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
comctl32
ImageList_GetIconSize
ImageList_DrawEx
_TrackMouseEvent
InitCommonControlsEx
ws2_32
WSAGetLastError
WSACleanup
closesocket
send
recv
connect
WSAAsyncSelect
setsockopt
socket
WSAStartup
shutdown
listen
bind
getpeername
ntohs
getsockname
accept
inet_addr
htons
gethostbyname
shlwapi
SHRegGetUSValueW
PathIsRootW
PathCombineW
PathRemoveFileSpecW
kernel32
GetSystemTime
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
GetSystemDefaultLangID
LoadLibraryA
CopyFileW
TerminateProcess
OpenProcess
CreateMutexW
SetLastError
GetStartupInfoW
HeapAlloc
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
QueryDosDeviceW
SetErrorMode
DeleteFileW
RemoveDirectoryW
MoveFileW
MoveFileExW
CreateDirectoryW
GetFileAttributesW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameW
GetVolumeInformationW
GetDiskFreeSpaceW
GetFullPathNameW
GetFileSize
FindFirstFileW
FindNextFileW
GetDriveTypeW
GetThreadPriority
CreateEventW
GetProcAddress
FreeLibrary
GetModuleFileNameW
FileTimeToSystemTime
GetCurrentDirectoryW
GetFileAttributesExW
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
__C_specific_handler
WaitForMultipleObjects
GetSystemDirectoryW
LoadLibraryW
ExpandEnvironmentStringsW
GetSystemInfo
GetVersionExA
LocalFree
LocalAlloc
ConnectNamedPipe
CreateNamedPipeW
GetTimeZoneInformation
MulDiv
GetTimeFormatW
GetNumberFormatW
GetDateFormatW
MultiByteToWideChar
HeapCreate
HeapSetInformation
GetModuleFileNameA
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsSetValue
FlsGetValue
GetModuleHandleA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
SetFilePointer
GetTempPathW
CreateFileW
FreeConsole
AllocConsole
SetStdHandle
SetConsoleScreenBufferSize
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
WriteFile
FlushFileBuffers
GetStdHandle
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
GetLocaleInfoW
GetCalendarInfoW
DeviceIoControl
GetOverlappedResult
ResetEvent
Sleep
FindNextChangeNotification
FindFirstChangeNotificationW
GetFileInformationByHandle
GetLocalTime
FindCloseChangeNotification
FindClose
GetSystemTimeAsFileTime
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
GetTickCount
LeaveCriticalSection
SetEvent
GetCommandLineW
GetCurrentThreadId
GetModuleHandleW
ReadFile
GetLastError
CloseHandle
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetCurrentProcessId
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
GetWindowsDirectoryW
user32
IsWindowVisible
SetCursor
SetCapture
ChangeClipboardChain
DrawEdge
DrawFrameControl
EqualRect
GetSubMenu
GetMenu
SetClipboardViewer
EnumWindows
ActivateKeyboardLayout
LoadIconW
IsDlgButtonChecked
SetScrollInfo
UpdateWindow
ScrollWindowEx
SetDlgItemInt
GetMenuState
RemoveMenu
GetMenuItemID
GetMenuDefaultItem
EnableMenuItem
AdjustWindowRect
GetSysColorBrush
OffsetRect
InvalidateRgn
MessageBeep
SetCursorPos
GetDlgItemInt
GetDlgCtrlID
SendDlgItemMessageW
GetDesktopWindow
ValidateRect
CharLowerW
CharUpperW
CreateIconIndirect
UnregisterHotKey
PostQuitMessage
IsClipboardFormatAvailable
OpenIcon
GetForegroundWindow
AttachThreadInput
SetActiveWindow
BringWindowToTop
EnumChildWindows
CheckDlgButton
GetMenuItemInfoW
GetKeyboardLayoutList
LoadCursorW
GetScrollInfo
InvalidateRect
ClientToScreen
ScreenToClient
ShowWindow
IsIconic
GetWindowPlacement
IsZoomed
GetWindowTextLengthW
GetWindowTextW
GetParent
CopyRect
EmptyClipboard
SetClipboardData
GetWindowLongPtrW
SetWindowLongPtrW
SetFocus
PtInRect
FindWindowW
InsertMenuW
SetDlgItemTextW
SetForegroundWindow
BeginPaint
EndPaint
OpenClipboard
GetClipboardData
CloseClipboard
FillRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
GetAsyncKeyState
GetClientRect
GetCapture
GetLastActivePopup
ReleaseCapture
IsWindowEnabled
GetFocus
GetNextDlgTabItem
EnableWindow
SetWindowPos
SetWindowTextW
SetWindowLongW
MessageBoxW
DialogBoxIndirectParamW
DrawTextW
GetMenuItemCount
CreatePopupMenu
AppendMenuW
DeleteMenu
SetMenuItemInfoW
GetWindowLongW
AdjustWindowRectEx
CallWindowProcW
GetDlgItem
GetWindowRect
MapWindowPoints
IntersectRect
GetMonitorInfoW
SystemParametersInfoW
GetDC
ReleaseDC
SetWindowsHookExW
PeekMessageW
WaitMessage
SetMenu
RegisterClipboardFormatW
RedrawWindow
GetMessagePos
RegisterWindowMessageA
ReplyMessage
GetCursorPos
CreateMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
KillTimer
GetDoubleClickTime
GetKeyState
RegisterHotKey
PostThreadMessageW
GetSysColor
EndDialog
PostMessageW
DestroyIcon
SetTimer
DestroyWindow
DefWindowProcW
SendMessageTimeoutW
GetWindowThreadProcessId
IsWindow
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
UnhookWindowsHookEx
CallNextHookEx
GetClassNameW
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetSystemMetrics
LoadImageW
CreateDialogIndirectParamW
gdi32
GetDeviceCaps
GetDIBits
SelectClipRgn
TextOutW
SetStretchBltMode
SetTextAlign
CreateCompatibleBitmap
OffsetClipRgn
OffsetRgn
CombineRgn
GetDCOrgEx
GetRandomRgn
EnumFontFamiliesExW
GetTextAlign
CreateCompatibleDC
BitBlt
StretchDIBits
GetRegionData
ExtCreateRegion
GetObjectW
CreateFontIndirectW
GetStockObject
GetNearestColor
CreateSolidBrush
CreateRectRgn
CreateDIBSection
GetCurrentObject
ExcludeClipRect
RectVisible
GetTextExtentExPointW
GetTextExtentPoint32W
DeleteDC
SetBkMode
CreateBitmapIndirect
CreatePatternBrush
SetBrushOrgEx
SetBkColor
SetTextColor
PatBlt
SelectObject
GetTextMetricsW
StretchBlt
DeleteObject
comdlg32
GetOpenFileNameW
GetSaveFileNameW
ChooseColorW
CommDlgExtendedError
advapi32
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
DeleteService
CloseServiceHandle
RegOpenKeyA
RegQueryValueW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceConfigW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
RegDeleteKeyW
GetUserNameW
QueryServiceStatusEx
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CreateServiceW
StartServiceW
OpenSCManagerW
OpenServiceW
ControlService
SetServiceStatus
shell32
DragFinish
DragAcceptFiles
Shell_NotifyIconW
SHBrowseForFolderW
SHGetFileInfoW
DragQueryFileW
SHGetSpecialFolderLocation
ord16
SHFileOperationW
ShellExecuteExW
SHGetDesktopFolder
SHGetPathFromIDListW
SHChangeNotify
DragQueryPoint
ole32
CoTaskMemFree
OleUninitialize
OleInitialize
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
RevokeDragDrop
DoDragDrop
RegisterDragDrop
ReleaseStgMedium
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
302KB
Virtual Size
302KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
71KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=110, productName=VS2005 build 50727, version=50727,
count=8, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=449, id=1, productName=Unmarked objects,
count=181, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
CS2RED' Programs/Everything.lng
- SHA256 270c2dbd55642543479c7e7e62f99ec11bbc65496010b1354a2be9482269d471
- MD5 ba118bdf7118802beea188727b155d5f
- SHA1 20fe923ec91d13f03bdb171df2fe54772f86ebba
- SHA512 01d8dd2bf9aa251512b6b9b47e9d966b7eda5f76302e6441c5e7110ff37b4be325a4f8096df26a140c67bd740dcd720bc4e9356ccb95703ad63fe9fdbbb0c41f
- SSDEEP 24576:9Uj10cDM1+8NnWk1Gmdo3eZWDmehoenMUjV7KDvl0CJ2G:YycDMrf1seuhoeMQVuDvlTJL
- MD5 SHA1 SHA512 SSDEEP
CS2RED' Programs/LastActivityView.exe
- IMPHASH 3fbcb180ebbfb0ad62cf50d337af18c5
- SHA256 af86dc3f76d39b67b967a3b714e9e70ed43eec8d3871e9691cb45d84372b53fb
- MD5 f27a284ef9b018cdd2a98a7b78ccdcb3
- SHA1 67e260b11e6227c18cae8925b4f6899103c607f2
- SHA512 9a8811f13517748539308a70933b126a3348407f397bf30f903019379f927532c64015853b94acf21bdbc554d638a0265d4394d026e289103db06fe93fe5524b
- SSDEEP 3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B
- MD5 SHA1 SHA512 SSDEEP
-
Nirsoft
Digest
86:d0:50:e9:bb:2f:ee:a9:26:74:b9:34:ef:82:25:c8:43:e0:7f:b7:d0:98:e5:f2:8e:e8:20:f8:95:33:8c:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Chains
Mar 28, 2023
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL
Serial Number
f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 9, 2019 - Sep 9, 2023
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
76662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Projects\VS2005\LastActivityView\Release\LastActivityView.pdb
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p__fmode
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_msize
__set_app_type
_controlfp
_except_handler3
_wcmdln
calloc
realloc
_purecall
_wcslwr
strlen
_itow
_wcsnicmp
qsort
free
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
swscanf
malloc
_ultow
wcscmp
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
wcscpy
memset
_wcsicmp
wcschr
_snwprintf
wcscat
wcsncat
comctl32
CreateToolbarEx
CreateStatusWindowW
ImageList_SetImageCount
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
kernel32
GetCurrentProcessId
ExitProcess
GetLogicalDrives
GetLongPathNameW
QueryDosDeviceW
GetVolumeInformationW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
GetModuleHandleW
ReadProcessMemory
SetErrorMode
DeleteFileW
CloseHandle
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetDriveTypeW
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetDateFormatW
FindNextFileW
SizeofResource
GetTempFileNameW
GlobalLock
FormatMessageW
FindFirstFileW
GetVersionExW
FindClose
GetTimeFormatW
GetFileAttributesW
FileTimeToLocalFileTime
ReadFile
FindResourceW
WriteFile
GetModuleFileNameW
LocalFree
LoadResource
CreateFileW
TzSpecificLocalTimeToSystemTime
LockResource
SystemTimeToTzSpecificLocalTime
lstrcpyW
MultiByteToWideChar
lstrlenW
LocalFileTimeToFileTime
LoadLibraryExW
GlobalAlloc
GetSystemDirectoryW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
GetCurrentProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
user32
ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
GetDlgItemInt
SetDlgItemInt
DeferWindowPos
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
SetDlgItemTextW
InvalidateRect
GetDlgItemTextW
GetWindowRect
GetSystemMetrics
RegisterClassW
PostMessageW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
LoadImageW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
KillTimer
SetTimer
GetParent
OpenClipboard
CheckMenuItem
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuRadioItem
SetClipboardData
EnableWindow
GetCursorPos
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
MoveWindow
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DestroyIcon
LoadIconW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
DrawTextExW
CreatePopupMenu
CallWindowProcW
gdi32
CreateFontIndirectW
SetTextColor
DeleteObject
DeleteDC
GetObjectW
SetBkMode
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
comdlg32
FindTextW
GetSaveFileNameW
advapi32
RegOpenKeyExW
RegConnectRegistryW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
OpenSCManagerW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
RegCloseKey
shell32
SHGetFileInfoW
ShellExecuteW
SHGetMalloc
SHBindToParent
SHGetDesktopFolder
SHGetPathFromIDListW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantTimeToSystemTime
SysFreeString
SysAllocString
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=64, version=9210,
count=11, id=28, version=9178,
count=305, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=41, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
CS2RED' Programs/SC INSTALLER.exe
- IMPHASH 4d363d3b473a6c355539abd95921390d
- SHA256 a08acf97b669ad3896c129066e8afaea4173ff8e6d49256475adb07491dc160b
- MD5 b0ea56470940e14501f3de3704ee3dfd
- SHA1 344a32cd672ae105a3d4d154c58c7c10345746a7
- SHA512 ff3d9f9d9102f72daee17b86d30e6b6bb52c3b8b8f7f36e41d5bf656d3f1f8dc678bc41d446cde4519761942578bd16676dfe47797c7459cda3cd4420113708f
- SSDEEP 393216:W0EjEDXajAA7ZNU5DanvweSC1abTNp83uQz9seZ2L/yj84e3km6Nsp:9Ewuj9785GITC1ancuctJsAsp
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
44:2a:f0:fd:dd:29:4e:cc:c2:9e:36:ff:d7:bc:24:61:9d:7a:d1:32:58:e3:41:b0:69:c0:d4:84:bc:92:21:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=HarpyGuard
Chains
Oct 3, 2023
Subject
CN=HarpyGuard
Serial Number
cd:ce:da:a4:68:18:70
Issuer
CN=HarpyGuard
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2023 - Jul 26, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
1927332
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
kernel32
CreateFileW
CloseHandle
WriteFile
DeleteFileW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateEventExW
WaitForSingleObject
CreateProcessW
GetLastError
GetExitCodeProcess
SetEvent
RemoveDirectoryW
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
CreateDirectoryW
GetTempPathW
GetTempFileNameW
MoveFileW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
RaiseException
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
CreateEventW
FindClose
FindFirstFileW
GetFullPathNameW
InitializeCriticalSection
lstrcpynW
CreateThread
LoadLibraryExW
GetCurrentProcess
Sleep
WideCharToMultiByte
GetDiskFreeSpaceExW
DecodePointer
GetExitCodeThread
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryW
lstrlenW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpiW
LoadLibraryW
GetDriveTypeW
CompareStringW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
GetShortPathNameW
SetFileAttributesW
GetFileTime
CopyFileW
ReadFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
MultiByteToWideChar
GetSystemInfo
WaitForMultipleObjects
GetVersionExW
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
LocalFree
LocalAlloc
SetUnhandledExceptionFilter
FileTimeToSystemTime
GetEnvironmentVariableW
GetSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetEnvironmentStringsW
InitializeCriticalSectionEx
LoadLibraryA
GetModuleFileNameA
GetCurrentThread
GetConsoleOutputCP
FlushFileBuffers
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringW
GetTickCount
GetCommandLineW
SetCurrentDirectoryW
SetEndOfFile
EnumResourceLanguagesW
GetSystemDefaultLangID
GetUserDefaultLangID
GetLocalTime
ResetEvent
GlobalFree
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CompareFileTime
CopyFileExW
OpenEventW
PeekNamedPipe
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetFileType
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
WriteConsoleW
GetProcessAffinityMask
GetModuleHandleA
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
563KB
Virtual Size
562KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
198KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=29395,
count=187, id=261, version=29395,
count=1, id=262, version=29395,
count=19, id=260, version=31935,
count=25, id=259, version=31935,
count=105, id=261, version=31935,
count=26, id=260, version=29395,
count=3, id=257, version=29395,
count=1, id=263, version=29395,
count=744, id=1, productName=Unmarked objects,
count=380, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=151,
count=1, id=258, version=32217,
CS2RED' Programs/shellbag_analyzer_cleaner.exe
- SHA256 c93a0f4c6b5f24ee31cddb92b0ea3337021b5fb91faae8a381d3bd2c9b6add54
- MD5 463058236a0d84f8f8982d946eed0e07
- SHA1 800ab71ed3b3bf4fb67fc9e1628e59d0aab8b124
- SHA512 18bd9aea8489c5e873a679da92c83d2739de9532f5751bd23aea9eda226b9a95909f8fd525b0ce47859492997002aee32ecf37bb79e07f24b512287b8fd58a53
- SSDEEP 24576:HM33oPhoNsZ8IbF1lyDt3Ups4yAg7UrA2ei9QgTum+ApT:sHogIJD2y9oIreG
- MD5 SHA1 SHA512 SSDEEP
Digest
fe:19:d7:74:64:01:11:5e:de:91:87:12:ed:d3:18:7f:fa:33:2f:be:bd:2f:ea:bd:87:54:4f:35:f6:f9:7b:5d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
Chains
Aug 25, 2021
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
da:cb:dd:fd:85:21:95:53:6d:9e:b5:0d:2a:19:50:80:d9:0f:d1:c4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
Chains
Jul 3, 2024
Subject
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
Serial Number
a3:fb:da:e5:43:2e:e4:4d:42:f2:6c:b2:68:e0:93:19
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 18, 2020 - Nov 18, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Goversoft LLC,O=Goversoft LLC,POSTALCODE=19958,STREET=16192 Coastal Hwy,L=Lewes,ST=Delaware,C=US
Serial Number
a3:fb:da:e5:43:2e:e4:4d:42:f2:6c:b2:68:e0:93:19
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 18, 2020 - Nov 18, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 12, 2019 - Dec 31, 2028
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
4
Entry point
996864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
970KB
Virtual Size
970KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
36B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
397KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CS2RED' Programs/tsc.txt
- SHA256 00183c390bed1506c2f16ece0bc2827d10d237d7d32ea91057cdb7c4ea81ccfe
- MD5 458315547af0e7559652323e09817b68
- SHA1 3ae5a087e7edf47ccebe1653bda370ce4273fb46
- SHA512 fbb728bb5716760a27e0a2f706362d460615ffbab13ab6e7e5ef40feaf954f38dc1886d5cdca43595355d22e8660fce5fee5170be16975701fc148ba48aea8fa
- MD5 SHA1 SHA512