blackguard | PCProtect_Setup[.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.sys
unpack001/$APPDATA/PCProtect/updates/SAVAPI 11.0.1/plg_fops_dummy.dll
unpack001/$PLUGINSDIR/AccessControl.dll
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/SysRestore.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/Accessibility.dll
unpack001/BouncyCastle.Crypto.dll
unpack001/DotNetZip.dll
unpack001/EntityFramework.SqlServer.dll
unpack001/EntityFramework.dll
unpack001/HtmlAgilityPack.dll
unpack001/Microsoft.AppCenter.Analytics.dll
unpack001/Microsoft.AppCenter.Crashes.dll
unpack001/Microsoft.AppCenter.dll
unpack001/Microsoft.CSharp.dll
unpack001/Microsoft.Extensions.Configuration.Abstractions.dll
unpack001/Microsoft.Extensions.Configuration.Binder.dll
unpack001/Microsoft.Extensions.Configuration.dll
unpack001/Microsoft.Extensions.DependencyInjection.Abstractions.dll
unpack001/Microsoft.Extensions.DependencyInjection.dll
unpack001/Microsoft.Extensions.Logging.Abstractions.dll
unpack001/Microsoft.Extensions.Logging.dll
unpack001/Microsoft.Extensions.Options.dll
unpack001/Microsoft.Win32.Primitives.dll
unpack001/Microsoft.Win32.Registry.AccessControl.dll
unpack001/Microsoft.Win32.Registry.dll
unpack001/Microsoft.Win32.SystemEvents.dll
unpack001/Mindscape.Raygun4Net.NetCore.Common.dll
unpack001/Mindscape.Raygun4Net.NetCore.dll
unpack001/NamedPipeServerStream.NetFrameworkVersion.dll
unpack001/Netlib.dll
unpack001/Newtonsoft.Json.dll
unpack001/Nito.AsyncEx.Context.dll
unpack001/Nito.AsyncEx.Coordination.dll
unpack001/Nito.AsyncEx.Interop.WaitHandles.dll
unpack001/Nito.AsyncEx.Oop.dll
unpack001/Nito.AsyncEx.Tasks.dll
unpack001/Nito.Cancellation.dll
unpack001/Nito.Collections.Deque.dll
unpack001/Nito.Disposables.dll
unpack001/PresentationCore.dll
unpack001/PresentationFramework-SystemCore.dll
unpack001/PresentationFramework-SystemData.dll
unpack001/PresentationFramework-SystemDrawing.dll
unpack001/PresentationFramework-SystemXml.dll
unpack001/PresentationFramework-SystemXmlLinq.dll
unpack001/PresentationFramework.Aero.dll
unpack001/PresentationFramework.Aero2.dll
unpack001/PresentationFramework.AeroLite.dll
unpack001/PresentationFramework.Classic.dll
unpack001/PresentationFramework.Luna.dll
unpack001/PresentationFramework.Royale.dll
unpack001/PresentationFramework.dll
unpack001/PresentationUI.dll
unpack001/PropertyChanged.dll
unpack001/ProtectedAPC.dll
unpack001/ReachFramework.dll
unpack001/SAVAPI/on_access/win32/win8/avgntflt.sys
unpack001/SAVAPI/on_access/win32/win8/avipbb.sys
unpack001/SAVAPI/on_access/win32/win8/avkmgr.sys
unpack001/SAVAPI/on_access/win64/win8/avgntflt.sys
unpack001/SAVAPI/on_access/win64/win8/avipbb.sys
unpack001/SAVAPI/on_access/win64/win8/avkmgr.sys
unpack001/SAVAPI/plg_fops_dummy.dll
unpack001/SQLite.Interop.dll
unpack001/SQLitePCLRaw.batteries_v2.dll
unpack001/SQLitePCLRaw.nativelibrary.dll
unpack001/SQLitePCLRaw.provider.dynamic_cdecl.dll
unpack001/System.CodeDom.dll
unpack001/System.Collections.Immutable.dll
unpack001/System.Collections.NonGeneric.dll
unpack001/System.Collections.Specialized.dll
unpack001/System.ComponentModel.Annotations.dll
unpack001/System.ComponentModel.Composition.Registration.dll
unpack001/System.ComponentModel.Composition.dll
unpack001/System.ComponentModel.EventBasedAsync.dll
unpack001/System.ComponentModel.Primitives.dll
unpack001/System.ComponentModel.TypeConverter.dll
unpack001/System.ComponentModel.dll
unpack001/System.Configuration.ConfigurationManager.dll
unpack001/System.Data.Common.dll
unpack001/System.Data.Odbc.dll
unpack001/System.Data.OleDb.dll
unpack001/System.Data.SQLite.EF6.dll
unpack001/System.Data.SQLite.dll
unpack001/System.Data.SqlClient.dll
unpack001/System.Design.dll
unpack001/System.Diagnostics.DiagnosticSource.dll
unpack001/System.Diagnostics.EventLog.dll
unpack001/System.Diagnostics.FileVersionInfo.dll
unpack001/System.Diagnostics.PerformanceCounter.dll
unpack001/System.DirectoryServices.AccountManagement.dll
unpack001/System.DirectoryServices.Protocols.dll
unpack001/System.DirectoryServices.dll
unpack001/System.Drawing.Design.dll
unpack001/System.Drawing.Primitives.dll
unpack001/System.Drawing.dll
unpack001/System.IO.Compression.Brotli.dll
unpack001/System.IO.Compression.dll
unpack001/System.IO.FileSystem.DriveInfo.dll
unpack001/System.IO.FileSystem.Watcher.dll
unpack001/System.IO.IsolatedStorage.dll
unpack001/System.IO.MemoryMappedFiles.dll
unpack001/System.IO.Packaging.dll
unpack001/System.IO.Ports.dll
unpack001/System.Linq.Expressions.dll
unpack001/System.Linq.Parallel.dll
unpack001/System.Linq.Queryable.dll
unpack001/System.Linq.dll
unpack001/System.Management.dll
unpack001/System.Net.Http.dll
unpack001/System.Net.NameResolution.dll
unpack001/System.Net.Requests.dll
unpack001/System.Net.ServicePoint.dll
unpack001/System.Net.WebClient.dll
unpack001/System.Net.WebHeaderCollection.dll
unpack001/System.Net.WebProxy.dll
unpack001/System.Net.WebSockets.Client.dll
unpack001/System.Net.WebSockets.dll
unpack001/System.ObjectModel.dll
unpack001/System.Private.DataContractSerialization.dll
unpack001/System.Private.ServiceModel.dll
unpack001/System.Private.Xml.Linq.dll
unpack001/System.Reflection.Context.dll
unpack001/System.Reflection.DispatchProxy.dll
unpack001/System.Reflection.Metadata.dll
unpack001/System.Resources.Extensions.dll
unpack001/System.Resources.Writer.dll
unpack001/System.Runtime.Caching.dll
unpack001/System.Runtime.CompilerServices.Unsafe.dll
unpack001/System.Runtime.CompilerServices.VisualC.dll
unpack001/System.Runtime.InteropServices.RuntimeInformation.dll
unpack001/System.Runtime.Serialization.Primitives.dll
unpack001/System.Security.AccessControl.dll
unpack001/System.Security.Claims.dll
unpack001/System.Security.Cryptography.Cng.dll
unpack001/System.Security.Cryptography.Csp.dll
unpack001/System.Security.Cryptography.Encoding.dll
unpack001/System.Security.Cryptography.Pkcs.dll
unpack001/System.Security.Cryptography.ProtectedData.dll
unpack001/System.Security.Cryptography.X509Certificates.dll
unpack001/System.Security.Cryptography.Xml.dll
unpack001/System.Security.Permissions.dll
unpack001/System.Security.Principal.Windows.dll
unpack001/System.ServiceModel.Duplex.dll
unpack001/System.ServiceModel.Http.dll
unpack001/System.ServiceModel.NetTcp.dll
unpack001/System.ServiceModel.Primitives.dll
unpack001/System.ServiceModel.Security.dll
unpack001/System.ServiceModel.Syndication.dll
unpack001/System.ServiceModel.dll
unpack001/System.Text.Encoding.CodePages.dll
unpack001/System.Text.Json.dll
unpack001/System.Threading.AccessControl.dll
unpack001/System.Transactions.Local.dll
unpack001/System.Web.HttpUtility.dll
unpack001/System.Windows.Controls.Ribbon.dll
unpack001/System.Windows.Extensions.dll
unpack001/System.Windows.Forms.Design.Editors.dll
unpack001/System.Windows.Forms.Design.dll
unpack001/System.Windows.Input.Manipulations.dll
unpack001/System.Windows.Presentation.dll
unpack001/System.Xaml.dll
unpack001/System.Xml.XPath.XmlDocument.dll
unpack001/Trinet.Core.IO.Ntfs.dll
unpack001/UIAutomationClient.dll
unpack001/UIAutomationClientSideProviders.dll
unpack001/UIAutomationProvider.dll
unpack001/UIAutomationTypes.dll
unpack001/Utilizr.NotifyIcon.dll
unpack001/Utilizr.OpenVPN.dll
unpack001/Utilizr.VPN.RasSharp.NetCore.dll
unpack001/Utilzr.WPF.dll
unpack001/Webshield.Client.dll
unpack001/WindowsBase.dll
unpack001/WindowsFormsIntegration.dll
unpack001/avira.managed.remediation.dll
unpack001/avira.managed.sdk.dll
unpack001/avira.managed.update.dll
unpack001/cachey-bashi.netcore.dll
unpack001/e_sqlite3.dll
unpack001/libcrypto-1_1.dll
unpack001/libssl-1_1.dll
unpack001/mscorlib.dll
unpack001/netstandard.dll
unpack001/nfregdrv.exe
unpack001/pwm.dll
unpack001/wscf.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

PCProtect_Setup.exe

IMPHASH ea4e67a31ace1a72683a99b80cf37830
SHA256 99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103
MD5 87cb9284aac0aa4112c153a5bcd89e99
SHA1 3b724ce214652b93d1a5fb5fd5de29c24f69c3df
SHA512 d171d56548a43f57241cf0431b7ce8d5fcb243b4bf9d7785c7f356e449cb6b8da9135231e012bb948293f1eac86cb893e1061f13b4c203a3bb60c9be986fcd67
SSDEEP 1572864:pJf8FOQTBHUoFkd07b9M6jok54D9xlYVCL:79QTBHPFJrExl2CL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0f:3c:73:97:9b:df:5e:d7:69:01:ca:13:82:08:3a:52:c6:d6:e0:6c:76:87:f7:81:2c:c8:35:49:c4:d8:ab:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA GetTempFileNameA RemoveDirectoryA WriteFile CreateDirectoryA GetLastError CreateProcessA GlobalLock GlobalUnlock CreateThread lstrcpynA SetErrorMode GetDiskFreeSpaceA lstrlenA GetCommandLineA GetVersion GetWindowsDirectoryA SetEnvironmentVariableA GetTempPathA CopyFileA GetCurrentProcess ExitProcess GetModuleFileNameA GetFileSize ReadFile GetTickCount Sleep CreateFileA GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aebb.dll

IMPHASH 3a20d38e32d00b58d66203e5798b7b1e
SHA256 cd6fcce8f0a2e4f832894abe41f2c4e7c0ab97b4a46eb478d085ffbb9ca36b5b
MD5 2af40e6f90240525f8cd27961b53f2db
SHA1 5eab9dc2edef6140df6842811da9e8ae9a27cbd9
SHA512 ba80cf1f33e14d5dd3a3f96196e265d33920ac4fcc23dd3da61e192233401aad522fceea4a295628f03345ec3e43ae16542b0adcf8adcf0ee93a3f2114c2bccf
SSDEEP 1536:BwgYl1cyd7JwVYgPj73dFZEqusWhmcdhRktha4rbtqa:B4t7AYgPjfeZHhRkthaFa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a3:e4:37:d0:7c:d7:3f:00:5b:a5:35:23:d8:a2:a3:76:f3:cd:10:fe:e1:34:d0:ba:c3:f2:94:25:63:da:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 25, 2022

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

1c:a2:8b:87:5c:8f:0d:56:fc:03:4b:f1:35:b7:07:99:74:d8:11:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Mar 25, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

6f:40:17:75:8e:d0:8a:39:e0:a3:bb:62

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

6332

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aecore.dll

IMPHASH 217ebb8a365fd7faa7f8b379d9f92737
SHA256 1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
MD5 2a4261a7dde3fdfd43793ca431890f84
SHA1 8be893f9fd941dc0971498587f52228e2e9d69b0
SHA512 e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
SSDEEP 6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

82:6c:0f:56:e7:0c:d5:a9:f4:7f:c9:0b:0c:1f:03:9f:e5:b9:ea:91:27:13:2b:02:c8:5e:56:a7:77:a0:52:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 12, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

5f:82:7d:5a:23:2a:e4:fe:53:6d:c0:84:2e:33:df:11:34:d1:b6:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Dec 12, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

165679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError DeviceIoControl FreeLibrary GetProcAddress LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW DecodePointer InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetFilePointerEx GetStringTypeW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aecrypto.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
MD5 e824d826c0ebb30047aaa308fe03b6c9
SHA1 1778f29052920ddc7ef192761123013cb7f648d2
SHA512 774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
SSDEEP 3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4a:05:64:d4:25:70:65:06:c0:93:3f:16:bc:76:a0:b0:e6:16:62:11:68:71:03:6e:00:73:8a:f4:62:fb:00:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

3f:2c:05:37:63:c1:c2:73:53:9c:97:f4:07:18:b5:82:c1:1b:3d:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Aug 3, 2021

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

59087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aedroid.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 12bfedbe10041d39020e9a15c4cc3d4b557a7d4fffe40cf2d75caecf5f1ed1ab
MD5 8facd0e1b34b24d3b7adb3b9be3375dd
SHA1 f7ac09b72c91a8c54e266b7f6b68b2e40366d026
SHA512 55fba8645835c69fe6e93da395de726bbcc0b3dd0049b5e4673f811cb92bc911a8bf1f6706a0922548635aa81d8aef95c3779cf827e52e70f851fa0be6a0c502
SSDEEP 49152:2bnUI0myoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/:OnUI0myoyI4rlfff/MtGcMnrjD4LTQXv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

79:a9:b8:7b:e7:bd:78:32:f9:54:23:b3:fc:10:b3:6f:08:ec:26:c5:41:4c:21:05:07:2f:54:ed:24:21:19:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 8, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

95:0a:d9:22:ef:4f:14:55:38:a1:c7:0d:74:7c:28:e2:83:5b:32:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Dec 8, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

119326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aedroid_gwf.dat

SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
MD5 961a1c1e0dfb8b54019c9ccec510b3ad
SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeemu.dll

IMPHASH 9b5c2716bd999e49e0bc0945944d4532
SHA256 9c9e782ac4490372119a95cac641970d805679a8aeef2ad59ee28c1a942cf5ac
MD5 02940a21ab69d26893bc00c064be569e
SHA1 e6eb2ba77bfa72fda91ba46924a18b8ad726f7b5
SHA512 fac2069467c574b856fdb4597fb973b9a4f3fef5288b0ed0bda72136f48ffce58063ea5b251ae01216f744ec17d2c824f07593f8de885bdad123f5867510b21b
SSDEEP 6144:HC9iYUBfVOM2SO79GGphjkL1HEli3ETCmkGeqcupFRiZnlQpeIj8+u4:JfVYVFphjkpHEli3ETCaZpFdeIQy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1f:89:d6:7b:c4:23:37:c8:62:87:ea:5d:c5:fb:ae:4a:04:ec:b4:d5:53:6f:43:46:b8:8f:2b:93:52:e5:d2:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

dd:97:19:71:7d:89:7c:5f:cb:ce:18:aa:46:10:cb:3c:7f:79:2d:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

0

Major OS version

6

Entry point

277265

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeexp.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 911d01f963ab2236e7bc977f96e84f292bef07f48f40f8927115e2b056992aa8
MD5 faee506a935d68524834d090cb0fc16e
SHA1 f3927c0170f15c1ad895f57aab48167781c51eff
SHA512 5b15442e84e828425832659124398cb867a3cd70f48e85c2ae6eb2261d9f83101e148264349f05b86fc8b034af6ab5dce0579c106e0bed95a8aa656839903a53
SSDEEP 6144:TIJxzjiTLxYnFZ9YJSXAVkpzFJv+rN0QmwAdWy9kvTZceYD+Pzb8ljBUJ:sxzjiyj9s+D+rNmjYy9BeYbPUJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9f:d6:f5:8b:30:61:44:91:be:3f:7f:86:6c:c5:56:91:fb:0d:ca:e4:a6:77:ae:12:67:03:76:dc:fd:ae:ba:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

114287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeexp_gwf.dat

SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
MD5 d68dbed2d9e81bb670e94b0b550cccdf
SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aegen.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
MD5 163ea96ca0a9b9f7469dd128fe5bce04
SHA1 60f4a01001fe4ad3b2aea24ce0b535a7d863f333
SHA512 b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
SSDEEP 12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

09:f4:52:55:bf:f9:02:43:c0:79:f1:a7:ce:55:db:fe:e8:ef:21:6e:7b:14:db:f9:bb:53:6a:07:84:b3:8b:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Aug 8, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

dc:b1:ae:62:aa:10:8a:bf:e6:9f:8a:5d:22:b4:1c:86:9f:02:f5:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Aug 8, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

569437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aehelp.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 2c0b8af1ed85fa5ff16f87f3c58beee9fc0230594dd062913ec5ce87abacba4a
MD5 c56e6711d0c6dbb6bd7bafbde06e9c90
SHA1 872c3d8d2a54ac10c22861052498c2ef954f8004
SHA512 611892b7b5a4a51fca74ee0d4d2dfa6a02ec22eda0fb9c24ff51a7f33a695a2aef3bb222763cd7ac5d0d6d5529634493fd2abd0a2c38fbbef34358700d65cb8b
SSDEEP 6144:qJcM9/q39zJguo+i6d5Pjsyb4BIdhqDiD+o9RScE72UG9zxAe:Ux09tghUZsyvPS4UG9zxJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

9d:91:74:e6:bd:51:20:c7:8f:bf:9a:39:8e:49:41:89:d3:b3:7c:4d:84:85:91:dd:dc:5f:bc:d7:84:76:18:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 8, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

163201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur.dll

IMPHASH 5b0f0adb0bc652db7edc954409410539
SHA256 23bfdb21548d8b0da6b1d63167c44207a3fe7f613bf36406168c667bb7d0a4f5
MD5 d3f86394440e679a8be729c2af168169
SHA1 3c50ae00ca1c65b71f6f01c18a1507c03207df5a
SHA512 40abd780623276742f4ff5e89135e1223e3f7226cfb8af66f87646bcbb46c46e23eebe1a4bf3e4e0603622fb803d91d4c7f25c31283cddacc9037335a436c936
SSDEEP 98304:9/P/JUX4fQyJVTL4sxamHxu0dcSgrz/2FJEncELaq855k0rmMxzuIi5dYPnu62QX:nmN1C1Nn7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

2f:61:ed:bb:69:80:c0:8b:13:ba:c8:c6:0c:aa:a5:8c:2a:ab:50:56:69:4f:1d:27:5e:27:22:f7:be:7f:57:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 15, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

9983951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_agen.dat

SHA256 ee8a06d4af03049c6699a37a24233f37eb08dd2720f57848e665ed6d1cc7eb78
MD5 159a422ec89a6699396140a500ddbfb8
SHA1 8bcc5d5ae855bb7e36412a6b2d9a8bbfa37f56a3
SHA512 db67a5792624b632c8cb3ab4bef963817faaa62dfa29f2da71b034a90e766c5d569b4c6ca2c04d85368674373fc72e60d4fc53711438923690a1ca0dfb4bb404
SSDEEP 49152:fAtG44TpuEkXGrhmWq6GOaJIf9x89H8KGAPg9ZFvh0JMfLU9g4:u4TbJYN6OOoH8KBPg9ZFviJr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_gwf.dat

SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
MD5 27dbb4a716dc8d87eac34a14f814dbc8
SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_mv.dat

SHA256 9ddc8bd72905ab30861d3ae37af5292b6162f63e6446c15a1ccee3f8aeb67910
MD5 9c93a76d871b55028d607207a90b39ff
SHA1 c3b33d3622dbc1d02d0ae0beaf2cef9db56962aa
SHA512 7f9529bc2ae489a1a2bf92f54055543c933dd39359bc7a77ec19c9bf30272947e10d785c4f3baa3deee2654d5c23cd1154856b8e54031bc8c4ee985f4ee88a4a
SSDEEP 24576:pDOi3wLUZGF509e2P/LjK7uXikERi7Rpo83imfmYc9yeLnx6LKd8AxBem0w1vo2m:0KFGuua+zN6WPmEH2LVlFFp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelibinf.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 812442ad5cdaeb6dd5dff76ddc3941fb9a1a56f999aa836f8fcbf4bb9e1b488f
MD5 21432626c63068ee47107da801c05ffc
SHA1 1b011f00a0a01bf217c41a0f5cb7d8c0f6b7046b
SHA512 1c6e973be37fbcfd2b945fbbde57afd37525aafd475b4229db8296ce48cbcffb2a092fb1d226b6f655a491535f7f2bff5139522daff92bf002304545fbeb596c
SSDEEP 3072:nA5Fh7lNUcO4WsdDKs63FgJln2qVsdP0xKMSET:PAWsddFV5Vsu8pET
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

3a:3a:9b:c1:fc:e2:27:88:78:44:09:ef:82:da:55:b6:e7:3f:d7:58:c4:a7:7f:a3:2c:44:11:34:3c:89:fe:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 26, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

34:24:aa:7b:be:bf:5f:de:ab:e3:15:6a:a8:48:82:e4:2c:b5:e6:6e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Oct 26, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

0

Major OS version

6

Entry point

14441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelibinf_db.dat

SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
MD5 ddc132992273330ec506e63fae4985b4
SHA1 7bf3018217f136662c159994f6530edf4c976a10
SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelidb.dat

SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeml.dll

IMPHASH 987fabbe7aaa43f6606c10cbab26a0d8
SHA256 537b3ea2ce48dc0cc343c1c6ce79ae5ba527b2fcddea24cadef1fc1eca8c42cc
MD5 0de0cb670e3046e388829fdab6910a9c
SHA1 2b9daea0200fd1c442c9a3a967bf51d68f7ab80d
SHA512 7e7ab02d20c3a1b8f76ce8c951570be1e719e0533ffc14970c958240a6adbe1c8ab88c826ef21083db0c74c6f83a1c9262ec6b2371b72d357bf6d5a298ba6f33
SSDEEP 3072:qsjdmLYGV1RkWeY9aN4R8kGW+JVhyTWrZy6xLqOVqrsyyP0Y:qsxmfRk4UkdGW+CqRVqrLY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

96:61:e3:07:74:4c:5e:0e:ce:9d:11:39:70:14:73:d2:43:40:92:2f:b4:f5:7a:76:c4:b2:6e:f3:0e:de:89:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jun 29, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

d4:3c:a2:de:5c:d6:c0:94:0e:6a:a8:b1:9e:ec:e7:5f:84:dc:a6:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jun 29, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

42858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aemobile.dll

IMPHASH f26319b70fd0009dfeb674e39bde957c
SHA256 3137d3d95d1caa59d349645ab8087d6b0c7cc3321873789c738553d4471143c6
MD5 b132b36c0b53839ee1c0fc8198170157
SHA1 3e7394ee8d3c4c0f36e00466fe0191ede592c01b
SHA512 1bba22a77ceaa59c00cf0d10a7afced2161985d8baae94c9cfe0cd5171464f49c53113b4ba8a027cb727aa242a23f79c1cf19a4df821ef6ac00f7a7c2ecd155e
SSDEEP 6144:pHfeO55RAQ9JUDSzFPCMhgFaaIembdw2p52s5dEy/ZAuvGnAQyFuDlXDG:dh3RAQ9FFPRImxw2fZiy/ZAu4DU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1a:e9:b0:72:4e:08:7f:6b:f9:b2:6f:68:f4:c9:01:13:b2:38:44:ab:ec:92:fb:88:12:f0:35:88:19:b0:b5:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jul 4, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

6c:ab:5d:1d:03:59:4a:57:18:a1:f6:10:d4:0f:51:c4:59:7e:87:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jul 4, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

226159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 4a3c2f29b2ab5e78e5a1558d2ddbc564cbd4474ce4115001ba6662c143b6482a
MD5 3dbd9c8da952507d0df2b46308fe83a2
SHA1 0d38ee68466f818e880680b73f5f74ca300ae629
SHA512 1e6b65fa80d95d1cb1da72b7905105f4b4fa6ee7c1fd63fdd7728a030ff42b9177e2eb0fbca1e64f44a11a253defd7bd179bc8c596fc565f3972ad89cf5c9616
SSDEEP 12288:jk1fpTUcoWP1AOSRCEL6/CJ1KVm0yjw0REYVXkVzLKt98r0:i1UcoWPBEGyKVLow1YVUVCu0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:93:6e:3b:ea:de:0a:6e:1b:17:b1:5c:b1:e3:58:26:6b:fe:40:78:6e:e0:42:64:3f:e0:18:28:4c:1f:5d:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

622653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice_gwf.dat

SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
MD5 0c95def0894c5e5716cf7a3ecc7545a6
SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice_mv.dat

SHA256 adac5f741e5ee6f669b76bca87a26bdafa9be60d8ac7e7c5059af9ccce919608
MD5 e346fe238be4b645e20e1bd77e9167bf
SHA1 252c2614387aef2304f85cebabcb89b7e5f04c96
SHA512 29965365aa6a5dae7bdcda0f437202d5a2874d60d3d59895871d05b4ca3bbea539fd04ae1895a0f6c77992ae2b7a39dd74837a1a6a72f15e92129517ff6375c9
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aepack.dll

IMPHASH 15e933b00ded9cae6f463a1796323b1f
SHA256 fff47393adf070bc04d044c0a939c620234881e1ad69d3776146e32d25e1f36d
MD5 26ab6a0a9b1c59a01f9b45bbc0bbc65d
SHA1 ef282c4322c361aaac6d70d0e27d4b2292de4999
SHA512 f17aca43e9f66ae21d295af5fbca5de0770ef77eb602f74ac6696aa9cf9af9884df21f9c9a98a6aa5d9ba5bbb3f9951c952d608dc3863e6a8a6a6c053639f26a
SSDEEP 24576:1oHuMoULNqpg3NV0ug3YdXIsPt5AUzp/X:mvom5NkI+UNP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1a:58:64:45:e9:dd:68:f0:00:7b:e4:0d:32:d1:b5:fa:9c:78:ba:ef:b3:16:88:59:b3:7b:4f:88:9b:1a:f6:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

686048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aerdl.dll

IMPHASH 24bc7db91306bdc7881dc1f977fdebe3
SHA256 d049ab67daae27ab3840730cadc5a82dfbd269b58896b9f8289324816e1680eb
MD5 62f7467baebb56a8beea7fffa6c4ee7c
SHA1 c13eb821d2675f110b1a38f8c0842b91edcab9b4
SHA512 d31498bdee77fd498226d6c971dff65eeecec66811109f1a729858fee6aa92f6d1601256740417ba5abb72b4c7109eb3e69ecc7446093bebee62c559d4e7a61a
SSDEEP 24576:8lGo7gc5YfW4W2ERk7IERLQw33gAcRRbfQ:xo5d4WPR7GLhofbfQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7d:13:92:df:78:40:eb:f2:43:3f:a2:f2:b8:a3:77:7c:ab:d0:18:07:59:0b:3c:c9:40:aa:96:ed:bd:44:d8:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2023 - Mar 18, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2023 - Mar 18, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

848574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aesbx.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 a03aa3e017606dce6f2cd19536db9306a6ebf2eaefb224be735569599a39330d
MD5 63159174de5eff0c3ed33f887c00e1b4
SHA1 aa787a058920e7010269d1286f32bda62206949a
SHA512 398831b8cfebe1a7878658087594dcdd74f6be8d380bcacd415acd5bbed85e6bd939c1562b3cee4e8ecbe64b0704be1cdab2dcc9c7ae6a0dfa0e8b8d0317f884
SSDEEP 24576:006liaoL0dhMPqd4MQSsnBuAZVeBV1XAw1CciqmjtLb5tNz/+SW728F6cLUpqfjr:00jL0nI54V1XdiJZtNS84jKsQi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

0d:e8:0f:e4:e2:96:d7:84:c7:29:55:a0:b9:0b:22:c4:91:53:61:89:d9:08:82:82:a0:ff:7d:4b:3d:b1:9a:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 12, 2022

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

14:d2:18:78:6e:da:99:00:1b:81:3f:a7:46:da:53:42:3b:cf:22:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

May 12, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2021 - Jun 28, 2022

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

1221506

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aescn.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 b816a2810fc9c1a5294a59b0232a1725519a2a7472f509c336b9fd1b189d0f3d
MD5 045180fa8eaf0c2409e101542014b5b8
SHA1 70656f926020e02e7c67fd2d145ca90b5952a9d5
SHA512 5659f42a6fe5cf259ad9528777ab5883f0185437b60710727c097cad2ceb60ac09eae4af59857c0021fc573343704ec6318cfc6d78ee2a1d7facc7321f4ae767
SSDEEP 3072:LvsmKNM8p6TrjmZGYx/wpTKwEGGyQYwc74RZQygPYDlIKpEU8+GIBfKLov+4OuuL:Lviu2+XmEGwpVnQY7ERay7BKU8FYxudl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

57:82:e1:6d:4d:a4:8b:7d:1f:c9:ce:bc:0c:e5:d5:79:aa:a3:4f:e4:34:2b:f1:6c:22:1c:37:9e:0e:ca:81:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 24, 2022

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f5:3d:6f:65:1c:ce:03:88:12:2a:10:ad:ec:72:29:33:a0:06:53:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

May 24, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2021 - Jun 28, 2022

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

75362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aescript.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 8371b7ea7e0e0650a4aca997d270b68543d61ef873190d02db37d7c3349b5942
MD5 11197cd2373a7b8364d9bb97406fa2b0
SHA1 05b81929d797330803febd8231907b54462706f1
SHA512 dff359f3330cceb1bbae2cb26748244509870f9f6f1307b4010e4a449cb50b87d4395fbc38e7b1a0fedfe16eb7b01b4cacac7631f606ec1467555ca5099138c9
SSDEEP 24576:90UGScZK1H+snGqwKchYOLOY5XzIR/l5/v33lwjlOm5Ui2TQ:KU0ZRYOLTI1l53KlOm5UI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

de:57:f7:53:86:16:57:63:c3:57:2a:42:2a:88:ff:04:c6:13:4b:65:dc:85:c3:8b:7d:9a:fd:b5:bf:81:ae:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 15, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

1055938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeset.dat

SHA256 1d06844d6c0aae9b0a5f6f7f61b4c7c6284fb085b7f878d596ee8407c67b7357
MD5 b78db48c5ff9494327032a27d5aa33cc
SHA1 43ffc51ef1da90ec791a95ab6d20e3cae7a66482
SHA512 855622613a0310cceb1b885f11d22876b1b6092fbdfa7ec19618d8ae71b2ad70ca75bfc44ea0e4069b38d9785c400025a8f6a4bedca539546eb10cbce078a051
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aevdf.dat

SHA256 1fa5d91c9a58fa3f9d3761ace1a8f3bd97fe6e903eaa6540cee0c75f89c681d1
MD5 7ad1fc9922e67652c346113289a557f3
SHA1 9b7dcf5873d40fb45e2016051329cff4d628c336
SHA512 c042d79fa0fffc8a173868f411242868b3a1b5d495dbaa0c70beca65f03b6a988d1dffa1e823ad3c126a5dde2592770e73029a184797fb7ab627e0564b34b5fa
SSDEEP 48:b3sa0DNeR8vdNsv4lFgtKTY6rTsYj6xO/Jzl69sYue4:b3N05e+vdNC4lyKTFTsYj6xSJpYjue4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aevdf.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 3acf87d057b627745f588315c528ca19699bc6e5999fb785160a432c7d42b182
MD5 1f2846f66f454dcd075690914c58d97c
SHA1 f6e6c89c11aaffaffaf98791c1faafd00e5d8aec
SHA512 20f555510d45aa62b0256f8898a360ef47f58a37faecfd014e34a0fdfe9f59178ad23532fd37c04edcad63b725571fdbd765ea5f30202b0525f6979d509e28ea
SSDEEP 3072:VGkspwGVB18ldNUYDFjsRRGMKEBeP/EvKaBlbCPL00eAplUlCtvt1JdkbTFtkIpu:VGkseGVB18lXRDyGMKUenkNCYiPU0tvZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

a8:df:e2:88:b0:84:09:f2:b8:09:b5:18:e0:68:60:7a:73:58:2f:7b:9d:ce:b2:40:99:d9:25:ad:c2:99:36:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jul 15, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

74:92:d8:a0:37:3a:2f:cf:c8:6d:3e:7f:ff:50:18:c2:ca:25:48:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jul 15, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

64157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/ams_setup.exe

IMPHASH 159adfe0cb0b35b14c9ff83cb2d1a025
SHA256 168c506b14418d3c64435d1e165e2b686b8c2273023d9f45848cee5a1355d27b
MD5 30ad65d8805ff9356ac7e75e67585f01
SHA1 7711885c3bcebe0bae7c5d33979eb52cbecb8f26
SHA512 d45eee2a5ab487d4d614da497b4ebcbe34f93828a294dcee9db5f0e4eadebcfe3408f30956b15a5352c465c956adf68d89c97a2a6609b15c7c5c43408949aa15
SSDEEP 3072:IjGFIi8a+vmi3zw4+j16h3U7yYYFOqnHifsW/bFYWoBKyMeTGXZ9PjlLgqER:W4IFb3z7O1iU73YFfe/jNXZ7pER
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

58:91:d3:92:dc:0e:d5:c5:d6:5c:90:7b:27:15:57:8d:4f:45:63:ec:2c:fd:90:a1:6a:78:06:79:fe:9a:f9:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

1

Major OS version

6

Entry point

30108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\aviraoa\ams_setup\ams_setup.pdb

shlwapi

PathFileExistsW PathRemoveFileSpecW

user32

GetSystemMetrics ExitWindowsEx MessageBoxW

kernel32

WriteFile CopyFileW SetEnvironmentVariableW GetCurrentProcess GetBinaryTypeW HeapAlloc HeapFree CreateFileW GetEnvironmentVariableW GetFullPathNameW MoveFileExW SetFilePointerEx GetFileSizeEx GetSystemTime LoadLibraryW FreeLibrary GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess WaitForSingleObject CloseHandle FindNextFileW FindFirstFileW FindClose DeleteFileW GetProcAddress GetModuleHandleW GetNativeSystemInfo LocalFree GetModuleFileNameW GetLocalTime GetLastError GetCommandLineW ReadFile ReadConsoleW HeapSize HeapReAlloc DecodePointer SetEndOfFile WriteConsoleW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle ExitProcess GetModuleHandleExW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

shell32

CommandLineToArgvW

advapi32

SetServiceObjectSecurity BuildExplicitAccessWithNameW SetEntriesInAclW QueryServiceObjectSecurity DeleteService CreateServiceW ChangeServiceConfig2W ChangeServiceConfigW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle FreeSid CheckTokenMembership AllocateAndInitializeSid

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/apc_random_id_generator.exe

IMPHASH da8ed38bc494edc43fed015b4c7918b8
SHA256 1239ea35953b0fe8677bee09dedb7c3eea987e977c73e73ef8862c4a3774b659
MD5 be6f0a323777bc43bce01fdc5ad58120
SHA1 a6c1742269fb7879dcb54dfd25af57dba66ab732
SHA512 921b11869d1ec2b5a19ef41b75504ac099429339a143cfa677fc54eb520a2b79b173e2e326afcaeceeab4f6b942098dd9a660b7c9dc3addc8b9ea53a3cac4548
SSDEEP 6144:y8o+8urNJEXczi5CLqOhcg7vnDUbRypWCaoo/Jiq/mEwhDsQ8cNWE9Zu:y8o+8MNJEiTPvnDUbRypWCap/+p9Zu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

08:ea:1c:34:71:84:d9:cd:dd:2c:fa:b7:5b:84:bb:35:87:16:d4:e9:f5:d9:71:17:e9:ba:3e:83:17:cf:d9:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

111069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\apc\random_id_gen\apc_random_id_generator.pdb

rpcrt4

UuidCreate

ws2_32

freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername WSAGetLastError socket shutdown ntohl select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept getnameinfo send

kernel32

ReadConsoleW GetConsoleMode LCMapStringW CompareStringW GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection GetConsoleOutputCP LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA CreateFileA GetCurrentProcessId GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetStdHandle GetHandleInformation SetHandleInformation WriteConsoleW GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW CreateHardLinkW SetEndOfFile LockFile LockFileEx UnlockFile UnlockFileEx DuplicateHandle GetCurrentProcess CreatePipe CreateNamedPipeA SetFilePointerEx HeapReAlloc DecodePointer FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize EnterCriticalSection WaitForMultipleObjects UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW RaiseException GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc

advapi32

LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptGenRandom CryptReleaseContext CryptAcquireContextA

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/apcfile.dll

IMPHASH d0a7a04ab2c72e5a3c1169b60f06b849
SHA256 7f6c31ea445c7b871a0ea2b73705776435b00f3e37223b53b5da9b4ad4d19c0c
MD5 ecf74de0b990c96fcf961e89cf73768c
SHA1 5ba320e5e1e4364cec95b130bebff52f3591c039
SHA512 8ab9b876db9edaee8862fe3cd0cde688158a487cf00f12ac85983c8fbe93a6f116f5d4ce96bf717ce64f4a231aee618b8b023c735ac1783249beaae95a3030bf
SSDEEP 49152:xCvhKevv/MEl1oInVGDM1UDtL0lzHYqV2WPY1KG5twA+arh2:xCvJ6IVGTyxHYqs/1KR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8c:be:8d:b8:6e:9b:1d:c2:fd:b9:a5:ee:68:c4:c6:4d:3a:8c:77:d2:5a:bf:b6:aa:01:58:e8:f9:f7:c5:8f:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2089296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\bamboo-build\SAV-APCSDKPACKAGE-WINX86SDK\package_release\bin\apcfile.pdb

ws2_32

inet_addr WSAGetLastError gethostname recv socket WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname shutdown ntohl getnameinfo ioctlsocket getpeername freeaddrinfo getaddrinfo closesocket listen htonl getsockname connect bind accept select __WSAFDIsSet inet_pton htons WSAIoctl setsockopt WSACleanup WSAStartup inet_ntop WSASetLastError ntohs WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

kernel32

EncodePointer DecodePointer GetCPInfo RaiseException RtlUnwind GetCurrentProcessId GetModuleHandleW GetProcAddress GetLastError GetCurrentProcess GetVersionExW GetLocaleInfoA SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA Sleep MoveFileExA CloseHandle WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetSystemTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber LoadLibraryW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation InitializeCriticalSection TryEnterCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA DuplicateHandle SwitchToThread GetCurrentThread ReleaseSemaphore CreateSemaphoreA ResetEvent FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle CreateFileW HeapSize SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW CreateHardLinkW CreateDirectoryW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GlobalFree FormatMessageA SetEndOfFile SetEnvironmentVariableW FlushFileBuffers ReadFile PeekNamedPipe SetCurrentDirectoryW GetDriveTypeA GetDriveTypeW SetHandleInformation GetSystemInfo MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileA GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA InterlockedFlushSList LoadLibraryExW SetFilePointerEx GetConsoleOutputCP CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler ExitProcess GetModuleFileNameW WriteConsoleW HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW HeapReAlloc OutputDebugStringW IsValidCodePage FindFirstFileExW GetCommandLineA GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteFileW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeSRWLock InitOnceBeginInitialize InitOnceComplete GetStringTypeW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

bcrypt

BCryptGenRandom

apc_add_cache apc_authenticate apc_category_name apc_create_context apc_ctx_get_file_lookup_filter apc_ctx_get_user_data apc_ctx_set_connection_timeout apc_ctx_set_data_timeout apc_ctx_set_file_lookup_filter apc_ctx_set_upload_connection_timeout apc_ctx_set_upload_data_timeout apc_ctx_set_user_data apc_disable_logging apc_enable_logging apc_file_cache_disable apc_file_cache_enable apc_file_cancel_uploads apc_file_check_file apc_file_check_files apc_file_check_files_ex apc_file_check_hash apc_file_check_hash_ex apc_file_check_hashes apc_file_check_hashes_ex apc_file_ctx_call_filters apc_file_ctx_get_elf_mode apc_file_ctx_get_ext apc_file_ctx_get_ext_policy apc_file_ctx_get_filters apc_file_ctx_get_mac_mode apc_file_ctx_get_pe_mode apc_file_ctx_hash apc_file_ctx_set_elf_mode apc_file_ctx_set_ext apc_file_ctx_set_ext_policy apc_file_ctx_set_filters apc_file_ctx_set_fops apc_file_ctx_set_mac_mode apc_file_ctx_set_pe_mode apc_file_ctx_set_temporary_dir apc_file_hash apc_file_hash_ex apc_file_info_get_extra_info apc_file_info_get_malware_name apc_file_initialize apc_file_initialize_context apc_file_metadata_set_download_url apc_file_set_batch_service apc_file_set_temporary_dir apc_file_set_upload_threadpool_limits apc_file_uninitialize apc_file_uninitialize_context apc_file_unwilling_to_upload apc_file_wait_for_uploads apc_file_willing_to_upload apc_free_context apc_get_file_lookup_filter apc_get_library_version apc_load_cache apc_save_cache apc_set_cache_dump_secure apc_set_connection_retries apc_set_connection_timeout apc_set_data_timeout apc_set_file_lookup_filter apc_set_low_upload_speed_limit apc_set_low_upload_speed_time apc_set_max_cache_size apc_set_max_upload_speed apc_set_metadata_product_id apc_set_metadata_product_language apc_set_metadata_product_license apc_set_metadata_product_random_id apc_set_metadata_product_type apc_set_metadata_product_version apc_set_out_of_memory_handler apc_set_proxy apc_set_proxy_auth apc_set_proxy_ssl_ca_cert apc_set_server_message_cb apc_set_service_address apc_set_ssl_ca_cert apc_set_ssl_crl apc_set_upload_connection_retries apc_set_upload_connection_timeout apc_set_upload_data_timeout apc_ssl_threads_initialize apc_ssl_threads_uninitialize apc_strerror

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/apchash.dll

IMPHASH c45291f055d661a4d27149e1fd47d098
SHA256 fb74e48074ba4d26049250bc68281751f9fb9a6c41c401e19f6870ebcfdf6a7a
MD5 a0c5e8f7cd6c02a8719ade39c1955135
SHA1 52153097ff4d14c89374ed9d144178ec104795ae
SHA512 30901a8332e09311bee3c244226d533840f277f47170fa85a7f2e06e3c1bae18a95db82b45ab1f31062be6f7c5dc6918bfe088f3088cfdce8ecb52df863da3b9
SSDEEP 3072:0IIIIb90Vo9gn6YfoT7lq3xsuHBfvPBwcbaGSI/2EQmhKeKhUbZXU0JxP05:0IIIIb9bYcI3xxZaGtuEQgtXU0k5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

73:73:cf:2e:34:53:18:6e:6d:ef:61:5f:f7:97:0c:64:5b:86:b5:c9:50:ab:29:fd:d0:ba:24:1c:c1:64:82:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

30443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\utils\apc\libapc_hash\apchash.pdb

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-apchash-product.conf

SHA256 e2cbcd600dce59af50b624e2079f4b92186dd0536f5ffbc2b859c5c440657e05
MD5 4257d3de2badf1811f90e8312bc74aee
SHA1 85a5ddcd2282e8049bc5432932baf418bc02ebca
SHA512 962cc45ff9aa7fe1bb8902bc195318408a7dc2728c7e89c5ceba3eaa7385d19eba52090a2f4e69bd25bb2a0a9f4500988f190e71fff84b9c9df6c8bb2052c4aa
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-on-access-savapilib-product.conf

SHA256 e5e0ae1892dcae23e6b2b914234cc2111efd1ad746887c61266618ce5ec5852c
MD5 c0d7ca0f42b0eb707f0ff09a1144d837
SHA1 1c5d84bcf2bfd97a51b156b04fde285a8fddd35f
SHA512 a4582b9ad7ae3bd795c271201850aa2ef5163b605f227fa4da06d6fd9d23144d811d16904257188832a2eeddb63692a12ed649ae4244eb3138b0a972e7686b19
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-savapi-engine.conf

SHA256 cfd50eeea0c80b8dde883951aa6149410ccbb6a08fb001cee109c276648feb1f
MD5 01a844c7204488b536c48a72090f8a39
SHA1 417b1670c72d9c0c70953e88fcf2ba8bc82c245e
SHA512 2aa341bbd42ad658bc4db5d5521dd1c5a882796b3bc745be89607ccbadc084bd790f92197e0881f4d45a13cee74fdd8c73b47e7cb86c2bf81598251c40591acf
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-savapi-product.conf

SHA256 30ef0c181ee31e52efe06d44f5d33e5a868160e6f93f573f38aac4b05f681af0
MD5 c94d4130ad378ddbc7e341937cf10692
SHA1 81a7fc4c1ebaf2c19a590c43d60d4b9f3650edbc
SHA512 59ac58e5ee40213cdbe8de93baa96db946fbd1e1c7b946ba31a61e4550e4bab29286811310fb966bb9725ffdd5f4b750b09a188193bd3bd5111eef5c882e2e49
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-savapilib-engine.conf

SHA256 ea5ade6e1bc0df9e2773dcaf5cf9bb087965dba3c74a12eeb9727747cffbb614
MD5 c0b5b102ad8dcb4190e4acd1e4c78d99
SHA1 6364654bbe47f784d84eb8387fe14d0a7c267a78
SHA512 76264a03d43d507574582aa6954d50ab3e0954153489abb4c311989226e9e951bb4de188cff8d92c4d48c96470d58d4d7bfc094a6a74c050ee8ef25a61395250
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-savapilib-product.conf

SHA256 f6c89a441e41a381ccb1785d97d9aeac95d6d01f13227431baa6a4c06b4f78e8
MD5 d8e715e99b1709e69303f9d9dfd0ba88
SHA1 68964f716482230d2b3d28677257f8742235e6ea
SHA512 3fce72763e81318f31bfb684fea8f189dc85fe3798d14978a3d589a649107e9a7ad61c0ea1f4f0ff2c50b8663fad3ec6870d9c595d7e66f8c0c11e3de42e5264
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate-xvdfmerge-product.conf

SHA256 1ccfc728f83e1709ae01936e369610e6f9bf7d83e9b406af995cab5fa1863d4e
MD5 c7e74ddde5788f5e9510034b66ff0fbd
SHA1 8b821abbe25c98877836a4a76446bb98871a9aa0
SHA512 7657ee00f0e8b5365b02d12393aa64e5862dc87e5ef5390824d536d72845b2e9e46a25ca0676f49e6d4cfcd7ee164e80832696a369e82d464d938139e8d745a4
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate.exe

IMPHASH 35e07a3a55743a4b4805df293e470e40
SHA256 afb45b8ae7d78085d95122ae01f6bac1515a89e7e2c87c55596670e2b5e922e1
MD5 e0947f2084e589a4d7f1c0f541b54321
SHA1 3ca9be3bc2678b85e36b9823a617376a268ab889
SHA512 316a214436031a498de8b2b6ca33cb9f73cacc3ee19f22f86d90583f817e35f0b93bd44e3af8e47baf1c7e44fc66b9c2031995cc4ce69a1bdbe980de93e5938f
SSDEEP 49152:JevEk9Vcz8AGAIaaQ2ldCPGwdYbO9ZMzYuWP011w99oUQ8Pbto:JevUsAz8ld+ubO9Ssur1a8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4d:f2:32:ce:e3:94:1e:21:31:7b:1d:01:4e:b9:fd:c9:b8:07:d9:1f:1b:fd:6a:c9:30:2c:1d:5f:15:76:5a:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2059170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\kmr4g80c\updater\avupdate.pdb

scew

scew_element_by_name scew_strcmp scew_element_attributes scew_element_children XML_Parse scew_list_next scew_list_data scew_element_attribute_by_name scew_parser_ignore_whitespaces scew_parser_free scew_parser_create scew_tree_set_root scew_tree_create scew_attribute_value scew_attribute_name scew_element_add_attribute_pair scew_element_add_element scew_element_add scew_element_count scew_element_set_contents scew_element_free scew_element_create scew_tree_root scew_element_contents scew_element_name scew_tree_free

ws2_32

WSASend inet_addr getsockopt WSAGetOverlappedResult sendto recvfrom shutdown getservbyname ntohl getnameinfo gethostbyname gethostname ioctlsocket getpeername freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup WSARecv send WSACloseEvent inet_ntop WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

mswsock

TransmitFile

rpcrt4

UuidCreate

shell32

CommandLineToArgvW SHGetFolderPathW

mpr

WNetAddConnection2W WNetCancelConnection2W

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptCreateHash OpenProcessToken GetTokenInformation LookupAccountSidW SetThreadToken DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegCloseKey CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash GetUserNameW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW ReportEventW RegisterEventSourceW DeregisterEventSource

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

ReleaseMutex SetEvent TryEnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FormatMessageA WaitForMultipleObjects InitializeCriticalSection GetHandleInformation SetEndOfFile SetEnvironmentVariableW SetFileTime SetFileAttributesW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindFirstFileA CreateEventA PeekNamedPipe FlushFileBuffers CancelIo DuplicateHandle SetFilePointer GetFileInformationByHandle DeleteFileW SetStdHandle LoadLibraryExW SetErrorMode RemoveDirectoryW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFullPathNameW GetDriveTypeW GetDriveTypeA GetCurrentDirectoryW SetCurrentDirectoryW ConvertThreadToFiber ConvertFiberToThread SwitchToThread GetCurrentThread CreateFileA CreateMutexA GetModuleFileNameA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EncodePointer RaiseException ExitProcess GetModuleHandleExW SetConsoleCtrlHandler CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleOutputCP WriteConsoleW GetCommandLineA GetConsoleCP HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc WriteFile GetFileType FindNextFileW FindFirstFileW FindClose CreateFiber ReleaseSemaphore GetVersionExW CreateSemaphoreA DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap ReadConsoleInputW DeviceIoControl TerminateProcess GetLastError GetLocaleInfoW MoveFileExW LocalFree FormatMessageW CreateFileW ReadFile CloseHandle SetHandleInformation CreateNamedPipeW GetOverlappedResult ResetEvent WaitForSingleObject CreateEventW HeapSize GetExitCodeProcess CreateProcessW FreeLibrary GetProcAddress LoadLibraryW GlobalFree GetCurrentProcessId OpenProcess GlobalAlloc GetComputerNameW GetCurrentThreadId GetModuleFileNameW GetModuleHandleW GetCurrentProcess GetSystemDirectoryW GetWindowsDirectoryW IsWow64Process LoadLibraryA MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA Sleep WideCharToMultiByte MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetTimeZoneInformation CreateHardLinkW GetACP GetOEMCP GetStdHandle GetConsoleScreenBufferInfo GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW GetSystemTime SystemTimeToFileTime GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber

bcrypt

BCryptGenRandom

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/avupdate_msg.avr

SHA256 056ec25ad90c88a86b85a9c72246b0d4003be39ef954a6bcb1baa92e63ed6101
MD5 7ff9f5f6a65afe7c10b5de77f4986042
SHA1 d19c140cade5ddf6d1f588f453fccad44525030b
SHA512 3271017bbf7afa11cb6804c5578d8fbc4410f01fb544074302cc491f357dbf1e52f8ab9d58648443f5e5f3fb64adb8dda96fe08d94ca2525465844864cf2ca98
SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13SrnZ:qiFRuCJNKzRxw3i5hSAIbyrZ+7wniZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/cacert.crt

SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
MD5 9956b172b62aeb41ca988999947a488e
SHA1 199e3607abeafd168b02b062697656a847fe4de7
SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/README

SHA256 43b602dc083b9e5836f32def1521b42f5971f7b12e47e8d272049283316f0aed
MD5 dd70354b0df8379ef2edecbe4304f900
SHA1 04670a5a3d483ae50bb5488cf8cecdfa7b7083aa
SHA512 1ee14e8834c0817305e01a03984a73484a23b26f9328224513412b764017501cdce0473f58d2d64ed647adf78f51bdc7b50f5efe3f0183d736154cab83ae70ad
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.cat

SHA256 736c72051ea40058e98362f29a7a9a5ad73032bbbf8bda53ea897f64c5bc7de8
MD5 622330091b3d75e6e562c37582ac8b2b
SHA1 6915486dbaf7cbd2846e63a6d1e12bff67c56922
SHA512 5f93f6a59d798bd25aab1fe9a75f6cb13210f07bb49b340861993deaea4206fec9fadbfad6cba0c000fa6709a2e6ec6de48cbb014232f7352d272586a414ce28
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.inf

SHA256 88f7e8d81340ab33fc71702c2817427e7b26ee31a76d59f167a00f2af2c783f0
MD5 139c7c318ef6d64fc6c7ecdf1f7422da
SHA1 7fc18f8244ee8c795f0da452fbb1f9bb628f9e2c
SHA512 504b7e7917f15e93bcdcdbd7189c8b29bc27487d2c61bf3d78f9edc4f361dc0136621b55f0e1b0bf7a69c8cee668f520b72d6f45197ab58f62b5b36371c7fd27
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys

IMPHASH 1ef61e02301b03f0dea57f84bcd2479d
SHA256 33d6cc050cefb737b70431c7e493a0d7b7f5ae7546d36fd24a5d4b1ebf29d307
MD5 6b60c0a7fdbabe955a183ae3b524d543
SHA1 be68e043fb0f6e0ca745b8361924ad0869bf2bb9
SHA512 040ecbb33bbba5bba6206cee7717cff01fc8d3436762a4f2af6647cd9f02b31d48538ebc0d91b627fd0f9324375544905c2e09e4040c55b3642480e683f73df9
SSDEEP 3072:3dxo0Wbd5kOx92/nQdp2kRaZE/I+j8CR/ehwdwTe6vuypGe08Uxb24lOPy:3dxo0Wbd5pJ/I88CR/p6vAnA4e
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

84:7c:33:ec:4c:fa:98:5a:f3:91:d2:68:da:ae:9b:55:a5:32:cb:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

1

Major OS version

6

Entry point

156286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb

ntoskrnl.exe

KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion SeCreateClientSecurity IoGetStackLimits ExAcquireResourceSharedLite RtlFreeUnicodeString RtlUpcaseUnicodeString ZwQueryValueKey ZwOpenKey toupper ZwReadFile ZwQueryInformationToken ZwOpenProcessTokenEx ZwOpenProcess _alldiv IoCreateSynchronizationEvent KeInsertQueueApc KeInitializeApc InterlockedPopEntrySList ZwDeleteValueKey ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject PsGetCurrentThreadId RtlUpcaseUnicodeChar ZwQueryDirectoryFile RtlAppendUnicodeToString ZwOpenFile wcsncat RtlAnsiStringToUnicodeString RtlInitAnsiString ZwSetInformationFile ZwQueryInformationFile InterlockedPushEntrySList ExReleaseResourceAndLeaveCriticalRegion ExEnterCriticalRegionAndAcquireResourceExclusive IoGetTopLevelIrp NtClose ObReferenceObjectByHandle IoFileObjectType RtlEqualSid RtlGetOwnerSecurityDescriptor ZwQuerySecurityObject RtlNtStatusToDosError KeWaitForSingleObject _allmul SeQueryInformationToken PsSetCreateProcessNotifyRoutine ExInitializePagedLookasideList ProbeForRead MmMapLockedPagesSpecifyCache towupper KeResetEvent RtlIntegerToUnicodeString RtlCreateUnicodeString ZwSetValueKey PsCreateSystemThread PsRevertToSelf SeImpersonateClientEx RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsTerminateSystemThread KeWaitForMultipleObjects ZwWriteFile IoDeleteDevice IoUnregisterShutdownNotification IoDeleteSymbolicLink ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList SeTokenType _aulldiv _aullrem _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s IoFreeMdl MmFreePagesFromMdl MmUnmapLockedPages RtlSetAllBits ExWaitForRundownProtectionRelease MmAllocatePagesForMdl ExReleaseRundownProtection RtlFindClearBitsAndSet ExAcquireRundownProtection RtlClearBit ExReInitializeRundownProtection KeTickCount KeBugCheckEx RtlUnwind KeQueryPriorityThread IoThreadToProcess PsGetProcessId IoIsSystemThread RtlEqualUnicodeString RtlCopyUnicodeString ExDeletePagedLookasideList KeGetCurrentThread PsReferencePrimaryToken PsLookupProcessByProcessId MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite ExGetPreviousMode MmIsAddressValid NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess memmove KeDelayExecutionThread _wcsnicmp wcscpy_s RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer IoWriteErrorLogEntry IoAllocateErrorLogEntry ZwSetSecurityObject IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetGroupSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAddAccessAllowedAce wcschr RtlAbsoluteToSelfRelativeSD RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor ZwCreateKey PsDereferencePrimaryToken PsDereferenceImpersonationToken ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeQueryTimeIncrement KeQuerySystemTime ExInitializeRundownProtection RtlInitializeBitMap KeSetEvent ObfDereferenceObject IoCreateSymbolicLink IoRegisterShutdownNotification ZwCreateFile ExInitializeResourceLite RtlLengthRequiredSid RtlInitializeSid RtlSubAuthoritySid RtlValidSid RtlLengthSid RtlAppendUnicodeStringToString RtlCompareUnicodeString IofCallDriver IofCompleteRequest IoWMIRegistrationControl RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess RtlHashUnicodeString KeInitializeEvent

hal

KeAcquireInStackQueuedSpinLock ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeGetCurrentIrql KeReleaseInStackQueuedSpinLock

fltmgr.sys

FltGetDestinationFileNameInformation FltDeleteInstanceContext FltGetVolumeProperties FltOpenVolume FltDeviceIoControlFile FltSetInstanceContext FltObjectReference FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltParseFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltQuerySecurityObject FltReferenceContext FltFsControlFile FltQueryInformationFile FltGetInstanceContext FltCreateFile FltClose FltGetStreamHandleContext FltSetStreamHandleContext FltReleaseContext FltAllocateContext FltReleaseFileNameInformation FltRegisterFilter FltStartFiltering FltCloseCommunicationPort FltUnregisterFilter FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltGetRoutineAddress FltDeleteContext

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.cat

SHA256 d50ffe995b3ad0b44dcc30976cb047ef690646872fa9dbc3c48950cd8593e918
MD5 116668cc50e8f234ba729a8d8895b1e3
SHA1 cb987ae4def6e022dc5e62cbf8a76e374bf9404c
SHA512 3c5d04ddfb87c0fc611f6eb7b281d7a67584f9b2a4713f3f14aa1f709cceace3898fc00e4a90bc9caf59cd11e006f917536e602f21b2ac610a0245af4f3bbf5b
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.inf

SHA256 4ae6e2a7c2e11bf797ba3b4877fb4ddf2ca75c6f774d4dfd4b002a307b7f938a
MD5 1b439a706d228a6dc534a3a8731c1afd
SHA1 49e34aee2faa0cbaa9bfd004eefe3150e64451b0
SHA512 d2cf3f4c289434654d7103f0517dc99bcf98f8db01e34af25c07015fe90ca88866bc0de8d6a1983406bb2f2ad85c179a47bc9095ce650a1ee0cedf23d2a8c3f0
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys

IMPHASH 666004f477406d2edd34100136c011b0
SHA256 2bf4e12f41f8d78737592b7f29b55206b2df15411cc2943e678f52096289d06f
MD5 a17862525867081a577923e210604a64
SHA1 9b6f498bbda86fc464d6e5094bc8529ecd3e7579
SHA512 e33c701cad149844913e5853187e4bbf43f6bc230fccaec21c847b373da7299849f2f3d93e6a07dc2c3c774f5119a31f0f44ed77821cc1e8dda93661e620b2ca
SSDEEP 3072:E6zDMkFB5rqrDX7r5E2wnyKVxqxJNxBIRxUcx5VEv3QuhznmZmopCn7:3zDMU5cHq2wn/EJNIRxXx5KB1Omo07
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

2d:b8:6c:ca:3b:b0:69:26:57:00:68:12:76:9a:52:6f:76:04:8f:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

1

Major OS version

6

Entry point

163902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb

ntoskrnl.exe

IofCompleteRequest IofCallDriver KeServiceDescriptorTable ZwClose ObfDereferenceObject KeSetEvent KeReleaseMutex KeWaitForSingleObject RtlCopyUnicodeString ZwReadFile ZwCreateFile RtlCompareUnicodeString FsRtlIsNameInExpression _strnicmp memmove ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject ProbeForRead ObReferenceObjectByPointer PsProcessType PsGetCurrentProcessId PsLookupProcessByProcessId KeResetEvent KeReadStateEvent RtlAppendUnicodeStringToString PsLookupThreadByThreadId RtlAnsiStringToUnicodeString RtlInitAnsiString _stricmp PsTerminateSystemThread PsThreadType PsCreateSystemThread RtlInsertElementGenericTableAvl ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite IoDeleteDevice IoDeleteSymbolicLink RtlIntegerToUnicodeString IoWMIRegistrationControl ExInitializePagedLookasideList IoCreateSymbolicLink IoCreateDevice ExInitializeResourceLite KeInitializeMutex KeGetCurrentThread _vsnwprintf KeWaitForMultipleObjects ExGetPreviousMode KeQuerySystemTime PsGetCurrentThreadId IoReleaseCancelSpinLock IoBuildSynchronousFsdRequest ObReferenceObjectByHandle ZwWriteFile _allmul _aullrem RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv ObfReferenceObject ObOpenObjectByPointer PsGetProcessId wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy wcsrchr strncpy IoDriverObjectType wcscpy_s KeDelayExecutionThread KeTickCount KeBugCheckEx RtlUnwind RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag ExAcquireResourceSharedLite KeEnterCriticalRegion ExAcquireResourceExclusiveLite ExReleaseResourceLite KeLeaveCriticalRegion memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList ExInitializeNPagedLookasideList KeInitializeEvent ZwSetInformationFile ZwQueryInformationFile PsReferencePrimaryToken PsDereferencePrimaryToken SeQueryInformationToken ZwQuerySystemInformation IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite MmIsAddressValid NtClose NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess ZwOpenProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory ZwDuplicateObject RtlImageDirectoryEntryToData RtlImageNtHeader ZwQueryObject ObQueryNameString RtlDowncaseUnicodeChar _wcsnicmp RtlLookupElementGenericTableAvl RtlDeleteElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry

hal

ExReleaseFastMutex KeGetCurrentIrql KfReleaseSpinLock KfAcquireSpinLock KeQueryPerformanceCounter ExAcquireFastMutex

avkmgr.sys

func4 func3 func5 func1 func0 func6 func7 func8 func9 funca func2 funcd

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.cat

SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
MD5 8dbe5877f742d7d8fb652c84f76fab5b
SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.inf

SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
MD5 e92853f21048c93a182a140e667983e9
SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys

IMPHASH df68c8435781307135dfe76497ab5341
SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
MD5 20894c53c0b9db8f86993d9ecb78f9d5
SHA1 7c18c5b571c906535d393a5165379f6316143107
SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

36926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

846B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.cat

SHA256 853c6ba3a145bdd47656b525985632ad46e1d2e8ad127449d59e2bf62bfd5d8f
MD5 49500efd1756f4b3934e8df70bf12d97
SHA1 7ee81eb8aa3e448fd7d9cd4559b9077d55b2afb1
SHA512 58b72baaffca047306915e09e9903b7fe6a6d9943e1d44644ad8ed2b3a31b371dd1ba2730789b75649bcc38df0782e8e6aad04f8f8b88eb800c333624aeea1a5
SSDEEP 192:EwafyS9JCUQXooyKfPFWQFT7Q5YVZL1aqnajKs0edqC:E9VarPFR5UYVSlGs0jC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.inf

SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys

IMPHASH 369430b7330b145ea00a0d756880608f
SHA256 33c6b1d49ab13d6ae9f22e05d77b70123de63c802363da0daf1be958b7d3d532
MD5 f16335a9102ffc99a8c8e07e1b2d57d4
SHA1 32ddb4251591e40db352661be4721c5c6402b90a
SHA512 57746307cab7e82e9e7ef5f033628810997954a40cf57f34650cbc9ac77fc2fa3465f1206f87e0082edc4121114dd71f2f816a628872fde26136012766a5cc52
SSDEEP 3072:mPhzNgtyTnwf3UCPID5tfaElzgbSvTR7VHhoxM732FrBT5t3BMXv8DBf:qhGtyTHC2tDcSvTZ9+Oarf9BMMd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

156256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb

ntoskrnl.exe

KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion InterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc _alldiv memcmp ZwQueryInformationFile ZwSetInformationFile InterlockedPushEntrySList ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine towupper RtlIntegerToUnicodeString RtlFreeUnicodeString ExInitializePagedLookasideList ProbeForRead ZwSetValueKey RtlCreateUnicodeString _allmul _aulldiv KeWaitForMultipleObjects wcsncat PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _aullrem _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry memmove RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid PsReferencePrimaryToken PsLookupProcessByProcessId ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp toupper RtlUnwind RtlUpcaseUnicodeChar RtlAppendUnicodeToString RtlCopyUnicodeString RtlEqualUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString KeResetEvent KeGetCurrentThread IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors memset memcpy RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeQuerySystemTime KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress PsCreateSystemThread RtlInitUnicodeString

hal

ExAcquireFastMutex KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock KfReleaseSpinLock KfAcquireSpinLock KeGetCurrentIrql ExReleaseFastMutex

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDeviceIoControlFile FltOpenVolume FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltParseFileNameInformation FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.cat

SHA256 4efdc56d06e5a17315784d3e700e359fd3ce701edceb6d3370de64d1617d42be
MD5 8e59d322b492d531124a0a51a5eeaae9
SHA1 c58672a169f96336e12c0367bd5afa5906bda93f
SHA512 2ff077f6115c6c4b87b11c78b7fb48ecc0f800f2b8a89ce16d709b802ced671f175c80746aa89f745de6f33d1f894991335de39214909ac0a084e709529a2548
SSDEEP 192:lBRIgR6uyHJCUymwBYyKaWFWQFO7EQDzBqqnaj/CdR4:59yVyPCFRNplLV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.inf

SHA256 a68faf360ca9d5da989a1b6e7ff69f7aabf7b52be7819ec862a6688b841125ff
MD5 34c3d7f3bd04501338c421cd9c62b993
SHA1 7feda197634072bc48e214800a3d4550cd1fa32a
SHA512 166b4ba8653b3f932ff806e39d92a48e2e2ef7c87f82fc0560add528bf5dab34e0937253c8c5778dcd31f9a925448414066c623d976fbce21893bed08c7ead70
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys

IMPHASH 8cf67a6f9f559410b2c92bfe6381b8f7
SHA256 629da28ac97f5b17b1603059242088727e1552d68fe350f97fcd0b67d412ab25
MD5 18ed8302d083dad602823988a304a4f6
SHA1 01014fd10d7babd6d81bb7e9511ffa7e13c890fa
SHA512 de9ea04221fb1270db37d35fcc1acdf7265103e079fd31566b0a043a1fa3b2267a034b720a3070538f289fd3847171d3d54277417ba0f67aede86f1b78db220d
SSDEEP 3072:FiRnqR7d4wgBQIFnh/Lpx211rrYQwKiYB+Qua7KjoLxkAAFP:Fiq4PbL/2THYQwK7B+Bau0S
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

172032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb

avkmgr.sys

func7 func8 func6 funca funcd func5 func4 func3 func2 func1 func9 func0

ntoskrnl.exe

RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite PsCreateSystemThread PsTerminateSystemThread IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression memcpy memmove memset KeNumberProcessors PsProcessType PsThreadType KeServiceDescriptorTable KeGetCurrentThread KeWaitForMultipleObjects MmGetSystemRoutineAddress ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf _allmul KeInitializeSpinLock RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv _aullrem ObfReferenceObject PsGetProcessId ObOpenObjectByPointer ZwQueryVirtualMemory wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcscpy_s wcsncpy wcsrchr IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken ObQueryNameString ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlImageDirectoryEntryToData RtlImageNtHeader RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry memcmp ZwSetInformationFile RtlInitUnicodeString RtlUnwind RtlInitAnsiString RtlIntegerToUnicodeString _strnicmp _stricmp RtlAnsiStringToUnicodeString KeQuerySystemTime

hal

KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.cat

SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
MD5 a63897b79888e60e29431eb1b28844de
SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.inf

SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
MD5 dddb1f6ae43397a15af280de3ebc3c83
SHA1 2651935088949e2dff211a7c1126a02836a9b781
SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys

IMPHASH 915211291455160b181a1b35daf6bd20
SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
MD5 e3ab0eeb7613ddbacc0388b96048ff5d
SHA1 f6e382597081451d6546339948edd3e854b7dfae
SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.cat

SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
MD5 f3018b52949cdcbf666ffaf6c17f985d
SHA1 9b4692f754d090cd8b2afb9c4ddce60a05aefc9e
SHA512 69b1b5c607e37d6cb0e7049fb0ce1ee79b720992a354aee73b67e9b87dc1e2c16548ae55786dbb65ec4e8bcfffd39586edc660d5b41d58d69746b8c25b627af0
SSDEEP 192:r2p32qXooyKfPFWQFTWQ0dPLrMhEqnajKsKmEU1Isb:6vrPFRoBjlGs6Ul
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.inf

SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
MD5 0d87b337d3a44a6b7de7bf6c4bbbabd6
SHA1 692a736647a575278c65dcde5996410071df09ba
SHA512 6910581b8f3b88596a5e8da43beac9ea68f6aa3644b8e634eefa8f12c3be1c243ad31eff0122904d8c61462f040667569a47c9f19950e5dac7e1a6c8f89aede2
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys

IMPHASH 935a7ea0e08363f64cb79c28de13e264
SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
MD5 d9f90202659f8ce4d5db6e83d24b46dd
SHA1 29a7b1068a5090ee59db422364b42d2c8f072a46
SHA512 b0a9a0c0f18446e6a2b9ad3200dbd2cb94acae5df553beb971b41220304941219d12d3e94ed91dec254e6b907dac6fcb1aa72a822a09a8e523cc76071b221c31
SSDEEP 3072:vMPogiYZ1dqoWYYCGxbceUW8bUDsQWBsMPelkz4IQ9RLNM/qIn20aqB:vooQZ1ddW5VUWvDTMGls4IQ9ZN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

24:1f:15:7d:b4:a5:38:b4:a7:f7:b6:aa:a8:ce:4e:9f:ad:38:ba:ee:d0:06:bb:74:31:3f:d6:76:41:08:d2:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Digest

e9:26:4e:79:f5:74:82:d2:64:ce:b2:4e:33:13:25:11:8e:62:a6:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Oct 14, 2021

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

230332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb

ntoskrnl.exe

RtlUpcaseUnicodeString KeLeaveCriticalRegion RtlAnsiStringToUnicodeString IoGetStackLimits ZwQuerySymbolicLinkObject ZwReadFile KeInitializeApc KeInsertQueueApc RtlAppendUnicodeToString RtlInitAnsiString ZwDeleteValueKey wcsncat KeReleaseSpinLock ExpInterlockedPopEntrySList RtlEqualUnicodeString ZwOpenSymbolicLinkObject KeEnterCriticalRegion ZwOpenProcessTokenEx IoCreateSynchronizationEvent SeCreateClientSecurity RtlFreeUnicodeString ZwQueryValueKey ZwQueryDirectoryFile ExAcquireResourceSharedLite ExReleaseResourceLite SeQueryInformationToken ZwOpenProcess toupper PsGetCurrentThreadId RtlCopyUnicodeString ZwOpenFile ZwQueryInformationToken RtlUpcaseUnicodeChar IoIsSystemThread KeQueryPriorityThread PsGetProcessId ZwOpenKey KeAcquireSpinLockRaiseToDpc ZwSetInformationFile ZwQueryInformationFile RtlEqualSid ExReleaseResourceAndLeaveCriticalRegion ExpInterlockedPushEntrySList ZwQuerySecurityObject IoFileObjectType RtlNtStatusToDosError ExEnterCriticalRegionAndAcquireResourceExclusive NtClose ExQueryDepthSList ObReferenceObjectByHandle IoGetTopLevelIrp RtlGetOwnerSecurityDescriptor KeWaitForSingleObject PsSetCreateProcessNotifyRoutine ExDeletePagedLookasideList ProbeForRead RtlCreateUnicodeString KeResetEvent RtlIntegerToUnicodeString ZwSetValueKey MmMapLockedPagesSpecifyCache ExInitializePagedLookasideList towupper RtlDeleteElementGenericTableAvl PsCreateSystemThread PsTerminateSystemThread SeImpersonateClientEx PsRevertToSelf KeWaitForMultipleObjects RtlEnumerateGenericTableWithoutSplayingAvl ZwWriteFile IoDeleteSymbolicLink IoDeleteDevice IoThreadToProcess ExInitializeNPagedLookasideList RtlHashUnicodeString ExDeleteNPagedLookasideList _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExReleaseFastMutex ExAcquireFastMutex RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl RtlInitializeGenericTableAvl sprintf_s MmUnmapLockedPages ExWaitForRundownProtectionRelease ExAcquireRundownProtection KeReleaseInStackQueuedSpinLock RtlSetAllBits ExReleaseRundownProtection KeAcquireInStackQueuedSpinLock MmAllocatePagesForMdl IoFreeMdl RtlFindClearBitsAndSet ExReInitializeRundownProtection MmFreePagesFromMdl RtlClearBit KeBugCheckEx IoGetDeviceObjectPointer _wcsnicmp PsLookupProcessByProcessId PsReferencePrimaryToken KeDelayExecutionThread ZwQueryInformationProcess wcscpy_s RtlInsertElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry IoCreateDevice ZwSetSecurityObject IoDeviceObjectType _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor RtlAbsoluteToSelfRelativeSD IoIsWdmVersionAvailable SeExports wcschr RtlAddAccessAllowedAce RtlGetSaclSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor ZwCreateKey ExAcquireResourceExclusiveLite SeTokenType PsDereferencePrimaryToken ExDeleteResourceLite PsDereferenceImpersonationToken PsGetCurrentProcessId ObOpenObjectByPointer ZwClose IofCallDriver RtlLengthSid KeNumberProcessors ExInitializeResourceLite ObfDereferenceObject IoCreateSymbolicLink RtlCompareMemory RtlInitializeSid RtlCompareUnicodeString IofCompleteRequest RtlAppendUnicodeStringToString KeQueryTimeIncrement IoGetCurrentProcess ZwCreateFile ExInitializeRundownProtection RtlInitializeBitMap RtlValidSid RtlGetVersion KeInitializeEvent MmGetSystemRoutineAddress KeSetEvent RtlInitUnicodeString InitializeSListHead IoRegisterShutdownNotification IoWMIWriteEvent ExFreePoolWithTag IoWMIRegistrationControl ExAllocatePoolWithTag RtlLengthRequiredSid IoUnregisterShutdownNotification RtlSubAuthoritySid __C_specific_handler

fltmgr.sys

FltGetDestinationFileNameInformation FltOpenVolume FltObjectReference FltGetVolumeProperties FltSetInstanceContext FltDeleteInstanceContext FltDeviceIoControlFile FltDoCompletionProcessingWhenSafe FltParseFileNameInformation FltGetFileNameInformation FltSetStreamContext FltCancelFileOpen FltGetStreamContext FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltQuerySecurityObject FltReferenceContext FltFsControlFile FltClose FltQueryInformationFile FltCreateFile FltGetInstanceContext FltReleaseFileNameInformation FltAllocateContext FltReleaseContext FltSetStreamHandleContext FltGetStreamHandleContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltGetRoutineAddress FltCloseCommunicationPort FltUnregisterFilter FltFreeSecurityDescriptor FltCreateCommunicationPort FltDeleteContext

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

19B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.cat

SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
MD5 351a7acf84d15a92dc75d3fc2f504f0e
SHA1 1d316b5d3a8729c0f03a140ac55066399fbc808f
SHA512 f705ee3bb4aa9328e808d0a8793692e1b525c0413e2005bd5f1d442be4da23e05b9549d85ccc8c1ae1f9c818a4ccc19207f0feffcd11d7b2b3039ed4e20c3b23
SSDEEP 192:Wh32QmwBYyKaWFWQFqtQjWMvN/qnaj9D6ad:WlPCFRkq/l5D6ad
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.inf

SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
MD5 b9a877ecc51ee9f13d9e5451f8b12895
SHA1 45a8abeb8c295295e4952893452c54850f721868
SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys

IMPHASH c67071a7e71763082096de0aad8766fc
SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
MD5 b49a44df6fe77ccb861985f5a5dd7ba5
SHA1 6e5163e191dd789f8cc33a531ce9ddd9bed2a842
SHA512 d53f56966c8750edc513c86c8e9b47fa1f0445a86a1d92621f1aa5fc9b9400a4a7f65b9ae0d2e537c9dde1b23b16fbd56af8ab74d62a8a777106e9b16e58be89
SSDEEP 3072:sUnNOdMrlqdSL3W3TRjWLKcudx0TzBrt6Ozv7druQuxAmP9FrN:PnQurlLLmxQu/0SOzZSBxDX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

ac:37:6a:b3:0e:25:4b:a1:7a:9b:38:3b:76:ef:af:ec:4a:6e:96:c8:6b:5b:80:08:2e:99:9f:33:bc:36:46:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

19:0f:6e:25:22:27:b3:83:8c:d4:bb:76:68:8a:0b:3a:01:f5:56:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Feb 4, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

176228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb

ntoskrnl.exe

KeInitializeMutex KeLeaveCriticalRegion RtlAnsiStringToUnicodeString ExInitializeNPagedLookasideList ExAcquireFastMutex PsLookupProcessByProcessId ZwQuerySymbolicLinkObject ZwReadFile RtlInitUnicodeString RtlIntegerToUnicodeString IoDeleteDevice KeSetEvent ExpInterlockedPushEntrySList MmGetSystemRoutineAddress KeInitializeEvent RtlInitAnsiString RtlGetVersion ExpInterlockedPopEntrySList ZwOpenSymbolicLinkObject FsRtlIsNameInExpression KeEnterCriticalRegion KeReleaseMutex ZwCreateFile ExDeletePagedLookasideList ExAcquireResourceSharedLite IoGetCurrentProcess ExReleaseResourceLite ZwClose RtlAppendUnicodeStringToString IofCompleteRequest ExQueryDepthSList KeWaitForSingleObject RtlCompareUnicodeString RtlCompareMemory ExDeleteResourceLite IoCreateSymbolicLink PsGetCurrentProcessId RtlCopyUnicodeString ExInitializePagedLookasideList KeReadStateEvent IoCreateDevice ExInitializeResourceLite KeNumberProcessors ObReferenceObjectByPointer ExDeleteNPagedLookasideList PsLookupThreadByThreadId IofCallDriver IoBuildSynchronousFsdRequest ExGetPreviousMode _vsnwprintf ObReferenceObjectByHandle PsGetCurrentThreadId KeWaitForMultipleObjects IoReleaseCancelSpinLock ZwWriteFile KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl PsThreadType RtlEnumerateGenericTableWithoutSplayingAvl KeAcquireSpinLockRaiseToDpc wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy strncpy IoDriverObjectType wcsrchr PsGetProcessId KeDelayExecutionThread KeBugCheckEx ExReleaseFastMutex KeResetEvent IoWMIWriteEvent ExFreePoolWithTag IoDeleteSymbolicLink PsProcessType IoWMIRegistrationControl ProbeForRead ExAllocatePoolWithTag _strnicmp RtlInsertElementGenericTableAvl ExAcquireResourceExclusiveLite ObfDereferenceObject _stricmp ZwSetInformationFile ZwQueryInformationFile _wcsnicmp RtlDowncaseUnicodeChar PsReferencePrimaryToken ZwQueryObject ZwQuerySystemInformation SeQueryInformationToken ZwOpenProcess ZwQueryInformationProcess PsDereferencePrimaryToken RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry __C_specific_handler

hal

KeQueryPerformanceCounter

avkmgr.sys

funca func8 func5 func0 func2 func7 func1 func4 func6 func3 func9

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.cat

SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
MD5 f3324c2c121d360f8ce3553e221c3ce6
SHA1 85939054d39067cc7e1089de71138b4b4283f800
SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.inf

SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
MD5 176af3c43b608af665f48a35f497bae1
SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys

IMPHASH bbbf29be00d696bbac6e5abddd6e312c
SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
MD5 eb5c2402e2f402a19504bf6ca9c3e06a
SHA1 63aa9690c36d743951558422d841276c25cde77d
SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2018 - Sep 20, 2019

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

32868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

406B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.cat

SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
MD5 3ece229fca8ecdf8e4889e062abbf95a
SHA1 47aa2952646097710297f5bded9b115e418bac00
SHA512 985d4005541e25f39bc7abf80c05b97fe57220bf02bcbb7ff41f792283af5aba87d7db433217ffcea002d35dd113913bbb6e980fbf99778126f129a799b58573
SSDEEP 192:NfafyZYxJCxuXooyKfPFWQFzWzQPIiQLCamylqnajsq3rQe:Nc0IrPFRI3iQ3Jllgkrb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.inf

SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys

IMPHASH 949a3f7ef15514eb7758bc1d821f6019
SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
MD5 ec059af10524644bddcc073916e78375
SHA1 93a9466afee21f61f643f540b2ab82ac7db60b62
SHA512 88310251e07eb6edda3eb28d057a18fd7d1ea7a9adc5f861fa7ad127561bfb035468974fd11685b66654fc37dc3577d7d720e2e9e4f4fc38d116c1089ee9afe7
SSDEEP 6144:S2M8JRGRI16YO/HqUU2miFjq5K3vPRTh9EsRbmN6:S25ERI16htvo5K3vPRr+
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

205488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb

ntoskrnl.exe

RtlEqualUnicodeString RtlCopyUnicodeString RtlAppendUnicodeToString RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExpInterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc ZwQueryInformationFile ZwSetInformationFile ExQueryDepthSList ExpInterlockedPushEntrySList ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetAllBits RtlFindClearBitsAndSet KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine towupper RtlIntegerToUnicodeString KeResetEvent ExInitializePagedLookasideList ProbeForRead RtlAnsiStringToUnicodeString RtlCreateUnicodeString __C_specific_handler KeWaitForMultipleObjects PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExAcquireFastMutex ExReleaseFastMutex RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid PsReferencePrimaryToken PsLookupProcessByProcessId ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp RtlInitAnsiString IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey wcsncat toupper PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite InitializeSListHead ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress ZwSetValueKey RtlInitUnicodeString

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDeviceIoControlFile FltOpenVolume FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltParseFileNameInformation FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

3B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.cat

SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
MD5 209bedcc941da626c2db370a80e3513e
SHA1 c88910bf5a4b35893e60d92828568d20420a9caf
SHA512 ddef0175e3e2919c4504f99d054b314e48f4ed0ac5c1b3153e1581b3614f304fe3850a8d465163cb4c502d4b026986121d6e4e30fc421d2c583b689ec933a10f
SSDEEP 192:CEbRVRDy8nJCx0mwBYyKaWFWQF259Q8I+XqnajlGupG8hod:njJn00PCFRO7ImlORd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.inf

SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
MD5 b9a877ecc51ee9f13d9e5451f8b12895
SHA1 45a8abeb8c295295e4952893452c54850f721868
SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.sys

IMPHASH b2557b252ab2c20a9c87b8e7393248c5
SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
MD5 c8d33c5b49a4760f2d81710eba839ba2
SHA1 8f41e4333dabe52bfd988a68785d0687599f1154
SHA512 451dca816d38538e082c7388aac0997eb04f5e8fc288fe44aeb661ece1e717060d73f24d60c7576403a68a5fbda3f931161602a2a8b98f506b56ff64c095cd78
SSDEEP 3072:lRgvKNe0BiAKLgBy6IdaJHIcVOmBvU6vHCSEQuqQ3TJu7Gyz:l2069oIMbVOcvU6vxEBDJI7z
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

188416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb

avkmgr.sys

func2 func3 func4 func5 func1 func7 func8 func9 funca func6 func0

ntoskrnl.exe

RtlIntegerToUnicodeString RtlInitAnsiString RtlInitUnicodeString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression __C_specific_handler KeNumberProcessors _stricmp KeWaitForMultipleObjects ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsThreadType wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcsncpy wcsrchr PsGetProcessId IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken ZwQueryObject ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry wcscpy_s ZwSetInformationFile _strnicmp PsProcessType

hal

KeQueryPerformanceCounter

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.cat

SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
MD5 88ae7b9879c9ac3a65ef73424600ba65
SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.inf

SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
MD5 fabaac0d5c0ef083150dec8615a8b2bb
SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.sys

IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
MD5 40786e1ac650f9f7e8b67a672b5eb69e
SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

342B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/plg_fops_dummy.dll

IMPHASH 030a305e7c90f0e0ba6c00476e02031b
SHA256 18f14d6ef36885b58dbe598cee1ff20c83afd5f9cf0c739394f74251f51bbf2f
MD5 e31669de92895bb6b150e3f319267458
SHA1 83a6ffc6da2421d28e4f8a068a0950726078673c
SHA512 2d5f7f682e88fe83223efa7763e1dd46f50462eb8f164c90bf34c41c40ba06b98720b2acc04238809fa646b708a2c4a640ddb0e1ec0a8ae244cc29737e4fec6d
SSDEEP 1536:ALBBbE9pvjyBQO53mWGw6abjwgNXjLEFSg1NZXarnYsWYEbcdOy/N5+q0q:ITbEP+BQO53mnanwmXjdIcnnO45+q0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

6689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle GetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation GetStringTypeW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW DecodePointer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/productname.dat

SHA256 84cc36c119381af58ccaead1ad8995b92317ca4ae8c38a38dc37071d712bb4d8
MD5 53ce39cd5a411bb30c5b1d413e641ec8
SHA1 0b7c31237c9b0a436ace5274938d420f8c7d6385
SHA512 3524dea3bfd8cc9539d70102ab3f49da50a1b0c1a68b7073869b7f193a30562d716526a6de13a40f07480763e3841bcc3743b91f46f9f87630707e63e7d76f26
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi.conf

SHA256 b30e328a864f6c4bd5544f6a7c3dbdc2cb97e668e2e583de0590506c881a16b9
MD5 c1f0cfade5c32a37b223f5f7b0ec3510
SHA1 8fb0afd1a53feb25652937d09865e3cc8cf3f02e
SHA512 9dc05c25f907ce29ebccca1c34fbf926ea7a4d803e2d2fb6106192176681fd151b82605bc066e7e55e03b14aae3ac81008dadc70889dbae887de5f67ec11aa40
SSDEEP 768:CORmWh90JmGrHbKlckb58aomNOKggzy+Yq:thSPHpkmnmN/dW+Yq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi.dll

IMPHASH 98df4127bc9f89b567dba0807b2d2ea7
SHA256 5617fc94cdd8b0c7a14df62cfc77f64ffe157d5fe96cc02c9ff209db97274e0e
MD5 85815e63269ec76386fd2a4d418f75be
SHA1 34b6ae807c5ab324e3e5a624b4bfa325ad86d890
SHA512 08401d39a1d8cd2b047b66c14236aaf04fc79d2a21c57e38198a6c2ccfca5e2959628a4674eb5609f7bb8d49eb87ea9033562bbdb058dc03beab81478b95e7d6
SSDEEP 49152:CZb4QJm+I6aJ9YPizIT9E1mJ85NDVwwLRFytPzZnpvsqKTZb:CZb4QJDVOKwmaNDVwSC1Znp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

a2:92:c9:67:e5:3a:02:3e:64:c3:a7:28:a2:47:ad:02:cf:a4:35:7f:71:c9:7b:9a:18:aa:6a:17:84:91:1a:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

6

Entry point

2071915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\libsavapi\daemon\libsavapi.pdb

kernel32

SetEvent CreateEventW GetCurrentProcess FindClose LoadLibraryW LoadLibraryA FreeLibrary ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread GetSystemTimeAsFileTime QueryPerformanceCounter CreateFiber DeleteFiber SwitchToFiber GetProcAddress GetModuleHandleW WriteFile GetFileType GetEnvironmentVariableW GetStdHandle FormatMessageW TlsFree TlsSetValue TlsGetValue TlsAlloc QueryDosDeviceW GetTimeFormatW GetDateFormatW GetLocalTime GetCurrentThreadId GetCurrentProcessId Sleep UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemInfo CloseHandle GetOEMCP GetACP WideCharToMultiByte MultiByteToWideChar CreateHardLinkW GetTempPathW SetLastError GetNativeSystemInfo HeapSize GetStringTypeW GetProcessHeap GetCommandLineA FindFirstFileExW GetCPInfo IsValidCodePage DecodePointer LCMapStringW CompareStringW GetModuleFileNameW DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GlobalFree FindNextFileW OutputDebugStringW FindFirstFileW HeapReAlloc HeapAlloc HeapFree WriteConsoleW FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler GetModuleHandleExW ExitProcess GetConsoleOutputCP SetFilePointerEx RaiseException EncodePointer RtlUnwind InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError CreateNamedPipeA CreatePipe UnlockFileEx UnlockFile LockFileEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount InitializeCriticalSectionEx QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA MoveFileExA WaitForSingleObjectEx CompareFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetSystemTime SystemTimeToFileTime InitializeCriticalSection ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation SetErrorMode LoadLibraryExW FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetEnvironmentVariableW SetStdHandle CreateFileW DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW FlushFileBuffers ReadFile PeekNamedPipe ReleaseSemaphore CreateSemaphoreA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW CreateDirectoryW RemoveDirectoryW GetCurrentThread OpenFileMappingW FormatMessageA DuplicateHandle SwitchToThread SetEndOfFile ResetEvent SetHandleInformation CreateFileMappingA CreateFileA GetVersionExW GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile

user32

GetSystemMetrics GetUserObjectInformationW MessageBoxW GetProcessWindowStation

advapi32

AllocateAndInitializeSid CryptAcquireContextA LogonUserW CheckTokenMembership FreeSid CloseServiceHandle OpenSCManagerW OpenServiceW GetEffectiveRightsFromAclW GetNamedSecurityInfoA GetNamedSecurityInfoW GetSecurityInfo OpenProcessToken OpenThreadToken PrivilegeCheck LookupPrivilegeValueA CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl QueryServiceStatus CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom

ws2_32

inet_ntop WSAWaitForMultipleEvents htons WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSAResetEvent inet_pton __WSAFDIsSet select htonl inet_addr setsockopt listen connect closesocket bind accept WSASetLastError send getpeername recv getnameinfo freeaddrinfo getaddrinfo ntohs getsockopt getsockname ioctlsocket gethostname WSAAddressToStringW WSAGetLastError WSACleanup WSAStartup gethostbyname ntohl shutdown getservbyname recvfrom sendto WSAGetOverlappedResult WSARecv WSASend socket

shlwapi

PathCanonicalizeW

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertFreeCertificateContext CertGetCertificateContextProperty CertDuplicateCertificateContext CertCloseStore CertGetEnhancedKeyUsage CertGetIntendedKeyUsage

iphlpapi

GetAdaptersAddresses

mswsock

TransmitFile

rpcrt4

UuidCreate

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

CharToSTCHAR SAVAPI_APC_cache_operation SAVAPI_APC_get_version SAVAPI_APC_initialize SAVAPI_APC_uninitialize SAVAPI_FPC_disable_preinit SAVAPI_OA_create_instances SAVAPI_OA_initialize SAVAPI_OA_start_scan SAVAPI_OA_stop_scan SAVAPI_OA_uninitialize SAVAPI_TCHAR_free SAVAPI_char_free SAVAPI_create_instance SAVAPI_engine_modules_get SAVAPI_engine_modules_get_ex SAVAPI_engine_versions_get SAVAPI_extract_malware_names SAVAPI_free SAVAPI_get SAVAPI_get_dynamic_detect SAVAPI_get_fops SAVAPI_get_instance_pool SAVAPI_get_type SAVAPI_get_user_data SAVAPI_get_version SAVAPI_global_set SAVAPI_initialize SAVAPI_is_running SAVAPI_is_running_ex SAVAPI_register_callback SAVAPI_release_instance SAVAPI_reload_engine SAVAPI_reload_engine_ex SAVAPI_reset_instance SAVAPI_scan SAVAPI_send_signal SAVAPI_set SAVAPI_set_avpal_init_flags SAVAPI_set_avpal_inited SAVAPI_set_ex SAVAPI_set_fops SAVAPI_set_log_callback SAVAPI_set_quickload_init SAVAPI_set_user_data SAVAPI_simple_scan SAVAPI_uninitialize SAVAPI_unregister_callback SAVAPI_with_encoding_get STCHARToChar STCHARToString STCHARToTCHAR StringToSTCHAR TCHARToSTCHAR _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4 asc2bin bin2asc bin2hex hex2bin

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi.exe

IMPHASH 4b8fd0313c7bf7140bc5c6706adc5060
SHA256 212b3d2c8f570375b95fb2de9f681a9f85796220b4bcb5abb6a2d248ffd9e1ea
MD5 ae60aaf104b487577024715df996309e
SHA1 ca80a770fd21bf51a4f1a3c05b1d4dc974780804
SHA512 108efd4b3e463a1ce658d497de80fcdcb9c6b7ab08abd8fddd639e8de4383b6a4f793cb3dc249d9c5e6d157db897d10b65d1e919487e65b480305fa61be3c98f
SSDEEP 12288:w/PGF6AJykhK9Qc955YkgP4imIJ93moIdsLvBPREFxQKjFBtD1O9rDxO77pP9jkf:Wu185YkRimID2sav1O9rDxMnkYAbmS11
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

f6:aa:98:bc:f7:f9:f4:1c:d7:17:98:2c:75:dc:c7:c8:5b:74:a0:8f:08:c9:0e:ae:f6:e1:7d:7f:64:44:0a:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

391995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\src\savapi.pdb

ws2_32

htonl getpeername send recv inet_addr getsockname ioctlsocket ntohl freeaddrinfo shutdown select getservbyname connect closesocket bind accept __WSAFDIsSet getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom ntohs htons listen getaddrinfo socket setsockopt WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

shlwapi

PathCanonicalizeW

mswsock

TransmitFile

rpcrt4

UuidCreate

kernel32

DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIo SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId GetTempPathW GetModuleFileNameW SetLastError CreateHardLinkW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW Sleep GetTickCount GetStdHandle GetConsoleScreenBufferInfo GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile DeviceIoControl CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SetHandleInformation GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation ExpandEnvironmentStringsW GetCurrentProcess FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle ReadFile GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle DeleteFileW SetFilePointer GetOverlappedResult MoveFileExW LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers PeekNamedPipe CreateFileA ConnectNamedPipe CreateNamedPipeA CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize FreeLibrary GetProcAddress LoadLibraryExW SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA DuplicateHandle SwitchToThread GetCurrentThread TlsGetValue TlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree OpenFileMappingW GetEnvironmentVariableW SetEnvironmentVariableW CreateFileMappingA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess GetVersionExW GetModuleFileNameA LoadLibraryA SetUnhandledExceptionFilter UnhandledExceptionFilter CloseHandle CreateFileW SetConsoleCtrlHandler GetLastError IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleMode ReadConsoleW ExitProcess GetCommandLineA GetConsoleCP HeapFree HeapAlloc CompareStringW LCMapStringW HeapReAlloc DecodePointer CreatePipe WriteFile IsValidCodePage GetCPInfo GetConsoleOutputCP FindFirstFileExW GetStringTypeW GetProcessHeap SetConsoleMode ReadConsoleInputW GetFileSizeEx SetErrorMode

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExA LookupAccountNameA LookupAccountSidA IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority EqualSid OpenProcessToken StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegOpenKeyExW RegSetValueExW RegDeleteKeyW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptReleaseContext

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi_post.bat

SHA256 4682c0f3dcbafa32e3dae743268a0babf67fe2970b4b0dd3f91cc7ed54627545
MD5 0dc718c8c4ccc13e58f9224f1af1125d
SHA1 51cca0861c564b973dc5017f6a9c86d47b2dad31
SHA512 b6e4b9b9b50669198d35a06c15bf8334eb3e68801946a96be66aee00361faceed6eefd84303979c5fceb87588a21d4fc1c94ca2a9dea5fb062d2a9da8c4cf27f
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi_pre.bat

SHA256 ec07adec51dc57f42077b2757421012c49fc771fb8cf664c36505d664e996c36
MD5 912510dd6dd41ca900d10834879601c7
SHA1 4dcaa7061636cf05ad5fe72ecb20ca29f2c003fe
SHA512 63f0e1b37d83d208d1d9fab44b74d5f0def82caeb4f2289d7ffb6bacb28013f6a24ae61d9a83e6684c80b5221675d76bc75a94c9fb2ebe31819465135753ea6c
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi_pretest.bat

SHA256 767637bffb932cad48218f8d128f2908e57c4a42326db29dfeaa1c5509018186
MD5 55d563f40e716ab251760a52f49a0e68
SHA1 fc8a086681368388dbf77199cabac654765b133b
SHA512 b218b11f9d66812a76c99b5a9a8cc73f9c83c626cef17049425855d5242e9c2e4355557c94d8a9f4d8f0fa6edc99a4658849f5edbb0320f7342dae4bda18e34b
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi_restart.exe

IMPHASH 28329b2bbd34737edf89c242f51f5b11
SHA256 4b75f1e230aa0195e8da68e481eeb90b9d85194f15e2d458bd8ebee6d9d69ccc
MD5 9919de22bf888ab8d7122a04646aa313
SHA1 35af4b2757b6d96e345ba43af1d126ccfbbeb23d
SHA512 deb7c4af295ed1c90205bd4c1299c62dbed70711ae16e3eceb64b386ca5e78537f801c1641d13617a6ee448cb187bb0399990a8161abc6685f0ee941a110224e
SSDEEP 3072:F52hQmn2wcv4N6eQQlhsPGhUI/CR5zC3MBqtRsivf1Z8OpyXBg7HZP0k:Le12w7tBlaV5zHqdEBsyk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ab:57:a6:80:c4:ea:58:25:e7:8d:b5:52:70:f1:55:ac:6e:3d:08:c2:c2:aa:0a:47:59:b6:84:fe:e8:23:50:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

8116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_restart\savapi_restart.pdb

kernel32

WriteConsoleW GetTickCount Sleep FormatMessageW LocalFree CreateProcessW GetExitCodeProcess WaitForSingleObject GetLastError CloseHandle CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc DecodePointer

advapi32

StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapi_stub.exe

IMPHASH 25235b078b3d329488576152e6e2b169
SHA256 91265685308da5d2a1cc5f478b83e43a4656fd075d7cfee3923380905fd8dfaf
MD5 3899d956a9c88d0519e188d067de5d19
SHA1 241b01e86a121694a48722ce4dc6c08bd0bf5cfd
SHA512 7f6e4d7b279f3c08022af6290e4015f12d4e8ba54ef65681d162bb421f08a81b57b4b2e7004861638c227da746127f5e9d4ee7932f3e2067b990f6b2951cb633
SSDEEP 6144:a+UDVHIZD9qmbvM3Y+c8A50LBZAzOejDx19iM856t0Q+GAC9k0q3Yl8rif9P2432:a+UDVHIZfbU3Y8/fejDxfiM85m0Q+GAr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8f:16:bb:ad:47:5f:b8:8f:62:0e:4e:b0:45:aa:d3:89:cf:fe:3a:cd:1a:9c:4e:28:5c:77:f3:42:cd:62:97:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

1

Major OS version

6

Entry point

128989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_stub\savapi_stub.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername gethostbyname socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException LoadLibraryExW GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW GetStdHandle CloseHandle GetHandleInformation SetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW ExitProcess SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW TryEnterCriticalSection SetEvent ReleaseMutex CreateMutexA CreateEventA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapSize GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent TerminateProcess CreateFileA CreatePipe CreateNamedPipeA GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleOutputCP GetConsoleMode FindFirstFileExW GetStringTypeW GetProcessHeap SetFilePointerEx SetFileAttributesW SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/savapiclient.dll

IMPHASH c23ac466c64dc5ed7062eba2817f1e18
SHA256 8f5aedf1f8e8dd027aabb3420ed7e0e38219a7d8d3b880f3a46671d32270fc69
MD5 eb905e77afda1a6e65342a83ac5fba75
SHA1 93434d20f75db97bf1947043982d33d282db96a0
SHA512 4fdb07e66639fe5efeea5f45a57db932be99e7ce81aac392f7fd52dc0b333a219da5af9df980ca3caf256f899640a4bcebdbdb8aa4bb2269160f692a72b880a2
SSDEEP 6144:+e0cf8LyAE2TDdvqRyTsJEgXHr067z7WcYj57l5nFLFzGTDkYXVjdZn/FOoiOTFS:+e0cf8LyeTDdvqRyTsNHr0GG5FBzGTDM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1b:8d:ab:08:2a:9f:64:95:d8:31:2d:38:d5:c5:46:3f:a9:5b:8b:1c:b2:ab:a7:07:06:06:90:b4:14:6a:be:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

180806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\libsavapi\client\libsavapiclient.pdb

ws2_32

recv inet_addr setsockopt send freeaddrinfo getaddrinfo getservbyname ntohl htons htonl getsockname getpeername ioctlsocket getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom socket shutdown select ntohs listen connect closesocket bind accept __WSAFDIsSet WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

advapi32

GetNamedSecurityInfoA RegisterEventSourceW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW DeregisterEventSource GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW

kernel32

GetModuleHandleExW RaiseException LoadLibraryExW FreeLibrary WriteConsoleW RtlUnwind InterlockedFlushSList GetModuleHandleW GetStartupInfoW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo SetEnvironmentVariableW GetConsoleOutputCP GetConsoleMode FindFirstFileExW FindNextFileW GetCommandLineA GetProcessHeap GetStringTypeW SetFilePointerEx InitializeCriticalSectionAndSpinCount GetOverlappedResult GetLastError SetLastError CloseHandle GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetHandleInformation WaitForSingleObject CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA GetCurrentProcess GetCurrentThread OpenFileMappingW GetStdHandle SetStdHandle CreateFileW DeleteFileW GetFileInformationByHandle SetFilePointer DeviceIoControl HeapSize CancelIo MoveFileExW CreateHardLinkW FlushFileBuffers ReadFile WriteFile PeekNamedPipe GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA ReleaseSemaphore CreateSemaphoreA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess CreateFileA GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA IsDebuggerPresent InitializeSListHead QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

shell32

CommandLineToArgvW

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/scew.dll

IMPHASH 571b82e04a3103a0e1e37478d9e58122
SHA256 10f3a985da345376502bb8e4fce9c59aa15633b78347bf9080fb61bdd2e3cd5d
MD5 4a144eb1f737dc00689659b36aff0384
SHA1 4ce0c8afbd153473d6a03fb2743e209b5ddd1c0e
SHA512 68e5044ed77ebdcef9b0b3fec7174ef5faf56b38aebf5df64ec925c817021453e97a3a02a348996cfb3976b995e59439b3128930ba176600ab4b10c12ff40726
SSDEEP 6144:G5ieH3XO7LeWBl3bVan3/G6C1XNj7rFIgQM3mbPnTbqMalXwnhHyz:G5PH3Xciil3kne6C1XNj7rFbQMYIwnk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c1:2a:dd:1d:b0:2a:c6:c6:97:1c:24:59:34:88:24:37:bb:16:26:f3:4a:42:f2:97:20:2d:01:3e:82:63:50:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

173781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\kmr4g80c\common\scew\scew.pdb

XML_Parse scew_attribute_compare scew_attribute_copy scew_attribute_create scew_attribute_free scew_attribute_name scew_attribute_parent scew_attribute_set_name scew_attribute_set_value scew_attribute_value scew_element_add scew_element_add_attribute scew_element_add_attribute_pair scew_element_add_element scew_element_add_pair scew_element_attribute_by_index scew_element_attribute_by_name scew_element_attribute_count scew_element_attributes scew_element_by_index scew_element_by_name scew_element_children scew_element_compare scew_element_contents scew_element_copy scew_element_count scew_element_create scew_element_delete_all scew_element_delete_all_by_name scew_element_delete_attribute scew_element_delete_attribute_all scew_element_delete_attribute_by_index scew_element_delete_attribute_by_name scew_element_delete_by_index scew_element_delete_by_name scew_element_detach scew_element_free scew_element_free_contents scew_element_list_by_name scew_element_name scew_element_parent scew_element_set_contents scew_element_set_name scew_error_code scew_error_expat_code scew_error_expat_column scew_error_expat_line scew_error_expat_string scew_error_string scew_isempty scew_list_append scew_list_create scew_list_data scew_list_delete scew_list_delete_item scew_list_find scew_list_find_custom scew_list_first scew_list_foreach scew_list_free scew_list_index scew_list_last scew_list_next scew_list_prepend scew_list_previous scew_list_size scew_parser_create scew_parser_expat scew_parser_free scew_parser_ignore_whitespaces scew_parser_load scew_parser_load_stream scew_parser_namespace_create scew_parser_reset scew_parser_set_element_hook scew_parser_set_tree_hook scew_printer_create scew_printer_free scew_printer_print_attribute scew_printer_print_element scew_printer_print_element_attributes scew_printer_print_element_children scew_printer_print_tree scew_printer_set_indentation scew_printer_set_indented scew_printer_set_writer scew_reader_buffer_create scew_reader_close scew_reader_create scew_reader_data scew_reader_end scew_reader_error scew_reader_file_create scew_reader_fp_create scew_reader_free scew_reader_read scew_strcmp scew_strdup scew_strescape scew_strtrim scew_tree_compare scew_tree_copy scew_tree_create scew_tree_free scew_tree_root scew_tree_set_root scew_tree_set_root_element scew_tree_set_xml_encoding scew_tree_set_xml_preamble scew_tree_set_xml_standalone scew_tree_set_xml_version scew_tree_xml_encoding scew_tree_xml_preamble scew_tree_xml_standalone scew_tree_xml_version scew_writer_buffer_create scew_writer_close scew_writer_create scew_writer_data scew_writer_end scew_writer_error scew_writer_file_create scew_writer_fp_create scew_writer_free scew_writer_write

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/update.bat

SHA256 924f07591863b3e6d43371593a3c4d57bba93cdbf59fdf102ba72abd55e92879
MD5 b862a1baac142bcacd391414d665a0a1
SHA1 79aa0c97010707640bfa3082b29fd61b1373dbce
SHA512 788f4e959fdf91f2c3a2a46ff9d1ed51f96c73238f3e9aaab9e2b2bd45759645085082aa831220c9ce023a7a741213538d852658b9cbe4b12bbee5705e1f2d7b
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/xvdfmerge.dll

IMPHASH 8e0283b879a0a5a261fb176ecb652c35
SHA256 d20f7ad78d1d548ebea41f6b496cb2399f8186493564c777f192c9a0eed23f18
MD5 af329640a44f6dc93e395e167a0c80f9
SHA1 9f3c6e132c874ec689c2ab5ad21282f326d93694
SHA512 988ce1e03736fbb4369bd5e0ffc52dae9c70811c65d11066d99a76e372fb72108d80c727fe4dd4e4e1125c927a68caf97af18009fb362048f408dbe36caba440
SSDEEP 6144:ylOdse4zxgQM+50K5xDAcAd5gL22nn0kvrDmENiyoJjK7bdgaO/10kGsKceGAqUh:ylOdse41gW50K5xDBXlvrDdiyoJjK7bh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

64:f1:e3:7c:88:4f:69:d7:db:03:39:7d:13:fd:48:88:53:4f:5b:08:ce:bc:80:66:18:e8:5d:80:cb:78:84:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

148328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\common\xvdf_merge\xvdfmerge.pdb

ws2_32

getaddrinfo getservbyname ntohs htons htonl getpeername socket shutdown send select recv getnameinfo inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl freeaddrinfo WSAGetLastError WSACleanup WSAStartup gethostbyname gethostname listen

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW GetModuleHandleExW ReadConsoleW GetConsoleMode SetFilePointerEx RaiseException InitializeCriticalSectionAndSpinCount GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile FreeLibraryAndExitThread GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ExitThread ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent GetHandleInformation SetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess FormatMessageA CreateFileA GetVersionExW GetModuleFileNameA LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA RtlUnwind InterlockedFlushSList ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW GetConsoleOutputCP IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer FindFirstFileExW GetCommandLineA GetProcessHeap SetEvent GetStringTypeW PeekNamedPipe GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

$PLUGINSDIR/AccessControl.dll

IMPHASH b79de4e8687b3fce7173ec8dc917f685
SHA256 d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d
MD5 9e7d36edcc188e166dee9552017ac94f
SHA1 0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a
SHA512 92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783
SSDEEP 192:y26NwF1FF8GqdxASZlSOnNGGPCqLXUdadWo2FfTCWWqDsYjGI5hBslft8gWNPjQo:I+8vwSZlgaJ3/4/4Q/bN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/INetC.dll

IMPHASH 8e4c63f70f7cc6490634d743e795c93e
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateThread CreateThread LocalAlloc lstrcpyA WaitForSingleObject MulDiv ReadFile GetModuleHandleA SleepEx lstrcatA GetTickCount CreateFileA GetFileSize DeleteFileA lstrcmpA lstrcmpiA SetFilePointer WriteFile GetProcAddress CloseHandle lstrlenA LoadLibraryA lstrcpynA LocalFree GlobalAlloc GlobalFree GetLastError WideCharToMultiByte

user32

LoadIconA SystemParametersInfoA GetWindowLongA GetParent MessageBoxA DispatchMessageA SetWindowLongA KillTimer PostMessageA IsWindow GetWindowTextA ShowWindow SendDlgItemMessageA TranslateMessage IsDialogMessageA CreateDialogParamA SetDlgItemTextA GetWindowRect SetWindowPos SetTimer SendMessageA RedrawWindow GetClientRect EnableWindow FindWindowExA UpdateWindow GetMessageA GetDlgItem wsprintfA DestroyWindow SetWindowTextA IsWindowVisible

comctl32

ord17

wininet

InternetSetOptionA InternetQueryOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile FtpOpenFileA InternetSetFilePointer HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetGetLastResponseInfoA InternetOpenA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetErrorDlg

$PLUGINSDIR/SysRestore.dll

IMPHASH a4814f13f35bacb060420cabbf9e8154
SHA256 c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
MD5 da046184a8d7269a0e138b0b0b9b2eb5
SHA1 d9bc5ea397857e17a86f80df1e50615eb6859044
SHA512 9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
SSDEEP 48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 9b2c306c8e0ed35e1aa50bd943de3719054102662db92a6f0a0f703197343147
MD5 51a39d41ab4a3b1ec542f45f3edc6f3b
SHA1 09b5853deb184e281885aa8421cd9ff578c51891
SHA512 a07f6d4e6026335e21c11227ba1f5c2f5154b836ce3dc05283424f5de981f5cc5d5ac8c3559a784bb98e20243b3b1d5ed7636bae6efa429bbf7911c5c197e52e
SSDEEP 1536:/eeeeeeeWeeeeeeekVVVVVneeeeee2V8eeeeeeexewHPLCjRE:/RE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 b2c7196bc66d0ba39812af671542664c2c8216b3334d1cbbd57241bf11653b0a
MD5 3eb2ff327fb3fc2495c7b4333d4bede2
SHA1 584c75cf25c01183d4849271d19a18406b4a8354
SHA512 db599db233a05d322895551a1de198639ca64cb7c01b096116ffcde43f2d87e50a426f927ddfce8db53eee24ad56a833419f4bbe52e2ecc816e6654e38940495
SSDEEP 768:tzut0F2PKoRtviqKg1oNEZneK9Nl34xcj4ghfrH64gi62PSfvLzGE2sv1+AdwM4F:JQeKxHvD6VqD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH e269b6260a93a17ceff5184b3982ded8
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

API-MS-Win-core-xstate-l2-1-0.dll

SHA256 4879fe3ea58d853f21658aefc5e8b92b7e6333d77c0af31a6bf9ff769475f6fd
MD5 5f11b9bb427753bdae6d312a02c516f9
SHA1 6fb327e5a64a94c2489f3a82999b7d60babb228a
SHA512 09a317ecb7d83f1aa2d06e65371513ae770c9df4691b5ad3d50918e4bfacf1635fafaa43ada4efd5d23c448a7eb80675baecccb3ca9dbbfba4e829248a5bf466
SSDEEP 384:9cf5b+W1hWx7HRN7izd72vH3rPR9z/gtP:uf5bVGic3l9zM
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-xstate-l2-1-0.pdb

Accessibility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
MD5 1b4cc6782e295675217cd17df70057f3
SHA1 f468087e7fbaa5aeed1fc41062b198570ae017e3
SHA512 05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
SSDEEP 192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a02884adf7c6cea2de69d260034930ebf9a0bbb51e7ceeb12b7fdd6d38941f80
MD5 fb8d7d2f2d25346e8ce9a70b5df5db55
SHA1 b7507ea12e1d0583fdee17583af26cbb17ed884d
SHA512 33a79b89ad7750084a47392b193a57cd3392c1f175eb63c4ac1c64919e47194c95b6c0514f10e972503e13980b88df329fdec29d3b3cf18ffeeea16bbe03e12d
SSDEEP 12288:8quZ72AyO5lpt5dFjTMrEtZZwem1ajAHOGeVy+BIRwcls9P5m6wYiKoP2X:8q4yAy8lT5d6oVjj/8Hls9P5mui6X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

fc:83:af:35:53:5f:44:e4:4c:f2:df:8b:52:5e:6f:36:5e:20:4d:b9:04:41:30:49:fc:2d:d3:4f:04:bc:76:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1083182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AviraLib.dll.config

SHA256 f9c12d9f6a4625c20e1f3bda1a076b50587be63ca2207376b085bd8b9d6bae86
MD5 7b6547aba2712929a012d362eb8adf74
SHA1 e7dde0f13bb8289f6b63aef2650d04ce6a8b1056
SHA512 9ed2348d075db48da699cc0f1131c17770ab2ab2b45298b003641201ac2b4639bdf2028cc2a0492b317de9d951a0cad2ce6dcd259e2f0421055a04ac43620985
MD5 SHA1 SHA512

NSIS installer

installer

BouncyCastle.Crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e7c9e901e6d927778938d3ee5d183dce495d6b6eb2a89242a700afe25d921cf6
MD5 9d34c40df4c87e378bdb0a3ebd36bfc2
SHA1 5c110a3a90e792270b44e3e3f6cf31bdd9020295
SHA512 51eea2113ac5acfd553b3e0b35390c38323218de55fd5b8abc8cf44bd0445df84eaf9349b52491737aa826ce76cfc2fe5eb5aaa60413cf376b4479ff21a19339
SSDEEP 49152:2brsw7nZ8pRbkwLdPkSAu5LdPkSAu5LdPkSAu5LdPkzkHi2LdPkSAu5LdPkSAu51:U8pRbx4kg1qA4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2369022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Branding.Desktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed3d49a91f5b88d425d5ceda3e120638c5a16116cf719e899a3395092dbd2fd6
MD5 83df60e9fa070f73fc478f3e2fa33118
SHA1 09f906f3834fad2f891f2faa88963035cde5f4ab
SHA512 6b8bb3f951676c5186f72053f6eddd807c9168e54452d97985536e0956752707ba5a8fd1b466631b6d3f7d5ee614398e8e0c07774d3998986982928495bcf90b
SSDEEP 384:vhPZBx2Y3p1iS90bIqEoZzHoNZsHLItkgtAM+o/8E9VF0NyCn:pBL2Gp1i7bIJkVikgtAMxkES
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

df:03:b7:17:03:23:b4:db:2d:f1:5a:59:80:49:01:92:95:7b:f4:98:ff:98:98:1d:ab:18:33:ec:a1:bc:b2:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

18142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47_cor3.dll

IMPHASH 185ce3a45c3a9cfb3bf83afd7f79c140
SHA256 e745872db4dd114a65ee1504f401ea26d879edb6614e369a07a80ce7ad1950ca
MD5 5e717c95808bcb5f654bb312d289b837
SHA1 c69448eafa40e35424744c28e68cf69ce11a3d97
SHA512 dc5e6ee0c8fe22897009060821b18bf2f7d0317d30682f7fa84a4c1889358c152d84d22ebe57d0ec8ccc1be8714bce6b1257d30671b8d0fea88309bbd137b8f0
SSDEEP 98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:03:25:89:c2:7e:fa:d3:87:c6:eb:60:79:f2:01:b5:35:a8:aa:17:92:20:75:6f:af:f9:c9:69:d8:6c:2d:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

10

Entry point

3010368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D3DCompiler_47.pdb

kernel32

WriteFile FreeLibrary Sleep TlsAlloc TlsSetValue HeapDestroy TlsGetValue TlsFree GetFullPathNameW GetFullPathNameA GetEnvironmentVariableA VirtualFree VirtualAlloc GetSystemInfo GetProcAddress LoadLibraryExW SetLastError IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW RaiseException EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleW GetModuleHandleExW IsValidCodePage GetACP GetOEMCP GetCPInfo SetFilePointerEx GetStringTypeW SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW ReadFile FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleFileNameW ReadConsoleW HeapSize HeapReAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LocalAlloc LocalFree GetFileSizeEx GetLastError CreateFileW HeapFree GetProcessHeap UnmapViewOfFile GetFileSize CreateFileMappingW MapViewOfFile GetFileAttributesW SetFileAttributesW DeleteFileW SetEndOfFile DeviceIoControl MapViewOfFileEx CreateFileMappingA ExpandEnvironmentStringsW HeapAlloc OutputDebugStringA CloseHandle LeaveCriticalSection EnterCriticalSection lstrcmpiA HeapCreate GetModuleFileNameA CreateFileA DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetDriveTypeW GetCurrentDirectoryW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW MultiByteToWideChar SetEnvironmentVariableW DisableThreadLibraryCalls

advapi32

CryptDestroyHash CryptAcquireContextW RegQueryValueExA RegEnumKeyExA RegOpenKeyExA CryptGetHashParam CryptCreateHash CryptHashData RegQueryValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext

rpcrt4

UuidCreate

DirectWriteForwarder.dll

SHA256 440c95dcdbe402d843095649773d1fc6da5d035802dd540ce29c71bc915d433b
MD5 a36d73301123334adc95e034b327daad
SHA1 cb4bd930cbe2c930d665dd4467e8b88815de8c1d
SHA512 438abf9aa1c00bf1f3e9ec7e9ac6bf5d89c492d68301044ba7fb205d3c5d34aae4940893eff721b91696de4c782a8a3558cdb39955943e350361639893ef3393
SSDEEP 6144:eTDF2kb51CJfk7g9wSikA+6Bl5f7d5rBkwLENfTKSr1dDqY9DGKwHrD:oDVbK6kA+6B/d5rlUfTrDT6KwHr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:d4:5c:5c:90:32:55:f6:ba:5a:1c:98:40:cf:5d:04:b2:38:eb:c0:52:e5:b7:cb:28:5a:8c:74:c0:7e:01:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DirectWriteForwarder.ni.pdb D:\a\_work\1\s\artifacts\bin\DirectWriteForwarder\Release\netcoreapp3.1\DirectWriteForwarder.pdb

DotNetZip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28d76d7ac169c5b71cca4e3073226f885a2f06720413a11e8db9b7fc08359462
MD5 6a8c8771bd399dd468595bab186c3e88
SHA1 df56e2573396ad8da5998c6aaf89c508f2060a85
SHA512 3e7a0e3b0b182e97e44504c4aa511065ea910a88e88ea849a5977f64dfd64aca6008815a6307e1d82a706b66811ddc5a1234b37c95a80e1a01feaa8b8fdc3d74
SSDEEP 3072:QXsFvbsM5ecgKXnukd2sn8Dhm58yEJEYkbQcHPoOFqvAvIMqUo1SccvdH8UfrxA6:tmE7gX22sGhs2JcjpIN9+8UfrOsWs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

244462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Engine.Win.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 270fc42dcaf1841d1871ae4b45404afe9cfc3b445e34aca1e386b67fda555434
MD5 da57061c46593965fe4583555fd6fba5
SHA1 968ee40fa24695eac44dc84a224e0c07230e317a
SHA512 d1877c261a2071f507ed80923f6db4073404b4b16ada02b3c21e9fb824dd92f0f81297b3a619a2f1acdae502f43434bbd9297562cbca653e1a7473c3f05fb4a9
SSDEEP 12288:nL43XI03XQnigPCHS/cEYjKbs4OjQ/I51Pq6Cs6YAD/z+87tho:nkoIXQigPJ/clg5kr6s078
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

db:e3:0b:40:67:d3:02:36:8b:4d:29:43:ab:52:fa:e1:50:1a:2f:a5:78:22:c7:89:37:44:6b:55:84:78:23:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

878734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.SqlServer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4c39d8f0fb669e6e337c5f3138f6171b0905cf875a92b0e3253f33955b87b55
MD5 4010a41e4730439275c00c358550393f
SHA1 572a2fb0526523e3669a53264fc51adac70c4ad8
SHA512 5a554c85ea0222c9d96ebe24b2b0730c3974c59389e2fd0672ccd2c99f78b937bc4529151a24cc68357a308d3e9990f09eb854b05466538c422847d9849f84a9
SSDEEP 6144:frmoela3kPuG2p6GeqDmjaVmnSmr/u65oPWtduB6yHtYw:fvelMwu65oqs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

584878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EntityFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7f8427f0d039ba33d7b414604baec4b62d6dfef9e1f5c078d403e7a04e8dd9b
MD5 ab3c40670c848ac52f32221a7976cedb
SHA1 20a05ff58f34ae9c6b046169e42db3b68b805fb2
SHA512 8e97b78a6ae9590e84b0d06f5a37586893c4c099a99aad2c50a6ea49ea1aae2acd07501d4e6af905a2263cd2a14f743746e18059204d8dff9b19439000cba705
SSDEEP 24576:nhI7iceqhqPP3COtQmJnfylfF6RTazewudnOCJNBZ3tc1D1Q5UGLG16pd4XtwZou:IOm2y5Ea8c1p2fa+wvHo8IryABzw1k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4936030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GUI.Win.deps.json

SHA256 31057e87e93969845fa1e9d9585e7f28859f69a301d3b03c0091aab62c62413a
MD5 9ad72fd35adefee97e45c7d3f4aca4d2
SHA1 36f507f2cdeb0fa168e231a12f16a6182a465887
SHA512 8a3467cf8b05efe30c43da72801729c43592a6279166430e332d2cbd9f20a5de5586c6c046486f64930049e9e544e5e9f0a68b5a2bc7ea08560f2ba8e4ecd505
SSDEEP 3072:/A5fgBS/Rt1Y9Im07R1ARkgT9uextHZqeajAXhKg09p:/Dm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

GUI.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2055cb0ad752fcdcffeed5a3696c12b679dab82624fa12ecbc554df50057f51e
MD5 29726704682e0d40ea6b0cc18a30b019
SHA1 7f630904f0f6833bc41fcc417f158b4de29cf287
SHA512 f57ce9be08baf4ecc55377097b2fe059e0d000fe17b57c7b2620dde907892b3442d259c4c37dfbaf9e6ca7f1a793325d421fb29b84c4ad2d2efaf5f0173ada77
SSDEEP 12288:rw2bFAzeuL9lRC5+Rh2gVS8GZdgdGuJggQT4KJeEyMF5OcRkZBp:025AzfC5+RfVodgdzJOOskZH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c5:7b:2e:01:9a:13:0b:fd:9d:ff:89:bf:bb:8b:2d:32:14:49:45:a8:70:69:76:07:e7:ad:40:18:56:68:d3:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

1929614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GUI.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f35cffed9992cf7af5710d8f48dd1ba55b9c16211746e16fa474277ec5e5e1a7
MD5 2ccdd5e34604c7b55df78be8d1977135
SHA1 785dfda116c774afa7270713b1308ad1d8c2d200
SHA512 89947874a3c167b6e1202f338ef084baca5c7f954205f65ecaa0b284e74618058b3b1db0fa8d45fd558746eb278feeedd98320c8b79cd67049af244f511e7049
SSDEEP 3072:imEWPCpf49WhHIDkWMeqoAomvoPdk/kdGYp9i5R3N:Yf49WMkso7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

166014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LICENSE.txt

SHA256 f9524cf8d591c32dc21902590e3182d0d0bef0cb0ba431f91bf6c9d71bd38cfa
MD5 6b1c894157e404adfa2c9168cc1feaf0
SHA1 de643d125afb3f3fbc698c87f125d5a0f64cd73b
SHA512 46ba913816ea8156aa1b676c415b98966ebaad608ce2b2b098d784a8f1b28323a12e47852a9c4f9aea8235854fa922ce3deaa75db790d955fb3c36a728691156
SSDEEP 1536:euu3tHOSJpAg81+XjOFYwT3Jtfefsw1FYwTbjQTfw0:ItHLzR8EOnJ61Ljo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Manifest/chrome-manifest.json

SHA256 adc15eeac0df3e0a4c245883f6f37dcb78c3c6b4bd65ef70f230d87db5b216b3
MD5 4cc671ed94a4ba83d6f8cf867086809d
SHA1 607884d22ad4debe76ceedc9f29d117a1f10ec17
SHA512 9e3c41fb617f257361f69451f379b6c46a756e4fc2e6d5cd310a18b0cc81aad19a499d69fa982ff1840e6d5a3705534d3ca38e3e15d5d3021459d8d4047f7c68
MD5 SHA1 SHA512

NSIS installer

installer

Manifest/edge-manifest.json

SHA256 b0ae3555fd8ce0ef472f594e3f2bc0f25d857c597d9f5a1da32d5bea27d8e481
MD5 17d49668e5f11bee426d3b6f626ab7f6
SHA1 51f3be72d7ab28dcbc3205b3a269fdcfbeab9398
SHA512 f78f03286c2fd83a6c18563ab7c2dfeedb0d17bd1ea6aa93e4927120cbce42d95e6fef0d573d47e34f55d90945a4029f542f39561adf15118c721efdfa7e8602
MD5 SHA1 SHA512

NSIS installer

installer

Manifest/firefox-manifest.json

SHA256 38d3918500f9ae357bc9bf6a528581fe27395be7eb472781904dc43125aac85f
MD5 b15436b8a081908805366af64e813a29
SHA1 289d5f8910baecff8896e7110b3c01aff437197d
SHA512 0104af4bd01ecd72b198ec2d1ec9f217fb1a5298a52546ec06c1ca5d5688f7cd849e11111d8c669490c6cc35b11b2f7535ca4863a03efe490580cb614a957702
MD5 SHA1 SHA512

NSIS installer

installer

Microsoft.AppCenter.Analytics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac8b2f3785163b38c4473f1aa25616a4616e2fbb29332fe3dd8da9574fc3c4cf
MD5 d4041b4e6cef641e52922aae24358e67
SHA1 03cd00c2094e6747b0bc489f1927d29dae39b5ea
SHA512 728dcee4a9e3909f760edbd6a6e582c6c40162f37cf0c5e61bb092679ef91e47e8e5bdba468c40f24010ae795f6e277ff1c60b9e46bee2dbc94b3d9c6491570a
SSDEEP 384:FHusqPUYyBiwwu9sXZsQb+Jx4veT6pzBcwyWUVMW:FOsqsYb9w7UBcH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.Crashes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1ac20df009a8879ff946388741b781b37f8209ac93260ff8a00573376def08be
MD5 389e880efe79f750488feed7fa52b1d2
SHA1 b0a58209ddd87d4ec1240bc1b556889850965148
SHA512 ce378858dd67c8ff7972036db1b558603c0c7bf74b82c0c965fcd039138be3eee08fb729b879a1c66b41d8fab7c70c0a9ad1c8e5c9490c4967cec87b2f62b436
SSDEEP 768:qs8Fis/HebQPbM9z9iDk+gGCHeHGoSMwdevPf:qr1bMvHXlemtde3f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.AppCenter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7ddc86b6500a27783071abb2a0769a1f47a7cb78d039642c2126ad1b879cefe
MD5 395ca70f6def000f67ae3334682c3a73
SHA1 5b32bb4f106e490044f8cb95b1da24605e66ffd0
SHA512 a47cde27ec3af919d68f6bba485b24c31b681b3572cc9af9c8df8e46af6d1441d4c5836303c4901f531fdc6e2092c6ecbd28a17b42616e42a0f9a2a9dd46dbec
SSDEEP 3072:O/6mN7KWjKL7gHdJWRYhvoiJVIAQlHvIRQ0OzbXq:cN7PjKL7gHdJWRYD5UHv3ZT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.CSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ce9323fc09281f1f8d86d741a594e29f7a9797de0284e1b168b1043c6c9a02
MD5 550c3defa28f7da52cfeb896254d5446
SHA1 9769ad55aee4cfbc94053e885d229ca98d953254
SHA512 264181da5f80966f2b0a76912d496ad55b403f99d31097b258c9ab87d39b41435015b8e702bfceed5f333fac9367f542dd397778504c8ed2a4b4ff4bb3a82370
SSDEEP 6144:3MsCfqudVKjZSkSNw1oxu0LhdkjVsZBwRnIfPk9eG3u9yHcohyz:csCfidSkSNw1otkcG3u9yHc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

299150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.dll

IMPHASH 2750e561997e3d2f8e185972112eba29
SHA256 f21da9fb831ac943736135b6ee109a4b352511b8d6c07cb03c66b61996d1ddc9
MD5 4ff7094e3edfda47ced912012044296b
SHA1 c6f3c9d81713687dc3820d8cabf14c2a32208d27
SHA512 372867bbae96c51ee11b413f552a67a53992b16dbfa44105381db3813e3c2f9a3dc9d16fc6bd6366514d4e1b4bf1eeccce5261bc3df837bf3e3eb5a04446c551
SSDEEP 24576:7Xg0Ff/wSOM0TJuCD0Kbyk3dIf//LXpWhIHWLRDAcc17QXk0:7HHFRKbhdIf/TcIIhk/0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 28, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

256480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DiaSymReader.Native.x86.pdb

kernel32

GetLastError FreeLibrary WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualQuery VirtualProtect MapViewOfFileEx GetFileSizeEx GetFullPathNameW ExpandEnvironmentStringsW DeviceIoControl WriteFile SetFilePointerEx SetEndOfFile ReadFile GetFileType DeleteFileW VirtualFree VirtualAlloc WideCharToMultiByte SetFileAttributesW GetFileAttributesW MapViewOfFile CreateFileMappingW GetFileSize CreateFileW UnmapViewOfFile CloseHandle MultiByteToWideChar GetSystemInfo DisableThreadLibraryCalls GetTickCount GetEnvironmentVariableW LCMapStringW FormatMessageW LocalFree RaiseException LoadLibraryExW GetProcAddress TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError InterlockedFlushSList RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter LocalAlloc GetCurrentThreadId Sleep LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateEventW

ole32

CoTaskMemAlloc CoTaskMemFree

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh _free_base free malloc calloc

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-string-l1-1-0

wcsncmp wcscpy_s _wcsdup wcscat_s _wcsicmp _wcsnicmp strcat_s _stricmp strncpy_s towlower wcsncat_s strcpy_s strncmp wcsncpy_s _memicmp

api-ms-win-crt-runtime-l1-1-0

_initterm _errno _crt_atexit _cexit abort __doserrno _execute_onexit_table _initterm_e _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _invalid_parameter_noinfo _seh_filter_dll terminate

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle _close _chsize_s __stdio_common_vsnwprintf_s __stdio_common_vfprintf _wfsopen _wfopen_s fread fseek fflush __stdio_common_vswprintf __acrt_iob_func ftell _wsopen_s __stdio_common_vsscanf _open_osfhandle __stdio_common_vswprintf_s _read __stdio_common_vsprintf_s _filelengthi64 fclose _lseeki64 __stdio_common_vsnprintf_s _write

api-ms-win-crt-convert-l1-1-0

atoi wcstoul atol _wtoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _wfullpath _wsplitpath_s _wmakepath_s _fullpath

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-multibyte-l1-1-0

_mbscmp

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

api-ms-win-crt-time-l1-1-0

_time32

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Microsoft.Extensions.Configuration.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9e4bf73dfed3d5aa9ff25780e87109a985cb6e2feab30bea42689cf7d1d4ed1
MD5 542b6ef0d8d600f43cecdaa5fe6a99a5
SHA1 3e5626ab326b8e0a08d48f1347c09eb3a8b1b882
SHA512 4ba7499c2b5cab18d185f63f857f8e94785642b5d0909d2c978b039d8920aadc0401f57ab7603f2ddae396c4c8edff5f56b31de36d24620733c9847f5b3152cd
SSDEEP 192:DMt6XYVhN6y0mb+dXM+4POdTJ6V2fGtbn/PTG/AxXEzRjz6P+M/FbSZbWsKTWM:D+V/6PI+1z8bXTG/ABEzRjz6P+M/Fbk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.Binder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4950a8400717903c28cd5b9562cff761afe5ac3470ab699855a898b29fe8a2e3
MD5 99ed54569b703e903f674ea4eda6c662
SHA1 5c59e3c564b4c057ebc1455cf7bc219b825aa11c
SHA512 fe4937471fee583ee73411eac6e256a622c2f8a10d885e2096546bbc93e393435fbc20d40b3f885f48f48767bfdde906209890e9088318505b10d84a7d4ae7e7
SSDEEP 384:dqnWO8HPEfXZ5PAxmLKRTuVWU28UJjyFygZ7gYU8ud/WiaGWM:dSWO86zgm0qfUTMuY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Configuration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91be5d8e169d4e809d077108827c041988018f37924c312dcf3c3c77264eaa7c
MD5 d29ef3e603946cdd964ded903c205d62
SHA1 959896475fe1dd758adf857b72bea25cdcd405cd
SHA512 3f82b58932bbe771fd102065399e36822f061c769a211b85661d4b0575cbca90cd18ae92d76101e2219f22bc247a163ba95718a4303a6d43784723437f7b88cc
SSDEEP 384:/dfVJtVnucJYXVJig3xLm+NMsTks7WK4WJeVWWM:FtluT31Ugi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1663be664cb7a7afa5786dc9f071fca8aeac3737fe8e29153f29223c8ab1608f
MD5 1cca6bb1ef856aed16e29b17b92ea225
SHA1 59bcdfef44880db1daf87951619cbc776a22746d
SHA512 6daea2c19e873594e8486ee09ab0cb9d30e4f76a1ba51fd3c2a40ac5c27c870e1e7b533247c17b8386c9016103d1423cd886efbf1256e89ca2a8b99f0d2d57fd
SSDEEP 768:jwd02Ew1NODPOlwlwlwlwlNm/ST5T1yEf:jwd02EacZ/mJz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

32878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.DependencyInjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21d64f47e3d226854b93ec5b1f94d3b8ecabb0000a5b759decd96507789c307c
MD5 692c5f999645b4e9babc2e830a2534e5
SHA1 da1ce989d55ef32809a4c0471be5ae9e5614e483
SHA512 ee6da0eeb5617b6b0ddb754cdced46a68a4aa95e5127ed94090f3640d4d0df3f003135ca84e5b4870679b0972e3c4f6b8059bd8a9c870ce8c5237cb0930235d7
SSDEEP 1536:CPkLGoLSeeeJHlFDj4aQsxYZiKdD4Zfg+:Q+XHzjeN4ZfD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 971a367da28ccca459fe2f7d755f0cea978310fdd064f6368fb8c8af814d74fd
MD5 613442a0e2cd90d79c3401554b8fba9e
SHA1 380df211e2bada028536a6c55bc8f33495bce1a2
SHA512 ef9a5696774f111a7ec99a6cc96d976e761faee4e128510f278a6f606de3f898413808f4c53cd19d27e83a46a1adef945c60d4bdc41f2aef70f710027c6bac87
SSDEEP 768:qwHqGdhpezbPK/QN8jmN8CduUNxYci62wyq/:T3dv6eAuUocywyi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30f4630b82b19f77abf33c8287cf4a00e8285aa71df1bb3fc05b7abf9026841b
MD5 1649856f9ae8ea8aa53b5aaa04da894d
SHA1 03574a2e9baf4edab20375bbf968228ca717ce8b
SHA512 20dda82a3c9501c7de052c86c09dafe4251042011305a7224bdd7bbf99f7b705cf6f5992f9fc27fdd5526dcbb3fd6caf6fe2128631c769c59fbbd5c639dbfc17
SSDEEP 384:uUNoqS641Wkrb90zrAj1+dOECTEPC5nnAKacrWYrqpWraVWM:uS/SkkrbqxdOEQ3AFchr+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1332dfbef2bb538faed7c85ae6f6c26d64333eed95486e3f81c9f2c1af5b9f33
MD5 e80731180d3f61c207d1e759b5e422fd
SHA1 c9a8989cdb44ae95f6f6404a6618bd001ddf95fe
SHA512 da74e650dbe60705e02882e7877cf0f5e7f08c1a17b3da5cd892b9a66fc06dfc7be8e324c13d8df17f7bc9898f22b399e0e81808c76e1274f70b6b1f58564a82
SSDEEP 768:JmOSgq1fwDct4Ipp8nV485AoX5R9iV+Wml9lblyMbWndaM:O1fwDct4+YJA0R9I+X5bo8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Extensions.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3cef68b21c85327a9e55e1eabca27c15adc2c6a68b57f5f26b106f4bc9caf2
MD5 61f024f6b0322ba5b988314329dc27d2
SHA1 198fa3cd893e164a1c8144adaf36a9711f5ed258
SHA512 cfd645addfebee65fb7b7d6029c4d5359d73605e94708adb40c52d3ed498aea8d05559633671b5702635958f244bcf60bc2a09302f6e72f4a5d66479ab021608
SSDEEP 768:33/GX+hgQVTGdJS6CPIUqOF0vWusFQaui4m1/LcfJOVfAMxkEa:n/GX+BVTGbfi9qOF0v3sqauiJkJO9x+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0e:2f:1e:b1:81:a8:66:ae:e6:21:7a:ae:98:18:04:d0:18:a6:01:7b:5f:5c:2c:86:de:cc:c7:45:35:70:02:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

34190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Toolkit.Uwp.Notifications.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b14999bfdbb2a55f335ed3e9da022a73e9ff6e96ba341ffef22637a6f1826188
MD5 71829de02b099241bad4ef0efba785cf
SHA1 625aca08f1b7020456303794543cc669853003a3
SHA512 dc5248ec12ff04db6722d6640ce2eab8dbf154ceaecbcb5f473e4ca869f60ada4bd136d849db82524743c652f2bb27d08870d28e2d54977c717b73fc853d6557
SSDEEP 1536:I3FYVCl7jqFaTsU6+QFBwkGKXX/3+fibJ+zGgr6j0tdISOUpUfZ:ooClnxsU6+QFtxXX/3+2+3r/c
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a8:a5:6f:e0:19:7c:75:8d:62:66:2b:14:a6:cc:fd:85:59:5d:68:92:91:b7:62:e7:c1:3c:d2:db:5e:d0:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Chains

Aug 12, 2020

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US

Serial Number

0e:71:58:6e:7d:8a:28:36:54:3d:5e:15:d2:b4:5d:e4

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 11, 2018 - Jun 15, 2021

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

109974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Microsoft.Toolkit.Uwp.Notifications/obj/Release/netcoreapp3.0/Microsoft.Toolkit.Uwp.Notifications.pdb

Microsoft.VisualBasic.Core.dll

SHA256 e0864f46e0f0ca66143b43c12a4b37dbe2fbe8fd138d5da59326fd632d6a3571
MD5 4ca0c139b698ff4b1a4fbaf653d8b607
SHA1 4881028e15d3fe3e52a6e0e8a10a3d926f3400d3
SHA512 db0e1eea47f75bde5427234888d88829fb184e31be0aefcf687e2dd4e351d9daa7cd5fdc5457ac445f17c5f784f4602f48fa8f49faa2c22c511729c5f550b93f
SSDEEP 24576:92o6FIAG8DgwIB0RLQh71gPOpxEDoQt7g8m:f6FjDgwAps2Itto
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:e2:c1:63:bc:69:df:61:1d:7e:fa:fc:f8:d6:62:f7:2d:79:1a:c8:da:00:2f:6f:49:16:cd:5c:96:7d:8e:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.Core.ni.pdb Microsoft.VisualBasic.Core.pdb

Microsoft.VisualBasic.dll

SHA256 89896b1dfdac9c395ef24e7e032f9b746ccc331bc0c9d791de3e5d2b357f1185
MD5 54427033e0d65a39722a76e07e430eb8
SHA1 7b83a4fe9997310c77aeaa5868b01b2b5a7b7c84
SHA512 b6304ec9042eee9d4c9e5f866fe9fa92582fe24dd3ba8f82374a17a7b87cc84e5f9608149269cc4c8e64cdc2c7b5ad7ac228070fe5cdd66da5b3bb9f00dfcb19
SSDEEP 384:JxWmH6L9QKWwQ3cgznLIqddm7HRN7d7EHR9zcIX:Y5QMgznLIkKd7Ex9zH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c2:b3:d2:9f:88:41:0d:3f:2c:f7:2c:87:ac:f0:24:2d:67:d0:8c:e9:45:d1:85:52:41:ce:e7:5b:4b:c1:ac:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.VisualBasic.ni.pdb Microsoft.VisualBasic.pdb

Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 85c9a4fac07761d259bd91c669e4e1c10cf79d0939e64ee96e32abdcce51c86c
MD5 8607bdfc638e4fa1d8e716486a9c6475
SHA1 9e246a9f462097de2b3b2472950eb6273e874efc
SHA512 91314554e0937194f74c802c695090582e9a6b857da72026ccf5432f5ad960547b4f4e2235f0a56108a63cbb40d60fb7d7bbb30b39f1851606a09bcf34371c5a
SSDEEP 96:/0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+qxv87xbO+XDS8PODxVWhPIeWE:8spQgrpnkeQwRUOKlxEdr50WhPIeW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1af18aa247c88bdfa1dbee361b6b901e541c0f7a0c1c31336d65ed5176b13e39
MD5 47c158136040881155f35b4877460849
SHA1 a60ab328c456cdcb7f71e14358a0ac202287a534
SHA512 14ff78a7029229c046117afc1292c3a4712dc3a4e3c4ce735781deab842b41a9bbb5fb516f19eb614299199074bc1da583d903bc08dacda6b8eb969f1bb78525
SSDEEP 96:MUhxTU0KDgJtLuWcL1v8Pcir4c2+qR3nsluxvbo+mDmDBEbKWFF3a9wxW:MOKDYrcL1cc1UsXxhfWFlscW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.Registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d72bbe2fe0fbc2177dd211308ae7331504ba0317aae60761e94817dc8856580a
MD5 90ce1c7910d0f504b2e3787e1ba199f1
SHA1 3acb3b6dec3b9c51e887f6a750035357bea5ee5e
SHA512 da7f23717e9341565d36bfaa90ec1e37d7d1ec59df91e495c607d404b00324d7e1c8d216e7adb64ba4bf7973888342098debbb8b8a4a95019200e1735b5204d5
SSDEEP 768:anNkMiBZdxRhmlhOPXwYMIKNwqSAVi2jsd/v:qkBZFhmlMPXJpkIAViWs5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Win32.SystemEvents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f05110e122fa7c73ac3571b82a0bfd5a8462a4b42b0b945c4f901928a29f3fc
MD5 fa51d1d280c2114a1de24feb9be14a32
SHA1 aa0916a3b709e2a19b7d3a55d2fdcb9cac333f88
SHA512 25c35857c79e03538825ccd6b87cee1d4a569d871889fd256fa413d69585a8e50340a0ececcf1824cac4ea976e15a3eff6ab367b0c4846f66593e0f67d233921
SSDEEP 768:Q8lYXXu7a7jtvp4VM7/9f+5KOo4KD2lJzPIsFPbPDT+9NWIc5YlL3qj:QyYXXu7a7jtvp4VM7/tSKO3KD8IsFr+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ea613cfa8e489c15d44bc1360e11be1d321de2d0327386df657425db4ebd847
MD5 2520a5a2506531cf6f8b4f2a733957bb
SHA1 202e824c042d89400c856a64624db4bd98e51f52
SHA512 8a95c483023177a8a88a1ebcdf8e00577f14a7b8603b722896ba1c714b2cc10477a74a0ff0bf7ffb70aba7e51327e54d07ee5dff6bfaffbb0ef51f08fe9adfac
SSDEEP 768:jOwA4HYdvQRXNJThTFYZSRcxEpZL5BWo1J8Bm5LhPUEfTZ75QluC9cjQvU+FlsLv:jOJ8PXNB5FZPL5BmBi8Ex+lbjkv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Mindscape.Raygun4Net.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 839a8f2b052dadd685a7222f69c42c11edf9f1e06964dfddec61320e9f359a98
MD5 94b6fa3995eb2ba34afa532b9fab39a9
SHA1 42480243477d813498bd83839cd16f6b7b828e96
SHA512 3bc4eeead6053cbf09d48297b75e270117b52562ba21a71d8163e7dc932f02c837fed47a813d6dd3efd43812faf1c9cd934e43bd482d8664fbc5191437bb6d90
SSDEEP 48:6xJk1fkEdDhOGGmntavItLNMwxLFvLmehCZutd22JMKM6ER5MtR5MPTHX:4SkEdDaOXv3Jv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NamedPipeServerStream.NetFrameworkVersion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 463e1a53996e8de4d2ff2a7b3919e24358c1895da120060d32c1bf4f9462bc83
MD5 f8d4f30967bf2a130721f2ebc084cc7a
SHA1 14d81ae3e20c321636262cfca5c2fd6caa59fb9c
SHA512 a9cdf2ae64e408349e321a69fe609f7b9e7d14505468c9d986bf46fd9ac77d5c79bb14eefe67f6b977705150a2787a41b74e685545240d7d60c524b3bfbbcbca
SSDEEP 768:g/VWCKBOs3a0k/c6sYB3zYD0DvlRGh/D/QPi:6WXBK0c13Bu/Ai
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Netlib.dll

IMPHASH f68acbcd9b68ea2a855ac109b1fca5e9
SHA256 9b33915254ff7c566937b73c0c98e579547fd50b65e4483277159d5c7eb44549
MD5 822cc56add5d97691b993f64b11f9847
SHA1 42b92efd9348f2306315274e34827953b8b26814
SHA512 a3c2e95bddeec26ae516e3b0cfa69a44ccd22f3930a692dd6e90fd4869676f5213781bc5523c15534eaaf3be5a949be07c0f5da4d6b2edf762b457363528f97e
SSDEEP 3072:GoC7RcDXGZYcS+sWv42+qct9iywOw174uXl8N:jc8uS+V42HcT/CXeN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Netlib.pdb

fwpuclnt

FwpmSubLayerAdd0 FwpmEngineClose0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmFilterDeleteByKey0 FwpmEngineOpen0 FwpmFilterGetByKey0 FwpmSubLayerDeleteByKey0 FwpmGetAppIdFromFileName0

ws2_32

htonl inet_pton inet_addr

iphlpapi

ConvertInterfaceIndexToLuid

rasapi32

RasGetEntryDialParamsW RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryPropertiesW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW

kernel32

WriteConsoleW CreateFileW DecodePointer HeapSize GetStringTypeW SetFilePointerEx SetStdHandle GetConsoleMode CloseHandle TlsAlloc GetConsoleOutputCP WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetOEMCP TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetCPInfo

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74deaa342747cf77f6efac6bee1cb6da2e7fa31988b3f1304eb1d01d621ba4ee
MD5 3c88cafb11eb9ee403dc2980edfaed36
SHA1 b9664b423200e28882a8e543cfdb8bca5ebe25de
SHA512 c5044bcc98bbb639c40cac5b5333c890feb4afb2d54b55d5d702ee7f83d86d3aa329303f88c70683f89658d7fca279104bd2c94ef3641a6fde522716c8365dd6
SSDEEP 12288:7QXc8tdRz3R5TzIQ/cVEfH9LbCtubHkttbXBfGpYoC:kXX33R54Q/XbCtuWhXBfGpYoC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

688574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14e949e8c2eff5bc7afda30804bdab15e293fde2c9f573c8d52ece54bb21c2a0
MD5 49add3e0dae1181cffc0d4dcde4e9502
SHA1 d2941dd7672b7e1d20ffe3d70dad84a71fb33852
SHA512 daa90a6db7cc28f4759deb2ffd3dd8c8f981839a8cca1299ebd558b41488ab0d9c56bda336396e7c6f46af192ca0fb02afb5851b66c65c47e3e39604fcdbf8d4
SSDEEP 384:iHd+/aJB+7+atTbuKE6CY+CTbkKM5E9P7EljEeDFkoFhx:i9SSaJ6KEpdBdrzx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Coordination.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe34dfb558d65d8b072f466021a0d15de8d202513b1f13a7b45ffc3e9125b588
MD5 805c7a0a6c838cd2e96b402417638ee9
SHA1 843ae9a6129c73f17df1a91ec09c4ac2a06099c6
SHA512 ccd6383841af4188b448d1ba153672b5861814ea8570d29ced77cffc10346c403a6f37bbf2d003b705f7a50a9c008e3a5e45a6bc30f617d9a34f64e0bc103e55
SSDEEP 768:m5MwEXdl+dbSMyWJ9TFOOo8pufD1oq2UcgFixdHGIcxCJVENySzWi+G:m5MIOEwJoDU1ixdCa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Interop.WaitHandles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f6c3af2124d0a7385ec595093062ae203573167332473c0dd6af323a8010190
MD5 a4a934cb7cda9fe457e751f43946b47d
SHA1 4cce8c0d38247450b158de3abd320003da9a4844
SHA512 15862a759007cf6211e0062e5257468e86f99868901c6565c08e6c401f9035ee86e2e639ceb8843ed4162adff35b3048c222948565a46e1df25b604254d9aa2f
SSDEEP 96:QH+IoX50CwqlKA2ANwIIv/GWnNwAh4TqBQBT+mu2hDOLFio1Xr5vKDAl:QpovZz9cGWiwBOa2hDOLFiWVl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Oop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75a30af7c9e46e45e6c2b11a8284d5eaf681b8d71e531200d4b480fc66b0f65e
MD5 73c77e64e8e1f0f010fc4158a1a7060f
SHA1 ed7a2e982f5475d4479467aa248e1e6cc4adb455
SHA512 0fbfa1d573da283c5898e9222349c523cb9c8b22f650af24b6980ab9202249020ee74e079acb6ed9ea3c1a74debef2aa70d33448d1012fc66868fe2f8db32c77
SSDEEP 96:zfaZaAMFhVyhCEvX7O+pqCbS0X1V0TzCw1:TAQ7QX/KCqz8eF1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.AsyncEx.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edef045c965f1dc14805cd66e2a0b2cae2bb34aa2c8e80468f34c34446906d0d
MD5 17f57e0d9b7c5cc602553301cd7b1607
SHA1 cd7567d67967684e72ba10d24c47e3d5c0eaedbd
SHA512 759fcc7914add3c80080c6ed9da94e9fa5e2af91752f5d7846b8cf01cc261b1eb76ba59188b1391d04a61f7ffffab7b68e0d8ce3f4b5b81fc4ff53c4aed78bef
SSDEEP 384:ardaj8E2h7/D8tg1a3FLF/pNw2QNmtMdIDToMiOrS6U07dYdt0EYP8R0OekBVg2B:Jj8E6oflfOtdgTo+/Ugd6R0UVk4m6z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Cancellation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f905ec7901dd2b3e59ec23142518996769b3c6916075776319a1c960fbddef08
MD5 df073384d167ac9baf66b991ecd6df79
SHA1 1278cb3cb7fbca5736fc386ff5e72053c6eb0f28
SHA512 5d06ca462cdcfbf4223c1b354c3578a8074e15ce850b91861f642c1d9cb29ad31fff9c16144dd2e34c289788b678296a7fc3a664c4b27e655d39415923432330
SSDEEP 192:VE6Vnko3LO0Gnr1CPkjMD1oE8jEXXwgRh:VHHO3nWkjMD1oE8jEXgah
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Collections.Deque.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 570f6df8ea487a9977c23cca5ce9ae582f645f057015ef779bb1c75afc208052
MD5 f37027e4b63b3f6468fd37332684d105
SHA1 68c3e376ba053990875dabf222fbb320b2495a8d
SHA512 ca8c0eb8a5b884d015131de216d97045a5b7e7ab457901db231b28a289d829803adfe18f58ccd26b153ebff64bb542cc8a7cf0c5f628e7108aa02196933461d5
SSDEEP 384:WRLkjeUXeOVXGAUbDYNt93FLr+hK9oY7W++wj8a7WwF5LMmXU5rGoMjnJX6eP6+3:WNOVYbo93FLr+gnEz01/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Nito.Disposables.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36be2376633d785adec9031ea49b2f578f50d5d2c74babf86f44566b903b4197
MD5 e4f25b163ce2b0cfdd30e22d2fed7e07
SHA1 16ca226a1380d219ba511a872eaea47c51818d76
SHA512 5afb2c7b8aaf67eb40964bb0fecd50a9522aeedbe18fcaa3fa02c7305ac3815f49a1e17732fa6a3f08f79507b0f2e19e1bb3cd0246ec3c95a247f7c789c3deec
SSDEEP 192:w3zvRqpaQjjXdct0MDxRYJEHrlBqw16ho:Qzv4LAuJExf8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PCProtect.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 ee2a8218d5b7a6d11916691102f3e76c4be3da66f8f8cf6f4f1a6f24cfc99f54
MD5 94d591293fff2ede848a882dcb8a51ef
SHA1 feac4ee52d01861e8a95a2d55a7dab69b90cd2bb
SHA512 4b3abff4f3f07e1a9c0980a073619aa5b492d53e0b86b4de3ceff3c716dbc39cadb24c2c791a12b4741684514124f8b82f527a1d1e3803d18d7ecce9bb5e5597
SSDEEP 49152:2KfYKsQ5ruBz690WwOwcMvO0gDLx+edI/EDplyDYVv1Yu1Idz1XUoxV4DQvHYxUV:FoZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c6:07:90:e2:80:f1:49:c7:b0:cc:af:95:d5:01:76:c9:1a:47:a3:76:9b:91:9c:10:31:5a:7f:5b:7d:d4:17:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

PasswordExtension.Win.deps.json

SHA256 7b34d7ea90a9664a8f6370c3b0e98ac3114eb96f0ee9edab6c669d86c2c3cdc1
MD5 cb9268125c592ca792954257032bd7ec
SHA1 6b2f1f5b425639aabc73dd0c0b119a1a51fe5549
SHA512 0ed3ac6039d742768ad3eeede207d96abb393780a431330cca8c27561a8dc79777ed11174890513ba7ef71cefe79cb1e3e54e7dab11b9208cedfb754b2ef389b
SSDEEP 3072:dsA5agPSxot1Y9Im07R1ARkgT9ueGtHZqeag6K7gn9U:a9W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

PasswordExtension.Win.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 af713223d450684b86abcdaf30c1ce92700d57f732ee8328492fa6930e33da4e
MD5 ffb09cb862daba449b12f3c76d833aac
SHA1 c5dac38c83e106475520345d964dca00b35b513e
SHA512 73c96c8f7ea507332e06a40fcf92e0b12f69f4c1f75d08cceb26f77b10793e0844809c6934cf1832a8da1e905a3f14c4a90b50fd253a22fc547a10fd16fb5072
SSDEEP 1536:QkYuTKG4tSaSsqnOcizwuAyZEpjZgxM9Na6WATrKpRF1EjniN7gmFOXrhOLvgqSY:vYpxgfnqXZEpjZgxM9NZWATrKpRF1Eje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

76:01:98:dc:ee:de:4a:2e:de:74:94:b9:81:12:b2:f1:e6:af:20:e9:8c:89:7f:6d:3f:b1:1f:32:d9:42:5f:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

82206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

PasswordExtension.Win.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 6f2700976bdd9dd272958a3283faf11b17bd60f59307fffce77e91777fc37068
MD5 db3f6312f860508d9eacced7287fa31b
SHA1 293a25e5acb9d2f9acd9317afe7367fbe183b9ef
SHA512 2f837e89bf6d04776a9e4a1521568bb71c3e6c23bd231673e87c2839f79de7dc23f1efb9f4c922eb509bbb62bb438d833d116998b89e38b9498fae6e237cd891
SSDEEP 3072:hc/QPqpDnKYSO40L58FvumU9aDtxG12X85cHac+Y1oAILp6rS:QQPq1nKLOxCM4A2XvlA8S
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

17:f2:19:08:df:3c:f3:19:22:30:71:09:ae:93:a3:a5:d8:84:e7:76:6a:7c:66:e5:64:1d:25:01:33:fe:0f:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

PasswordExtension.Win.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

PenImc_cor3.dll

IMPHASH 897d4b325f4d1ecbf05e1d417468dc0f
SHA256 3002b51d51172b402fdb20cb6f87a6c9c0abe8a4a8feab3d2bc4b82f1216e5e9
MD5 7560e528fcc8df6c4d4bbd86e0749c0d
SHA1 df3fee25640fb715b7ec590aba394e0457a612de
SHA512 c1871aa76e7ab34ab0e0a7ad9540b306ee45bded1e0e5cb0c9f031da6f69f057d34e0b4a386a0d1e31aab8ba17bd2e0d564e327b828e33dc4eb828eaf00b0a81
SSDEEP 3072:9/TNcQAdQk1RaV6tS/vfAcdtMUqfY4AvdhFXk:UQA+QSPATLA0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1e:8b:ae:78:77:81:91:fb:d5:1b:b9:f6:e9:be:e5:60:4a:b0:05:5e:ea:ec:21:fd:2a:3b:5a:30:f9:ad:68:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

68928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PenImc\Win32\Release\PenImc_cor3.pdb

kernel32

GetThreadLocale SetThreadLocale DeleteCriticalSection DecodePointer EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex InitializeCriticalSection CreateEventW GetCurrentProcessId OpenEventW OpenMutexW OpenFileMappingW MapViewOfFile UnmapViewOfFile SetEvent LocalFree SignalObjectAndWait IsWow64Process GetCurrentProcess OutputDebugStringW CreateMutexW CreateThread QueueUserAPC SetWaitableTimer CancelWaitableTimer CreateActCtxW ActivateActCtx VerSetConditionMask LoadLibraryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedFlushSList TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError RaiseException lstrcmpiW GetModuleHandleW GetProcAddress FreeLibrary CreateWaitableTimerW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind GetCurrentThreadId

user32

MsgWaitForMultipleObjectsEx CharNextW GetWindowRect EqualRect CallNextHookEx IsWindow SetWindowsHookExW MonitorFromWindow GetParent GetDesktopWindow GetWindowThreadProcessId PeekMessageW GetMonitorInfoW UnhookWindowsHookEx GetSystemMetrics GetWindow

advapi32

ConvertSidToStringSidW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW

shell32

ShellExecuteExW

ole32

CoLockObjectExternal CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoGetApartmentType

oleaut32

SysStringLen RegisterTypeLi SysFreeString LoadTypeLi SysAllocString VarUI4FromStr UnRegisterTypeLi

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncpy_s wcscat_s wcscpy_s memset wcsncmp

api-ms-win-crt-heap-l1-1-0

_recalloc realloc calloc free _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table abort _invalid_parameter_noinfo _errno _initterm_e _initterm _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _seh_filter_dll _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

rpcrt4

CStdStubBuffer_AddRef IUnknown_Release_Proxy NdrDllUnregisterProxy NdrOleFree CStdStubBuffer_DebugServerQueryInterface IUnknown_AddRef_Proxy CStdStubBuffer_Invoke CStdStubBuffer_QueryInterface NdrOleAllocate CStdStubBuffer_DebugServerRelease NdrDllRegisterProxy NdrDllGetClassObject CStdStubBuffer_Disconnect IUnknown_QueryInterface_Proxy CStdStubBuffer_IsIIDSupported NdrDllCanUnloadNow CStdStubBuffer_Connect NdrCStdStubBuffer_Release CStdStubBuffer_CountRefs

Name

.text

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

PresentationCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9a711c29f615b2f292851650cb12cd64b6074913c29125ffc399ed760c853ad3
MD5 00bd4ac73d8c20b14e9887f45454e381
SHA1 a24ac293000375ca862376b5d397a0c3b2911067
SHA512 db32923fec19ec450b21e8b2380d06bcf9d562ee05559c53ba47c208d91d89ebe1fb0492329ba6ef072c47ce4c65fe8e7673dbd16307fc74e2c4a7e67d25ad9e
SSDEEP 49152:X1BB4con0YW9r81922/V6nOrB89rXintYP2H5msUIc4:FBB4cg0Yqc922/V2F
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3415742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ec952a95cb5f7102bd63c59dfdd0491b7948287f2c64d75a57cbb3ea5ffc89c
MD5 3d59b212dff3c0fa45214c6291a9a330
SHA1 87311de58423e64b75a91b6319e2a4ae666e011c
SHA512 bcbda26622427ecf3a6906821c8d74a97d180adcae6ca168bca73774a898e65f80b10824a1cdd1a578b533d1f3e4a9c2f64417f7e68d7727e70ab315e8b6e1ee
SSDEEP 96:18eLal55RmWyfkmgE5/a4Mr+A5onJY7h2mziS+Df0v3sGK1NQcXP+3zkuGD/D6W1:TKzFyDCK8onJAZv+bR7f+3dWEc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemData.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 92abd19ddce03e86f9c884325f615976d7578a5b4d9607d9871290a588c9e809
MD5 dff4cee2431337eeea633854d81fc38d
SHA1 eb138c089ea3da756c847cfaaac595586734a098
SHA512 adfb1077cad4308a4547e8cce9d489c3c4822595feeefe1cd54ea716d77ad5952101c51807fd4a2413a7938f6268c8aea12e129e05731d69006fba2a68cef8ec
SSDEEP 192:daA9pDysNjR05zgo5f80zup/WKZWbzPWks:9bPRRvo5kaVK0Wks
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemDrawing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a167a15ce94ebdf4c627fb651e05c694fadeb6bb00e5814db13b2e7dd33cbeb
MD5 9dd4e7e817c6c220f7abe2db522a9578
SHA1 0671ebba04cf1a4b003f821cb43dd159b3373b2e
SHA512 33a5fd207225c54710c027ce966f7abbf3a3c91622c68cdc4f8efa99a5e6f5ae6f3eaa98edeb894779ca3d383e08de804c5da6ebaaece17ad47e2cf515decd36
SSDEEP 96:TMF4vTAt+hsY5RypreziMit/ziozRoNH7+sGD/D6HY+Ub7W5b:IF479urqJK9RoNHSdW5b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e63047da788d63ba9967157fab4a441bc83bab628e00abf6dd044e5d1969688
MD5 f9ab7399b269797a093d268b1a71bac5
SHA1 6263304ea5c307c54ef35479aeb6d1564036b928
SHA512 3442a2a8b8af5960a2aa4a4db1771ccd4f5cf48da4eb7364b1c8ce9bd465ea20defdb1ba5aedd59dcdc7efd60db92f3ffc417ffd6d837b8e6db4c71ed3f8270f
SSDEEP 192:gpZRDlQ/LIw+zsT1tTTtfDo++DGjITBYWNH:gpDh+L3+Ut1fDo4jITBYWNH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework-SystemXmlLinq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d9bb8146142744b5514ac1ad82306961cf594b6f0b75adcbdb61241d2e02d76
MD5 a0a471e2ca1ab5cdb84165223aa1ac93
SHA1 9190b6b20445bb109aea2bd135d11103c8f71306
SHA512 5b4a5892ab3323138bd455b626d2ec540c73eae89c2aa4b3b639ba1e6d9946c50d557f5059483c71b6def344a9d31c4ade9026f049358c5ebfcd43b487f178bc
SSDEEP 96:n6w2ETNHQziY1qGuuTxWzGD/D6s2Y+Ub7Wp7:n6wfH0t1qGuuTxWwjWp7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 54411e1de691917d2ff59be6551af95fa3a20556e5f8058bcf49b0cc1bcf68f6
MD5 74026ffe0933b4afe3fe8810e950763d
SHA1 b8813272fd54b2f67e65715f4b7374568dca163a
SHA512 8887dd784d071b6b28f0e54ef0dba9488a741f2c109d46aa5d074121aa5c7d1f1ca2e79aefab8b53f7de9a7369352853c6f5ec6aadcb5b068c94da69017a7e78
SSDEEP 3072:ihFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZW8WUnkXFuW6xu5FyTMR:/aojguW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

241534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Aero2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 24e62ac897f6af99631940184a2d26e1f18d6949dc2a1b00fef5a5fe9d98b37c
MD5 59fff35603af5369086a2dcc69517236
SHA1 b03b644518e87b234bdc488daa7567d380e74c6c
SHA512 f7484b2aa9acbc2934723077e46a77f6930918ef8bd5f4c93e75f2322fc135089464d56504c29a769c393174e6e03d8323e1319d632626417e2949cd50af377f
SSDEEP 3072:QhFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZPGUnVHiFcAaQImTTl:haSUnVEPaQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

247598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.AeroLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 82c55e4e8d7c81cbacea3b7042a3bd6ceb7064b66bfa3d63477784b01e02a609
MD5 2a37a62d650f02344025a450e343bd1f
SHA1 c65d91b21db6823ae36273712e01d4bee1a019a6
SHA512 5460b87607ea14f5652b468e4b2d61fb8960f8d31d6b9cbf275cf9fe9b99e3d59396ba3c3c2baf1111d574fff92ed3328ffc1404933b505c8f5e34d473600d0d
SSDEEP 1536:QoauV8x9p/uvS++D1k9T7DwVNSPoV66yEKMtqWC6XOz9MFhpLBS+FN6LsbPCXbPp:QoauSr0K9K2SwFhZStsk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

173662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Classic.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e061162ee7263fdfc72db682b71e220e8108f1c523dbf634ef630a2393522535
MD5 7bf91a2c218036feb7f66c043d12bfb0
SHA1 ab29704c24f7b394ddc716f17d9bbcf97ba151a9
SHA512 61cc8a77cf28daf38f9b782f8fa1e914f310f9ad16adc7d6af8ac49708a12b97164304ecaa370cb5b3c4a73677584059ca77a636d3ded9c672cb91f6181ff53f
SSDEEP 1536:9txgsnh7pkcLCX4fSFl5UXEUlFCpHVpltqznYqafevHnfFtJxN5zJf81OSmOHOLF:7x3h9cXxFlquptRHU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

183422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Luna.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 737477e6150f9f5fb6b63456883df87b5cc0ec59ddc75de8c8cf69749ef41229
MD5 28c01af7048caa566bc544843e666b14
SHA1 362be72687fb1e98e5669a17230efdf5c6e393ab
SHA512 78a910c1e616e5d9a5e9d8aa9307ddd00879efe452adbc0b69c541ab0adcec9c9a8825e1cdaba4d7b0deef6f127f20cae589cdb771583ad84c5f13df2a788dd4
SSDEEP 3072:Uepl3sO85wLbfp3G/uqv2tXFq278biT2SmDu1vqylFYNrySbjJfrLqiuqvOfmFqZ:tnfQ/uqQB7Miahu1puryejxrruqfd77
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

492686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.Royale.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 105a980b2fcbd8fbc3262b87a5d97890f8612158f95f9cbffa23b238e0acc729
MD5 b576e7f9cebd41b158174153d91fe0db
SHA1 84d7c508b3ad1646bbf5b5fb6e2f249db5723188
SHA512 99a14743bafb174b85fc4062ae21fef86a689dc5ff0cc7435784abcf6d5245430b7634e8141695c4dee5600a3e086633c1ae363fe4296a81d05c76dfdd44a31e
SSDEEP 1536:MgSAnQHC9yhfbLH3zPvcut4Xs892JXcfMChHhvG0gd8LxmEEbk0qdBw3jFdENYGK:MgSAQHUILvK96Xcfb81vFdqhGkdg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

204750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 73e08d9f4afc20be63c3309c6aec1b840df189f9c22018a7b44665184004d1da
MD5 03c9a4de00b3f8835146b5a364ecd065
SHA1 d390564ace7f72818f69c9b0d9eb58c1ab8fd182
SHA512 2e5217b52a61b966acc233091f44cecf97b8703a5ec77fcab10f9467505d5da209199b47959f1383ad4f6d8c6aefbcf2ce8e7fa33fda04f2cb9f428a58e0c611
SSDEEP 49152:OBf1XN6xcqFQaU4LxamTnQ5iw3AJzGpEUzbH/loQcI1fDyqzO:OBfFN6xRFQaJWpb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5802638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PresentationNative_cor3.dll

IMPHASH 1ba17ed539f0828d6eb789fa20855dd9
SHA256 5a71ba70796a1d679ba83f28cfe0cdd44eaa1778e2084cc6bf2785682e6d9447
MD5 80df7c9c106dcbb1d7ee2cacfca143cd
SHA1 997c002394d0c7e818bd3068a26afa2dbf6beb58
SHA512 81911a29b4e21302414ea632a2ce6ba58fd6b889ca202f5a73f582a5e8dbe9f473a593ad19230b97fc2c37e5654d7026b7915183c357f302dd75a388a7b205f3
SSDEEP 24576:1FDj94E+ReeC/xOFX/yQv6QjLDWnL+pzfqPa25ljGVgH+ZPZQlEA:1Fj94E+ReewyPyQCQTwAzqPaylA1OlD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

48:14:cc:e4:73:d9:ea:d8:18:98:f1:c7:60:a4:63:28:fe:df:ca:7a:1e:32:7d:0a:6e:40:c5:ca:b8:35:fd:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

5568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\PresentationNative\Win32\Release\PresentationNative_cor3.pdb

kernel32

TerminateProcess IsProcessorFeaturePresent LoadLibraryW GetProcAddress VerSetConditionMask SetUnhandledExceptionFilter GetProcessHeap HeapAlloc HeapFree HeapReAlloc UnhandledExceptionFilter GetCurrentProcess DeleteCriticalSection DisableThreadLibraryCalls FreeLibrary InitializeCriticalSection OutputDebugStringW GetCurrentThread TerminateThread InitializeCriticalSectionEx GlobalDeleteAtom OutputDebugStringA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter LeaveCriticalSection EnterCriticalSection RaiseException InterlockedFlushSList LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError GetLastError

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit abort terminate

api-ms-win-crt-heap-l1-1-0

malloc free calloc

api-ms-win-crt-string-l1-1-0

iswpunct wcsncmp strcpy_s memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

ntdll

NtQuerySystemInformation DbgPrintEx DbgPrompt DbgBreakPoint RtlUnwind

user32

GetMenuBarInfo SetWindowLongW SetScrollPos SetFocus MapWindowPoints GetWindowTextLengthW GetWindowTextW GetWindowLongW GetWindow GetParent GetKeyboardLayoutList GetAncestor FindWindowExW EnableWindow

gdi32

GetTextExtentPoint32W

ole32

CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString VariantInit VariantChangeType VariantClear

CreateDocContext CreateInstalledObjectsInfo CreateTextAnalysisSink CreateTextAnalysisSource DestroyDocContext DestroyInstalledObjectsInfo EnableWindowWrapper FindWindowExWrapper FsAddFigureObstacle FsClearUpdateInfoInPage FsClearUpdateInfoInSubpage FsClearUpdateInfoInSubtrack FsClearUpdateInfoInTableSrv FsCommitFilledRectangle FsCompareSubpages FsCompareSubtrack FsCompareTableSrv FsCreateDocContext FsCreateDummyFootnoteRejector FsCreatePageBottomless FsCreatePageFinite FsCreateSubpageBottomless FsCreateSubpageFinite FsDestroyDocContext FsDestroyFootnoteRejector FsDestroyPage FsDestroyPageBreakRecord FsDestroySubpage FsDestroySubpageBreakRecord FsDestroySubtrack FsDestroySubtrackBreakRecord FsDestroyTableSrv FsDestroyTableSrvBreakRecord FsDuplicateGeometry FsDuplicatePageBreakRecord FsDuplicateSubpageBreakRecord FsDuplicateSubtrackBreakRecord FsDuplicateTableSrvBreakRecord FsFAllFootnotesAllowed FsFFootnoteAllowed FsFormatSubtrackBottomless FsFormatSubtrackFinite FsFormatTableSrvBottomless FsFormatTableSrvFinite FsGetClientHandle FsGetColumnRectangle FsGetEmptySpaces FsGetFigureObstacleData FsGetFloaterFsimethods FsGetIntervals FsGetMaxNumberEmptySpaces FsGetMaxNumberIntervals FsGetNextTick FsGetNumberSubpageFootnotes FsGetNumberSubtrackFootnotes FsGetPageRectangle FsGetShiftOffset FsGetSubpageColumnBalancingInfo FsGetSubpageFootnoteInfo FsGetSubtrackColumnBalancingInfo FsGetSubtrackFootnoteInfo FsGetTableObjFsimethods FsGetTableSrvColumnBalancingInfo FsGetTableSrvFootnoteInfo FsGetTableSrvNumberFootnotes FsJustifySubpage FsQueryAttachedObjectList FsQueryCompositeColumnDetails FsQueryCompositeColumnFootnoteList FsQueryDcpLineVariantsFromCachedTextPara FsQueryEndnoteColumnDetails FsQueryFigureObjectDetails FsQueryFloaterDetails FsQueryFootnoteColumnDetails FsQueryFootnoteColumnTrackList FsQueryHeightDefinedColumnSpanAreaList FsQueryLineCompositeElementList FsQueryLineListComposite FsQueryLineListSingle FsQueryPageDetails FsQueryPageFootnoteColumnList FsQueryPageSectionList FsQuerySectionBasicColumnList FsQuerySectionCompositeColumnList FsQuerySectionDetails FsQuerySectionEndnoteColumnList FsQuerySegmentDefinedColumnSpanAreaList FsQuerySubpageBasicColumnList FsQuerySubpageDetails FsQuerySubpageHeightDefinedColumnSpanAreaList FsQuerySubpageSegmentDefinedColumnSpanAreaList FsQuerySubtrackDetails FsQuerySubtrackParaList FsQueryTableObjCellList FsQueryTableObjDetails FsQueryTableObjFigureCountWord FsQueryTableObjFigureListWord FsQueryTableObjRowDetails FsQueryTableObjRowList FsQueryTableObjTableProperDetails FsQueryTableSrvCellList FsQueryTableSrvRowDetails FsQueryTableSrvRowList FsQueryTableSrvTableDetails FsQueryTextDetails FsQueryTrackDetails FsQueryTrackParaList FsRegisterFloatObstacle FsReleaseGeometry FsResolveOverlap FsRestoreGeometry FsShiftSubtrackVertical FsSynchronizeBottomlessSubtrack FsTransferDisplayInfoSubpage FsTransferDisplayInfoSubtrack FsTransferDisplayInfoTableSrv FsTransformBbox FsTransformPoint FsTransformRectangle FsTransformVector FsUpdateBottomlessPage FsUpdateBottomlessSubpage FsUpdateBottomlessSubtrack FsUpdateBottomlessTableSrv FsUpdateFinitePage GetAncestorWrapper GetFloaterHandlerInfo GetKeyboardLayoutListWrapper GetMenuBarInfoWrapper GetNumberSubstitutionList GetParentWrapper GetScriptAnalysisList GetTableObjHandlerInfo GetTextExtentPoint32Wrapper GetWindowLongPtrWrapper GetWindowLongWrapper GetWindowTextLengthWrapper GetWindowTextWrapper GetWindowWrapper GlobalDeleteAtomWrapper IsPrintPackageTargetSupported IsStartXpsPrintJobSupported IsWindows10OrGreater IsWindows10RS1OrGreater IsWindows10RS2OrGreater IsWindows10RS3OrGreater IsWindows10RS5OrGreater IsWindows10TH1OrGreater IsWindows10TH2OrGreater IsWindows7OrGreater IsWindows7SP1OrGreater IsWindows8OrGreater IsWindows8Point1OrGreater IsWindowsServer IsWindowsVistaOrGreater IsWindowsVistaSP1OrGreater IsWindowsVistaSP2OrGreater IsWindowsXPOrGreater IsWindowsXPSP1OrGreater IsWindowsXPSP2OrGreater IsWindowsXPSP3OrGreater LateBoundStartXpsPrintJob LoAcquireBreakRecord LoAcquirePenaltyModule LoCloneBreakRecord LoCreateBreaks LoCreateContext LoCreateLine LoCreateParaBreakingSession LoDestroyContext LoDisplayLine LoDisposeBreakRecord LoDisposeLine LoDisposeParaBreakingSession LoDisposePenaltyModule LoEnumLine LoGetEscString LoGetPenaltyModuleInternalHandle LoQueryLineCpPpoint LoQueryLinePointPcp LoRelievePenaltyResource LoSetBreaking LoSetDoc LoSetTabs LocbkGetObjectHandlerInfo MILGetClassificationTables MapWindowPointsWrapper NlCreateHyphenator NlDestroyHyphenator NlGetClassObject NlHyphenate NlLoad NlUnload PrintToPackageTarget SetFocusWrapper SetScrollPosWrapper SetWindowLongPtrWrapper SetWindowLongWrapper

PresentationUI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b77e0b332b763360827c9d76371015cb50b46ce1a611e5ececfa0601c6ff94e9
MD5 4af1178bebfd8b52ff646b10130d7057
SHA1 91685be41b4e616c6b0cb480b52b9eaa951b65f5
SHA512 b62bb3aac73ae66c8d8e632d4d02384ae2281d68ec259f54cb71dee784bab4f11fa4d548bc6ba44e3e2d964be427c36d6d58585e8fb97b2fc68b356ba2090dd8
SSDEEP 6144:qJEFeOBKsz8cSUvVBjtTWPGgoDTcS/TXIjVQfoVGd3HyG2KusN2qoKl4vVIL9Ioa:1FTJwwGlyTcssQfoVGd3HyGNuwU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

834046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

PropertyChanged.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52ec64563ea08f61ef3f568699fd8a66eb5e532d5f7fc342ad46a69ccdf81ae3
MD5 4826da1d501c41bf5869823d4540cbab
SHA1 311cabfeb0aeeeda3495af1f529e5427b0241a14
SHA512 ba7475503aabb5b602ab1d748cf5ff4e55fb3a6d0ea3b67dc3c1d6142c9f87f88e814b9cd819f66cdcf2c387b3e79cddd1314a6c32906e9e71c0ce0d93ca202f
SSDEEP 96:SI/1qHR6SLIrUVGYK5wVWRyLdYag/GDC5F9:Si1qHRnkgVGneVWRyJaB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertychanged\PropertyChanged\obj\Release\netstandard2.0\PropertyChanged.pdb

ProtectedAPC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7f836ca5ba7b282712c7e5972855cca616d53956b144be1576f83ea44be9743
MD5 ec918ed1f2f603ba94a2507227d39f26
SHA1 ecad966014ff84d553203ae02a84b8e23e225550
SHA512 f2fe12e9f7c81aa25122b0c28e90366a8d23170e476f644d111b602417ba5d531a6c6de5a7e0c9b37fc68f86154f9ae82bcd3a69aa1454e25f24a86526815524
SSDEEP 384:SLm5VUtFAhV707OF7GH1CPBMmvjztR5mDzqQzfDeIw2kPtWa:koVUtFGFCH1OBlvjztREeYdwlPtWa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

27758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ProtocolFilters.dll

IMPHASH 0c3f6577c4dea6e1634d3e32a034907a
SHA256 fe28fafffddd2e0bc0d1ca72a1acb0e85f54a2cf2f016fdd75eaf05bffe20161
MD5 b9ee93c1223b2e7a3143891596cff908
SHA1 8da507e0d88af5b9395eb6eb65344b3b34bd8e52
SHA512 c973a415619963b69d9bf6eeb58c8f6be0cf76f1db8ca72b7d2fd4f0717d8f14b575ff250df34d65fd72ec2dc96b87bd4e1ee9c91dbb5d073def3fd527d0ad38
SSDEEP 12288:1BELhX3eiRFvy4z6uZxE+j7tWZmTgmkMVeJDi9LPDMwn4jzpp7U7RwM5xXrMkmHo:/oKcxEWtWZmLVegBnKX/Mg4OOFf2TaqU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

d4:84:e8:ea:6c:f6:ce:bc:d6:49:30:8c:47:03:bd:e3:34:c1:9f:ba:ed:82:7f:9d:b7:2e:89:0d:32:5d:ce:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

358094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_c_api\win32\protocolfilters.pdb

kernel32

ProcessIdToSessionId FreeLibrary GetVersion LoadLibraryA CreateEventA CreateMutexA SetEvent GetLastError DeleteFileW GetFileAttributesW CreateDirectoryW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection OpenProcess QueryPerformanceFrequency QueryPerformanceCounter GetTempFileNameW CreateProcessW WaitForSingleObject LeaveCriticalSection EnterCriticalSection CloseHandle GetShortPathNameW FindNextFileW FindFirstFileW FindClose GetProcAddress ExpandEnvironmentStringsW SetConsoleCtrlHandler LoadLibraryW OutputDebugStringW CreateFileW WriteConsoleW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA FlushFileBuffers HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess SetStdHandle GetCurrentProcessId GetModuleFileNameW GetConsoleCP WideCharToMultiByte WriteFile GetFileType GetStdHandle SetFilePointerEx SetFilePointer ReadConsoleW GetConsoleMode GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThread CreateSemaphoreW GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter FatalAppExitA InitializeCriticalSectionAndSpinCount GetCommandLineA GetSystemTimeAsFileTime LoadLibraryExW ExitThread GetCurrentThreadId CreateThread HeapReAlloc GetProcessHeap HeapFree HeapAlloc SetEndOfFile GetTempPathA DecodePointer EncodePointer ReadFile MultiByteToWideChar IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind RaiseException InterlockedExchange Sleep GetFileAttributesExW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation LookupAccountSidA LookupAccountSidW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegEnumKeyExW

crypt32

CertCloseStore CertFreeCertificateContext CertAddEncodedCertificateToStore CertEnumCertificatesInStore CertSetCertificateContextProperty CertOpenSystemStoreA CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertFindCertificateInStore CertAddCertificateContextToStore CertOpenStore PFXExportCertStoreEx

libssl-1_1

SSL_set_accept_state SSL_set_connect_state TLS_client_method TLS_server_method SSL_free SSL_new SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_default_passwd_cb SSL_CTX_use_certificate SSL_CTX_use_PrivateKey SSL_set_bio SSL_CTX_free SSL_CTX_new SSL_CTX_set_options SSL_get_session SSL_version SSL_get_shutdown SSL_shutdown SSL_renegotiate_pending SSL_renegotiate SSL_do_handshake SSL_get_ciphers SSL_get_error SSL_CTX_callback_ctrl SSL_CTX_ctrl SSL_ctrl SSL_write SSL_read SSL_connect SSL_accept SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_set_session SSL_set_verify SSL_set_cipher_list SSL_CIPHER_get_name SSL_CTX_set_cipher_list SSL_is_init_finished SSL_get_servername SSL_get0_alpn_selected SSL_CTX_set_alpn_select_cb SSL_set_alpn_protos SSL_select_next_proto SSL_CTX_set_client_cert_cb OPENSSL_init_ssl SSL_get1_session SSL_SESSION_free

libcrypto-1_1

X509_STORE_CTX_free X509_STORE_CTX_init X509_STORE_add_cert X509_STORE_load_locations X509_STORE_CTX_get_error X509_verify_cert_error_string X509_sign X509_digest X509_cmp_time X509_gmtime_adj X509_EXTENSION_free EVP_PKEY_new i2d_X509 X509_get_signature_nid X509_NAME_oneline X509_set_version X509_set_serialNumber X509_get_serialNumber X509_set_issuer_name X509_get_issuer_name X509_set_subject_name X509_get_subject_name X509_getm_notBefore X509_set1_notBefore X509_getm_notAfter X509_set1_notAfter X509_set_pubkey X509_NAME_get_index_by_NID X509_NAME_get_entry X509_NAME_delete_entry X509_NAME_add_entry_by_txt X509_NAME_ENTRY_get_data X509_get_ext_by_NID X509_get_ext X509_delete_ext X509_add_ext X509_get_ext_d2i X509_verify_cert X509_find_by_subject X509_STORE_CTX_new X509V3_set_ctx AES_set_encrypt_key AES_set_decrypt_key AES_cbc_encrypt OCSP_cert_to_id OCSP_response_status OCSP_response_get1_basic OCSP_resp_get0_certs OCSP_resp_find_status OCSP_check_validity OCSP_basic_add1_cert OCSP_BASICRESP_free OCSP_basic_verify OPENSSL_sk_pop_free BIO_write OBJ_obj2nid EVP_PKEY_id EVP_PKEY_bits PKCS7_free X509_NAME_get_text_by_NID PKCS8_PRIV_KEY_INFO_free EVP_PKCS82PKEY ERR_get_error PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_p8inf PKCS12_decrypt_skey PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_unpack_authsafes PKCS12_free PKCS12_SAFEBAG_free d2i_PKCS12_bio BIO_f_buffer PEM_read_bio_X509 PEM_read_bio_PrivateKey X509_STORE_free X509_STORE_new RSA_generate_key i2d_PrivateKey d2i_AutoPrivateKey X509V3_EXT_conf_nid EVP_PKEY_free EVP_PKEY_assign EVP_get_digestbyname EVP_sha256 EVP_sha1 OBJ_nid2sn ASN1_STRING_to_UTF8 BN_to_ASN1_INTEGER i2a_ASN1_INTEGER BN_free BN_new BN_pseudo_rand OPENSSL_init_crypto CRYPTO_free CRYPTO_malloc OPENSSL_sk_push OPENSSL_sk_free OPENSSL_sk_new_null OPENSSL_sk_value OPENSSL_sk_num PEM_write_bio_X509 d2i_X509 X509_free BIO_s_mem BIO_ctrl BIO_read BIO_free BIO_new X509_new

ws2_32

WSAStartup ntohs ntohl htons WSAAddressToStringA WSACleanup

Name

.text

Size

526KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ReachFramework.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d6192a62168a5ee42b45eefb3abaae9cbaf0fd46e2b4ab64a612b6efe8a4c8e
MD5 948cb84290473e06b8f69bed5a38ffaa
SHA1 61acb3f2aafd33d9c40ff848ed02e91995d02986
SHA512 69ef93290fe2b1f180a78fcf99c9fe9871d4f29361493649e1ead42fb032af6c0b9ec0ecbfb46af64a2aefdfa5202b67a16a86e16e9b4d0a6c61ec2f307e94e4
SSDEEP 12288:83Ovqr3RAN/d3z9A+lt34Dv672/Z5YQMmV1K1UzlZuwR4rcf7E4F6:83Ovqj+N/dFltIF5YQMS1K1UzlZu84rE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

627438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aebb.dll

IMPHASH 3a20d38e32d00b58d66203e5798b7b1e
SHA256 cd6fcce8f0a2e4f832894abe41f2c4e7c0ab97b4a46eb478d085ffbb9ca36b5b
MD5 2af40e6f90240525f8cd27961b53f2db
SHA1 5eab9dc2edef6140df6842811da9e8ae9a27cbd9
SHA512 ba80cf1f33e14d5dd3a3f96196e265d33920ac4fcc23dd3da61e192233401aad522fceea4a295628f03345ec3e43ae16542b0adcf8adcf0ee93a3f2114c2bccf
SSDEEP 1536:BwgYl1cyd7JwVYgPj73dFZEqusWhmcdhRktha4rbtqa:B4t7AYgPjfeZHhRkthaFa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1a:a3:e4:37:d0:7c:d7:3f:00:5b:a5:35:23:d8:a2:a3:76:f3:cd:10:fe:e1:34:d0:ba:c3:f2:94:25:63:da:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 25, 2022

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

1c:a2:8b:87:5c:8f:0d:56:fc:03:4b:f1:35:b7:07:99:74:d8:11:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Mar 25, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

6f:40:17:75:8e:d0:8a:39:e0:a3:bb:62

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

6332

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aecore.dll

IMPHASH 217ebb8a365fd7faa7f8b379d9f92737
SHA256 1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
MD5 2a4261a7dde3fdfd43793ca431890f84
SHA1 8be893f9fd941dc0971498587f52228e2e9d69b0
SHA512 e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
SSDEEP 6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

82:6c:0f:56:e7:0c:d5:a9:f4:7f:c9:0b:0c:1f:03:9f:e5:b9:ea:91:27:13:2b:02:c8:5e:56:a7:77:a0:52:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 12, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

5f:82:7d:5a:23:2a:e4:fe:53:6d:c0:84:2e:33:df:11:34:d1:b6:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Dec 12, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

165679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError DeviceIoControl FreeLibrary GetProcAddress LoadLibraryW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW DecodePointer InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetFilePointerEx GetStringTypeW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW

SAVAPI/aecrypto.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
MD5 e824d826c0ebb30047aaa308fe03b6c9
SHA1 1778f29052920ddc7ef192761123013cb7f648d2
SHA512 774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
SSDEEP 3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4a:05:64:d4:25:70:65:06:c0:93:3f:16:bc:76:a0:b0:e6:16:62:11:68:71:03:6e:00:73:8a:f4:62:fb:00:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

3f:2c:05:37:63:c1:c2:73:53:9c:97:f4:07:18:b5:82:c1:1b:3d:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Aug 3, 2021

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

59087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aedroid.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 12bfedbe10041d39020e9a15c4cc3d4b557a7d4fffe40cf2d75caecf5f1ed1ab
MD5 8facd0e1b34b24d3b7adb3b9be3375dd
SHA1 f7ac09b72c91a8c54e266b7f6b68b2e40366d026
SHA512 55fba8645835c69fe6e93da395de726bbcc0b3dd0049b5e4673f811cb92bc911a8bf1f6706a0922548635aa81d8aef95c3779cf827e52e70f851fa0be6a0c502
SSDEEP 49152:2bnUI0myoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/:OnUI0myoyI4rlfff/MtGcMnrjD4LTQXv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

79:a9:b8:7b:e7:bd:78:32:f9:54:23:b3:fc:10:b3:6f:08:ec:26:c5:41:4c:21:05:07:2f:54:ed:24:21:19:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Dec 8, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

95:0a:d9:22:ef:4f:14:55:38:a1:c7:0d:74:7c:28:e2:83:5b:32:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Dec 8, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

119326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aedroid_gwf.dat

SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
MD5 961a1c1e0dfb8b54019c9ccec510b3ad
SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeemu.dll

IMPHASH 9b5c2716bd999e49e0bc0945944d4532
SHA256 9c9e782ac4490372119a95cac641970d805679a8aeef2ad59ee28c1a942cf5ac
MD5 02940a21ab69d26893bc00c064be569e
SHA1 e6eb2ba77bfa72fda91ba46924a18b8ad726f7b5
SHA512 fac2069467c574b856fdb4597fb973b9a4f3fef5288b0ed0bda72136f48ffce58063ea5b251ae01216f744ec17d2c824f07593f8de885bdad123f5867510b21b
SSDEEP 6144:HC9iYUBfVOM2SO79GGphjkL1HEli3ETCmkGeqcupFRiZnlQpeIj8+u4:JfVYVFphjkpHEli3ETCaZpFdeIQy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1f:89:d6:7b:c4:23:37:c8:62:87:ea:5d:c5:fb:ae:4a:04:ec:b4:d5:53:6f:43:46:b8:8f:2b:93:52:e5:d2:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 3, 2021

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

dd:97:19:71:7d:89:7c:5f:cb:ce:18:aa:46:10:cb:3c:7f:79:2d:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

54:09:d5:71:49:1d:e7:22:df:46:2f:a4

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 26, 2019 - Apr 26, 2022

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

0

Major OS version

6

Entry point

277265

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeexp.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 911d01f963ab2236e7bc977f96e84f292bef07f48f40f8927115e2b056992aa8
MD5 faee506a935d68524834d090cb0fc16e
SHA1 f3927c0170f15c1ad895f57aab48167781c51eff
SHA512 5b15442e84e828425832659124398cb867a3cd70f48e85c2ae6eb2261d9f83101e148264349f05b86fc8b034af6ab5dce0579c106e0bed95a8aa656839903a53
SSDEEP 6144:TIJxzjiTLxYnFZ9YJSXAVkpzFJv+rN0QmwAdWy9kvTZceYD+Pzb8ljBUJ:sxzjiyj9s+D+rNmjYy9BeYbPUJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9f:d6:f5:8b:30:61:44:91:be:3f:7f:86:6c:c5:56:91:fb:0d:ca:e4:a6:77:ae:12:67:03:76:dc:fd:ae:ba:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

114287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeexp_gwf.dat

SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
MD5 d68dbed2d9e81bb670e94b0b550cccdf
SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aegen.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
MD5 163ea96ca0a9b9f7469dd128fe5bce04
SHA1 60f4a01001fe4ad3b2aea24ce0b535a7d863f333
SHA512 b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
SSDEEP 12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

09:f4:52:55:bf:f9:02:43:c0:79:f1:a7:ce:55:db:fe:e8:ef:21:6e:7b:14:db:f9:bb:53:6a:07:84:b3:8b:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Aug 8, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

dc:b1:ae:62:aa:10:8a:bf:e6:9f:8a:5d:22:b4:1c:86:9f:02:f5:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Aug 8, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

569437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aehelp.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 2c0b8af1ed85fa5ff16f87f3c58beee9fc0230594dd062913ec5ce87abacba4a
MD5 c56e6711d0c6dbb6bd7bafbde06e9c90
SHA1 872c3d8d2a54ac10c22861052498c2ef954f8004
SHA512 611892b7b5a4a51fca74ee0d4d2dfa6a02ec22eda0fb9c24ff51a7f33a695a2aef3bb222763cd7ac5d0d6d5529634493fd2abd0a2c38fbbef34358700d65cb8b
SSDEEP 6144:qJcM9/q39zJguo+i6d5Pjsyb4BIdhqDiD+o9RScE72UG9zxAe:Ux09tghUZsyvPS4UG9zxJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

9d:91:74:e6:bd:51:20:c7:8f:bf:9a:39:8e:49:41:89:d3:b3:7c:4d:84:85:91:dd:dc:5f:bc:d7:84:76:18:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 8, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

163201

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeheur.dll

IMPHASH 5b0f0adb0bc652db7edc954409410539
SHA256 23bfdb21548d8b0da6b1d63167c44207a3fe7f613bf36406168c667bb7d0a4f5
MD5 d3f86394440e679a8be729c2af168169
SHA1 3c50ae00ca1c65b71f6f01c18a1507c03207df5a
SHA512 40abd780623276742f4ff5e89135e1223e3f7226cfb8af66f87646bcbb46c46e23eebe1a4bf3e4e0603622fb803d91d4c7f25c31283cddacc9037335a436c936
SSDEEP 98304:9/P/JUX4fQyJVTL4sxamHxu0dcSgrz/2FJEncELaq855k0rmMxzuIi5dYPnu62QX:nmN1C1Nn7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

2f:61:ed:bb:69:80:c0:8b:13:ba:c8:c6:0c:aa:a5:8c:2a:ab:50:56:69:4f:1d:27:5e:27:22:f7:be:7f:57:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 15, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

9983951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeheur_agen.dat

SHA256 ee8a06d4af03049c6699a37a24233f37eb08dd2720f57848e665ed6d1cc7eb78
MD5 159a422ec89a6699396140a500ddbfb8
SHA1 8bcc5d5ae855bb7e36412a6b2d9a8bbfa37f56a3
SHA512 db67a5792624b632c8cb3ab4bef963817faaa62dfa29f2da71b034a90e766c5d569b4c6ca2c04d85368674373fc72e60d4fc53711438923690a1ca0dfb4bb404
SSDEEP 49152:fAtG44TpuEkXGrhmWq6GOaJIf9x89H8KGAPg9ZFvh0JMfLU9g4:u4TbJYN6OOoH8KBPg9ZFviJr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeheur_gwf.dat

SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
MD5 27dbb4a716dc8d87eac34a14f814dbc8
SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aeheur_mv.dat

SHA256 9ddc8bd72905ab30861d3ae37af5292b6162f63e6446c15a1ccee3f8aeb67910
MD5 9c93a76d871b55028d607207a90b39ff
SHA1 c3b33d3622dbc1d02d0ae0beaf2cef9db56962aa
SHA512 7f9529bc2ae489a1a2bf92f54055543c933dd39359bc7a77ec19c9bf30272947e10d785c4f3baa3deee2654d5c23cd1154856b8e54031bc8c4ee985f4ee88a4a
SSDEEP 24576:pDOi3wLUZGF509e2P/LjK7uXikERi7Rpo83imfmYc9yeLnx6LKd8AxBem0w1vo2m:0KFGuua+zN6WPmEH2LVlFFp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aelibinf.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 812442ad5cdaeb6dd5dff76ddc3941fb9a1a56f999aa836f8fcbf4bb9e1b488f
MD5 21432626c63068ee47107da801c05ffc
SHA1 1b011f00a0a01bf217c41a0f5cb7d8c0f6b7046b
SHA512 1c6e973be37fbcfd2b945fbbde57afd37525aafd475b4229db8296ce48cbcffb2a092fb1d226b6f655a491535f7f2bff5139522daff92bf002304545fbeb596c
SSDEEP 3072:nA5Fh7lNUcO4WsdDKs63FgJln2qVsdP0xKMSET:PAWsddFV5Vsu8pET
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

3a:3a:9b:c1:fc:e2:27:88:78:44:09:ef:82:da:55:b6:e7:3f:d7:58:c4:a7:7f:a3:2c:44:11:34:3c:89:fe:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Oct 26, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

34:24:aa:7b:be:bf:5f:de:ab:e3:15:6a:a8:48:82:e4:2c:b5:e6:6e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Oct 26, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

0

Major OS version

6

Entry point

14441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aelibinf_db.dat

SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
MD5 ddc132992273330ec506e63fae4985b4
SHA1 7bf3018217f136662c159994f6530edf4c976a10
SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aelidb.dat

SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeml.dll

IMPHASH 987fabbe7aaa43f6606c10cbab26a0d8
SHA256 537b3ea2ce48dc0cc343c1c6ce79ae5ba527b2fcddea24cadef1fc1eca8c42cc
MD5 0de0cb670e3046e388829fdab6910a9c
SHA1 2b9daea0200fd1c442c9a3a967bf51d68f7ab80d
SHA512 7e7ab02d20c3a1b8f76ce8c951570be1e719e0533ffc14970c958240a6adbe1c8ab88c826ef21083db0c74c6f83a1c9262ec6b2371b72d357bf6d5a298ba6f33
SSDEEP 3072:qsjdmLYGV1RkWeY9aN4R8kGW+JVhyTWrZy6xLqOVqrsyyP0Y:qsxmfRk4UkdGW+CqRVqrLY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

96:61:e3:07:74:4c:5e:0e:ce:9d:11:39:70:14:73:d2:43:40:92:2f:b4:f5:7a:76:c4:b2:6e:f3:0e:de:89:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jun 29, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

d4:3c:a2:de:5c:d6:c0:94:0e:6a:a8:b1:9e:ec:e7:5f:84:dc:a6:98

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jun 29, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

42858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aemobile.dll

IMPHASH f26319b70fd0009dfeb674e39bde957c
SHA256 3137d3d95d1caa59d349645ab8087d6b0c7cc3321873789c738553d4471143c6
MD5 b132b36c0b53839ee1c0fc8198170157
SHA1 3e7394ee8d3c4c0f36e00466fe0191ede592c01b
SHA512 1bba22a77ceaa59c00cf0d10a7afced2161985d8baae94c9cfe0cd5171464f49c53113b4ba8a027cb727aa242a23f79c1cf19a4df821ef6ac00f7a7c2ecd155e
SSDEEP 6144:pHfeO55RAQ9JUDSzFPCMhgFaaIembdw2p52s5dEy/ZAuvGnAQyFuDlXDG:dh3RAQ9FFPRImxw2fZiy/ZAu4DU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1a:e9:b0:72:4e:08:7f:6b:f9:b2:6f:68:f4:c9:01:13:b2:38:44:ab:ec:92:fb:88:12:f0:35:88:19:b0:b5:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jul 4, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

6c:ab:5d:1d:03:59:4a:57:18:a1:f6:10:d4:0f:51:c4:59:7e:87:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jul 4, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

226159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeoffice.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 4a3c2f29b2ab5e78e5a1558d2ddbc564cbd4474ce4115001ba6662c143b6482a
MD5 3dbd9c8da952507d0df2b46308fe83a2
SHA1 0d38ee68466f818e880680b73f5f74ca300ae629
SHA512 1e6b65fa80d95d1cb1da72b7905105f4b4fa6ee7c1fd63fdd7728a030ff42b9177e2eb0fbca1e64f44a11a253defd7bd179bc8c596fc565f3972ad89cf5c9616
SSDEEP 12288:jk1fpTUcoWP1AOSRCEL6/CJ1KVm0yjw0REYVXkVzLKt98r0:i1UcoWPBEGyKVLow1YVUVCu0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:93:6e:3b:ea:de:0a:6e:1b:17:b1:5c:b1:e3:58:26:6b:fe:40:78:6e:e0:42:64:3f:e0:18:28:4c:1f:5d:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

622653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeoffice_gwf.dat

SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
MD5 0c95def0894c5e5716cf7a3ecc7545a6
SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aeoffice_mv.dat

SHA256 adac5f741e5ee6f669b76bca87a26bdafa9be60d8ac7e7c5059af9ccce919608
MD5 e346fe238be4b645e20e1bd77e9167bf
SHA1 252c2614387aef2304f85cebabcb89b7e5f04c96
SHA512 29965365aa6a5dae7bdcda0f437202d5a2874d60d3d59895871d05b4ca3bbea539fd04ae1895a0f6c77992ae2b7a39dd74837a1a6a72f15e92129517ff6375c9
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aepack.dll

IMPHASH 15e933b00ded9cae6f463a1796323b1f
SHA256 fff47393adf070bc04d044c0a939c620234881e1ad69d3776146e32d25e1f36d
MD5 26ab6a0a9b1c59a01f9b45bbc0bbc65d
SHA1 ef282c4322c361aaac6d70d0e27d4b2292de4999
SHA512 f17aca43e9f66ae21d295af5fbca5de0770ef77eb602f74ac6696aa9cf9af9884df21f9c9a98a6aa5d9ba5bbb3f9951c952d608dc3863e6a8a6a6c053639f26a
SSDEEP 24576:1oHuMoULNqpg3NV0ug3YdXIsPt5AUzp/X:mvom5NkI+UNP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1a:58:64:45:e9:dd:68:f0:00:7b:e4:0d:32:d1:b5:fa:9c:78:ba:ef:b3:16:88:59:b3:7b:4f:88:9b:1a:f6:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 17, 2023 - Mar 20, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

686048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aerdl.dll

IMPHASH 24bc7db91306bdc7881dc1f977fdebe3
SHA256 d049ab67daae27ab3840730cadc5a82dfbd269b58896b9f8289324816e1680eb
MD5 62f7467baebb56a8beea7fffa6c4ee7c
SHA1 c13eb821d2675f110b1a38f8c0842b91edcab9b4
SHA512 d31498bdee77fd498226d6c971dff65eeecec66811109f1a729858fee6aa92f6d1601256740417ba5abb72b4c7109eb3e69ecc7446093bebee62c559d4e7a61a
SSDEEP 24576:8lGo7gc5YfW4W2ERk7IERLQw33gAcRRbfQ:xo5d4WPR7GLhofbfQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7d:13:92:df:78:40:eb:f2:43:3f:a2:f2:b8:a3:77:7c:ab:d0:18:07:59:0b:3c:c9:40:aa:96:ed:bd:44:d8:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2023 - Mar 18, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 15, 2023 - Mar 18, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

848574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aesbx.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 a03aa3e017606dce6f2cd19536db9306a6ebf2eaefb224be735569599a39330d
MD5 63159174de5eff0c3ed33f887c00e1b4
SHA1 aa787a058920e7010269d1286f32bda62206949a
SHA512 398831b8cfebe1a7878658087594dcdd74f6be8d380bcacd415acd5bbed85e6bd939c1562b3cee4e8ecbe64b0704be1cdab2dcc9c7ae6a0dfa0e8b8d0317f884
SSDEEP 24576:006liaoL0dhMPqd4MQSsnBuAZVeBV1XAw1CciqmjtLb5tNz/+SW728F6cLUpqfjr:00jL0nI54V1XdiJZtNS84jKsQi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

0d:e8:0f:e4:e2:96:d7:84:c7:29:55:a0:b9:0b:22:c4:91:53:61:89:d9:08:82:82:a0:ff:7d:4b:3d:b1:9a:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 12, 2022

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

14:d2:18:78:6e:da:99:00:1b:81:3f:a7:46:da:53:42:3b:cf:22:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

May 12, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2021 - Jun 28, 2022

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

1221506

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aescn.dll

IMPHASH 3683678e5963198141430a6a94214b32
SHA256 b816a2810fc9c1a5294a59b0232a1725519a2a7472f509c336b9fd1b189d0f3d
MD5 045180fa8eaf0c2409e101542014b5b8
SHA1 70656f926020e02e7c67fd2d145ca90b5952a9d5
SHA512 5659f42a6fe5cf259ad9528777ab5883f0185437b60710727c097cad2ceb60ac09eae4af59857c0021fc573343704ec6318cfc6d78ee2a1d7facc7321f4ae767
SSDEEP 3072:LvsmKNM8p6TrjmZGYx/wpTKwEGGyQYwc74RZQygPYDlIKpEU8+GIBfKLov+4OuuL:Lviu2+XmEGwpVnQY7ERay7BKU8FYxudl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

57:82:e1:6d:4d:a4:8b:7d:1f:c9:ce:bc:0c:e5:d5:79:aa:a3:4f:e4:34:2b:f1:6c:22:1c:37:9e:0e:ca:81:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 24, 2022

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f5:3d:6f:65:1c:ce:03:88:12:2a:10:ad:ec:72:29:33:a0:06:53:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

May 24, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 24, 2021 - Jun 28, 2022

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

75362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aescript.dll

IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
SHA256 8371b7ea7e0e0650a4aca997d270b68543d61ef873190d02db37d7c3349b5942
MD5 11197cd2373a7b8364d9bb97406fa2b0
SHA1 05b81929d797330803febd8231907b54462706f1
SHA512 dff359f3330cceb1bbae2cb26748244509870f9f6f1307b4010e4a449cb50b87d4395fbc38e7b1a0fedfe16eb7b01b4cacac7631f606ec1467555ca5099138c9
SSDEEP 24576:90UGScZK1H+snGqwKchYOLOY5XzIR/l5/v33lwjlOm5Ui2TQ:KU0ZRYOLTI1l53KlOm5UI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

de:57:f7:53:86:16:57:63:c3:57:2a:42:2a:88:ff:04:c6:13:4b:65:dc:85:c3:8b:7d:9a:fd:b5:bf:81:ae:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 15, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

1055938

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/aeset.dat

SHA256 1d06844d6c0aae9b0a5f6f7f61b4c7c6284fb085b7f878d596ee8407c67b7357
MD5 b78db48c5ff9494327032a27d5aa33cc
SHA1 43ffc51ef1da90ec791a95ab6d20e3cae7a66482
SHA512 855622613a0310cceb1b885f11d22876b1b6092fbdfa7ec19618d8ae71b2ad70ca75bfc44ea0e4069b38d9785c400025a8f6a4bedca539546eb10cbce078a051
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/aevdf.dat

SHA256 1fa5d91c9a58fa3f9d3761ace1a8f3bd97fe6e903eaa6540cee0c75f89c681d1
MD5 7ad1fc9922e67652c346113289a557f3
SHA1 9b7dcf5873d40fb45e2016051329cff4d628c336
SHA512 c042d79fa0fffc8a173868f411242868b3a1b5d495dbaa0c70beca65f03b6a988d1dffa1e823ad3c126a5dde2592770e73029a184797fb7ab627e0564b34b5fa
SSDEEP 48:b3sa0DNeR8vdNsv4lFgtKTY6rTsYj6xO/Jzl69sYue4:b3N05e+vdNC4lyKTFTsYj6xSJpYjue4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/aevdf.dll

IMPHASH 08d194711eac35605e4b049b8990031b
SHA256 3acf87d057b627745f588315c528ca19699bc6e5999fb785160a432c7d42b182
MD5 1f2846f66f454dcd075690914c58d97c
SHA1 f6e6c89c11aaffaffaf98791c1faafd00e5d8aec
SHA512 20f555510d45aa62b0256f8898a360ef47f58a37faecfd014e34a0fdfe9f59178ad23532fd37c04edcad63b725571fdbd765ea5f30202b0525f6979d509e28ea
SSDEEP 3072:VGkspwGVB18ldNUYDFjsRRGMKEBeP/EvKaBlbCPL00eAplUlCtvt1JdkbTFtkIpu:VGkseGVB18lXRDyGMKUenkNCYiPU0tvZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

a8:df:e2:88:b0:84:09:f2:b8:09:b5:18:e0:68:60:7a:73:58:2f:7b:9d:ce:b2:40:99:d9:25:ad:c2:99:36:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Jul 15, 2022

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

74:92:d8:a0:37:3a:2f:cf:c8:6d:3e:7f:ff:50:18:c2:ca:25:48:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Chains

Jul 15, 2022

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE

Serial Number

3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 17, 2022 - Feb 16, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 3, 2022 - Apr 28, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

6

Entry point

64157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SAVAPI/ams_setup.exe

IMPHASH 159adfe0cb0b35b14c9ff83cb2d1a025
SHA256 168c506b14418d3c64435d1e165e2b686b8c2273023d9f45848cee5a1355d27b
MD5 30ad65d8805ff9356ac7e75e67585f01
SHA1 7711885c3bcebe0bae7c5d33979eb52cbecb8f26
SHA512 d45eee2a5ab487d4d614da497b4ebcbe34f93828a294dcee9db5f0e4eadebcfe3408f30956b15a5352c465c956adf68d89c97a2a6609b15c7c5c43408949aa15
SSDEEP 3072:IjGFIi8a+vmi3zw4+j16h3U7yYYFOqnHifsW/bFYWoBKyMeTGXZ9PjlLgqER:W4IFb3z7O1iU73YFfe/jNXZ7pER
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

58:91:d3:92:dc:0e:d5:c5:d6:5c:90:7b:27:15:57:8d:4f:45:63:ec:2c:fd:90:a1:6a:78:06:79:fe:9a:f9:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

1

Major OS version

6

Entry point

30108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\aviraoa\ams_setup\ams_setup.pdb

shlwapi

PathFileExistsW PathRemoveFileSpecW

user32

GetSystemMetrics ExitWindowsEx MessageBoxW

kernel32

WriteFile CopyFileW SetEnvironmentVariableW GetCurrentProcess GetBinaryTypeW HeapAlloc HeapFree CreateFileW GetEnvironmentVariableW GetFullPathNameW MoveFileExW SetFilePointerEx GetFileSizeEx GetSystemTime LoadLibraryW FreeLibrary GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess WaitForSingleObject CloseHandle FindNextFileW FindFirstFileW FindClose DeleteFileW GetProcAddress GetModuleHandleW GetNativeSystemInfo LocalFree GetModuleFileNameW GetLocalTime GetLastError GetCommandLineW ReadFile ReadConsoleW HeapSize HeapReAlloc DecodePointer SetEndOfFile WriteConsoleW GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle ExitProcess GetModuleHandleExW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

shell32

CommandLineToArgvW

advapi32

SetServiceObjectSecurity BuildExplicitAccessWithNameW SetEntriesInAclW QueryServiceObjectSecurity DeleteService CreateServiceW ChangeServiceConfig2W ChangeServiceConfigW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegQueryValueExW RegDeleteKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle FreeSid CheckTokenMembership AllocateAndInitializeSid

SAVAPI/apc_random_id_generator.exe

IMPHASH da8ed38bc494edc43fed015b4c7918b8
SHA256 1239ea35953b0fe8677bee09dedb7c3eea987e977c73e73ef8862c4a3774b659
MD5 be6f0a323777bc43bce01fdc5ad58120
SHA1 a6c1742269fb7879dcb54dfd25af57dba66ab732
SHA512 921b11869d1ec2b5a19ef41b75504ac099429339a143cfa677fc54eb520a2b79b173e2e326afcaeceeab4f6b942098dd9a660b7c9dc3addc8b9ea53a3cac4548
SSDEEP 6144:y8o+8urNJEXczi5CLqOhcg7vnDUbRypWCaoo/Jiq/mEwhDsQ8cNWE9Zu:y8o+8MNJEiTPvnDUbRypWCap/+p9Zu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

08:ea:1c:34:71:84:d9:cd:dd:2c:fa:b7:5b:84:bb:35:87:16:d4:e9:f5:d9:71:17:e9:ba:3e:83:17:cf:d9:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

111069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\apc\random_id_gen\apc_random_id_generator.pdb

rpcrt4

UuidCreate

ws2_32

freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername WSAGetLastError socket shutdown ntohl select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept getnameinfo send

kernel32

ReadConsoleW GetConsoleMode LCMapStringW CompareStringW GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection GetConsoleOutputCP LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA CreateFileA GetCurrentProcessId GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetStdHandle GetHandleInformation SetHandleInformation WriteConsoleW GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW CreateHardLinkW SetEndOfFile LockFile LockFileEx UnlockFile UnlockFileEx DuplicateHandle GetCurrentProcess CreatePipe CreateNamedPipeA SetFilePointerEx HeapReAlloc DecodePointer FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize EnterCriticalSection WaitForMultipleObjects UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW RaiseException GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc

advapi32

LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptGenRandom CryptReleaseContext CryptAcquireContextA

SAVAPI/apcfile.dll

IMPHASH d0a7a04ab2c72e5a3c1169b60f06b849
SHA256 7f6c31ea445c7b871a0ea2b73705776435b00f3e37223b53b5da9b4ad4d19c0c
MD5 ecf74de0b990c96fcf961e89cf73768c
SHA1 5ba320e5e1e4364cec95b130bebff52f3591c039
SHA512 8ab9b876db9edaee8862fe3cd0cde688158a487cf00f12ac85983c8fbe93a6f116f5d4ce96bf717ce64f4a231aee618b8b023c735ac1783249beaae95a3030bf
SSDEEP 49152:xCvhKevv/MEl1oInVGDM1UDtL0lzHYqV2WPY1KG5twA+arh2:xCvJ6IVGTyxHYqs/1KR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8c:be:8d:b8:6e:9b:1d:c2:fd:b9:a5:ee:68:c4:c6:4d:3a:8c:77:d2:5a:bf:b6:aa:01:58:e8:f9:f7:c5:8f:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2089296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\bamboo-build\SAV-APCSDKPACKAGE-WINX86SDK\package_release\bin\apcfile.pdb

ws2_32

inet_addr WSAGetLastError gethostname recv socket WSASend WSARecv WSAGetOverlappedResult sendto recvfrom getservbyname shutdown ntohl getnameinfo ioctlsocket getpeername freeaddrinfo getaddrinfo closesocket listen htonl getsockname connect bind accept select __WSAFDIsSet inet_pton htons WSAIoctl setsockopt WSACleanup WSAStartup inet_ntop WSASetLastError ntohs WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

kernel32

EncodePointer DecodePointer GetCPInfo RaiseException RtlUnwind GetCurrentProcessId GetModuleHandleW GetProcAddress GetLastError GetCurrentProcess GetVersionExW GetLocaleInfoA SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA Sleep MoveFileExA CloseHandle WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetSystemTime SystemTimeToFileTime GetStdHandle GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber LoadLibraryW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation InitializeCriticalSection TryEnterCriticalSection SetEvent ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA DuplicateHandle SwitchToThread GetCurrentThread ReleaseSemaphore CreateSemaphoreA ResetEvent FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle CreateFileW HeapSize SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW CreateHardLinkW CreateDirectoryW RemoveDirectoryW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GlobalFree FormatMessageA SetEndOfFile SetEnvironmentVariableW FlushFileBuffers ReadFile PeekNamedPipe SetCurrentDirectoryW GetDriveTypeA GetDriveTypeW SetHandleInformation GetSystemInfo MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateFileA GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA InterlockedFlushSList LoadLibraryExW SetFilePointerEx GetConsoleOutputCP CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler ExitProcess GetModuleFileNameW WriteConsoleW HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW HeapReAlloc OutputDebugStringW IsValidCodePage FindFirstFileExW GetCommandLineA GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteFileW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW InitializeSRWLock InitOnceBeginInitialize InitOnceComplete GetStringTypeW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource

bcrypt

BCryptGenRandom

apc_add_cache apc_authenticate apc_category_name apc_create_context apc_ctx_get_file_lookup_filter apc_ctx_get_user_data apc_ctx_set_connection_timeout apc_ctx_set_data_timeout apc_ctx_set_file_lookup_filter apc_ctx_set_upload_connection_timeout apc_ctx_set_upload_data_timeout apc_ctx_set_user_data apc_disable_logging apc_enable_logging apc_file_cache_disable apc_file_cache_enable apc_file_cancel_uploads apc_file_check_file apc_file_check_files apc_file_check_files_ex apc_file_check_hash apc_file_check_hash_ex apc_file_check_hashes apc_file_check_hashes_ex apc_file_ctx_call_filters apc_file_ctx_get_elf_mode apc_file_ctx_get_ext apc_file_ctx_get_ext_policy apc_file_ctx_get_filters apc_file_ctx_get_mac_mode apc_file_ctx_get_pe_mode apc_file_ctx_hash apc_file_ctx_set_elf_mode apc_file_ctx_set_ext apc_file_ctx_set_ext_policy apc_file_ctx_set_filters apc_file_ctx_set_fops apc_file_ctx_set_mac_mode apc_file_ctx_set_pe_mode apc_file_ctx_set_temporary_dir apc_file_hash apc_file_hash_ex apc_file_info_get_extra_info apc_file_info_get_malware_name apc_file_initialize apc_file_initialize_context apc_file_metadata_set_download_url apc_file_set_batch_service apc_file_set_temporary_dir apc_file_set_upload_threadpool_limits apc_file_uninitialize apc_file_uninitialize_context apc_file_unwilling_to_upload apc_file_wait_for_uploads apc_file_willing_to_upload apc_free_context apc_get_file_lookup_filter apc_get_library_version apc_load_cache apc_save_cache apc_set_cache_dump_secure apc_set_connection_retries apc_set_connection_timeout apc_set_data_timeout apc_set_file_lookup_filter apc_set_low_upload_speed_limit apc_set_low_upload_speed_time apc_set_max_cache_size apc_set_max_upload_speed apc_set_metadata_product_id apc_set_metadata_product_language apc_set_metadata_product_license apc_set_metadata_product_random_id apc_set_metadata_product_type apc_set_metadata_product_version apc_set_out_of_memory_handler apc_set_proxy apc_set_proxy_auth apc_set_proxy_ssl_ca_cert apc_set_server_message_cb apc_set_service_address apc_set_ssl_ca_cert apc_set_ssl_crl apc_set_upload_connection_retries apc_set_upload_connection_timeout apc_set_upload_data_timeout apc_ssl_threads_initialize apc_ssl_threads_uninitialize apc_strerror

SAVAPI/apchash.dll

IMPHASH c45291f055d661a4d27149e1fd47d098
SHA256 fb74e48074ba4d26049250bc68281751f9fb9a6c41c401e19f6870ebcfdf6a7a
MD5 a0c5e8f7cd6c02a8719ade39c1955135
SHA1 52153097ff4d14c89374ed9d144178ec104795ae
SHA512 30901a8332e09311bee3c244226d533840f277f47170fa85a7f2e06e3c1bae18a95db82b45ab1f31062be6f7c5dc6918bfe088f3088cfdce8ecb52df863da3b9
SSDEEP 3072:0IIIIb90Vo9gn6YfoT7lq3xsuHBfvPBwcbaGSI/2EQmhKeKhUbZXU0JxP05:0IIIIb9bYcI3xxZaGtuEQgtXU0k5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

73:73:cf:2e:34:53:18:6e:6d:ef:61:5f:f7:97:0c:64:5b:86:b5:c9:50:ab:29:fd:d0:ba:24:1c:c1:64:82:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

30443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\utils\apc\libapc_hash\apchash.pdb

SAVAPI/avupdate-apchash-product.conf

SHA256 e2cbcd600dce59af50b624e2079f4b92186dd0536f5ffbc2b859c5c440657e05
MD5 4257d3de2badf1811f90e8312bc74aee
SHA1 85a5ddcd2282e8049bc5432932baf418bc02ebca
SHA512 962cc45ff9aa7fe1bb8902bc195318408a7dc2728c7e89c5ceba3eaa7385d19eba52090a2f4e69bd25bb2a0a9f4500988f190e71fff84b9c9df6c8bb2052c4aa
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-on-access-savapilib-product.conf

SHA256 e5e0ae1892dcae23e6b2b914234cc2111efd1ad746887c61266618ce5ec5852c
MD5 c0d7ca0f42b0eb707f0ff09a1144d837
SHA1 1c5d84bcf2bfd97a51b156b04fde285a8fddd35f
SHA512 a4582b9ad7ae3bd795c271201850aa2ef5163b605f227fa4da06d6fd9d23144d811d16904257188832a2eeddb63692a12ed649ae4244eb3138b0a972e7686b19
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-savapi-engine.conf

SHA256 cfd50eeea0c80b8dde883951aa6149410ccbb6a08fb001cee109c276648feb1f
MD5 01a844c7204488b536c48a72090f8a39
SHA1 417b1670c72d9c0c70953e88fcf2ba8bc82c245e
SHA512 2aa341bbd42ad658bc4db5d5521dd1c5a882796b3bc745be89607ccbadc084bd790f92197e0881f4d45a13cee74fdd8c73b47e7cb86c2bf81598251c40591acf
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-savapi-product.conf

SHA256 30ef0c181ee31e52efe06d44f5d33e5a868160e6f93f573f38aac4b05f681af0
MD5 c94d4130ad378ddbc7e341937cf10692
SHA1 81a7fc4c1ebaf2c19a590c43d60d4b9f3650edbc
SHA512 59ac58e5ee40213cdbe8de93baa96db946fbd1e1c7b946ba31a61e4550e4bab29286811310fb966bb9725ffdd5f4b750b09a188193bd3bd5111eef5c882e2e49
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-savapilib-engine.conf

SHA256 ea5ade6e1bc0df9e2773dcaf5cf9bb087965dba3c74a12eeb9727747cffbb614
MD5 c0b5b102ad8dcb4190e4acd1e4c78d99
SHA1 6364654bbe47f784d84eb8387fe14d0a7c267a78
SHA512 76264a03d43d507574582aa6954d50ab3e0954153489abb4c311989226e9e951bb4de188cff8d92c4d48c96470d58d4d7bfc094a6a74c050ee8ef25a61395250
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-savapilib-product.conf

SHA256 f6c89a441e41a381ccb1785d97d9aeac95d6d01f13227431baa6a4c06b4f78e8
MD5 d8e715e99b1709e69303f9d9dfd0ba88
SHA1 68964f716482230d2b3d28677257f8742235e6ea
SHA512 3fce72763e81318f31bfb684fea8f189dc85fe3798d14978a3d589a649107e9a7ad61c0ea1f4f0ff2c50b8663fad3ec6870d9c595d7e66f8c0c11e3de42e5264
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate-xvdfmerge-product.conf

SHA256 1ccfc728f83e1709ae01936e369610e6f9bf7d83e9b406af995cab5fa1863d4e
MD5 c7e74ddde5788f5e9510034b66ff0fbd
SHA1 8b821abbe25c98877836a4a76446bb98871a9aa0
SHA512 7657ee00f0e8b5365b02d12393aa64e5862dc87e5ef5390824d536d72845b2e9e46a25ca0676f49e6d4cfcd7ee164e80832696a369e82d464d938139e8d745a4
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/avupdate.exe

IMPHASH 35e07a3a55743a4b4805df293e470e40
SHA256 afb45b8ae7d78085d95122ae01f6bac1515a89e7e2c87c55596670e2b5e922e1
MD5 e0947f2084e589a4d7f1c0f541b54321
SHA1 3ca9be3bc2678b85e36b9823a617376a268ab889
SHA512 316a214436031a498de8b2b6ca33cb9f73cacc3ee19f22f86d90583f817e35f0b93bd44e3af8e47baf1c7e44fc66b9c2031995cc4ce69a1bdbe980de93e5938f
SSDEEP 49152:JevEk9Vcz8AGAIaaQ2ldCPGwdYbO9ZMzYuWP011w99oUQ8Pbto:JevUsAz8ld+ubO9Ssur1a8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

4d:f2:32:ce:e3:94:1e:21:31:7b:1d:01:4e:b9:fd:c9:b8:07:d9:1f:1b:fd:6a:c9:30:2c:1d:5f:15:76:5a:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

2059170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\kmr4g80c\updater\avupdate.pdb

scew

scew_element_by_name scew_strcmp scew_element_attributes scew_element_children XML_Parse scew_list_next scew_list_data scew_element_attribute_by_name scew_parser_ignore_whitespaces scew_parser_free scew_parser_create scew_tree_set_root scew_tree_create scew_attribute_value scew_attribute_name scew_element_add_attribute_pair scew_element_add_element scew_element_add scew_element_count scew_element_set_contents scew_element_free scew_element_create scew_tree_root scew_element_contents scew_element_name scew_tree_free

ws2_32

WSASend inet_addr getsockopt WSAGetOverlappedResult sendto recvfrom shutdown getservbyname ntohl getnameinfo gethostbyname gethostname ioctlsocket getpeername freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup WSARecv send WSACloseEvent inet_ntop WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

mswsock

TransmitFile

rpcrt4

UuidCreate

shell32

CommandLineToArgvW SHGetFolderPathW

mpr

WNetAddConnection2W WNetCancelConnection2W

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptCreateHash OpenProcessToken GetTokenInformation LookupAccountSidW SetThreadToken DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf RegCloseKey CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash GetUserNameW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW ReportEventW RegisterEventSourceW DeregisterEventSource

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

kernel32

ReleaseMutex SetEvent TryEnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FormatMessageA WaitForMultipleObjects InitializeCriticalSection GetHandleInformation SetEndOfFile SetEnvironmentVariableW SetFileTime SetFileAttributesW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindFirstFileA CreateEventA PeekNamedPipe FlushFileBuffers CancelIo DuplicateHandle SetFilePointer GetFileInformationByHandle DeleteFileW SetStdHandle LoadLibraryExW SetErrorMode RemoveDirectoryW CreateDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFullPathNameW GetDriveTypeW GetDriveTypeA GetCurrentDirectoryW SetCurrentDirectoryW ConvertThreadToFiber ConvertFiberToThread SwitchToThread GetCurrentThread CreateFileA CreateMutexA GetModuleFileNameA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind EncodePointer RaiseException ExitProcess GetModuleHandleExW SetConsoleCtrlHandler CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleOutputCP WriteConsoleW GetCommandLineA GetConsoleCP HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc WriteFile GetFileType FindNextFileW FindFirstFileW FindClose CreateFiber ReleaseSemaphore GetVersionExW CreateSemaphoreA DecodePointer IsValidCodePage GetCPInfo FindFirstFileExW GetStringTypeW GetProcessHeap ReadConsoleInputW DeviceIoControl TerminateProcess GetLastError GetLocaleInfoW MoveFileExW LocalFree FormatMessageW CreateFileW ReadFile CloseHandle SetHandleInformation CreateNamedPipeW GetOverlappedResult ResetEvent WaitForSingleObject CreateEventW HeapSize GetExitCodeProcess CreateProcessW FreeLibrary GetProcAddress LoadLibraryW GlobalFree GetCurrentProcessId OpenProcess GlobalAlloc GetComputerNameW GetCurrentThreadId GetModuleFileNameW GetModuleHandleW GetCurrentProcess GetSystemDirectoryW GetWindowsDirectoryW IsWow64Process LoadLibraryA MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA Sleep WideCharToMultiByte MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetTimeZoneInformation CreateHardLinkW GetACP GetOEMCP GetStdHandle GetConsoleScreenBufferInfo GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW GetSystemTime SystemTimeToFileTime GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber

bcrypt

BCryptGenRandom

_cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

SAVAPI/avupdate_msg.avr

SHA256 056ec25ad90c88a86b85a9c72246b0d4003be39ef954a6bcb1baa92e63ed6101
MD5 7ff9f5f6a65afe7c10b5de77f4986042
SHA1 d19c140cade5ddf6d1f588f453fccad44525030b
SHA512 3271017bbf7afa11cb6804c5578d8fbc4410f01fb544074302cc491f357dbf1e52f8ab9d58648443f5e5f3fb64adb8dda96fe08d94ca2525465844864cf2ca98
SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13SrnZ:qiFRuCJNKzRxw3i5hSAIbyrZ+7wniZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/cacert.crt

SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
MD5 9956b172b62aeb41ca988999947a488e
SHA1 199e3607abeafd168b02b062697656a847fe4de7
SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/README

SHA256 43b602dc083b9e5836f32def1521b42f5971f7b12e47e8d272049283316f0aed
MD5 dd70354b0df8379ef2edecbe4304f900
SHA1 04670a5a3d483ae50bb5488cf8cecdfa7b7083aa
SHA512 1ee14e8834c0817305e01a03984a73484a23b26f9328224513412b764017501cdce0473f58d2d64ed647adf78f51bdc7b50f5efe3f0183d736154cab83ae70ad
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win32/win7/avgntflt.cat

SHA256 736c72051ea40058e98362f29a7a9a5ad73032bbbf8bda53ea897f64c5bc7de8
MD5 622330091b3d75e6e562c37582ac8b2b
SHA1 6915486dbaf7cbd2846e63a6d1e12bff67c56922
SHA512 5f93f6a59d798bd25aab1fe9a75f6cb13210f07bb49b340861993deaea4206fec9fadbfad6cba0c000fa6709a2e6ec6de48cbb014232f7352d272586a414ce28
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgntflt.inf

SHA256 88f7e8d81340ab33fc71702c2817427e7b26ee31a76d59f167a00f2af2c783f0
MD5 139c7c318ef6d64fc6c7ecdf1f7422da
SHA1 7fc18f8244ee8c795f0da452fbb1f9bb628f9e2c
SHA512 504b7e7917f15e93bcdcdbd7189c8b29bc27487d2c61bf3d78f9edc4f361dc0136621b55f0e1b0bf7a69c8cee668f520b72d6f45197ab58f62b5b36371c7fd27
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avgntflt.sys

IMPHASH 1ef61e02301b03f0dea57f84bcd2479d
SHA256 33d6cc050cefb737b70431c7e493a0d7b7f5ae7546d36fd24a5d4b1ebf29d307
MD5 6b60c0a7fdbabe955a183ae3b524d543
SHA1 be68e043fb0f6e0ca745b8361924ad0869bf2bb9
SHA512 040ecbb33bbba5bba6206cee7717cff01fc8d3436762a4f2af6647cd9f02b31d48538ebc0d91b627fd0f9324375544905c2e09e4040c55b3642480e683f73df9
SSDEEP 3072:3dxo0Wbd5kOx92/nQdp2kRaZE/I+j8CR/ehwdwTe6vuypGe08Uxb24lOPy:3dxo0Wbd5pJ/I88CR/p6vAnA4e
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

84:7c:33:ec:4c:fa:98:5a:f3:91:d2:68:da:ae:9b:55:a5:32:cb:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

1

Major OS version

6

Entry point

156286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb

ntoskrnl.exe

KeLeaveCriticalRegion ExReleaseResourceLite ExAcquireResourceExclusiveLite KeEnterCriticalRegion SeCreateClientSecurity IoGetStackLimits ExAcquireResourceSharedLite RtlFreeUnicodeString RtlUpcaseUnicodeString ZwQueryValueKey ZwOpenKey toupper ZwReadFile ZwQueryInformationToken ZwOpenProcessTokenEx ZwOpenProcess _alldiv IoCreateSynchronizationEvent KeInsertQueueApc KeInitializeApc InterlockedPopEntrySList ZwDeleteValueKey ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject PsGetCurrentThreadId RtlUpcaseUnicodeChar ZwQueryDirectoryFile RtlAppendUnicodeToString ZwOpenFile wcsncat RtlAnsiStringToUnicodeString RtlInitAnsiString ZwSetInformationFile ZwQueryInformationFile InterlockedPushEntrySList ExReleaseResourceAndLeaveCriticalRegion ExEnterCriticalRegionAndAcquireResourceExclusive IoGetTopLevelIrp NtClose ObReferenceObjectByHandle IoFileObjectType RtlEqualSid RtlGetOwnerSecurityDescriptor ZwQuerySecurityObject RtlNtStatusToDosError KeWaitForSingleObject _allmul SeQueryInformationToken PsSetCreateProcessNotifyRoutine ExInitializePagedLookasideList ProbeForRead MmMapLockedPagesSpecifyCache towupper KeResetEvent RtlIntegerToUnicodeString RtlCreateUnicodeString ZwSetValueKey PsCreateSystemThread PsRevertToSelf SeImpersonateClientEx RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsTerminateSystemThread KeWaitForMultipleObjects ZwWriteFile IoDeleteDevice IoUnregisterShutdownNotification IoDeleteSymbolicLink ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList SeTokenType _aulldiv _aullrem _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s IoFreeMdl MmFreePagesFromMdl MmUnmapLockedPages RtlSetAllBits ExWaitForRundownProtectionRelease MmAllocatePagesForMdl ExReleaseRundownProtection RtlFindClearBitsAndSet ExAcquireRundownProtection RtlClearBit ExReInitializeRundownProtection KeTickCount KeBugCheckEx RtlUnwind KeQueryPriorityThread IoThreadToProcess PsGetProcessId IoIsSystemThread RtlEqualUnicodeString RtlCopyUnicodeString ExDeletePagedLookasideList KeGetCurrentThread PsReferencePrimaryToken PsLookupProcessByProcessId MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite ExGetPreviousMode MmIsAddressValid NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess memmove KeDelayExecutionThread _wcsnicmp wcscpy_s RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer IoWriteErrorLogEntry IoAllocateErrorLogEntry ZwSetSecurityObject IoDeviceObjectType IoCreateDevice RtlGetDaclSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetGroupSecurityDescriptor _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAddAccessAllowedAce wcschr RtlAbsoluteToSelfRelativeSD RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor ZwCreateKey PsDereferencePrimaryToken PsDereferenceImpersonationToken ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeQueryTimeIncrement KeQuerySystemTime ExInitializeRundownProtection RtlInitializeBitMap KeSetEvent ObfDereferenceObject IoCreateSymbolicLink IoRegisterShutdownNotification ZwCreateFile ExInitializeResourceLite RtlLengthRequiredSid RtlInitializeSid RtlSubAuthoritySid RtlValidSid RtlLengthSid RtlAppendUnicodeStringToString RtlCompareUnicodeString IofCallDriver IofCompleteRequest IoWMIRegistrationControl RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess RtlHashUnicodeString KeInitializeEvent

hal

KeAcquireInStackQueuedSpinLock ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeGetCurrentIrql KeReleaseInStackQueuedSpinLock

fltmgr.sys

FltGetDestinationFileNameInformation FltDeleteInstanceContext FltGetVolumeProperties FltOpenVolume FltDeviceIoControlFile FltSetInstanceContext FltObjectReference FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltGetFileNameInformation FltParseFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltQuerySecurityObject FltReferenceContext FltFsControlFile FltQueryInformationFile FltGetInstanceContext FltCreateFile FltClose FltGetStreamHandleContext FltSetStreamHandleContext FltReleaseContext FltAllocateContext FltReleaseFileNameInformation FltRegisterFilter FltStartFiltering FltCloseCommunicationPort FltUnregisterFilter FltBuildDefaultSecurityDescriptor FltCreateCommunicationPort FltFreeSecurityDescriptor FltGetRoutineAddress FltDeleteContext

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win7/avipbb.cat

SHA256 d50ffe995b3ad0b44dcc30976cb047ef690646872fa9dbc3c48950cd8593e918
MD5 116668cc50e8f234ba729a8d8895b1e3
SHA1 cb987ae4def6e022dc5e62cbf8a76e374bf9404c
SHA512 3c5d04ddfb87c0fc611f6eb7b281d7a67584f9b2a4713f3f14aa1f709cceace3898fc00e4a90bc9caf59cd11e006f917536e602f21b2ac610a0245af4f3bbf5b
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avipbb.inf

SHA256 4ae6e2a7c2e11bf797ba3b4877fb4ddf2ca75c6f774d4dfd4b002a307b7f938a
MD5 1b439a706d228a6dc534a3a8731c1afd
SHA1 49e34aee2faa0cbaa9bfd004eefe3150e64451b0
SHA512 d2cf3f4c289434654d7103f0517dc99bcf98f8db01e34af25c07015fe90ca88866bc0de8d6a1983406bb2f2ad85c179a47bc9095ce650a1ee0cedf23d2a8c3f0
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avipbb.sys

IMPHASH 666004f477406d2edd34100136c011b0
SHA256 2bf4e12f41f8d78737592b7f29b55206b2df15411cc2943e678f52096289d06f
MD5 a17862525867081a577923e210604a64
SHA1 9b6f498bbda86fc464d6e5094bc8529ecd3e7579
SHA512 e33c701cad149844913e5853187e4bbf43f6bc230fccaec21c847b373da7299849f2f3d93e6a07dc2c3c774f5119a31f0f44ed77821cc1e8dda93661e620b2ca
SSDEEP 3072:E6zDMkFB5rqrDX7r5E2wnyKVxqxJNxBIRxUcx5VEv3QuhznmZmopCn7:3zDMU5cHq2wn/EJNIRxXx5KB1Omo07
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

2d:b8:6c:ca:3b:b0:69:26:57:00:68:12:76:9a:52:6f:76:04:8f:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Jul 26, 2024

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Minor OS version

1

Major OS version

6

Entry point

163902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb

ntoskrnl.exe

IofCompleteRequest IofCallDriver KeServiceDescriptorTable ZwClose ObfDereferenceObject KeSetEvent KeReleaseMutex KeWaitForSingleObject RtlCopyUnicodeString ZwReadFile ZwCreateFile RtlCompareUnicodeString FsRtlIsNameInExpression _strnicmp memmove ZwQuerySymbolicLinkObject ZwOpenSymbolicLinkObject ProbeForRead ObReferenceObjectByPointer PsProcessType PsGetCurrentProcessId PsLookupProcessByProcessId KeResetEvent KeReadStateEvent RtlAppendUnicodeStringToString PsLookupThreadByThreadId RtlAnsiStringToUnicodeString RtlInitAnsiString _stricmp PsTerminateSystemThread PsThreadType PsCreateSystemThread RtlInsertElementGenericTableAvl ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite IoDeleteDevice IoDeleteSymbolicLink RtlIntegerToUnicodeString IoWMIRegistrationControl ExInitializePagedLookasideList IoCreateSymbolicLink IoCreateDevice ExInitializeResourceLite KeInitializeMutex KeGetCurrentThread _vsnwprintf KeWaitForMultipleObjects ExGetPreviousMode KeQuerySystemTime PsGetCurrentThreadId IoReleaseCancelSpinLock IoBuildSynchronousFsdRequest ObReferenceObjectByHandle ZwWriteFile _allmul _aullrem RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv ObfReferenceObject ObOpenObjectByPointer PsGetProcessId wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy wcsrchr strncpy IoDriverObjectType wcscpy_s KeDelayExecutionThread KeTickCount KeBugCheckEx RtlUnwind RtlCompareMemory RtlInitUnicodeString MmGetSystemRoutineAddress memcpy ExAllocatePoolWithTag IoWMIWriteEvent ExFreePoolWithTag ExAcquireResourceSharedLite KeEnterCriticalRegion ExAcquireResourceExclusiveLite ExReleaseResourceLite KeLeaveCriticalRegion memset KeNumberProcessors RtlGetVersion IoGetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList ExInitializeNPagedLookasideList KeInitializeEvent ZwSetInformationFile ZwQueryInformationFile PsReferencePrimaryToken PsDereferencePrimaryToken SeQueryInformationToken ZwQuerySystemInformation IoFreeMdl MmUnlockPages MmProbeAndLockPages IoAllocateMdl ProbeForWrite MmIsAddressValid NtClose NtOpenProcess NtQueryInformationProcess ZwQueryInformationProcess ZwOpenProcess ZwFreeVirtualMemory ZwAllocateVirtualMemory ZwDuplicateObject RtlImageDirectoryEntryToData RtlImageNtHeader ZwQueryObject ObQueryNameString RtlDowncaseUnicodeChar _wcsnicmp RtlLookupElementGenericTableAvl RtlDeleteElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry

hal

ExReleaseFastMutex KeGetCurrentIrql KfReleaseSpinLock KfAcquireSpinLock KeQueryPerformanceCounter ExAcquireFastMutex

avkmgr.sys

func4 func3 func5 func1 func0 func6 func7 func8 func9 funca func2 funcd

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win7/avkmgr.cat

SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
MD5 8dbe5877f742d7d8fb652c84f76fab5b
SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avkmgr.inf

SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
MD5 e92853f21048c93a182a140e667983e9
SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win7/avkmgr.sys

IMPHASH df68c8435781307135dfe76497ab5341
SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
MD5 20894c53c0b9db8f86993d9ecb78f9d5
SHA1 7c18c5b571c906535d393a5165379f6316143107
SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

6

Entry point

36926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

846B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win32/win8/avgntflt.cat

SHA256 853c6ba3a145bdd47656b525985632ad46e1d2e8ad127449d59e2bf62bfd5d8f
MD5 49500efd1756f4b3934e8df70bf12d97
SHA1 7ee81eb8aa3e448fd7d9cd4559b9077d55b2afb1
SHA512 58b72baaffca047306915e09e9903b7fe6a6d9943e1d44644ad8ed2b3a31b371dd1ba2730789b75649bcc38df0782e8e6aad04f8f8b88eb800c333624aeea1a5
SSDEEP 192:EwafyS9JCUQXooyKfPFWQFT7Q5YVZL1aqnajKs0edqC:E9VarPFR5UYVSlGs0jC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avgntflt.inf

SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avgntflt.sys

IMPHASH 369430b7330b145ea00a0d756880608f
SHA256 33c6b1d49ab13d6ae9f22e05d77b70123de63c802363da0daf1be958b7d3d532
MD5 f16335a9102ffc99a8c8e07e1b2d57d4
SHA1 32ddb4251591e40db352661be4721c5c6402b90a
SHA512 57746307cab7e82e9e7ef5f033628810997954a40cf57f34650cbc9ac77fc2fa3465f1206f87e0082edc4121114dd71f2f816a628872fde26136012766a5cc52
SSDEEP 3072:mPhzNgtyTnwf3UCPID5tfaElzgbSvTR7VHhoxM732FrBT5t3BMXv8DBf:qhGtyTHC2tDcSvTZ9+Oarf9BMMd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

156256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb

ntoskrnl.exe

KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion InterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc _alldiv memcmp ZwQueryInformationFile ZwSetInformationFile InterlockedPushEntrySList ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetAllBits RtlFindClearBitsAndSet ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine towupper RtlIntegerToUnicodeString RtlFreeUnicodeString ExInitializePagedLookasideList ProbeForRead ZwSetValueKey RtlCreateUnicodeString _allmul _aulldiv KeWaitForMultipleObjects wcsncat PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _aullrem _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry memmove RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid PsReferencePrimaryToken PsLookupProcessByProcessId ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp toupper RtlUnwind RtlUpcaseUnicodeChar RtlAppendUnicodeToString RtlCopyUnicodeString RtlEqualUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString KeResetEvent KeGetCurrentThread IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors memset memcpy RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeQuerySystemTime KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress PsCreateSystemThread RtlInitUnicodeString

hal

ExAcquireFastMutex KeReleaseInStackQueuedSpinLock KeAcquireInStackQueuedSpinLock KfReleaseSpinLock KfAcquireSpinLock KeGetCurrentIrql ExReleaseFastMutex

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDeviceIoControlFile FltOpenVolume FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltParseFileNameInformation FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

21B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avipbb.cat

SHA256 4efdc56d06e5a17315784d3e700e359fd3ce701edceb6d3370de64d1617d42be
MD5 8e59d322b492d531124a0a51a5eeaae9
SHA1 c58672a169f96336e12c0367bd5afa5906bda93f
SHA512 2ff077f6115c6c4b87b11c78b7fb48ecc0f800f2b8a89ce16d709b802ced671f175c80746aa89f745de6f33d1f894991335de39214909ac0a084e709529a2548
SSDEEP 192:lBRIgR6uyHJCUymwBYyKaWFWQFO7EQDzBqqnaj/CdR4:59yVyPCFRNplLV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avipbb.inf

SHA256 a68faf360ca9d5da989a1b6e7ff69f7aabf7b52be7819ec862a6688b841125ff
MD5 34c3d7f3bd04501338c421cd9c62b993
SHA1 7feda197634072bc48e214800a3d4550cd1fa32a
SHA512 166b4ba8653b3f932ff806e39d92a48e2e2ef7c87f82fc0560add528bf5dab34e0937253c8c5778dcd31f9a925448414066c623d976fbce21893bed08c7ead70
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avipbb.sys

IMPHASH 8cf67a6f9f559410b2c92bfe6381b8f7
SHA256 629da28ac97f5b17b1603059242088727e1552d68fe350f97fcd0b67d412ab25
MD5 18ed8302d083dad602823988a304a4f6
SHA1 01014fd10d7babd6d81bb7e9511ffa7e13c890fa
SHA512 de9ea04221fb1270db37d35fcc1acdf7265103e079fd31566b0a043a1fa3b2267a034b720a3070538f289fd3847171d3d54277417ba0f67aede86f1b78db220d
SSDEEP 3072:FiRnqR7d4wgBQIFnh/Lpx211rrYQwKiYB+Qua7KjoLxkAAFP:Fiq4PbL/2THYQwK7B+Bau0S
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

172032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb

avkmgr.sys

func7 func8 func6 funca funcd func5 func4 func3 func2 func1 func9 func0

ntoskrnl.exe

RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite PsCreateSystemThread PsTerminateSystemThread IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression memcpy memmove memset KeNumberProcessors PsProcessType PsThreadType KeServiceDescriptorTable KeGetCurrentThread KeWaitForMultipleObjects MmGetSystemRoutineAddress ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf _allmul KeInitializeSpinLock RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl _aulldiv _aullrem ObfReferenceObject PsGetProcessId ObOpenObjectByPointer ZwQueryVirtualMemory wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcscpy_s wcsncpy wcsrchr IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken ObQueryNameString ZwQueryObject ZwDuplicateObject ZwAllocateVirtualMemory ZwFreeVirtualMemory ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlImageDirectoryEntryToData RtlImageNtHeader RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry memcmp ZwSetInformationFile RtlInitUnicodeString RtlUnwind RtlInitAnsiString RtlIntegerToUnicodeString _strnicmp _stricmp RtlAnsiStringToUnicodeString KeQuerySystemTime

hal

KeGetCurrentIrql ExAcquireFastMutex ExReleaseFastMutex KfAcquireSpinLock KfReleaseSpinLock KeQueryPerformanceCounter

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win32/win8/avkmgr.cat

SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
MD5 a63897b79888e60e29431eb1b28844de
SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win32/win8/avkmgr.inf

SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
MD5 dddb1f6ae43397a15af280de3ebc3c83
SHA1 2651935088949e2dff211a7c1126a02836a9b781
SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win32/win8/avkmgr.sys

IMPHASH 915211291455160b181a1b35daf6bd20
SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
MD5 e3ab0eeb7613ddbacc0388b96048ff5d
SHA1 f6e382597081451d6546339948edd3e854b7dfae
SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

36864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

980B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

776B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win64/win7/avgntflt.cat

SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
MD5 f3018b52949cdcbf666ffaf6c17f985d
SHA1 9b4692f754d090cd8b2afb9c4ddce60a05aefc9e
SHA512 69b1b5c607e37d6cb0e7049fb0ce1ee79b720992a354aee73b67e9b87dc1e2c16548ae55786dbb65ec4e8bcfffd39586edc660d5b41d58d69746b8c25b627af0
SSDEEP 192:r2p32qXooyKfPFWQFTWQ0dPLrMhEqnajKsKmEU1Isb:6vrPFRoBjlGs6Ul
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avgntflt.inf

SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
MD5 0d87b337d3a44a6b7de7bf6c4bbbabd6
SHA1 692a736647a575278c65dcde5996410071df09ba
SHA512 6910581b8f3b88596a5e8da43beac9ea68f6aa3644b8e634eefa8f12c3be1c243ad31eff0122904d8c61462f040667569a47c9f19950e5dac7e1a6c8f89aede2
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avgntflt.sys

IMPHASH 935a7ea0e08363f64cb79c28de13e264
SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
MD5 d9f90202659f8ce4d5db6e83d24b46dd
SHA1 29a7b1068a5090ee59db422364b42d2c8f072a46
SHA512 b0a9a0c0f18446e6a2b9ad3200dbd2cb94acae5df553beb971b41220304941219d12d3e94ed91dec254e6b907dac6fcb1aa72a822a09a8e523cc76071b221c31
SSDEEP 3072:vMPogiYZ1dqoWYYCGxbceUW8bUDsQWBsMPelkz4IQ9RLNM/qIn20aqB:vooQZ1ddW5VUWvDTMGls4IQ9ZN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

24:1f:15:7d:b4:a5:38:b4:a7:f7:b6:aa:a8:ce:4e:9f:ad:38:ba:ee:d0:06:bb:74:31:3f:d6:76:41:08:d2:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Digest

e9:26:4e:79:f5:74:82:d2:64:ce:b2:4e:33:13:25:11:8e:62:a6:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Oct 14, 2021

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 3, 2021 - Mar 1, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

230332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb

ntoskrnl.exe

RtlUpcaseUnicodeString KeLeaveCriticalRegion RtlAnsiStringToUnicodeString IoGetStackLimits ZwQuerySymbolicLinkObject ZwReadFile KeInitializeApc KeInsertQueueApc RtlAppendUnicodeToString RtlInitAnsiString ZwDeleteValueKey wcsncat KeReleaseSpinLock ExpInterlockedPopEntrySList RtlEqualUnicodeString ZwOpenSymbolicLinkObject KeEnterCriticalRegion ZwOpenProcessTokenEx IoCreateSynchronizationEvent SeCreateClientSecurity RtlFreeUnicodeString ZwQueryValueKey ZwQueryDirectoryFile ExAcquireResourceSharedLite ExReleaseResourceLite SeQueryInformationToken ZwOpenProcess toupper PsGetCurrentThreadId RtlCopyUnicodeString ZwOpenFile ZwQueryInformationToken RtlUpcaseUnicodeChar IoIsSystemThread KeQueryPriorityThread PsGetProcessId ZwOpenKey KeAcquireSpinLockRaiseToDpc ZwSetInformationFile ZwQueryInformationFile RtlEqualSid ExReleaseResourceAndLeaveCriticalRegion ExpInterlockedPushEntrySList ZwQuerySecurityObject IoFileObjectType RtlNtStatusToDosError ExEnterCriticalRegionAndAcquireResourceExclusive NtClose ExQueryDepthSList ObReferenceObjectByHandle IoGetTopLevelIrp RtlGetOwnerSecurityDescriptor KeWaitForSingleObject PsSetCreateProcessNotifyRoutine ExDeletePagedLookasideList ProbeForRead RtlCreateUnicodeString KeResetEvent RtlIntegerToUnicodeString ZwSetValueKey MmMapLockedPagesSpecifyCache ExInitializePagedLookasideList towupper RtlDeleteElementGenericTableAvl PsCreateSystemThread PsTerminateSystemThread SeImpersonateClientEx PsRevertToSelf KeWaitForMultipleObjects RtlEnumerateGenericTableWithoutSplayingAvl ZwWriteFile IoDeleteSymbolicLink IoDeleteDevice IoThreadToProcess ExInitializeNPagedLookasideList RtlHashUnicodeString ExDeleteNPagedLookasideList _wcsupr RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExReleaseFastMutex ExAcquireFastMutex RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl RtlInitializeGenericTableAvl sprintf_s MmUnmapLockedPages ExWaitForRundownProtectionRelease ExAcquireRundownProtection KeReleaseInStackQueuedSpinLock RtlSetAllBits ExReleaseRundownProtection KeAcquireInStackQueuedSpinLock MmAllocatePagesForMdl IoFreeMdl RtlFindClearBitsAndSet ExReInitializeRundownProtection MmFreePagesFromMdl RtlClearBit KeBugCheckEx IoGetDeviceObjectPointer _wcsnicmp PsLookupProcessByProcessId PsReferencePrimaryToken KeDelayExecutionThread ZwQueryInformationProcess wcscpy_s RtlInsertElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry IoCreateDevice ZwSetSecurityObject IoDeviceObjectType _snwprintf RtlLengthSecurityDescriptor SeCaptureSecurityDescriptor RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor RtlAbsoluteToSelfRelativeSD IoIsWdmVersionAvailable SeExports wcschr RtlAddAccessAllowedAce RtlGetSaclSecurityDescriptor RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor ZwCreateKey ExAcquireResourceExclusiveLite SeTokenType PsDereferencePrimaryToken ExDeleteResourceLite PsDereferenceImpersonationToken PsGetCurrentProcessId ObOpenObjectByPointer ZwClose IofCallDriver RtlLengthSid KeNumberProcessors ExInitializeResourceLite ObfDereferenceObject IoCreateSymbolicLink RtlCompareMemory RtlInitializeSid RtlCompareUnicodeString IofCompleteRequest RtlAppendUnicodeStringToString KeQueryTimeIncrement IoGetCurrentProcess ZwCreateFile ExInitializeRundownProtection RtlInitializeBitMap RtlValidSid RtlGetVersion KeInitializeEvent MmGetSystemRoutineAddress KeSetEvent RtlInitUnicodeString InitializeSListHead IoRegisterShutdownNotification IoWMIWriteEvent ExFreePoolWithTag IoWMIRegistrationControl ExAllocatePoolWithTag RtlLengthRequiredSid IoUnregisterShutdownNotification RtlSubAuthoritySid __C_specific_handler

fltmgr.sys

FltGetDestinationFileNameInformation FltOpenVolume FltObjectReference FltGetVolumeProperties FltSetInstanceContext FltDeleteInstanceContext FltDeviceIoControlFile FltDoCompletionProcessingWhenSafe FltParseFileNameInformation FltGetFileNameInformation FltSetStreamContext FltCancelFileOpen FltGetStreamContext FltGetDiskDeviceObject FltObjectDereference FltCloseClientPort FltSendMessage FltQuerySecurityObject FltReferenceContext FltFsControlFile FltClose FltQueryInformationFile FltCreateFile FltGetInstanceContext FltReleaseFileNameInformation FltAllocateContext FltReleaseContext FltSetStreamHandleContext FltGetStreamHandleContext FltStartFiltering FltRegisterFilter FltBuildDefaultSecurityDescriptor FltGetRoutineAddress FltCloseCommunicationPort FltUnregisterFilter FltFreeSecurityDescriptor FltCreateCommunicationPort FltDeleteContext

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

19B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

752B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avipbb.cat

SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
MD5 351a7acf84d15a92dc75d3fc2f504f0e
SHA1 1d316b5d3a8729c0f03a140ac55066399fbc808f
SHA512 f705ee3bb4aa9328e808d0a8793692e1b525c0413e2005bd5f1d442be4da23e05b9549d85ccc8c1ae1f9c818a4ccc19207f0feffcd11d7b2b3039ed4e20c3b23
SSDEEP 192:Wh32QmwBYyKaWFWQFqtQjWMvN/qnaj9D6ad:WlPCFRkq/l5D6ad
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avipbb.inf

SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
MD5 b9a877ecc51ee9f13d9e5451f8b12895
SHA1 45a8abeb8c295295e4952893452c54850f721868
SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avipbb.sys

IMPHASH c67071a7e71763082096de0aad8766fc
SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
MD5 b49a44df6fe77ccb861985f5a5dd7ba5
SHA1 6e5163e191dd789f8cc33a531ce9ddd9bed2a842
SHA512 d53f56966c8750edc513c86c8e9b47fa1f0445a86a1d92621f1aa5fc9b9400a4a7f65b9ae0d2e537c9dde1b23b16fbd56af8ab74d62a8a777106e9b16e58be89
SSDEEP 3072:sUnNOdMrlqdSL3W3TRjWLKcudx0TzBrt6Ozv7druQuxAmP9FrN:PnQurlLLmxQu/0SOzZSBxDX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

ac:37:6a:b3:0e:25:4b:a1:7a:9b:38:3b:76:ef:af:ec:4a:6e:96:c8:6b:5b:80:08:2e:99:9f:33:bc:36:46:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

19:0f:6e:25:22:27:b3:83:8c:d4:bb:76:68:8a:0b:3a:01:f5:56:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Chains

Feb 4, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE

Serial Number

05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2019 - Nov 16, 2021

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 11, 2020 - Mar 5, 2021

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

176228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb

ntoskrnl.exe

KeInitializeMutex KeLeaveCriticalRegion RtlAnsiStringToUnicodeString ExInitializeNPagedLookasideList ExAcquireFastMutex PsLookupProcessByProcessId ZwQuerySymbolicLinkObject ZwReadFile RtlInitUnicodeString RtlIntegerToUnicodeString IoDeleteDevice KeSetEvent ExpInterlockedPushEntrySList MmGetSystemRoutineAddress KeInitializeEvent RtlInitAnsiString RtlGetVersion ExpInterlockedPopEntrySList ZwOpenSymbolicLinkObject FsRtlIsNameInExpression KeEnterCriticalRegion KeReleaseMutex ZwCreateFile ExDeletePagedLookasideList ExAcquireResourceSharedLite IoGetCurrentProcess ExReleaseResourceLite ZwClose RtlAppendUnicodeStringToString IofCompleteRequest ExQueryDepthSList KeWaitForSingleObject RtlCompareUnicodeString RtlCompareMemory ExDeleteResourceLite IoCreateSymbolicLink PsGetCurrentProcessId RtlCopyUnicodeString ExInitializePagedLookasideList KeReadStateEvent IoCreateDevice ExInitializeResourceLite KeNumberProcessors ObReferenceObjectByPointer ExDeleteNPagedLookasideList PsLookupThreadByThreadId IofCallDriver IoBuildSynchronousFsdRequest ExGetPreviousMode _vsnwprintf ObReferenceObjectByHandle PsGetCurrentThreadId KeWaitForMultipleObjects IoReleaseCancelSpinLock ZwWriteFile KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl PsThreadType RtlEnumerateGenericTableWithoutSplayingAvl KeAcquireSpinLockRaiseToDpc wcschr RtlUpcaseUnicodeChar KeClearEvent wcsncpy strncpy IoDriverObjectType wcsrchr PsGetProcessId KeDelayExecutionThread KeBugCheckEx ExReleaseFastMutex KeResetEvent IoWMIWriteEvent ExFreePoolWithTag IoDeleteSymbolicLink PsProcessType IoWMIRegistrationControl ProbeForRead ExAllocatePoolWithTag _strnicmp RtlInsertElementGenericTableAvl ExAcquireResourceExclusiveLite ObfDereferenceObject _stricmp ZwSetInformationFile ZwQueryInformationFile _wcsnicmp RtlDowncaseUnicodeChar PsReferencePrimaryToken ZwQueryObject ZwQuerySystemInformation SeQueryInformationToken ZwOpenProcess ZwQueryInformationProcess PsDereferencePrimaryToken RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl IoWriteErrorLogEntry IoAllocateErrorLogEntry __C_specific_handler

hal

KeQueryPerformanceCounter

avkmgr.sys

funca func8 func5 func0 func2 func7 func1 func4 func6 func3 func9

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win7/avkmgr.cat

SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
MD5 f3324c2c121d360f8ce3553e221c3ce6
SHA1 85939054d39067cc7e1089de71138b4b4283f800
SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win7/avkmgr.inf

SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
MD5 176af3c43b608af665f48a35f497bae1
SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win7/avkmgr.sys

IMPHASH bbbf29be00d696bbac6e5abddd6e312c
SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
MD5 eb5c2402e2f402a19504bf6ca9c3e06a
SHA1 63aa9690c36d743951558422d841276c25cde77d
SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Nov 14, 2018

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2016 - Jan 19, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 20, 2018 - Sep 20, 2019

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

1

Major OS version

6

Entry point

32868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

406B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avgio.dll

IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
MD5 49e51045f2951fd248318ac9f1ccb18e
SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 27, 2020

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

2a:09:50:26:3e:06:49:6a:27:81:f5:50

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 11, 2018 - Jul 11, 2021

Subject

CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Minor OS version

0

Major OS version

6

Entry point

32568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb

kernel32

SetProcessWorkingSetSize VerifyVersionInfoW DeleteFileW GetFileSize SetFileAttributesW WriteFile CreateIoCompletionPort PostQueuedCompletionStatus GetFileSizeEx ReadFile SetFilePointerEx QueryPerformanceCounter GetQueuedCompletionStatus LoadLibraryW ResetEvent GetCurrentThread GetCurrentThreadId SetThreadPriority TerminateThread GetTickCount VirtualQuery MapViewOfFile UnmapViewOfFile WriteConsoleW GetProcAddress GetModuleHandleW FreeLibrary GetSystemInfo OpenProcess GetCurrentProcessId GetCurrentProcess Sleep QueryPerformanceFrequency SetErrorMode VerSetConditionMask GetModuleFileNameW CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult DeviceIoControl CreateFileW SetLastError GetLastError CloseHandle SetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind InterlockedFlushSList RaiseException EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW MoveFileExW HeapValidate GetConsoleMode GetFileType ExitProcess HeapFree HeapAlloc GetStdHandle LCMapStringW MultiByteToWideChar GetProcessHeap SetStdHandle GetConsoleOutputCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers HeapSize DecodePointer

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW SetServiceStatus TraceMessage RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

SAVAPI/on_access/win64/win8/avgntflt.cat

SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
MD5 3ece229fca8ecdf8e4889e062abbf95a
SHA1 47aa2952646097710297f5bded9b115e418bac00
SHA512 985d4005541e25f39bc7abf80c05b97fe57220bf02bcbb7ff41f792283af5aba87d7db433217ffcea002d35dd113913bbb6e980fbf99778126f129a799b58573
SSDEEP 192:NfafyZYxJCxuXooyKfPFWQFzWzQPIiQLCamylqnajsq3rQe:Nc0IrPFRI3iQ3Jllgkrb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avgntflt.inf

SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avgntflt.sys

IMPHASH 949a3f7ef15514eb7758bc1d821f6019
SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
MD5 ec059af10524644bddcc073916e78375
SHA1 93a9466afee21f61f643f540b2ab82ac7db60b62
SHA512 88310251e07eb6edda3eb28d057a18fd7d1ea7a9adc5f861fa7ad127561bfb035468974fd11685b66654fc37dc3577d7d720e2e9e4f4fc38d116c1089ee9afe7
SSDEEP 6144:S2M8JRGRI16YO/HqUU2miFjq5K3vPRTh9EsRbmN6:S25ERI16htvo5K3vPRr+
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

205488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb

ntoskrnl.exe

RtlEqualUnicodeString RtlCopyUnicodeString RtlAppendUnicodeToString RtlUpcaseUnicodeChar RtlFreeUnicodeString KeQueryPriorityThread KeEnterCriticalRegion KeLeaveCriticalRegion KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock ExpInterlockedPopEntrySList ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite IoCreateSynchronizationEvent IoGetStackLimits ZwOpenFile ZwReadFile ZwOpenKey ZwDeleteValueKey ZwQueryValueKey ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlUpcaseUnicodeString PsGetCurrentThreadId PsGetProcessId ZwOpenProcess SeCreateClientSecurity SeQueryInformationToken IoIsSystemThread IoThreadToProcess ZwQueryDirectoryFile ZwOpenProcessTokenEx ZwQueryInformationToken KeInitializeApc KeInsertQueueApc ZwQueryInformationFile ZwSetInformationFile ExQueryDepthSList ExpInterlockedPushEntrySList ExEnterCriticalRegionAndAcquireResourceExclusive ExReleaseResourceAndLeaveCriticalRegion IoGetTopLevelIrp ObReferenceObjectByHandle IoSetFileObjectIgnoreSharing RtlEqualSid RtlGetOwnerSecurityDescriptor RtlNtStatusToDosError NtClose ZwQuerySecurityObject IoFileObjectType KeWaitForSingleObject RtlClearBit RtlSetAllBits RtlFindClearBitsAndSet KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExReInitializeRundownProtection ExAcquireRundownProtection ExReleaseRundownProtection ExWaitForRundownProtectionRelease MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl IoFreeMdl ExDeletePagedLookasideList PoUnregisterPowerSettingCallback PsSetCreateProcessNotifyRoutine towupper RtlIntegerToUnicodeString KeResetEvent ExInitializePagedLookasideList ProbeForRead RtlAnsiStringToUnicodeString RtlCreateUnicodeString __C_specific_handler KeWaitForMultipleObjects PsCreateSystemThread PsTerminateSystemThread RtlDeleteElementGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl SeImpersonateClientEx PsRevertToSelf ZwWriteFile IofCompleteRequest IoDeleteDevice IoDeleteSymbolicLink IoUnregisterShutdownNotification RtlHashUnicodeString ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList _wcsupr RtlCompareMemory RtlPrefixUnicodeString IoBuildDeviceIoControlRequest IofCallDriver IoGetAttachedDeviceReference RtlLookupElementGenericTableAvl ExAcquireFastMutex ExReleaseFastMutex RtlInitializeGenericTableAvl RtlGetElementGenericTableAvl RtlIsGenericTableEmptyAvl sprintf_s wcscpy_s IoAllocateErrorLogEntry IoWriteErrorLogEntry RtlInsertElementGenericTableAvl IoGetDeviceObjectPointer KeDelayExecutionThread ProbeForWrite ExGetPreviousMode MmProbeAndLockPages MmUnlockPages IoAllocateMdl NtOpenProcess MmIsAddressValid PsReferencePrimaryToken PsLookupProcessByProcessId ZwQueryInformationProcess NtQueryInformationProcess _wcsnicmp RtlInitAnsiString IoDeviceObjectType IoCreateDevice ZwSetSecurityObject RtlGetDaclSecurityDescriptor RtlGetGroupSecurityDescriptor RtlGetSaclSecurityDescriptor SeCaptureSecurityDescriptor RtlLengthSecurityDescriptor _snwprintf RtlCreateSecurityDescriptor SeExports IoIsWdmVersionAvailable RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor wcschr ZwCreateKey wcsncat toupper PsDereferenceImpersonationToken PsDereferencePrimaryToken SeTokenType ExDeleteResourceLite PsGetCurrentProcessId ObOpenObjectByPointer ZwClose KeNumberProcessors RtlLengthSid RtlSubAuthoritySid RtlInitializeSid RtlLengthRequiredSid RtlValidSid ZwCreateFile ObfDereferenceObject PoRegisterPowerSettingCallback IoWMIRegistrationControl IoRegisterShutdownNotification IoGetCurrentProcess IoCreateSymbolicLink ExInitializeRundownProtection ExInitializeResourceLite InitializeSListHead ExFreePoolWithTag ExAllocatePoolWithTag KeQueryTimeIncrement KeInitializeSpinLock KeSetEvent KeInitializeEvent RtlGetVersion RtlInitializeBitMap RtlAppendUnicodeStringToString RtlCompareUnicodeString MmGetSystemRoutineAddress ZwSetValueKey RtlInitUnicodeString

fltmgr.sys

FltGetDestinationFileNameInformation FltObjectReference FltGetVolumeProperties FltDeleteInstanceContext FltSetInstanceContext FltDeviceIoControlFile FltOpenVolume FltDoCompletionProcessingWhenSafe FltGetStreamContext FltSetStreamContext FltCancelFileOpen FltParseFileNameInformation FltGetFileNameInformation FltGetDiskDeviceObject FltObjectDereference FltSendMessage FltCloseClientPort FltReferenceContext FltQuerySecurityObject FltGetInstanceContext FltClose FltFsControlFile FltQueryInformationFile FltCreateFile FltReleaseContext FltGetStreamHandleContext FltSetStreamHandleContext FltAllocateContext FltReleaseFileNameInformation FltFreeSecurityDescriptor FltBuildDefaultSecurityDescriptor FltCloseCommunicationPort FltCreateCommunicationPort FltGetRoutineAddress FltStartFiltering FltUnregisterFilter FltRegisterFilter FltDeleteContext

Name

.text

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

NONPAGED

Size

512B

Virtual Size

3B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avipbb.cat

SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
MD5 209bedcc941da626c2db370a80e3513e
SHA1 c88910bf5a4b35893e60d92828568d20420a9caf
SHA512 ddef0175e3e2919c4504f99d054b314e48f4ed0ac5c1b3153e1581b3614f304fe3850a8d465163cb4c502d4b026986121d6e4e30fc421d2c583b689ec933a10f
SSDEEP 192:CEbRVRDy8nJCx0mwBYyKaWFWQF259Q8I+XqnajlGupG8hod:njJn00PCFRO7ImlORd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avipbb.inf

SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
MD5 b9a877ecc51ee9f13d9e5451f8b12895
SHA1 45a8abeb8c295295e4952893452c54850f721868
SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avipbb.sys

IMPHASH b2557b252ab2c20a9c87b8e7393248c5
SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
MD5 c8d33c5b49a4760f2d81710eba839ba2
SHA1 8f41e4333dabe52bfd988a68785d0687599f1154
SHA512 451dca816d38538e082c7388aac0997eb04f5e8fc288fe44aeb661ece1e717060d73f24d60c7576403a68a5fbda3f931161602a2a8b98f506b56ff64c095cd78
SSDEEP 3072:lRgvKNe0BiAKLgBy6IdaJHIcVOmBvU6vHCSEQuqQ3TJu7Gyz:l2069oIMbVOcvU6vxEBDJI7z
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

188416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb

avkmgr.sys

func2 func3 func4 func5 func1 func7 func8 func9 funca func6 func0

ntoskrnl.exe

RtlIntegerToUnicodeString RtlInitAnsiString RtlInitUnicodeString MmGetSystemRoutineAddress RtlAnsiStringToUnicodeString RtlCompareUnicodeString RtlCopyUnicodeString RtlAppendUnicodeStringToString RtlGetVersion KeInitializeEvent KeReadStateEvent KeResetEvent KeSetEvent KeInitializeMutex KeReleaseMutex KeEnterCriticalRegion KeLeaveCriticalRegion KeWaitForSingleObject ExAllocatePoolWithTag ExFreePoolWithTag ExAcquireFastMutex ExReleaseFastMutex ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList ExInitializePagedLookasideList ExDeletePagedLookasideList ProbeForRead ExInitializeResourceLite ExAcquireResourceSharedLite ExAcquireResourceExclusiveLite ExReleaseResourceLite ExDeleteResourceLite IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoGetCurrentProcess IoWMIRegistrationControl ObReferenceObjectByPointer ObfDereferenceObject ZwCreateFile ZwReadFile ZwClose ZwOpenSymbolicLinkObject ZwQuerySymbolicLinkObject RtlInsertElementGenericTableAvl PsGetCurrentProcessId PsLookupProcessByProcessId PsLookupThreadByThreadId FsRtlIsNameInExpression __C_specific_handler KeNumberProcessors _stricmp KeWaitForMultipleObjects ExGetPreviousMode IoBuildSynchronousFsdRequest IofCallDriver IofCompleteRequest IoReleaseCancelSpinLock ObReferenceObjectByHandle ZwWriteFile PsGetCurrentThreadId _vsnwprintf KeInitializeSpinLock KeAcquireSpinLockRaiseToDpc KeReleaseSpinLock PsCreateSystemThread PsTerminateSystemThread RtlInitializeGenericTableAvl RtlEnumerateGenericTableWithoutSplayingAvl PsThreadType wcschr RtlUpcaseUnicodeChar KeClearEvent strncpy wcsncpy wcsrchr PsGetProcessId IoDriverObjectType KeDelayExecutionThread ProbeForWrite MmProbeAndLockPages MmUnlockPages IoAllocateMdl IoFreeMdl ZwQueryInformationFile NtOpenProcess MmIsAddressValid ZwOpenProcess NtClose SeQueryInformationToken PsReferencePrimaryToken PsDereferencePrimaryToken ZwQueryObject ZwQuerySystemInformation ZwQueryInformationProcess NtQueryInformationProcess RtlDeleteElementGenericTableAvl RtlLookupElementGenericTableAvl _wcsnicmp RtlDowncaseUnicodeChar IoAllocateErrorLogEntry IoWriteErrorLogEntry wcscpy_s ZwSetInformationFile _strnicmp PsProcessType

hal

KeQueryPerformanceCounter

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/on_access/win64/win8/avkmgr.cat

SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
MD5 88ae7b9879c9ac3a65ef73424600ba65
SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/on_access/win64/win8/avkmgr.inf

SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
MD5 fabaac0d5c0ef083150dec8615a8b2bb
SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/on_access/win64/win8/avkmgr.sys

IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
MD5 40786e1ac650f9f7e8b67a672b5eb69e
SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

10

Entry point

32768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

275B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

512B

Virtual Size

342B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SAVAPI/plg_fops_dummy.dll

IMPHASH 030a305e7c90f0e0ba6c00476e02031b
SHA256 18f14d6ef36885b58dbe598cee1ff20c83afd5f9cf0c739394f74251f51bbf2f
MD5 e31669de92895bb6b150e3f319267458
SHA1 83a6ffc6da2421d28e4f8a068a0950726078673c
SHA512 2d5f7f682e88fe83223efa7763e1dd46f50462eb8f164c90bf34c41c40ba06b98720b2acc04238809fa646b708a2c4a640ddb0e1ec0a8ae244cc29737e4fec6d
SSDEEP 1536:ALBBbE9pvjyBQO53mWGw6abjwgNXjLEFSg1NZXarnYsWYEbcdOy/N5+q0q:ITbEP+BQO53mnanwmXjdIcnnO45+q0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

6689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW SetFileAttributesW DeleteFileW MoveFileExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetCurrentDirectoryW GetFullPathNameW MultiByteToWideChar CompareStringW LCMapStringW SetStdHandle GetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation GetStringTypeW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW DecodePointer

SAVAPI/productname.dat

SHA256 84cc36c119381af58ccaead1ad8995b92317ca4ae8c38a38dc37071d712bb4d8
MD5 53ce39cd5a411bb30c5b1d413e641ec8
SHA1 0b7c31237c9b0a436ace5274938d420f8c7d6385
SHA512 3524dea3bfd8cc9539d70102ab3f49da50a1b0c1a68b7073869b7f193a30562d716526a6de13a40f07480763e3841bcc3743b91f46f9f87630707e63e7d76f26
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi.conf

SHA256 b30e328a864f6c4bd5544f6a7c3dbdc2cb97e668e2e583de0590506c881a16b9
MD5 c1f0cfade5c32a37b223f5f7b0ec3510
SHA1 8fb0afd1a53feb25652937d09865e3cc8cf3f02e
SHA512 9dc05c25f907ce29ebccca1c34fbf926ea7a4d803e2d2fb6106192176681fd151b82605bc066e7e55e03b14aae3ac81008dadc70889dbae887de5f67ec11aa40
SSDEEP 768:CORmWh90JmGrHbKlckb58aomNOKggzy+Yq:thSPHpkmnmN/dW+Yq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SAVAPI/savapi.dll

IMPHASH 98df4127bc9f89b567dba0807b2d2ea7
SHA256 5617fc94cdd8b0c7a14df62cfc77f64ffe157d5fe96cc02c9ff209db97274e0e
MD5 85815e63269ec76386fd2a4d418f75be
SHA1 34b6ae807c5ab324e3e5a624b4bfa325ad86d890
SHA512 08401d39a1d8cd2b047b66c14236aaf04fc79d2a21c57e38198a6c2ccfca5e2959628a4674eb5609f7bb8d49eb87ea9033562bbdb058dc03beab81478b95e7d6
SSDEEP 49152:CZb4QJm+I6aJ9YPizIT9E1mJ85NDVwwLRFytPzZnpvsqKTZb:CZb4QJDVOKwmaNDVwSC1Znp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

a2:92:c9:67:e5:3a:02:3e:64:c3:a7:28:a2:47:ad:02:cf:a4:35:7f:71:c9:7b:9a:18:aa:6a:17:84:91:1a:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

6

Entry point

2071915

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\libsavapi\daemon\libsavapi.pdb

kernel32

SetEvent CreateEventW GetCurrentProcess FindClose LoadLibraryW LoadLibraryA FreeLibrary ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread GetSystemTimeAsFileTime QueryPerformanceCounter CreateFiber DeleteFiber SwitchToFiber GetProcAddress GetModuleHandleW WriteFile GetFileType GetEnvironmentVariableW GetStdHandle FormatMessageW TlsFree TlsSetValue TlsGetValue TlsAlloc QueryDosDeviceW GetTimeFormatW GetDateFormatW GetLocalTime GetCurrentThreadId GetCurrentProcessId Sleep UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemInfo CloseHandle GetOEMCP GetACP WideCharToMultiByte MultiByteToWideChar CreateHardLinkW GetTempPathW SetLastError GetNativeSystemInfo HeapSize GetStringTypeW GetProcessHeap GetCommandLineA FindFirstFileExW GetCPInfo IsValidCodePage DecodePointer LCMapStringW CompareStringW GetModuleFileNameW DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GlobalFree FindNextFileW OutputDebugStringW FindFirstFileW HeapReAlloc HeapAlloc HeapFree WriteConsoleW FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler GetModuleHandleExW ExitProcess GetConsoleOutputCP SetFilePointerEx RaiseException EncodePointer RtlUnwind InterlockedFlushSList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError CreateNamedPipeA CreatePipe UnlockFileEx UnlockFile LockFileEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount InitializeCriticalSectionEx QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA MoveFileExA WaitForSingleObjectEx CompareFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW GetSystemTime SystemTimeToFileTime InitializeCriticalSection ReleaseMutex WaitForSingleObject CreateMutexA CreateEventA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation SetErrorMode LoadLibraryExW FindFirstFileA GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetEnvironmentVariableW SetStdHandle CreateFileW DeleteFileW SetFilePointer DeviceIoControl GetOverlappedResult CancelIo MoveFileExW FlushFileBuffers ReadFile PeekNamedPipe ReleaseSemaphore CreateSemaphoreA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW CreateDirectoryW RemoveDirectoryW GetCurrentThread OpenFileMappingW FormatMessageA DuplicateHandle SwitchToThread SetEndOfFile ResetEvent SetHandleInformation CreateFileMappingA CreateFileA GetVersionExW GetModuleFileNameA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess LockFile

user32

GetSystemMetrics GetUserObjectInformationW MessageBoxW GetProcessWindowStation

advapi32

AllocateAndInitializeSid CryptAcquireContextA LogonUserW CheckTokenMembership FreeSid CloseServiceHandle OpenSCManagerW OpenServiceW GetEffectiveRightsFromAclW GetNamedSecurityInfoA GetNamedSecurityInfoW GetSecurityInfo OpenProcessToken OpenThreadToken PrivilegeCheck LookupPrivilegeValueA CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl QueryServiceStatus CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom

ws2_32

inet_ntop WSAWaitForMultipleEvents htons WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSAResetEvent inet_pton __WSAFDIsSet select htonl inet_addr setsockopt listen connect closesocket bind accept WSASetLastError send getpeername recv getnameinfo freeaddrinfo getaddrinfo ntohs getsockopt getsockname ioctlsocket gethostname WSAAddressToStringW WSAGetLastError WSACleanup WSAStartup gethostbyname ntohl shutdown getservbyname recvfrom sendto WSAGetOverlappedResult WSARecv WSASend socket

shlwapi

PathCanonicalizeW

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertOpenStore CertOpenSystemStoreA CertFreeCertificateContext CertGetCertificateContextProperty CertDuplicateCertificateContext CertCloseStore CertGetEnhancedKeyUsage CertGetIntendedKeyUsage

iphlpapi

GetAdaptersAddresses

mswsock

TransmitFile

rpcrt4

UuidCreate

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

CharToSTCHAR SAVAPI_APC_cache_operation SAVAPI_APC_get_version SAVAPI_APC_initialize SAVAPI_APC_uninitialize SAVAPI_FPC_disable_preinit SAVAPI_OA_create_instances SAVAPI_OA_initialize SAVAPI_OA_start_scan SAVAPI_OA_stop_scan SAVAPI_OA_uninitialize SAVAPI_TCHAR_free SAVAPI_char_free SAVAPI_create_instance SAVAPI_engine_modules_get SAVAPI_engine_modules_get_ex SAVAPI_engine_versions_get SAVAPI_extract_malware_names SAVAPI_free SAVAPI_get SAVAPI_get_dynamic_detect SAVAPI_get_fops SAVAPI_get_instance_pool SAVAPI_get_type SAVAPI_get_user_data SAVAPI_get_version SAVAPI_global_set SAVAPI_initialize SAVAPI_is_running SAVAPI_is_running_ex SAVAPI_register_callback SAVAPI_release_instance SAVAPI_reload_engine SAVAPI_reload_engine_ex SAVAPI_reset_instance SAVAPI_scan SAVAPI_send_signal SAVAPI_set SAVAPI_set_avpal_init_flags SAVAPI_set_avpal_inited SAVAPI_set_ex SAVAPI_set_fops SAVAPI_set_log_callback SAVAPI_set_quickload_init SAVAPI_set_user_data SAVAPI_simple_scan SAVAPI_uninitialize SAVAPI_unregister_callback SAVAPI_with_encoding_get STCHARToChar STCHARToString STCHARToTCHAR StringToSTCHAR TCHARToSTCHAR _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetNumberValue@4 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithLength@8 _cJSON_ParseWithLengthOpts@16 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_SetValuestring@8 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4 asc2bin bin2asc bin2hex hex2bin

SAVAPI/savapi.exe

IMPHASH 4b8fd0313c7bf7140bc5c6706adc5060
SHA256 212b3d2c8f570375b95fb2de9f681a9f85796220b4bcb5abb6a2d248ffd9e1ea
MD5 ae60aaf104b487577024715df996309e
SHA1 ca80a770fd21bf51a4f1a3c05b1d4dc974780804
SHA512 108efd4b3e463a1ce658d497de80fcdcb9c6b7ab08abd8fddd639e8de4383b6a4f793cb3dc249d9c5e6d157db897d10b65d1e919487e65b480305fa61be3c98f
SSDEEP 12288:w/PGF6AJykhK9Qc955YkgP4imIJ93moIdsLvBPREFxQKjFBtD1O9rDxO77pP9jkf:Wu185YkRimID2sav1O9rDxMnkYAbmS11
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

f6:aa:98:bc:f7:f9:f4:1c:d7:17:98:2c:75:dc:c7:c8:5b:74:a0:8f:08:c9:0e:ae:f6:e1:7d:7f:64:44:0a:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

391995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\src\savapi.pdb

ws2_32

htonl getpeername send recv inet_addr getsockname ioctlsocket ntohl freeaddrinfo shutdown select getservbyname connect closesocket bind accept __WSAFDIsSet getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom ntohs htons listen getaddrinfo socket setsockopt WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

shlwapi

PathCanonicalizeW

mswsock

TransmitFile

rpcrt4

UuidCreate

kernel32

DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIo SetEvent ResetEvent WaitForSingleObject CreateEventW GetCurrentProcessId GetTempPathW GetModuleFileNameW SetLastError CreateHardLinkW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW OutputDebugStringW Sleep GetTickCount GetStdHandle GetConsoleScreenBufferInfo GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile DeviceIoControl CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseMutex CreateMutexA ReleaseSemaphore CreateSemaphoreA SetHandleInformation GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation ExpandEnvironmentStringsW GetCurrentProcess FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle ReadFile GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetStdHandle DeleteFileW SetFilePointer GetOverlappedResult MoveFileExW LockFile LockFileEx UnlockFile UnlockFileEx FlushFileBuffers PeekNamedPipe CreateFileA ConnectNamedPipe CreateNamedPipeA CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize FreeLibrary GetProcAddress LoadLibraryExW SetEndOfFile SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FormatMessageA DuplicateHandle SwitchToThread GetCurrentThread TlsGetValue TlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree OpenFileMappingW GetEnvironmentVariableW SetEnvironmentVariableW CreateFileMappingA GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess GetVersionExW GetModuleFileNameA LoadLibraryA SetUnhandledExceptionFilter UnhandledExceptionFilter CloseHandle CreateFileW SetConsoleCtrlHandler GetLastError IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InitializeCriticalSectionAndSpinCount RaiseException GetModuleHandleExW WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx GetConsoleMode ReadConsoleW ExitProcess GetCommandLineA GetConsoleCP HeapFree HeapAlloc CompareStringW LCMapStringW HeapReAlloc DecodePointer CreatePipe WriteFile IsValidCodePage GetCPInfo GetConsoleOutputCP FindFirstFileExW GetStringTypeW GetProcessHeap SetConsoleMode ReadConsoleInputW GetFileSizeEx SetErrorMode

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW LookupPrivilegeValueA PrivilegeCheck OpenThreadToken GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExA LookupAccountNameA LookupAccountSidA IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority EqualSid OpenProcessToken StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegOpenKeyExW RegSetValueExW RegDeleteKeyW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource CryptReleaseContext

SAVAPI/savapi_post.bat

SHA256 4682c0f3dcbafa32e3dae743268a0babf67fe2970b4b0dd3f91cc7ed54627545
MD5 0dc718c8c4ccc13e58f9224f1af1125d
SHA1 51cca0861c564b973dc5017f6a9c86d47b2dad31
SHA512 b6e4b9b9b50669198d35a06c15bf8334eb3e68801946a96be66aee00361faceed6eefd84303979c5fceb87588a21d4fc1c94ca2a9dea5fb062d2a9da8c4cf27f
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_pre.bat

SHA256 ec07adec51dc57f42077b2757421012c49fc771fb8cf664c36505d664e996c36
MD5 912510dd6dd41ca900d10834879601c7
SHA1 4dcaa7061636cf05ad5fe72ecb20ca29f2c003fe
SHA512 63f0e1b37d83d208d1d9fab44b74d5f0def82caeb4f2289d7ffb6bacb28013f6a24ae61d9a83e6684c80b5221675d76bc75a94c9fb2ebe31819465135753ea6c
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_pretest.bat

SHA256 767637bffb932cad48218f8d128f2908e57c4a42326db29dfeaa1c5509018186
MD5 55d563f40e716ab251760a52f49a0e68
SHA1 fc8a086681368388dbf77199cabac654765b133b
SHA512 b218b11f9d66812a76c99b5a9a8cc73f9c83c626cef17049425855d5242e9c2e4355557c94d8a9f4d8f0fa6edc99a4658849f5edbb0320f7342dae4bda18e34b
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/savapi_restart.exe

IMPHASH 28329b2bbd34737edf89c242f51f5b11
SHA256 4b75f1e230aa0195e8da68e481eeb90b9d85194f15e2d458bd8ebee6d9d69ccc
MD5 9919de22bf888ab8d7122a04646aa313
SHA1 35af4b2757b6d96e345ba43af1d126ccfbbeb23d
SHA512 deb7c4af295ed1c90205bd4c1299c62dbed70711ae16e3eceb64b386ca5e78537f801c1641d13617a6ee448cb187bb0399990a8161abc6685f0ee941a110224e
SSDEEP 3072:F52hQmn2wcv4N6eQQlhsPGhUI/CR5zC3MBqtRsivf1Z8OpyXBg7HZP0k:Le12w7tBlaV5zHqdEBsyk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ab:57:a6:80:c4:ea:58:25:e7:8d:b5:52:70:f1:55:ac:6e:3d:08:c2:c2:aa:0a:47:59:b6:84:fe:e8:23:50:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

8116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_restart\savapi_restart.pdb

kernel32

WriteConsoleW GetTickCount Sleep FormatMessageW LocalFree CreateProcessW GetExitCodeProcess WaitForSingleObject GetLastError CloseHandle CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc DecodePointer

advapi32

StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle

SAVAPI/savapi_stub.exe

IMPHASH 25235b078b3d329488576152e6e2b169
SHA256 91265685308da5d2a1cc5f478b83e43a4656fd075d7cfee3923380905fd8dfaf
MD5 3899d956a9c88d0519e188d067de5d19
SHA1 241b01e86a121694a48722ce4dc6c08bd0bf5cfd
SHA512 7f6e4d7b279f3c08022af6290e4015f12d4e8ba54ef65681d162bb421f08a81b57b4b2e7004861638c227da746127f5e9d4ee7932f3e2067b990f6b2951cb633
SSDEEP 6144:a+UDVHIZD9qmbvM3Y+c8A50LBZAzOejDx19iM856t0Q+GAC9k0q3Yl8rif9P2432:a+UDVHIZfbU3Y8/fejDxfiM85m0Q+GAr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

8f:16:bb:ad:47:5f:b8:8f:62:0e:4e:b0:45:aa:d3:89:cf:fe:3a:cd:1a:9c:4e:28:5c:77:f3:42:cd:62:97:80

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

1

Major OS version

6

Entry point

128989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_stub\savapi_stub.pdb

ws2_32

getnameinfo freeaddrinfo getaddrinfo getservbyname ntohs htons htonl getpeername gethostbyname socket shutdown send select recv listen inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl WSAGetLastError WSACleanup WSAStartup gethostname

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW RaiseException LoadLibraryExW GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW GetStdHandle CloseHandle GetHandleInformation SetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW ExitProcess SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW TryEnterCriticalSection SetEvent ReleaseMutex CreateMutexA CreateEventA FlushFileBuffers ReadFile SetFilePointer WriteFile PeekNamedPipe GetOverlappedResult CancelIo Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapSize GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent TerminateProcess CreateFileA CreatePipe CreateNamedPipeA GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx FreeLibrary InitializeCriticalSectionAndSpinCount RtlUnwind GetCommandLineA HeapAlloc HeapFree CompareStringW LCMapStringW HeapReAlloc IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer GetConsoleOutputCP GetConsoleMode FindFirstFileExW GetStringTypeW GetProcessHeap SetFilePointerEx SetFileAttributesW SystemTimeToFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

SAVAPI/savapiclient.dll

IMPHASH c23ac466c64dc5ed7062eba2817f1e18
SHA256 8f5aedf1f8e8dd027aabb3420ed7e0e38219a7d8d3b880f3a46671d32270fc69
MD5 eb905e77afda1a6e65342a83ac5fba75
SHA1 93434d20f75db97bf1947043982d33d282db96a0
SHA512 4fdb07e66639fe5efeea5f45a57db932be99e7ce81aac392f7fd52dc0b333a219da5af9df980ca3caf256f899640a4bcebdbdb8aa4bb2269160f692a72b880a2
SSDEEP 6144:+e0cf8LyAE2TDdvqRyTsJEgXHr067z7WcYj57l5nFLFzGTDkYXVjdZn/FOoiOTFS:+e0cf8LyeTDdvqRyTsNHr0GG5FBzGTDM
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

1b:8d:ab:08:2a:9f:64:95:d8:31:2d:38:d5:c5:46:3f:a9:5b:8b:1c:b2:ab:a7:07:06:06:90:b4:14:6a:be:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

180806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\libsavapi\client\libsavapiclient.pdb

ws2_32

recv inet_addr setsockopt send freeaddrinfo getaddrinfo getservbyname ntohl htons htonl getsockname getpeername ioctlsocket getnameinfo WSASend WSARecv WSAGetOverlappedResult sendto recvfrom socket shutdown select ntohs listen connect closesocket bind accept __WSAFDIsSet WSACleanup WSAStartup gethostbyname gethostname WSAGetLastError getsockopt

mswsock

TransmitFile

rpcrt4

UuidCreate

advapi32

GetNamedSecurityInfoA RegisterEventSourceW CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW DeregisterEventSource GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid LookupPrivilegeValueA PrivilegeCheck OpenThreadToken OpenProcessToken RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW

kernel32

GetModuleHandleExW RaiseException LoadLibraryExW FreeLibrary WriteConsoleW RtlUnwind InterlockedFlushSList GetModuleHandleW GetStartupInfoW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW DecodePointer IsValidCodePage GetCPInfo SetEnvironmentVariableW GetConsoleOutputCP GetConsoleMode FindFirstFileExW FindNextFileW GetCommandLineA GetProcessHeap GetStringTypeW SetFilePointerEx InitializeCriticalSectionAndSpinCount GetOverlappedResult GetLastError SetLastError CloseHandle GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetHandleInformation WaitForSingleObject CreateEventA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA GetCurrentProcess GetCurrentThread OpenFileMappingW GetStdHandle SetStdHandle CreateFileW DeleteFileW GetFileInformationByHandle SetFilePointer DeviceIoControl HeapSize CancelIo MoveFileExW CreateHardLinkW FlushFileBuffers ReadFile WriteFile PeekNamedPipe GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FormatMessageA ReleaseSemaphore CreateSemaphoreA DuplicateHandle SwitchToThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess CreateFileA GetVersionExW GetModuleFileNameA GetProcAddress LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA IsDebuggerPresent InitializeSListHead QueryPerformanceCounter UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

shell32

CommandLineToArgvW

SAVAPI/scew.dll

IMPHASH 571b82e04a3103a0e1e37478d9e58122
SHA256 10f3a985da345376502bb8e4fce9c59aa15633b78347bf9080fb61bdd2e3cd5d
MD5 4a144eb1f737dc00689659b36aff0384
SHA1 4ce0c8afbd153473d6a03fb2743e209b5ddd1c0e
SHA512 68e5044ed77ebdcef9b0b3fec7174ef5faf56b38aebf5df64ec925c817021453e97a3a02a348996cfb3976b995e59439b3128930ba176600ab4b10c12ff40726
SSDEEP 6144:G5ieH3XO7LeWBl3bVan3/G6C1XNj7rFIgQM3mbPnTbqMalXwnhHyz:G5PH3Xciil3kne6C1XNj7rFbQMYIwnk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c1:2a:dd:1d:b0:2a:c6:c6:97:1c:24:59:34:88:24:37:bb:16:26:f3:4a:42:f2:97:20:2d:01:3e:82:63:50:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

1

Major OS version

6

Entry point

173781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\kmr4g80c\common\scew\scew.pdb

XML_Parse scew_attribute_compare scew_attribute_copy scew_attribute_create scew_attribute_free scew_attribute_name scew_attribute_parent scew_attribute_set_name scew_attribute_set_value scew_attribute_value scew_element_add scew_element_add_attribute scew_element_add_attribute_pair scew_element_add_element scew_element_add_pair scew_element_attribute_by_index scew_element_attribute_by_name scew_element_attribute_count scew_element_attributes scew_element_by_index scew_element_by_name scew_element_children scew_element_compare scew_element_contents scew_element_copy scew_element_count scew_element_create scew_element_delete_all scew_element_delete_all_by_name scew_element_delete_attribute scew_element_delete_attribute_all scew_element_delete_attribute_by_index scew_element_delete_attribute_by_name scew_element_delete_by_index scew_element_delete_by_name scew_element_detach scew_element_free scew_element_free_contents scew_element_list_by_name scew_element_name scew_element_parent scew_element_set_contents scew_element_set_name scew_error_code scew_error_expat_code scew_error_expat_column scew_error_expat_line scew_error_expat_string scew_error_string scew_isempty scew_list_append scew_list_create scew_list_data scew_list_delete scew_list_delete_item scew_list_find scew_list_find_custom scew_list_first scew_list_foreach scew_list_free scew_list_index scew_list_last scew_list_next scew_list_prepend scew_list_previous scew_list_size scew_parser_create scew_parser_expat scew_parser_free scew_parser_ignore_whitespaces scew_parser_load scew_parser_load_stream scew_parser_namespace_create scew_parser_reset scew_parser_set_element_hook scew_parser_set_tree_hook scew_printer_create scew_printer_free scew_printer_print_attribute scew_printer_print_element scew_printer_print_element_attributes scew_printer_print_element_children scew_printer_print_tree scew_printer_set_indentation scew_printer_set_indented scew_printer_set_writer scew_reader_buffer_create scew_reader_close scew_reader_create scew_reader_data scew_reader_end scew_reader_error scew_reader_file_create scew_reader_fp_create scew_reader_free scew_reader_read scew_strcmp scew_strdup scew_strescape scew_strtrim scew_tree_compare scew_tree_copy scew_tree_create scew_tree_free scew_tree_root scew_tree_set_root scew_tree_set_root_element scew_tree_set_xml_encoding scew_tree_set_xml_preamble scew_tree_set_xml_standalone scew_tree_set_xml_version scew_tree_xml_encoding scew_tree_xml_preamble scew_tree_xml_standalone scew_tree_xml_version scew_writer_buffer_create scew_writer_close scew_writer_create scew_writer_data scew_writer_end scew_writer_error scew_writer_file_create scew_writer_fp_create scew_writer_free scew_writer_write

SAVAPI/update.bat

SHA256 924f07591863b3e6d43371593a3c4d57bba93cdbf59fdf102ba72abd55e92879
MD5 b862a1baac142bcacd391414d665a0a1
SHA1 79aa0c97010707640bfa3082b29fd61b1373dbce
SHA512 788f4e959fdf91f2c3a2a46ff9d1ed51f96c73238f3e9aaab9e2b2bd45759645085082aa831220c9ce023a7a741213538d852658b9cbe4b12bbee5705e1f2d7b
MD5 SHA1 SHA512

NSIS installer

installer

SAVAPI/xvdfmerge.dll

IMPHASH 8e0283b879a0a5a261fb176ecb652c35
SHA256 d20f7ad78d1d548ebea41f6b496cb2399f8186493564c777f192c9a0eed23f18
MD5 af329640a44f6dc93e395e167a0c80f9
SHA1 9f3c6e132c874ec689c2ab5ad21282f326d93694
SHA512 988ce1e03736fbb4369bd5e0ffc52dae9c70811c65d11066d99a76e372fb72108d80c727fe4dd4e4e1125c927a68caf97af18009fb362048f408dbe36caba440
SSDEEP 6144:ylOdse4zxgQM+50K5xDAcAd5gL22nn0kvrDmENiyoJjK7bdgaO/10kGsKceGAqUh:ylOdse41gW50K5xDBXlvrDdiyoJjK7bh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

64:f1:e3:7c:88:4f:69:d7:db:03:39:7d:13:fd:48:88:53:4f:5b:08:ce:bc:80:66:18:e8:5d:80:cb:78:84:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Chains

Mar 21, 2023

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445

Serial Number

09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2022 - Jun 1, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

6

Entry point

148328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Windows\Temp\a2a2bepz\common\xvdf_merge\xvdfmerge.pdb

ws2_32

getaddrinfo getservbyname ntohs htons htonl getpeername socket shutdown send select recv getnameinfo inet_addr getsockname ioctlsocket connect closesocket bind accept ntohl freeaddrinfo WSAGetLastError WSACleanup WSAStartup gethostbyname gethostname listen

rpcrt4

UuidCreate

kernel32

CreateThread WriteConsoleW GetModuleHandleExW ReadConsoleW GetConsoleMode SetFilePointerEx RaiseException InitializeCriticalSectionAndSpinCount GetLastError SetLastError MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP CreateHardLinkW OutputDebugStringW GetModuleFileNameW GetCurrentProcessId GetCurrentThreadId GetLocalTime GetDateFormatW GetTimeFormatW SetErrorMode FreeLibrary GetProcAddress LoadLibraryExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TlsAlloc TlsFree GlobalFree FindClose FindFirstFileA FindFirstFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileType GetFileTime GetFullPathNameW SetFileAttributesW SetFileTime LocalFree SetCurrentDirectoryW GetCurrentDirectoryW GetDriveTypeA GetDriveTypeW FlushFileBuffers ReadFile SetFilePointer WriteFile FreeLibraryAndExitThread GetOverlappedResult CancelIo WaitForSingleObject CreateEventA CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ExitThread ReleaseMutex CreateMutexA Sleep GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation CreateDirectoryW FindNextFileW RemoveDirectoryW HeapSize SetStdHandle CreateFileW DeleteFileW DeviceIoControl MoveFileExW ReleaseSemaphore CreateSemaphoreA DuplicateHandle GetCurrentProcess SwitchToThread GetCurrentThread TlsGetValue TlsSetValue SetEndOfFile ResetEvent GetHandleInformation SetHandleInformation WaitForMultipleObjects GetExitCodeProcess CreateProcessW OpenProcess TerminateProcess FormatMessageA CreateFileA GetVersionExW GetModuleFileNameA LoadLibraryA LockFile LockFileEx UnlockFile UnlockFileEx CreatePipe CreateNamedPipeA RtlUnwind InterlockedFlushSList ExitProcess HeapFree HeapAlloc HeapReAlloc CompareStringW LCMapStringW GetConsoleOutputCP IsValidCodePage GetCPInfo SetEnvironmentVariableW DecodePointer FindFirstFileExW GetCommandLineA GetProcessHeap SetEvent GetStringTypeW PeekNamedPipe GetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW

shell32

CommandLineToArgvW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA LogonUserW SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo GetNamedSecurityInfoW GetNamedSecurityInfoA GetEffectiveRightsFromAclW FreeSid AllocateAndInitializeSid RegSetValueExW RegCreateKeyW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource

SOS_README.md

SHA256 72bab8ad57ae20824c84aaf9fe2e0e305b2108286e066545e6bac14ac7af1450
MD5 afdf90f86dd5c98ccee0be65cbb99f0a
SHA1 dd66bbff9bcc51522b0985d0f42b34277fa3ae6d
SHA512 bc06ebe3b83956aa78190b543134d89112bbf33dac89faad71830cf24a872aa1982ded9d03cb38b969727502d26b7b9154781940f0682d5a7c7d330531a137f7
MD5 SHA1 SHA512

NSIS installer

installer

SQLite.Interop.dll

IMPHASH 34df93b01d634fcb6a5390542276120d
SHA256 0dcdfbad2b4fd598ee78682b3920e1a268b03bb47b5dc26fbb9050089368a043
MD5 5810639d1477c0c33ddd1efe75256dbd
SHA1 6a6149730e40fecd9c30534e8f806e310d03e1cd
SHA512 f22368fcf5fe5495d0e318b692f163e8e6438735601132fe0d66158c8ae26e99453e8931388884ecfd998e42de3f98bbc9b10e89ff081609006b9805c1a40d9c
SSDEEP 24576:W4QYrTvFVZfiPaD0Yfvpmy/tabrremrrD5tNdKksOLnvirpl7609abLvN:EYrTAPDYf1mD7KksOGrpFkbzN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

5792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\mistachkin\Documents\checkouts\sqlite\dotnet\bin\2017\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

kernel32

LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx OutputDebugStringA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SetFilePointerEx GetDiskFreeSpaceW WriteFile AreFileApisANSI GetFullPathNameW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile DeleteFileA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA CompareStringW LCMapStringW GetACP GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStdHandle GetFileType GetStringTypeW SetStdHandle DecodePointer GetConsoleCP GetConsoleMode WriteConsoleW

advapi32

CryptDeriveKey CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash

_interop_compileoption_get@4 _interop_compileoption_used@4 _interop_libversion@0 _interop_sourceid@0 _sqlite3_backup_finish_interop@4 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_parameter_name_interop@12 _sqlite3_blob_close_interop@4 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_context_collcompare_interop@20 _sqlite3_context_collseq_interop@16 _sqlite3_create_disposable_module_interop@112 _sqlite3_create_function_interop@36 _sqlite3_cursor_rowid_interop@12 _sqlite3_errmsg_interop@8 _sqlite3_finalize_interop@4 _sqlite3_index_column_info_interop@32 _sqlite3_last_insert_rowid_interop@8 _sqlite3_malloc_size_interop@4 _sqlite3_memory_highwater_interop@8 _sqlite3_memory_used_interop@4 _sqlite3_msize_interop@8 _sqlite3_open16_interop@20 _sqlite3_open_interop@20 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_reset_interop@4 _sqlite3_result_double_interop@8 _sqlite3_result_int64_interop@8 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor_interop@12 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_pointer sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_create_window_function sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_drop_modules sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_filename_database sqlite3_filename_journal sqlite3_filename_wal sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts3_may_be_corrupt sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_hard_heap_limit64 sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_keyword_check sqlite3_keyword_count sqlite3_keyword_name sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare16_v3 sqlite3_prepare_v2 sqlite3_prepare_v3 sqlite3_preupdate_count sqlite3_preupdate_depth sqlite3_preupdate_hook sqlite3_preupdate_new sqlite3_preupdate_old sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_pointer sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_set_last_insert_rowid sqlite3_sha_init sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_isexplain sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_str_append sqlite3_str_appendall sqlite3_str_appendchar sqlite3_str_appendf sqlite3_str_errcode sqlite3_str_finish sqlite3_str_length sqlite3_str_new sqlite3_str_reset sqlite3_str_value sqlite3_str_vappendf sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_key sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_frombind sqlite3_value_int sqlite3_value_int64 sqlite3_value_nochange sqlite3_value_numeric_type sqlite3_value_pointer sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_collation sqlite3_vtab_config sqlite3_vtab_nochange sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_set_directory16 sqlite3_win32_set_directory8 sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug sqlite3changegroup_add sqlite3changegroup_add_strm sqlite3changegroup_delete sqlite3changegroup_new sqlite3changegroup_output sqlite3changegroup_output_strm sqlite3changeset_apply sqlite3changeset_apply_strm sqlite3changeset_apply_v2 sqlite3changeset_apply_v2_strm sqlite3changeset_concat sqlite3changeset_concat_strm sqlite3changeset_conflict sqlite3changeset_finalize sqlite3changeset_fk_conflicts sqlite3changeset_invert sqlite3changeset_invert_strm sqlite3changeset_new sqlite3changeset_next sqlite3changeset_old sqlite3changeset_op sqlite3changeset_pk sqlite3changeset_start sqlite3changeset_start_strm sqlite3changeset_start_v2 sqlite3changeset_start_v2_strm sqlite3rebaser_configure sqlite3rebaser_create sqlite3rebaser_delete sqlite3rebaser_rebase sqlite3rebaser_rebase_strm sqlite3session_attach sqlite3session_changeset sqlite3session_changeset_strm sqlite3session_config sqlite3session_create sqlite3session_delete sqlite3session_diff sqlite3session_enable sqlite3session_indirect sqlite3session_isempty sqlite3session_patchset sqlite3session_patchset_strm sqlite3session_table_filter

SQLitePCLRaw.batteries_v2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aebb3dbeda2b2eb0605a20acc126b50aca3795b066155292dad3666f730603e0
MD5 0c9ba51b96a446e0fdce3810bf76fa45
SHA1 6defb626766f10eeedae8dcf67c3f9b13be7534e
SHA512 d74fe14562b39f74c4b3d1e1c0db95a77796e209d21006e5af4d82840febbeaf7ce6c2b15cb0622a4250890bb005ece3488190e00344ae2d569917c94e462bca
SSDEEP 48:6kPbdHwQ4Bspt3ya8iRqYcbKNGeztNSClElgiNEpij4iuAO6CDV/ozfLsnOVjf/q:tR9MsziavRqYcfeztNSClElg0nOdVb+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 62588f4b54fca74c06a6c7669345879be5f0d34cd33733468083f326345283dc
MD5 6eaeed8b15c9c32fe363f4fbbe72ef27
SHA1 a50ac667ed5c54bbac074ede39e46c19e87ee5fb
SHA512 c5f65ef1143ade20c796d8bc69952027de19a1ad4b9c45257784a178e7380270302e461963f4348bb5c17e3b067c75259706054ee6e347c7fff98cac3627ccd3
SSDEEP 768:JUS2u7++JE/4pXstBztMp0R0eNiNib1KgNsVr8EI5P3tOeGVyAMxkEa:Bu+oqXstBqboiVQEReGaxW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6e:d2:cf:20:ce:ab:46:3e:e0:f4:7c:fd:7f:3a:63:59:41:3f:c0:47:30:6c:70:97:71:b2:2e:ab:21:91:b6:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

50958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.nativelibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3210fe35503c5cee094f9c1b86710850dab15deb36ea53c266a9665e4ecb793a
MD5 f7bd7cf71c917b7f05667945775b40e3
SHA1 8140e79d3aee95ad338d292407e5c0acca99d494
SHA512 6dcac6e463264c74370f5b3f2ded397cc3fe198e9a739fd7aae04348e149e205628d1496a71bcf65f6e843a7ff61f7cf60b6c4616e062c4e81c2c5b5c921261d
SSDEEP 48:6fyiWa0CmSUgG6S3mUPIbAO2NlMrpidNtgTHL9hbmD03cDLsnOVo9ryyiii:x9a0fSK6S3ZMAOmUL9dosL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SQLitePCLRaw.provider.dynamic_cdecl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d7f066394f6754b1a06dee90ec6f076d9bfcd07033cf6bc19a2af8baf746e8b2
MD5 ddefd87d06e352815663d1be0dd33d72
SHA1 d058fc451aa076dd39e32303e78ac9dbc3334cca
SHA512 9e8df90322986a252247b0ce9f2faa8532f92fa52d821fc1cb46b2d63d89b67cf48d65d31a99998f5c5c75357bf168fc301894884243cab96f44266abba4fad4
SSDEEP 1536:iUZbxdTL9g2M3KuHDSLLkOGYoH/spwJP:iUNxj5LFGYcP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

61822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SSCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 74d2c627a6167f4a3c73e3ad7356040c35a58a546560f4a5563d06e76a09953f
MD5 09aaae492a6c8e809cd56ed2b1c4a7cc
SHA1 d3e3776c76e9b75a688a70e0a481e5cb86b441d3
SHA512 f96305a1646e8263b5eeb812f1156d08855865d7ae5ffdf313f69dec00b7327f78089af3ed02c1d9293420bb26dff0733ccaff76d604b62ccd5945f0a75acc0d
SSDEEP 3072:96Wo0c4hdUwUFwh69UOdlIF2122PuFhwtnvXGRcn+:4AUhE69UOdlIF2122PuFhw922+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e6:31:8a:e9:a8:cf:3d:38:c7:e4:3f:00:41:44:c3:6c:dc:11:47:1a:96:59:b4:3f:82:84:73:b2:d4:35:80:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

147134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Savapi.Net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6b7b735b7da116dbea2e8a1a4d2cbf4ed6ac00a6dfe022f6a14a4a4e748d6d96
MD5 ef356c6de487918ab5c3714358daf6bf
SHA1 2ed64400b151ce3dad1cd1b8695ee0bdd96638ef
SHA512 668b169fe7b0b7daf296245a28f9cfa8712c7d7ee7e4baf69d10a71b75954c6c6b97ae4d789ea970d493ec2854e6fccc739b2e09617a244170bc8449bb93eef5
SSDEEP 1536:Uned8SoGyn1+JluF3X+4pF1bgHMbw8PWiIOZLvVOKZ1369axg:Uned8VGy33XVpfgsbw8PWiBR8Ey
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

82:7f:0f:72:fc:fb:9d:54:c4:ab:d4:da:be:67:b0:d2:8f:f1:b5:01:34:4e:a6:eb:e0:7e:33:9c:88:55:f3:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

86542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SecurityService.deps.json

SHA256 0e3511d21b5ae8e724322a16188558c78814558c1a20950c66e1e7fff5810ede
MD5 d3da7acc157cb704aaa29c814100e142
SHA1 bda1ce953f6e3f0f4c4bcef2d5905b5679b6e2d8
SHA512 c5737b7cbcc7cf1208dce95ea0b66e43802bbb2dfb6e60787854431cc4f413c63e22769564057bf3d72ba391b68a0c2c30d3e9296d16546a86d52074d52124b9
SSDEEP 3072:9O5DgP3el4UUt1YueccmnAH4RMwpRkgTf1yMGtHZqeNosl9S6r0giHa9b:9AiHm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

SecurityService.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4046a85d6a08176885b05507d3bd7c17107163fb37b96e2995edce66afb3dfe7
MD5 29aaf3ddfd31ab31b44a91ee8bb952e9
SHA1 b29fbbc6d629eae6d4ebcf4b66454f7648664242
SHA512 9f2d7f6a1237be834ee1a6fcf38d8828d0080ef12892b65794b7480d4848b84fa820a0c072764b24a4ac5702c188c632ad89e4dd3447b3ea4e0d4124400f3708
SSDEEP 1536:5vCv8KSmur55VQg1p4Qqq3h08HC3HbwElGwYBlRPxd:5D8q3W6C3HbwElGfrF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

f2:76:eb:92:96:51:ed:6e:33:7a:42:de:4c:bd:ef:11:f2:e5:83:a1:9b:59:60:7b:3c:34:64:6a:0b:7f:69:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

62382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SecurityService.exe

IMPHASH 0e4978c6d7358363a563494a824fabf2
SHA256 f24b2b80d08c27c3343565b3ea4e7015155eccd56237a97dbeaf374fb5e8cdd7
MD5 013fe3386620dae512cbeec2b6f65801
SHA1 4229bbb2c79cf8cda95aada97510696c208214c7
SHA512 1c1f8d83719aa7c26ca1261b5fd01327cde485445cf23cb4171cda16a03c3aefa9e36912a768549d019569fbda6747dbf786493dd83cf7af42847d4f3060afe1
SSDEEP 3072:Kc/QPqpDnKYSO40L58FvumU9aDtxG12X85coZc+Y1oAILp2afr+iY:dQPq1nKLOxCM4A2XwAA1fql
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

70:02:51:d4:1b:85:c4:69:d5:18:0d:b9:e6:ab:77:fb:79:37:c5:d9:26:d0:0a:60:64:c9:e0:1b:a6:52:61:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB

Chains

Oct 31, 2023

Digest

70:02:51:d4:1b:85:c4:69:d5:18:0d:b9:e6:ab:77:fb:79:37:c5:d9:26:d0:0a:60:64:c9:e0:1b:a6:52:61:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB

Serial Number

33:00:00:aa:30:3f:cd:59:83:f1:84:31:64:00:00:00:00:aa:30

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 30, 2023 - Nov 2, 2023

Subject

CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB

Serial Number

33:00:00:aa:30:3f:cd:59:83:f1:84:31:64:00:00:00:00:aa:30

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 30, 2023 - Nov 2, 2023

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:4E89-9666-FFE7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2f:28:35:21:b5:92:0b:e0:fa:00:00:00:00:00:2f

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2023 - Jun 14, 2024

Minor OS version

0

Major OS version

6

Entry point

74032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW GetTempPathW GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc OutputDebugStringW GetModuleHandleW GetCurrentProcessId Sleep RemoveDirectoryW DeleteCriticalSection CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind RaiseException InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegCloseKey ReportEventW RegisterEventSourceW DeregisterEventSource RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _initialize_wide_environment _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _cexit _crt_atexit _get_initial_wide_environment _register_onexit_function _initialize_onexit_table _controlfp_s _exit __p___argc __p___wargv _c_exit _initterm _initterm_e terminate _errno abort exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fflush _wfopen __stdio_common_vswprintf fclose __stdio_common_vsprintf_s _set_fmode __p__commode fread fseek fwrite __acrt_iob_func fputwc fputws __stdio_common_vfwprintf

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcpy_s _wcsnicmp _wcsdup strcspn wcsnlen memset

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc calloc free _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func setlocale __pctype_func ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _gmtime64

SecurityService.runtimeconfig.json

SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
MD5 1bc39e80d6d10935c1e3c9503108e508
SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
MD5 SHA1 SHA512

NSIS installer

installer

SharedDesktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23bac5edc72eb6a8280c7da8309a9d895ee0c4ca0263a41831982e3ce2a76806
MD5 e95727066ad792c8559b2fc44e795b98
SHA1 ee2430108d04275facf2174f61ecbe8837575906
SHA512 8dd5773bcbc74be4f21420f85de13a21ebc45bff5ae0ae10b8d50aba582720cc85bbbab61690ee256d8b2491c1675e55ee2a529644d49f00650456086eee76f9
SSDEEP 3072:BQE2ZTVSljTS5qfqiQScZXcuDfYhBSiRFHprWQljrdIDhq+n7:m+YCLFJrrK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

8c:28:df:b3:aa:c6:6d:0e:d5:08:13:ed:9a:e9:22:88:64:9b:fc:ec:1f:65:d9:32:e6:a7:a7:d6:8e:fc:57:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

204238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.AppContext.dll

SHA256 76b3757d6a5da7d268a412f342ce0997b2649978504f25daeb9190266a4686ce
MD5 97057f8b94f3ef7bfdf76bda971d69ed
SHA1 b4d80b317b7ca2d32879305faabf7d49af4fb7ec
SHA512 6fff3c4bdb29e7a82f9868bf0d5120ff26a1a7ab8bfd9ab5c2231315d4444ee2aaac2d484326dedf78e384e1ebd4f5985dc41afe1509a0c11e44cf8774f273ed
SSDEEP 192:ixW+usWtOPGxVCdkveWvcuyjS7HnhWgN7aMWhteGxgV8FGecX01k9z3AK/V2pA:iW+usW/VCdk37HRN7LnHR9zH/wA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ba:40:50:c8:ba:8e:0a:c8:41:e6:73:78:49:f7:64:6a:1a:d3:fb:77:88:a7:81:8b:c5:b0:60:14:70:e9:a7:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.AppContext.ni.pdb System.AppContext.pdb

System.Buffers.dll

SHA256 8e4f4a2a7e7a389f86004ee0b0dcff9e99f0375cd4ae8b1e3f751626fc633973
MD5 ee51a763ea8cd7a3115ecb3c99a5544c
SHA1 a8b0bf1ba791f0ad38b92d8893a8d3f6f9656b8e
SHA512 f6b6232a453242d4856b420556f5567ed71ce85c8d23f9ad3f4a2cf0d3534721d124caa07d7de6f2efc192aa3b4dcbd7b03cbc23702e5fb823cb59301c8af520
SSDEEP 384:kWYdhWBn6Xdo5d7HRN7rCDeZR9z4emA9u:gyrJ+DU9zHmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:07:37:42:da:a0:2b:2a:a6:b0:ec:cf:fc:8a:5d:86:8c:df:21:dc:ae:d7:ef:79:9f:6e:21:88:dc:7d:9c:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Buffers.ni.pdb System.Buffers.pdb

System.CodeDom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d3910d8782594fed0a1542362ac0af0189ccbbe78bb084a75759245b0fbb77bd
MD5 f92060a47c375aa93f21dbc0aa18f908
SHA1 34642be2d85691828482d6b7b78b1f0cb2b387a9
SHA512 fb73612565bb43981a11e12dd89477e5cc70c1392c3948a6d5a44e4d9b3d59fe5ee9723cf21cb7cd121cd7933c347201ba3adf42317c77b3c2dd652f4130350b
SSDEEP 3072:Rcr0PWG/8ybZnOckimh1OoFDiKNpXcMpHIX/eTnUlIbEKYk/qcRt:RsVSoiUyeTnglkfR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

175838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Concurrent.dll

SHA256 86bd69a2f0fc3736d94deb5aa3e695a2b99d692c743f7f2b43e8ddf199ae6eb6
MD5 34c497eda61e2f73726dc57562e96b7b
SHA1 0e1d04c8d1609a3d9a8d3aa18fb46779f1806a64
SHA512 dddceb67b4fce4a1b59aa6187d63b80c44587d7a60ebcfd3a08220e7c1ccf98c3a1006b6d42fb2c2f2219020a1c675ddff69e4e5b2fe86abcb1935c4880b6116
SSDEEP 3072:e4UhTsJCh/g90Mhy2NDO2OlCVQrrFaUSBik2zRR4RCKyhRsmPSb3Tec+hZ0MQJ6c:pUhrZYO2wFaUSBirYUA6cAZ02lHf1Mbf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

21:bd:1e:6c:54:54:05:61:b4:f4:25:20:2c:72:0f:f7:57:d8:dc:9b:af:ed:c5:04:d2:10:17:b3:71:dc:96:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Concurrent.ni.pdb System.Collections.Concurrent.pdb

System.Collections.Immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3c73145b2a78a6a37abbf428f2ec82fbd92840d207f0c03a66252a22b632bd01
MD5 5f7aca1f4c6723b9a616d58523183c7b
SHA1 d19ad439d779be30c2d8efef93fb4e30bb506bfe
SHA512 54623d1b5d6e555fb284d082bdd0e8be6b6101a0fd329c8d5b9eb15055ff9c69ecb66bc41a89ea91460f4d28a0bf6eabad22638ffd618811a43134c21a6cdf01
SSDEEP 3072:fuEBOblJax1oIu4WLuFgoZuptFwVYXu1xmb4Y6yqKcpFcfHCTESAg/qMxTHxQJ:fu5IVu4WqFgoZuptFwVYXgG6p
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

172974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.NonGeneric.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f7f125366baea508eba4f5c58db2b796bca77f1ddb7ef58d9cbb41f48552817c
MD5 e5149c5a1b021247b8eb3102dd12c37e
SHA1 d3ff95fee15ef11276f04228079df0aa6bb36ce3
SHA512 972926f98a286776faa228bcc0f4348ce10b027a93aba942c70950dbf81d1bb97f82c00e773a24b008429e801eb3d78c4dcd8b7144c40c3585b741cd23cc5eb3
SSDEEP 384:+wk8s5hYkV4K9H++aJ4Z98CPYQEW0wXV9R5WqKj02T6acdzkGX2qyaB/nutgNEgC:FQhY+R9HKj/Ytxy4YgNEgVcZ6XWoMS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.Specialized.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfce971806b56567a816b8364fa0880679dbd81c1024c135eeccff3c9ccfecb6
MD5 f765dcc06acb0405773428bdf129f8dd
SHA1 a8ab97da616c4a6b029751be3707c8fd5b062ea2
SHA512 0176e3112796f04ac8865aa62047e50d243917282860d057c1bc4ce8a7c58ca24f1286629358b66dd0a67fe1c0c2aa5319735d1dbe60d8c6e75ac04e1e8df01d
SSDEEP 384:Tkg0Ugm2/MzgtSWeJDoycZIDz6KpDCqCBJ2i6c7bsaaBWk9j38x5iCaM7W8xaqK6:IgPtMDyZ95CBJ2POKOs3jPvwV+GJ7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.dll

SHA256 f1bf608e71fd2b229b7f2f43aca213858b5fadc79a388fbce3dd125bf003a205
MD5 9b63ce723dfda91347901c0475e65430
SHA1 6074f7e122ee6ad2f236600e70bccf2997e798d2
SHA512 6597c9a7e25b6ba77950fe01db912a1d270d4b34c3245397265c7edd4eacfa0094b499cc167132253b271e5badb6f0376222dfff6446ba84219559f51ea24410
SSDEEP 6144:MtXwIIhqhvyiMZa+lXOd5iS6L0ivTKLbnfsr0:5Iii+XOsNTKLbd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a9:d3:ed:27:8e:71:63:44:c9:28:2e:c0:c2:2a:94:1f:a7:41:d1:58:89:eb:c8:83:cb:66:c9:5d:40:44:ab:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Collections.ni.pdb System.Collections.pdb

System.ComponentModel.Annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c9ca64fdf263d84d52fa4b2b1594a400b57a873139439c065625ff8e2a21a5e
MD5 30b1666571a3852105649cba73c55121
SHA1 9fce126661b79cf304ab3990751f45bb11c2b3bc
SHA512 cd82b3674d85587ea2fe0ab82af0a57bcbec55455ca87ad364164b491d9b8cd94cb1526d14997d5a53592f30c7aa22365a024ff83820fe6f0f3e3a8e4137ee1d
SSDEEP 1536:EYva02E5II96J0OsHPLljEPOtJg9yVGGBuA:M02E5IILfPLhEPOtK9yVNBx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

75710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Composition.Registration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d9424f2fefcf665694aea12e2cb7ff7fbc7196049af90caa0e43cbd1563f436
MD5 aff4faf177f73d0e257b544538bddcca
SHA1 268bffd8f5da2603dba26733a9611bb5befd0cc5
SHA512 c70e8144915e39ce020fb47aed98a471178f5639e43cd9075973e520116403af6f6e56bc5ee52646eed879dddc206a6a8faec1a4ae5e39da22c18abcd4e695fd
SSDEEP 768:VtXB8spyLLVCd1vnDb1ZscSLVZ/VYxMCii/9EDvn:V5GsQLarR9kvZk/o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Composition.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3d47555080c369692813fcf34e70b01642e4960d3b8048c448ca939a9e1ab30
MD5 f84d96a9698df9c7e48813376c2fc81f
SHA1 7eb3c012e2c53520dfd2086a8a7915ad919c28a8
SHA512 3d73af67e314729ff3d57070fa0af5e7045847aa912d2173a0b156da590358e6b52154c6b7d32f10d1cba56fa8bcdfa68e69d89e15d1b6f25bba16b102c5b8b9
SSDEEP 3072:mjrq86pK+9H9eaeaXXGUsnNjwaFmmgDX/cOoW6xVTIcXbjy1oPv1Cp7CEQtktCsf:mjrF6pK+977nmO56QcXvVHqhptCsayB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

263406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.DataAnnotations.dll

SHA256 b9a9a982e1b48977cd6ec751e818bb10f21547eed609c0614a6da3997417928a
MD5 ac924580d865d2df33df0f6b74652e3e
SHA1 e12e1c03479c1daeaf10b4536db2f3dea3be87a0
SHA512 c41dc2d0cf942dfa748cefd99b5d204a5952a91aad5134024348a8602c21bbe7198e32e1bcb58974f0ac6a467d1d2245ad0744cc70f093d56b02bf9335e80456
SSDEEP 384:MWuSQW9LglJeIeGXxnM4d6Stue7HRN7Pwd7EHR9zcq:5/WtjPO7Ex9zf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1e:11:86:c7:d8:76:32:43:07:5e:72:4d:ca:4e:0a:59:e7:60:79:2e:90:8c:99:f3:f2:e7:9b:3e:64:08:f3:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.DataAnnotations.ni.pdb System.ComponentModel.DataAnnotations.pdb

System.ComponentModel.EventBasedAsync.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 89a2d921f2c2203e3eb295acee96b3215e6306e30d0ee1a39150daf868b507f2
MD5 d8de0d9fcda718426d3072f4052c6485
SHA1 fab9768c697a6c4e6f9428f851b33e8203b57b99
SHA512 4707755be9fcee8615a3feba2012a098fad609fc838f3a6296d04f60830ca9ca8f6cc82e39f3f80219749707ce819110a86bf752106e1bd7122bc2ead456b8fc
SSDEEP 384:NBymWyiIAYmu2ZUQ5JRD5dN8+RbZ4jJwVJugzp05WvbnW:NE3u8UkTNzOctd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6101264a84dcdaaa463ae65876495d7ad10d7f03161b4d1244cb880441ab178e
MD5 387448bf92f46e5677c8d2d714680326
SHA1 a9c69ec20d71a053f1a4bb420941b3e4c2806a4c
SHA512 d2185de7191013ab47f843bffd8fb4b6c1a1633e73b09da145bbc74c55fc9e63a241a23d7b4f8957603489fceb7f67537dc2594bbf4061f0dfc3006695919dcf
SSDEEP 384:zwA+OR5hINt75/v+8Di4LfxwoEr0nR1C1ipH5w96qtWnoOW:zw2R/et7k8mHoEQiCnY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

26878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.TypeConverter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f43a2bb016e6876ff787cee39884471b500fa0a5261735e9e16e85542af8cfeb
MD5 b8283cbf4a540b91b92ee5cd218c2630
SHA1 0c3efa24fa62d4e0aa3835e1cd4d4009b3b292c4
SHA512 3f3fed446cc85845d6d73fa38ceea14c50b749a8b2339f0a8bc8777db2b643ef9f3b5821594bb68093428e38bac0e14fdfd535d1691823b9d6dcf334016a9731
SSDEEP 6144:ZBxLwZHK1PcEwy8bSAmcxKOTeNcB00hxVjrrKcC:aRIbwy8bnwNcBhPf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

264334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ComponentModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a15a39aa1df6a921085bf47cf85183cbff7b6e94cfc7d1ab478195167782babd
MD5 0b18c6343b9cac4158936fe51c0ee660
SHA1 404bd6c558e9b8abb3692a3071d2b38c2e50e45c
SHA512 6097c234fa0fe44285d15bf3e3d38f7ad1079626c3c73578aca6a0d84c550259556a69a2185dc210046ba0b63086c4c22e035b67ce15a6d81a206bef0e5f75c7
SSDEEP 48:6mFo6KQ+TuoY3LlciVcdDf3D+O8gOFF+IvYSPbDzDseDSyWFZWOTW0KRQW3aWE5Y:Fo6KQ+XKFV8+A+FxvYSPbDzDmW4syWE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.ConfigurationManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d9629ced6b319b38524a7058e66a0f190452d1a24dc615fd66f8c4317c9ad894
MD5 5294941977402f5a9f85d3075feb5870
SHA1 84a98acbfe206f02e04035bd2df17cbcb629af20
SHA512 4721307125dd61cdcd6a56b490596d2ee0a0f117abf477be6926a0124544d3d5147fc6c10d9ccb33bb41a3676374fd3ecb3b0b4098359715c2dacb59f2cc1f8b
SSDEEP 6144:hn1wmsacaTpNltGDafOsdV0Z8oApKK1sPTdokGH5OTNWLOdqJJQN9NtxwP9SGcio:d7staTpNjG+fOsdV0Z8oApKK1sPTdokr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

370974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.dll

SHA256 329ebd13feaa6a484a272ff7da93a00557afa61847799485d9cf101a77a35366
MD5 b3d9f7e6c869474cac528fb820c2bcd6
SHA1 bc9a6d99e6a9e193665c386392798372202f09ee
SHA512 9a758f942a49da19433e697787d1cb98e438779c37d8f5791342d19ec004aeb34a13d07aac692e05ccf27060a55864808daee10e1d31303a6a63da8b5683f9fc
SSDEEP 384:4WvE6WnTXTSv/fTNRvGZYdf3zyP/weDgnJedQMyWuk7HRN7EAFHDeZR9z4Ot2n:WMQknz8FVFHDU9zLkn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

5e:e9:a8:9e:dd:b3:15:dd:b7:77:64:7e:73:95:2b:fb:c4:df:c6:98:12:95:8e:cb:e4:ed:d2:9f:ee:7c:99:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Configuration.ni.pdb System.Configuration.pdb

System.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3337e97694959d11e6120b2fd6db451f3e4f4ea0f7a5b4a87c0ad606cf9bd84
MD5 a3e979be10dccccda9e87d425d39f4c3
SHA1 9dbb0fab778f7d60977e5b35da7608b25704b51d
SHA512 7ab9363359a578cceacf1f2947e85ca3cdbb384e1352bd1eccf6eab4bf42e61a059d74d2807d01764fbd8fe1f87a786ce1004bf6c36285d2d9d903dd11e34c53
SSDEEP 768:yDqXT/HhpokAfpJoAe+otGtmxbsIxSRZaeqJsB8N7LrNJJeKm5VyYAMxkEOA:P/kkuoAe+4BsbUJsB8BpeKm5JxCA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

96:fa:c1:79:93:02:de:f7:e8:5f:da:ba:ec:9d:51:0d:ba:ef:fd:28:88:26:20:d3:46:ef:4c:5b:1f:44:d2:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

68478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Core.dll

SHA256 66bd8ef96f1ca8c3578e3b8e6ee2a7564b79c08c893d0639c9e3d79f29779f3d
MD5 347aa3e63d9daf15be3f5fde2cd2c971
SHA1 51d76c9d8d94ae8b329080217e91a8ab90033342
SHA512 966b231192e2b04e8e56153c037dcf17c01878bbd5b92b3e5dc141d09025f613b2ccc7bac9a7ac5309d04a6ca3d2593e851a479246381a500cc1d8948e62a7ae
SSDEEP 384:VWXdhWxxkVVOU1CXtlB7ksmopBFXLwJjd0uQRz2+gqXPRRD185ddOXJuquh7HRNb:0W/bB7ksmopBFXLwJjd0uQRz2+gqXPR8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:b4:49:c5:77:da:0a:af:ac:12:83:0e:0b:7f:83:27:15:8b:d9:08:e2:37:15:bc:8c:f8:de:c4:e3:be:4a:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Core.ni.pdb System.Core.pdb

System.Data.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc63f1a6bf5eb643facc49a9741cbbb881ce13ebc1672c25feb5017516d9f12d
MD5 949867e3df037992b6f6df7b91aaabaf
SHA1 104622ae7b3abdd5d79bf7cbeae9001f00403aea
SHA512 2f16ef2fbdc62f59b576003b6118d66aa9e8ee471a1140eca2a5893a1f70bfee5f22141147060e49c02e101e17371c99b0a49b0fa5e61904044b998991b21081
SSDEEP 12288:iYmCxNCYK16zj4t6qsGjGvMaQ0aW3miUgnKq4MCBubAlX/IRNV:XpfCYssGGMDW3mifKq4vBPX/IRNV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

959790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.DataSetExtensions.dll

SHA256 ebf0cb220bec0ebdafb2b3aadd2feaa0b315903b66f438e10022e97cdf40b122
MD5 cf0fdfd68fd31c3cd54c095b968a3b83
SHA1 7d65f542a217df807f75766c5bbef2137aa2ef60
SHA512 55ea61cef71c30302aa9c7b0943ae99b3ffc2c8cdcf4d428a96c646557081568048c5519627c42b2c9f2cf8d59dfbc3844885e56b698162d6e9a81b7d3e5f986
SSDEEP 192:XARWa+sWapV/xkjbPOdVyeWvcuyjS7HnhWgN7a8Whd4N+KD1Y6uHX01k9z3A3rRZ:XARWa+sWgkOdVc7HRN7cO3DeZR9z4rRZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f7:5f:d1:e4:d6:12:7e:7d:e7:57:17:ab:20:6c:95:17:57:5f:41:e1:9e:d5:99:d6:56:71:6d:32:5a:fd:83:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.DataSetExtensions.ni.pdb System.Data.DataSetExtensions.pdb

System.Data.Odbc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4ed82f8cff2b194c223b7cae7dd67a54f433fa27e895ec216c57576659ca7cc
MD5 17219622e80e5992fd7f44efc3fc0ef2
SHA1 3902c70670f0bbdb6fc58c7dc84cf92d9ea47e31
SHA512 62defd5445bb88705bb8af9b5ca3e920af0472b075f1f5cc05b564e2010e3d185b54528cf16f5f3b198a5b712cdcb969314915be032ed0040c3424cc3a0cb294
SSDEEP 3072:qYoi4nfyAqFhVsTvhN4AtfAS7bCXEi/aMeNOhw6F0NYfpfNs1ObOF/Ai6u80/tL:aqAqFhyNn/CUijwZN+f+1XF/Aiz8M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

256270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.OleDb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ec6f1fa47ea95e42820119bdea16416dbc99ccf9993e8c572b65e2cf13eb71c
MD5 696b0771a3e4563dba4f2dfe142f3a61
SHA1 5d110f65b56140d1a4f71f18162bedd02e04ad46
SHA512 953adfd1aa41477f07cdd821d5c9de6afcefad7062a1bfd41dfc5054f37048511b3db2dd17cd21576065287fa44f59c7f3dcb437f426d77c7a28d61a71485a26
SSDEEP 6144:ovZNPlrF7urbtYC/Hx4rPHM37FJ5lKcVrmj3y1UYcf:mNPlhtC/HC7Mb5Rr+yy9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

351310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SQLite.EF6.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d76c1b7aaa70c319d5802505214ec734ecbaed9f8e9776168e25ff0808c4185
MD5 4f428be996d234e1e66b4651d5850f8b
SHA1 4444f6b6e5fc3b117abfbc097358932a72986532
SHA512 302ef1ebc733d716150470a37c21fc8037b0ce2404a98d73b94c84f0c015e69a1c3249d887605ce577671c20d6c5011be6e3d5510a774dc46f2e214115fa5491
SSDEEP 3072:AruAaoTvRdmltzgAHVwIn6KP8sPBsq+4uZ4AIa2r:AruAaoT3mlhDVwA6KP8s2q+1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

189870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27869ae8706d91d81e29b669e8140abd8b6bcd0c8df18e70fcc7d6ecec9469e6
MD5 3a3dc6f0ff7b9d8311b62243f45119f1
SHA1 13ad0df5d3914bf4529cbe424275cfdefcf16aec
SHA512 031c7ec34f07499f94cea63b09dc53cb3515a139cc60c0544c76be8fd6f9211f53a7daf927b5d1487abbdf945ac51ecd8e8d82b48a706c6a21173276d6b45c0a
SSDEEP 6144:vA3IUiJWeZ4idh2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5i:43IV6FNFaFeFOFwcGF6cmFWc0FWc8cIO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

358926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.SqlClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fa4c1ff23369da57b5629fcac7ab9a9dc1729d57d709c4f8773dd78dcc35c2b2
MD5 f40298c4e892964b837b3d8b61a5c103
SHA1 e0eafd79653a53eeb3498087a4bcedeef7f11046
SHA512 eab8793ed77e0f87a7236e30946275b53d383f291a49582cb795fbd774e042d31dd241ab4fbd8e7cec0ef62197a9c86775d3b76a126c9f85a1a4a8bb43a70bfb
SSDEEP 12288:CI9KWOF/4G3Hd2tiy0FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFHFtFVFx:h9KZstvubhtSNzDW7kPu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1017150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.dll

SHA256 4c080437275d09e0d0ccbeaaaf6bb6e9098444b47297fab1ccd1a1ca4c85292a
MD5 ea3dc441ae295b4f6fdd6aa01fee2411
SHA1 23475b7bf62c9f222f6c2c1c420593ea45f77c9f
SHA512 11914e4f87c40416509ff6c1eaa91f5eaf57c1b36ad7622b989985389f2d406da2a27e7965998edbca02e635dcc0a6d3e8b2e8f2686d9c7b6775443ffdd2a57f
SSDEEP 384:/WisCWum1j2Sux4ZQodPcq59oZd7VEXjQ7HRN7iV7EHR9zcbik:yKmC4ZQoBXTkiV7Ex9ze
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6b:bb:71:3b:0b:d3:73:f9:75:cf:65:25:75:07:9c:e7:c0:1f:fd:51:83:3f:14:1e:05:ac:e0:93:78:8b:c1:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Data.ni.pdb System.Data.pdb

System.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 94cbe7ce7868e6f134c193017992091ce4d2b3e976272e4f55f74b4d34e31dd6
MD5 c5f8f18779df6ba0854b7673cf7d08cf
SHA1 2db5a071cdbbb08966d64f2e5b6aefb48914f5b7
SHA512 ff0357685c6ed1b6ded84f5fae5db99d6672567c67ea4ccb598094dbfba565e4348fb3274fd3bec350fe81a3ae36bc358a82dd50b3dcd5be5693189e0409f1ea
SSDEEP 192:+tO4/UFga/GtLbrc7/ciqteUCiGA+yQjxiCWOHW:qv/UFH/iLbrw/ci8CiGA+z9iCWOHW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Contracts.dll

SHA256 9c292b4d80503530430658410cf41fcc73ca598510522a985a0af0dfd5553aef
MD5 ca01cc510c6eeb820119263487a0f31a
SHA1 a260cbad4557c5ed85b8d9fe44910d2eb27c67b7
SHA512 9c272c57de1f62f7e9c43714b893f08887e86f6ef6c5f048571ca342dcc097254902f901a6fe4d83485f46d1319a4c0ed89d6973fc68e1387453827cc54d8c3e
SSDEEP 384:cW6NhWJdxtdMn7HRN7kwYmfWojR9zDw4M:6WQ7PfWoF9zO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f0:4c:54:aa:d9:07:0c:47:f1:a2:76:11:06:de:8b:11:6b:15:cf:d7:4c:03:29:fc:86:66:77:c4:f1:4e:84:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Contracts.ni.pdb System.Diagnostics.Contracts.pdb

System.Diagnostics.Debug.dll

SHA256 ff3ce0f75423aae99fe0783ce99ae67508a3ab257ade509a8cdc0770bb97c0fc
MD5 5c4209fc9564a5aedfd35682fbd99ca1
SHA1 27f028d41cf905d0371c71e7e0b09fbf939264d7
SHA512 1f6099afe1d03f0761381d5597120036dae4794789ea60f1cef232cb161d70f73c5614b48205983040b0166e5a05c09447a1c17c893828fe7db5c04974fc98c9
SSDEEP 384:VW2tRWMBdMi5dL+7HRN7jg8M8/fi/GR9zZ8BGi:Z9BdpzSVMufiC9zuGi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

81:fb:63:18:0f:f9:29:79:c0:16:e0:f4:8d:4d:ea:51:0a:7a:d2:c9:23:44:4e:6e:8d:0c:0d:6e:26:83:58:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Debug.ni.pdb System.Diagnostics.Debug.pdb

System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6befd0c09a36dcaeb688a5ef89e991187167e2153f930bf09e6acbc9c59f897
MD5 bcfa0edc100106536e6104f183307c63
SHA1 3052823d30795cb08147eff4686bc58325ca4fe4
SHA512 46a16abed798d67071212ce011a9c251c6d715978c715f140679873176d33df4b8daa090a7a9c99a40ac086ca951df1de744d2fc1ee3d4f0d74d495e253cc01a
SSDEEP 384:wQ79vkYm7EQz96oVsqM3ZN+MCTjprGDkTB1MqAYMjN96pXb5TtYQFtJTG/hULWfy:rcc3NqMpBm9qD2B1MeCAL5pJtWpkJtp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.EventLog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e585a43846e5817c72a48778759232e2e9328af4bc6ad7f04804a11f3918a19
MD5 d975f4a3de1da0f9f44e44fefddcef83
SHA1 f2f9d4bc23c7d49832f49b5d080e6758a2bcd0bb
SHA512 819596d1438a7ce211470555f36e254e9752864170aed6535605afe148511527f339b9f900962f98a70219ca71e130e48cd9c743a9c0dc20a8b0e26a602986da
SSDEEP 3072:vmG55WbsGpZbUBjlEkmsmWOSupk7xkbZo:+GLWbsEZbUJGuOSy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

125022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.FileVersionInfo.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d53a32399ddc0a04e9b7d48864c5fd0df340747504827d65a863eba3169cb160
MD5 53c1b501125cde723c149a981275466f
SHA1 e08cc61e4dd50ab6c274df4dbfbe5031167be391
SHA512 0ca14eda2fb53a5bc7aea7f57cee07dcfb3db09b13c721dbbe743a83d596ee9e1be458736a62381da9cffa46f2d0da93ffdead1ce6ce7984a5aed38d650bb1af
SSDEEP 192:8Y7E5VhLH10l7c1bRSjB2biWqehQN9NZFdA1GZnJxB+hxexZtWaWdsVqW:Ij5g7cE2iWq5Fq1G7xsAqaWdsVqW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.PerformanceCounter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad428d16cdae6b76e9802b1dbd9d8f16df55d782477410675db1d847e5d3fe95
MD5 093e29a3ad69fa2e61eb0909cb300289
SHA1 e6401e509da0247a2c3d56f78fea9b76c2e33404
SHA512 f6bafbffc7fc0e0d1890a061f0e06798706a4cd48d7ac569d875cc31bef1ac2ddf60eb32dea69c9829decd23f5ed11ede24fe50ba5884937907497dd3bc3b056
SSDEEP 3072:qSVBqd9rzX3B2aXilGPbvkuaSlbAp/7cRy:xBqPX0ibv0obiY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

120382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Process.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fc55f28742bdf7821e53ccf003ae40408ddb6567ca6fbd03194c08c43c4803f5
MD5 42233d2d7ec704a4f81bc5c10709a131
SHA1 2f58e7cf6525acf3013ddace5d1558d61089c1a7
SHA512 a30dfc6f85328cd7ab0fa87f23a36f0d8356da7ea23ceaee697a62adc8f0bd978e0a01ba2f03362b90a34692a31113033d9a0df37100a6403e3587eb787bec21
SSDEEP 3072:2HHfPYA20yta6TE+joo+2Id4p9z9b3771PtqNh39A:izAD9b3771PIfa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b9:64:2f:e4:d6:15:80:ae:ed:32:20:ab:53:89:be:54:07:c0:18:52:f2:3e:22:20:fc:27:6d:d8:37:d6:1a:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

110974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.StackTrace.dll

SHA256 669e9c108229b377ad55e11d5cf9cc6d033446ed197b55d6182ea8b513b86905
MD5 0290c1b9f1a55e5a1692d0e1271e960f
SHA1 0c91a85b97d8144f04271d21022a514766630e74
SHA512 3c9fa67bb229cd318e030024de4e391643579e2c0413da9e8af30326bcdc5a17094f0966d68bda33725609c02d5d668c0538780a12e72052996ed691d3ce1655
SSDEEP 768:c/F+r8slu8kXZwQ39Rm4t7WHa0Nvxug9zutd:c/F+r8slEXTqvx1zutd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d7:3f:bd:cd:35:ae:a2:b6:7b:e1:2e:50:e2:bc:3e:e9:35:b9:6e:9b:08:c5:2c:eb:b7:c7:0e:79:f4:35:3f:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.StackTrace.ni.pdb System.Diagnostics.StackTrace.pdb

System.Diagnostics.TextWriterTraceListener.dll

SHA256 b4dc72c1254a16af4ff47ebea502d03b28d03c72302ceacf5993c05a0bc3ac6e
MD5 d638a282b89c495d9c2b896287a6bfcd
SHA1 e5c92ba20dcb1101db432a5ceb29a3cb51af257d
SHA512 2452a1b4263bc4235c4a2e076cb8c279ded0ed4ed6bacdf8c0d6175cba68414effb2aaa947cf941da1ed42858d209ad33382df3b8136f85e89670fe87b0cc8bf
SSDEEP 768:D5Q8MVdREB7Jeq2ZqOklRyNbv3pgPYgjcq3l9zU:D5id6B7Jn2ZqOkl8bqPoqHzU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a1:b0:d5:2a:ca:3a:b9:8f:a9:7e:fa:d3:13:b5:49:dc:08:86:8c:10:bb:2c:df:b1:25:90:2a:cb:35:16:03:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.TextWriterTraceListener.ni.pdb System.Diagnostics.TextWriterTraceListener.pdb

System.Diagnostics.Tools.dll

SHA256 3fa65d869a931e705cbe1e2b9b12ae6b15520db0719129311dbe4376fbfb7fa5
MD5 630b7d2500dd8107264d2c9253fa2956
SHA1 45fb7c9334f9e1c1a196a860945ad0e631ddbf82
SHA512 2a27e56bad0577f681c078e82f99b6daab988b349fdd9e90356f5e0436b7ac0ba54894139befd9eb93d7390a1b2f3df7204599975e59de862817bc649390d063
SSDEEP 384:dWQ3DWCALOv4dzD7HRN7UAm8QtR9z/wR3+:xqMY/jQP9z23+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

dd:39:04:19:30:b5:28:0c:ff:bc:db:44:a2:f9:c4:04:b8:65:91:8f:ac:02:2a:a4:c2:55:d3:54:52:0e:8c:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Tools.ni.pdb System.Diagnostics.Tools.pdb

System.Diagnostics.TraceSource.dll

SHA256 3911650b7663fa60e4f2d4710fded59030bc35834d7c6e70db1d36c12cf71927
MD5 c88cd34a9ec7d7bfe34133e1cd5a4801
SHA1 3391e707bd482a7caf85ed8a546c1e88d543640c
SHA512 d21db07f9f0cf2be2d39cef58348f03f5214cb82903d0c96bfa3a8cd7f1eaca04442ad14b5fd1347b9bb80ec9d2462a96553d344124796f31c70d2118daf5934
SSDEEP 1536:RWg9Fs/6PNmJElBQz0L+gEPEQq3zvlhBco54syFu2U2E/AOKuauaaK0ckrwpySoL:RWos/6PNmalGWb/3ckrEcj/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

50:b0:00:6d:1f:bf:17:6a:dd:70:62:e1:65:e6:28:5a:2c:b9:09:b3:3d:fd:36:61:b1:a4:39:9a:e1:d0:6b:ac

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.TraceSource.ni.pdb System.Diagnostics.TraceSource.pdb

System.Diagnostics.Tracing.dll

SHA256 2d4d885ae11d80c2499dc83c4e884a749cb64f95b297ad9ba0b5389f29fb79bc
MD5 3a0a716a5f848904872914343df34f16
SHA1 e0970e5720442204acfddb2ea0b24de59b4241da
SHA512 3d854b60438adda193d50529b091b1b4d0441bb5aba48a6402fa2c3a8cb36d455c48326db4634c52df2a902986e36b7da1d06d32732cd488d3b5ef1bf7160739
SSDEEP 384:cWbmEWu3+ysGUPk6d/JcnE7HRN7GxLkGER9zRReO:8wqGUPkWCngGF+9zDeO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:f4:48:c1:83:97:21:f5:0d:94:33:9a:b7:9b:59:be:6b:ee:16:af:69:06:58:fb:8a:4c:55:f2:ab:d2:99:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Diagnostics.Tracing.ni.pdb System.Diagnostics.Tracing.pdb

System.DirectoryServices.AccountManagement.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3492d44d9fb05b07c0c7302b85dab9dffbe522085ded93ff8868ed6bf5e162f6
MD5 cbd45c5b94ff14408bc443e7b95181eb
SHA1 6e06d9ee36f29adb10a6b12f1425454a48956f96
SHA512 0f9edd0436adfb3ed3b4f4a835751395dc76cd1f220b415d76e99255f40c2ae053c07e3e90b330a46ca7e3161b101a9d6bb92b85efac8782e2a334b4ca9ae2af
SSDEEP 3072:db3kNZ2FXU2URLoegkGLKu1FjRr+MpjzzZOQIjNE7wS8Ww8jwN2klRZ2cT8z1N7y:KNmq3GL/RIgLw4wNPfZLEN7RkkWd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

270494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.DirectoryServices.Protocols.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5705a01705fcd05fab4fa91d3fe35338898cf6bda8375dd6e172dc8d84969648
MD5 3e30539f7b5718887d8886433cdedf6b
SHA1 5b84bdeb9f807d150ead048bba680fc511693b3e
SHA512 74269c9e22705c0fe14b3f6994b63a3f1404d66980ee5721ace10c0a4b301cdf615be8e537a4cf03702a1e03951f10264562aadac0891ff31e477d62fc781657
SSDEEP 1536:oKvEDLCIyyxV9rCF4Da48YLpOTwaUrHZ8ujD4nX5IW7keDfIV9sCgY+YQ:GmIyyxVI6npHL3IIW7keDfIVHgY+R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

122654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.DirectoryServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d176f4579c03fdf4660353153b20e2063f348b6becb9b073449cc5c1ec5ae745
MD5 e61418e77cf4b0b77ab3d808efb73548
SHA1 94e6bdea7f1c4317f721b611169d9ccf6c239699
SHA512 76c02a5efbd26d63e049e5d1cd077de74dbc06eb19d39d997089dbc3c0478e00a13548f1e38121b9e4aaa55ee987bbc27607f8f8042ef7b0b04cadb0caca1d89
SSDEEP 6144:RjhaX6w8sb/fgViR6RX89IhrIXalKupWE97SDN2qavbbUPlMYaf:7aX6w8sbEa6O9MIKQc97SDNzal
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

358542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0dd43e677a2145b49dfb46e8af82ae30748d50330e9d60b36d98c607994d492f
MD5 3a422efe9a7528ec81d12f9c2d97027f
SHA1 da245c8e8a940c0ca08dd5b6535a5a0e85778ea3
SHA512 dad9fde6fcdbb4917c2f54aaed4ac565822d7c3f51167ee1968703b9f50a6e16eb18823f5fdd87e074716fabab65e3a4bb131c5b83b2ee1cda7c6d4e1d7f05a2
SSDEEP 6144:8np7x0ZMTCHziS9t74/jGbPvxsPdBmBvhqqWy31:8BqMmHdEKHx4BUd31
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

24:39:a6:fa:67:09:bd:bb:e7:d7:c6:c3:2f:86:3e:1b:f8:e0:49:f2:64:03:bf:fc:74:58:40:93:96:b9:82:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

409502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 04a476dd96439238ed5dc55ed9f20c398a1137d78a2114eeb9c8c9de0e827b64
MD5 16a050bc879bbf76a0d551b33d2a65b0
SHA1 c838d9fd10cfb8a92f0e9a34eb8f391abc100d11
SHA512 d09b542f398261c18a34ad5591a510522d8dba00d0ac810e0ddc6384acd3938e8921fd00605d7dc5f4dc6fccccf8d2eabab7f52a42d855ab39b2b97d266b67be
SSDEEP 48:6ZZtI1Lyw59vXwlZMJ7suoMXq+IvBD/DgvM9VZiIDXZWOq85lbT5WDXEg:MA1zXQW7suQxvBD/DgvGfbWWBWY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0ba7867b6531edc491d6c7fac8b2e15645769cc74d05414a41e46b71da9336ca
MD5 7f9c4333e71b39c53c460ee3b0f91bda
SHA1 3d98ca7ea66103d86c45557a139bb50d46ad503c
SHA512 b00ea3eb03e83c1e6b7a3cfa518cc870270a422cdc07b28e4d37870e1fe4b1837e6efa92285f28781de05855ad2c533773ff1c311fa7f9903ac446b70ecfcab6
SSDEEP 768:v5RbmqzJjVi6diWO4w8BWNSjo9puuBcAOUF83Oew9MyT5jBrnF7a33W9AP+SX:v5Rbh6k4/NVpuu+jPPw9T5j6+SX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

53198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Drawing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22f2d62131936595ca34d0606add4b0a8539baece15fd13413f008fb4ee0b0ee
MD5 9148b038a5d96921b2c18184720c1fc8
SHA1 436edd5ef5a7f521f779fe84913488337aec0193
SHA512 b2353594720cbf00baccdd1f5ce0f7440b7bbeadbf1e464f1195ff73422dbd4af4f64eb3e64b35d4b68d71efef1e7970aa7d8a7b837e765fd04bb0f21d1944ca
SSDEEP 192:/vKy9nPOqgcm+3GbNLe7VYrYxrgjsC/DVVx9r5LWrtW:ayxPOqgcF3Gde7VYrYOjT/Jf9lLWrtW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Dynamic.Runtime.dll

SHA256 02691fbf19e669f9f15fb6c57f8c8fe565952345bd23f8eb79acf3489c7aa6c6
MD5 e42b0abbe713da1f9d5ff21883c760cb
SHA1 3370c376fb512dbe39cbed36d13cd11dca826d02
SHA512 8eb130cfec7381f36b408108b3bb9bea27c8c786b3fdd1a0e8ef997616e1f33a9da63b2643f4af95d6dfa3978cd8968035ed0e7b41ac88b2e814150a482431cf
SSDEEP 192:ci4MWsh1WRDgpxBAcx+dEteWvcuyjS7HnhWgN7aMWhsMHxgV8FGecX01k9z3AKIa:AMWsh1Wy7BAK+dEd7HRN7NHR9zHIxN3q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e2:95:bb:9b:f4:70:d3:ca:58:4f:ad:2e:ba:6d:06:cb:30:74:cd:17:68:33:63:e8:61:56:f2:0b:da:ac:c5:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Dynamic.Runtime.ni.pdb System.Dynamic.Runtime.pdb

System.Globalization.Calendars.dll

SHA256 973d89ac235160df9128d10f5a5bee2d131ad7debb148f5774c2579d97b3c4e0
MD5 053d592bb5251b2f15a3391223c9e167
SHA1 db768f758582f9c43c00ac4e66612bad76a4b539
SHA512 5ac7ef2bfa825dddeb085a8ae17c936b71240d69d36a8395db856ee436da1b4e751a7750a81e8707a269cbcb7b1b26e57bb24db6daa06db28965c77636400473
SSDEEP 384:3RqXWDRq4sRqm0RqsWFsudWfdL7HRN7niR9zR6E:hqKqNqmuqE9XO9z9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2c:e8:17:09:32:26:56:04:11:58:c7:d8:f1:fb:c7:67:98:78:c5:3a:89:07:20:a9:30:5a:b2:55:41:d9:67:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.Calendars.ni.pdb System.Globalization.Calendars.pdb

System.Globalization.Extensions.dll

SHA256 bd41ec1b117416b3abce7867c9aa3927f7b52114bbd3a979c6fa60d0fa3f49b1
MD5 2b51e34e537d25bf22e0a865d37ba277
SHA1 56bfbb6a8f6b065a24876c9a469163c832e8772a
SHA512 cb553dfab531eb766fe470f753d758acc13baaac77d52f49f052debc2d549c080d608da1b1afda55966c9c864dc187f1a75acafe0dfb8dbdf28e6a112cd28f43
SSDEEP 384:ERPWYRgPRp0RkWGZ4d83Y7HRN7hE3X+R9zusroD8wmWP:+NypusZf8aXi9zuSGP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ba:b6:e3:eb:b3:d8:5f:a3:84:e9:ce:6f:dc:bd:c9:2c:0a:57:ee:81:64:b6:e7:33:37:d3:67:da:24:13:87:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.Extensions.ni.pdb System.Globalization.Extensions.pdb

System.Globalization.dll

SHA256 ea40b3d97d8f582e4b1dfb4425adb0f0682e3cbba03e6d27ba6afacfa7408c13
MD5 4a00c73a2b8f7bd5bd2349bf189306f9
SHA1 f86d3eeb69fe26974f5156cc35e5209300702b18
SHA512 84a3f7027e93200324d60b4d854b09a3a374e802d99ffb7fe9ae8cf797c90e155597b5d17f2dd2c64c69096f64bc6ecd25ec502dee170b00ec47f00be24fa8b4
SSDEEP 384:SRLWdRM+RA0RAW9RZdVX7HRN78eHR9zHm4:A03AuXR9r8ex9zG4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

15:30:16:60:6f:48:eb:8b:ec:15:39:4c:73:c9:2c:ab:1d:64:bf:dc:39:ba:94:43:4c:9f:df:a8:40:33:85:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Globalization.ni.pdb System.Globalization.pdb

System.IO.Compression.Brotli.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 09362f89d15733cb65f3306b3fd280aa95694d1dfccf16b6c31ade1163f36ad0
MD5 ad0ff61576e77443c96aed460f540d5f
SHA1 f42abb6f6524404b25d6454efe15289f26285482
SHA512 b12726e120daa1d6292a14ae2228952d2ca9b800dd94cb6e9b0d37280980a348bbb680fee04c3aee29c35a342c28df7d877dce2d480b68e1d84fef931cb322ba
SSDEEP 768:JOCKEExaQEWggXySafnx1knop76fkgRabAaREX2wzH:JOCKYTWhySafxunop76NabRcVzH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.FileSystem.dll

SHA256 6b3632355c4ec32e4edc8fd6b6e655d47b8547876660557675153f3e50b54b21
MD5 ddbb9f0ce12046992cd06dec451e03a4
SHA1 e0702efc5e7ee7afd7d6dfba92962bece91ee808
SHA512 28b71a65207359eef8b3294e0396103803e4f27cd589222e5f3889ce17478615391498991a22d3d631695a02c4c863dd3ae0b2bc7e9d4c9747b290dd0afff35e
SSDEEP 192:EBWu9RWcxiUd4jgDeWvcuyjS7HnhWgN7aMWhnM2MxgV8FGecX01k9z3AKSVl:8Wu9RWgHdMgb7HRN7w7VHR9zHSv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

60:82:4c:9b:40:26:67:73:a0:9b:38:8a:3e:24:7d:8e:ba:a4:ab:c7:bf:20:fa:c4:77:0c:cd:f8:7f:1b:0b:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.FileSystem.ni.pdb System.IO.Compression.FileSystem.pdb

System.IO.Compression.ZipFile.dll

SHA256 146171b2d8ba7c6cfc1327e26e4017b08693af5514263203db60d9c43e13914a
MD5 6258cea236def9f37ce76d19cb8b045b
SHA1 969302144f452946ee6a9eb70a4a53b7f9866e99
SHA512 cbe8c0e73f567ed250d0db936e325fa1a66576e30ce765f027c2c87f32cacad4c51f5a9bbb4bfc1ea3b3cdeec97ba3dc5b300dd7df084f03aaa0016c9aab5b96
SSDEEP 768:lB5FuK2wuCRWMkRWUWZF4scL/ftDqybuLtn6K9zw:lBfuOpajbuLtnXz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:3f:cd:af:d6:09:4b:36:c9:c3:5f:bd:1a:8a:ee:7e:bd:9d:45:af:e8:3b:f5:2a:8c:09:66:cf:c3:fc:0e:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Compression.ZipFile.ni.pdb System.IO.Compression.ZipFile.pdb

System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e273d82c08d82bc194535807a505cb2a6c08c95df8913f8210a407c8738c75d3
MD5 e839f0aa073273aa6a75889f19ec1623
SHA1 ff171b601e43e5c249331519fefa5bd527ed95fd
SHA512 9a7b22102b81f03b503729beeec7a8d29f0ab22bf37a7dca43b4fc0ffe01c7d0738e14b5589f5f95fb98228266c8597aa8454820f52830aebb443e6ad17c991b
SSDEEP 1536:YMCGc6zkuPVlA82ELFQ2eRu51DjrHF7YIfb7J9qf7cLesNA:RcWkuHN26Ruu51DV7YIfbd9qf7+ru
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

96718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2b9d85dd6c7c4092901e55427bf4a36db02f64fc15370f99f308ec98627c66e8
MD5 a675758956cbbdc0aa02807cc0c742ea
SHA1 d67ba7713edc1ea6f3e21f0973797b8529061470
SHA512 6813a1d91e0e5968f92114935b10563ff7eb182b998ffc65b7470785182e9925202cd0d559523c8f65674a1a2b76d48f074ad1fcb968cce8c08e44c99fab5ad9
SSDEEP 768:kwI/QAgtb29dMKu3IfgpX3Ba1bvxTXpv0oZDS0ZNCVzAMxkE:kwI/QAmpXAbvx10+20ZNCJx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

47:bf:dd:7e:34:db:dc:93:ab:15:72:ca:4d:b3:ee:13:b3:c3:f1:99:2d:05:94:0e:ce:c1:75:0d:af:82:18:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

40286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.DriveInfo.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a65c92649a9ed0944c455a33507f0f7fc177a9f52d10aa9a5adc4c56433bf1f
MD5 895c7d821f04ae51a07cb5fb0dd4f42b
SHA1 4b24d8f1f9019cd753f490650f95482f3144620f
SHA512 e9df8d55deee4b0b4b31ec9e4b174bda88f7672592f0b943f40513722ed102bf9f590083829414ca63d9596edaf630f76b68b4b8a8016d8144f30b06b165f13e
SSDEEP 384:xeVCHWl2Yd5zwNyAQbr9DFoV5vyGIRj2bWsX0WURlW:xAfTJr9DWNej2g
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

22030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.Primitives.dll

SHA256 008d12100f44bd8322a0253bd9791a9df3ac5b3924d704e7db98e3e8749489e5
MD5 104033f493d5e199b3bfd82180b277f1
SHA1 f0e05b304cb65a377f71a0ae68dbc9172685e05f
SHA512 bb8f7d37d005a59bdc47eee727404a5d818f605e5045b8552ee0adb07b87f577aaca6ed61b0eb1141971f051f435ac4101c506c7d55ac4bf35bc67510363a406
SSDEEP 192:eW/pNW8gXYViOxEdnX6eWvcuyjS7HnhWgN7aB+Wh8+c/EH+BEg7X01k9z3APD:eW/pNWUEdXE7HRN72SjR9zw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

70:f2:b0:a3:c5:50:65:6e:80:34:1a:21:17:bb:70:55:c5:32:34:fa:c3:09:37:50:2e:b6:4f:83:8e:aa:80:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.Primitives.ni.pdb System.IO.FileSystem.Primitives.pdb

System.IO.FileSystem.Watcher.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e32173739da64884e502d3ecc24de44913ee19ed438b6cb82c8cf7e8ae9e1ac2
MD5 801a9b0c3b35e89f7ff62ad5923f131d
SHA1 4f499b81efd19cb5f3be001776651126a8d8dcc5
SHA512 c7781a432003af0b77b6fc8349062e0ef09f276a7723f78519844ce24557224f4ed2b51498e82d5aeb7a201c1f01fcf1be860259ea333121fdf42f01a0b78fa7
SSDEEP 384:DNKlvFUu2U7ojkK1f4jfljl2Yd5ziNQ2ZQX4zPigfWvSAvUcn1NPtrt6MEq8LADw:Al28wkvfl7fgZQXR86vyADJ8HI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.FileSystem.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9cc9b0c2edca8d11deca90fda5cdd6c234a929fe9f17eacb21aa64cab10290bc
MD5 173860e72a28958c641ce458fd62c10b
SHA1 10ba9a2c69551b146aa1769bdafafacd6c10b14f
SHA512 ef0e066502401af53ae391e09881beb58914d9940bb05992865299aa0983f485e8667266281f7a19f8089470a8c9831133b821c1a7b720138768f3ecfac9d84c
SSDEEP 1536:8JOhhAge4IwnsVpA2J5/sw4q4gMYQpZRHav61NAaQJJZA09M+UM/UYffbGi2gOWy:8J0hAP4IwsXrcOzJJZh9M+iY3bGinCuy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

02:45:25:4a:7a:99:3f:46:f7:0e:4f:57:4c:35:63:4b:49:c0:7b:79:27:8c:5a:9d:f9:9a:11:e3:b9:92:c9:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

91582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.IsolatedStorage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0a66211216f3d68a6efeaf0263f2f24c553e901dd5d9313aba680de28048baf0
MD5 53160f475a0b060b0129385c1bc813ac
SHA1 e636b9ee8cecd8413a6ff47bc6c8b777e4ed81cc
SHA512 c7894bad5bf669683dd1a533af8abb4a6b6e4f7e26bf0b09685b863b4fa26d58f45b93f3b245b8abb6a7353e086acf68411c3746e0516bc5169887c2d9227943
SSDEEP 768:011x1A1Q0p7A78fvnTEYaHeWDI7eQGKJ+:C0p7AOsStGM+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.MemoryMappedFiles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2df35c86f91788c9829f8f75502a5f2c7f014a93d3ff6f36cec510bcac5b8234
MD5 744fee1c3e2cf893150fc14428642991
SHA1 eda7d8fbeb06452bb80bf8ddfbe8cd85a67e15e3
SHA512 8a2ae3d9d535d80cfa5b24599a348f5200097eb2f17a6fc9c7d5231936e10630271a6ef8dac6fca932084343e736325e0cb0effaa866556104233f3e2f2cc0f0
SSDEEP 384:S49jUQtDgBRFULvnAQ2Yd5zbgNw9v2/+d6dKoJ8Li/QqkCMwW5WP/uhxWV/LW:SO5tDbLfPm+d6co2G4IMwHb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Packaging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 64e1c57c8d441c2b3b98bb662742099165889644da55f281e2cc24888d2be8fa
MD5 941e3abc504d50131bc31e6bc58f22c5
SHA1 8fd7b3df32037cad841c22ad85ae86cab7e6a0f7
SHA512 b4680552ec4fd12d9302b549e2460b2f1499217af489ca4efffe67797d5a5c7b223ce688fdc1e19b087dd4b9a88b037db915ca9f7e7567f2010fa1deb7cf4ee3
SSDEEP 3072:qLNQmGkt4A59NzpHXHOQDAFWS6NpU3HEN:q5QmGkq29NzRZJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Pipes.AccessControl.dll

SHA256 ac6e45f9daedafd4c0fc8cf2e9efa3fd9222c74939678140d08288692ebe92e3
MD5 9173e9bed16968efe8f7c4a886049f02
SHA1 5c20f947aed3336349967f609c78738babe28a26
SHA512 6fb3912486df8e50da163ff13549de5bdf049e220dbe01d582c7339f6fdc0707704c38d8a5acde1beffdd8310d68c2d39c897b8ddcadc3bd451ce8baea91a232
SSDEEP 192:MW+q4WbBSxHdLdeWvcuyjS7HnhWgN7aMWhbx6IVnKaQwP7yX01k9z3ABNtqMSvS:MW+q4WN4HdLN7HRN7A6zaHeR9zgNp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d2:26:2b:f8:7c:a6:b8:62:e3:45:fb:4c:72:0a:1d:bd:1e:00:e7:15:88:07:e9:25:6a:23:df:6d:d0:89:99:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Pipes.AccessControl.ni.pdb System.IO.Pipes.AccessControl.pdb

System.IO.Pipes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d4e33b7608aee509eee9856add231252b7137b77bab4762fdd7c342711c120a3
MD5 899427d6a497f41bf22bd7c02e629aff
SHA1 5dfb154dba058b788170117a5aba0b7dd00b8610
SHA512 092294f662b024080f5ac12e8a7daadca4378174b477d4112df517f13edba692be113a2dcca49ab9fb8a92fdeaafed7b0ebdf087d1188cfe4eb610605ca8e241
SSDEEP 768:ths3o27tiKh2Zfkb4Vf/MdcQSe9tH2Kmp1Ha6MNJmLyw6V6AMxkEv/:Ts3o278Zfkb4RMdW3KmaJmGw6axD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c1:8f:f0:1e:1b:83:df:df:92:48:b9:8e:a7:2e:01:6c:19:45:71:98:a4:1b:77:d6:de:2f:df:00:70:00:97:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

59742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.Ports.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b4697b44efbacc69dea47d1b7321fb8ca230157df46ed235a0f40aa60f3294a
MD5 cf8254f4b70ff0ef644554c5322003ef
SHA1 f1db876c3803f8d03eafbd7e56e215bba05d7dc3
SHA512 8b9beba9f022a3773629be717f34b106d784287c699291c00e827d1ac130fb5e2c586abd4711fd41131f9b6bb4a07d476f53fe7a7768acecc7beae5792b676f8
SSDEEP 768:UE1ikiHVWVpYmHqXs6Un11fF+8Sn60X7mnKT0AKi9BH6BraCgBzZJuxfG:R2WVn1/M60oeDHmafBzZsxfG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.UnmanagedMemoryStream.dll

SHA256 422998cf85d8d8e1b298f444bb2803ed842080b50bbf190fd72426bff9e6ba9b
MD5 cd4e2781a48b1ee742aafdd4a3d72a08
SHA1 731afcacf8231c3a8310c4dabea05c596eb17ef4
SHA512 92f0b6cff18debc4f0e87b3234764f3a1ce9da443b0aeac04c878bd9846cc0f1449c713f11ec8de75ee3e4da93ec74e0c054726c8d97f3a723f5b5d89b793302
SSDEEP 192:kWjVZWY9pwPEpPxddWzHeWvcuyjS7HnhWgN7aMWhZ3xgV8FGecX01k9z3AKaVm2:kWjVZWCwcfddsv7HRN74GHR9zHaH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f1:eb:e1:5a:73:8e:7f:06:d4:11:fa:44:b5:31:56:b4:67:87:8b:6e:0f:9e:1a:d3:a9:28:51:9d:5c:c4:4c:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.UnmanagedMemoryStream.ni.pdb System.IO.UnmanagedMemoryStream.pdb

System.IO.dll

SHA256 5bc93b530f357667a2f2b8b13b47e80320d8782f642ebb747137910674125b35
MD5 8ace2d6fd91112ac6dca9914bc4afffb
SHA1 3ff6b44edf62c9164b243e3c585a47ba4b5663f9
SHA512 b89e8fc4d5ca8628e6e4235a0390ccadeb19e1321379805a4d3e2802d00b19c827fde26c35dcdc65e6d3b04509d71654d9769892fcbb08da3d6e78500c1c2b69
SSDEEP 384:AW2eMWGz833hdDI7HRN7UhROpg8M8/fi/GR9zZ8B+:R4zSjsUhQnMufiC9zu+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d7:eb:62:e2:c3:e0:3a:4a:07:a3:2b:ee:fb:ad:18:b6:0b:1f:be:00:a7:aa:a6:0c:31:60:ad:12:e3:15:b5:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.IO.ni.pdb System.IO.pdb

System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 258b767748e2691ff3e82c6b89ce7dbdf3b035891a0e41766cbe91f179bb0eb9
MD5 70b144811fe4f21067f9c7b3d20f605c
SHA1 1dd8bc5c194a8efca892b8add2ff777ae79f9745
SHA512 8f10ce2e9d8b9e7c3a1d6e840e3d4af4dde8dfe751018f56cf165d5901f66bc2e5aa975dcab5d4f7e407ae6adc74e74966e2ed966961ed34012940229f533a42
SSDEEP 6144:UvBFsMm1bUIylLIOM/1rYUMzY5hBOTAfOPOUBSBYHNlJfISL:UJFsMmRCsOMtYPC6UOPOCxL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

546862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.Parallel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 25cc15aef9c67413a2d551c8426c110f73e04845cfef2d27cca6cad5224a4adb
MD5 91b9077d6aa53899b3a0068063081e36
SHA1 ebee4b820159e69b88a068c2860dd6089d09a112
SHA512 b9eaf3d88f06a03c876c429ac337df96626b5c7685fdd7384810a653ec5db29b75d9d4d9b3bc0ceea084377e7940b62232685e9e5b51f0ca3184b1cdb9a20f63
SSDEEP 3072:YdTedrb/Lw/k36UIDvJ1AYro2rlyutytsf7LdBW:d4/K0BhlyutMa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

215262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.Queryable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71e59c2e83cbb97ade8ccd4a7fd019b6185b3ed6c257a0757cbd8adef55f240e
MD5 ce101c7e9dc1d626d9ff91afc09046eb
SHA1 c299217787421fd36f1db43e5bbfc361e9ab888d
SHA512 649b2c8e55564b66be2038552d2c3bdefb3d28c6fc25ee0be53560c14b1639d77f97d798c0707a7621b3d5ab9ea1b898e258b5cbcbf4e1898bc26b692adae974
SSDEEP 768:WjFL9MkIN2bACHMcpcLWC70XnxNM1I5Cvzi:WpqkIN2bz4WlXxNMm4vzi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

63854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 29b2f7958f6c7ce20a658f375af34bf2bdaada624757afd3fe2559e2e9b37aba
MD5 dcfc8caf03a43639952445f7c4442ef1
SHA1 a72e39cae0705b714f3b99d1f7864d7c89648045
SHA512 3c0ef19e4ac2aca96f5fbc312fdff0a1a20f9a3c60c524cf827eae99f8a72fbb5fb5a1479c36a4a3e0c201cb1f60bdc965bdd9f40e0e262b947a9c39b888fd75
SSDEEP 1536:dOA+EyGUSp6xpWLdXUXZcgleTiE50yTKy5Z/caUmztQ3CO1xgCdRRBeXbPNJT3:AA4TSJ2ZVkTiE5DTJz/cakfS+Rqj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

132894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Management.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 342015b3457ead575893f97ccb882e7cc2af932b582223d30771cce65d5308ab
MD5 285ffb3fe6bc4eccefb054d3df9fc624
SHA1 5edcbd41f0410efcbfb9a73063b34659f83f145c
SHA512 dadc0f7f61521517f55a38c777887be42fef119445c043a6004262258260f170373de5cefe4a809602a5c1839137bf5599e187a92b761852891cc80537bc39e0
SSDEEP 6144:4YLz4kuJ7BBTiVPDkoknzA7PDDyn+Z0q:4YLz45da7PDOn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

289694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Memory.dll

SHA256 dbb7584e06a35b6045eeb156dedb5469ae5056dbb45bd689790355d60ec37eff
MD5 6e439844aab932d1ff439b8c929e3f22
SHA1 a9a3b6f2ab33b0003ece721e02a10acce32ab516
SHA512 fd2dded613d2d394eb01c4197fb7fb0a0cb5e5289872f111fabaf3e665aa02c23fa19187a0371d5bc2743826b560e1fbfcf9ecef171ba61c75de2fc12429a49d
SSDEEP 3072:JAcX8QifNc1Y1cWDOK/9yqkewgUF0fOC9NAgWajt1:6cX8X1sK/QqkwUyfJ8gP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f5:ee:d4:cb:6e:f2:ee:36:02:13:0c:91:ef:9d:3d:90:ea:15:b8:0e:38:2d:95:01:99:70:bc:6c:06:0d:6b:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Memory.ni.pdb System.Memory.pdb

System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e9cf29860d5887e1a17f071354def3ada4778bb1bf1806133375318058d7e67
MD5 8f8b534f8dd6d2cdcd17ec87698746ec
SHA1 d50165971f90818ce86f816c15c31744ee8b18b1
SHA512 577545e89c757e9a5221f527dc7f96c15afb14c8050667e115b9eaa4ebe02e19d63f3ce112557b7a1913e2e6ac0a4d43b61533f2c9e5845dcc3a5f54de5d091d
SSDEEP 6144:PINUrGH/LKugWDh1xHx0qYV60bA3nIwLfcZiv+RGacXhPzdaXjO69pD0eBp:PqUrGfS4HxHx0qE6083IwYCdwd0e3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

538622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.HttpListener.dll

SHA256 e48e82ea2942a1d81c43485ee482c9d84ad8d766e485578d7907122c4c4ec22f
MD5 13209cbac19f5c803ad3332c5da0238f
SHA1 3f7451603be3adea6052565276d0e6cadbcad7e9
SHA512 9ad5c922788be6f6e0f2b34a27c0df54e248e022f29344b11ed8c72ce1c2d8f66a8937b0b79a4ad704cf9f28c71bae4331a21a2c086d4ac056c856383f8adf96
SSDEEP 12288:RqbR16eYC5SSoqWqYzXj1ere51nTX1aLUpj5jT2Z:0oSofqYzZere51r1aLUpN0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cd:f1:df:a4:ca:6f:08:3c:35:ec:53:33:4e:92:11:24:b4:4b:21:35:e9:96:41:53:1b:c0:1b:b8:2a:e2:4e:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.HttpListener.ni.pdb System.Net.HttpListener.pdb

System.Net.Mail.dll

SHA256 e9e18d6028b22b4d31ee0190769cbcccede665cce4b1be8420d93e03c82bdd29
MD5 af0cd503056c24b2b3d3b0e035633d14
SHA1 7dd22a1050aa226cdfb287b78e313447cb51228d
SHA512 6f7a99a36c36cbaee77544d1871844810c049351836ea5110db41b72f6df54126b77421054645568db2c810b735ff01df9f119160453d402f311eaa8d3ee12b0
SSDEEP 6144:S5GM5Lt6SvLa3CkHpJ8kkiP6VO9qrUk3CLoAzzDji4tfOMPxBGtts3TBbJxmrK6V:AoPc2jaKfOMPxBGttIT4rPT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ac:df:97:8b:08:ae:b1:82:ef:70:de:df:97:4b:61:13:50:7e:f3:6f:23:0e:42:7f:fc:2c:c1:90:5f:dd:b6:b7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Mail.ni.pdb System.Net.Mail.pdb

System.Net.NameResolution.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70ee5550a3c3c9ada5f408ba13b87afc01ade4635bc275df0710015e312df513
MD5 b732780107b427015693069d38817b11
SHA1 6e1ee51b77d74108adf22018ba362dfdc5fdd9cc
SHA512 10ee6adae638170b87650afcc8759b0be747343743b9f3f6a3899cb136f13cab0c118e151e954580d651c87f9349c0f50d15b579b38c74ed9fdd6a30ba8b18fe
SSDEEP 384:Joo9/aC8e6+EfoaUUW/8X6fGA5nnIZOgSsEXSNGs9qh9iDp8QngSTZODcKckcsb9:G2tEFUSKfLnn8OZiYs8aGQgSTZORD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.NetworkInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e4815ffdc1b4173401411de167a061f59a94267b9bc11ae6ee3ebc66cb08a3e5
MD5 efb2eac78d492e73e7b04c016dea1767
SHA1 6186afe740f92ce7018eb481e1ce0c1845088adc
SHA512 7094d3f3dd73067dda9f36ee3743d3c93fac813f7702ef991f170b4531a611c73a6b7d751d60dfeb5f67a1e778be140be0f07427e34658d5ef82664d6b1d9ea9
SSDEEP 1536:vmshbr5UXZfOzhpsTbk6oX6YixEVFI3XNkOxnTz:vm6rsfWs3k6oX6YqEVAN1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a8:24:8e:43:85:85:b1:f7:55:2d:ba:53:29:0d:25:a1:22:9d:89:95:f6:20:21:a4:53:b4:c9:77:ea:40:b0:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

85182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Ping.dll

SHA256 ec784bfc140fba12eeb1b8f5a70b39e24a91762aab174c7248893a3b6e466c71
MD5 897b496363f5180dbf97125fc6f0cba6
SHA1 220b3976ca77ac937f76f3639a8c97e6e4ff64c8
SHA512 ff545fed040d1b6d8f105d126ca0d138e4bf272c7df763b4e737f4c11b96ff5b05b133c302426001e4eb411cd46b91801949427b25102d972f5796b9d4f80c59
SSDEEP 1536:LUtE8ZojpxJmacaun1V3Tf7DXmIHN/hLlQ1mYha+Mz23R:LVpxJfbun1VjWIHN/5W1zAd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:2f:49:1d:48:03:15:38:ee:f1:e2:3e:d8:86:27:39:7a:68:54:47:1e:50:41:da:11:65:fd:8f:da:a7:65:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Ping.ni.pdb System.Net.Ping.pdb

System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0aa7828ab8b75237fe8b59b3cfa0ab8b10954b16ee38117ec60117028460e33a
MD5 5c628225a625a8dd9de9a2257dc648a3
SHA1 fd5bb27ab6203b48af414c42d392bbea4e88843e
SHA512 5e30530ce2eb534e80db70d1cb314a234cc7aeb6aa9d010a0da1008c4385d72551f1191c84bbdacbb87d3f94c6b622b4bd6cd56c88046e62d1c51f01e879bdd4
SSDEEP 1536:lawAVSlfXA4rPikq509XQhMZF/mFhkU9KwLrcfMgSxE:labSlfQ9kqCAh2F/sOUqMq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ca:88:ca:37:67:41:bf:8b:7f:13:cf:2a:fb:70:b3:4d:79:b6:13:57:37:79:eb:35:20:cb:65:12:56:8a:3e:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

85166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Requests.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5ff7ef1283526ed727a3cc02e07687caddee28afce6e13441f0756ce1280cbdf
MD5 e886c545c1c55e59685ebc0c9c297d81
SHA1 434032be177fddaf02995e22f41d2755a084cfe8
SHA512 77a7bee18916875883b04e606207ca6ef5558fd90f4407ef86374278a05247aa198f5e991720e818c93733bdf2fa410e12c13933aeeedcd1f3f683209406aa87
SSDEEP 3072:A9FdHZiK4fD/Dstn2r/B+h96sngvQodcpDWGrTw2k:YIKafstn2bQSsgrcpA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

135822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad9ef809008bbd2bf59c48ef4dc972680a664dcbd0d255c5152fefc529e31a10
MD5 cccd07b609f24c3e38a77842a57e9c1c
SHA1 80a4374e48f477788d2ebdb2f8df10aa779a6c3a
SHA512 6a668b676ba7c617b4e904d30924fd92067e11ac6fafd065069a246031bc911d7482ca63bccdffe5de1b76bae05b226504f0563ba075981b8bc1eda3342e54e9
SSDEEP 3072:OhJ3n0/B7wWUR+NyXg7trk7OpSA+6kGE2KgbqJfQLED9NTYIce:EJ30iPBqSzrf+LS9d3x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b8:4d:2f:8c:b1:8a:cb:63:98:5d:b7:2b:8a:ec:a2:2c:2b:81:f0:66:40:34:19:1c:fd:61:d8:ac:97:39:a7:d2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

231134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.ServicePoint.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22c805e2477e4e7a6e34924ba5201d6305eaaaaed70b62017c45c362f7d9f8f6
MD5 b11cfca2012430a64ef3b6399da33d28
SHA1 835233232866588eaca8a9205db40ee1b579dced
SHA512 a17fc736509a186c79e96cb00bb914f56f51cc36d08761d944afd9f1cd51a35b7adb2bf3dfe46d4279eae4bea709faf8e1d00b7c908746ccdf28d325b1f75603
SSDEEP 384:FtN6w9evlPN1pxTTga2iyQz7fAJsiW+cCW:FtxOlPX9b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.Sockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 53529620c3aa4075982e9dbdc8952e9bdbcc7aeb95d7abacbade4d414ef1f04c
MD5 c6825f02dc1ce074608a8bce48b0dab5
SHA1 95418f0310e4f74b78c14fbb6b9f22910bd41a4b
SHA512 be1912024330df7f5dbf834b58acb92d7f1ed45edcf5dae660af0ec08323e4dc4e9b2988320b211b3e005118256ac0767f79884b8012dabe31c47f695cdf8250
SSDEEP 3072:ciq9PVTL6Ix1iTlUfUhTvnJkm9gulQcTiKEiK+PADfZwSEArRQoS+Knk2J96aW:U9dTL1x1Mg0TvnJhgVkjPRVk2J5W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a5:04:85:ff:5e:d1:f9:be:d5:62:aa:c6:4d:33:b5:17:cd:0f:b1:28:a3:ae:26:c1:04:ac:5e:2e:c5:49:95:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

198446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 134a691633398fa66c598cec9e1e70685b23f3414878de0e109d7d24e1431644
MD5 39721fd5f62a5f1c9c0dd8139ab740ab
SHA1 6705bce547f5528abac8c1b2f528d321e1395e11
SHA512 8cef3c30ede35357c479d44821974f8f751359b4c22263d56d5439653c951f7cfd0c6c741bb7a44f38c90430c9f2bd76455f9acf7a5e762e3dd8e7fcfdb5da07
SSDEEP 1536:wOb+9zNGhv3BBBDzkVFUunU9Y3Bv4HWiocWz:6i8oY3Bv4HWis
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

62830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebHeaderCollection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c39b4e8ed6085f4598276241006b336de0a7f1b4656c58ddcf618404afe0e7ea
MD5 8fb46a733e9cc705a7e8a20574bd04f9
SHA1 c09491ffff7cfdc9957464289e52088eb5cef540
SHA512 16ebd096e0970c573596d115b9d78a4f493585163a6c8ea1a516dc55d9db60494c86ad7e6891a632cd0d33540d464cb84ea5f3bc5998bf9653c278d430df4aff
SSDEEP 768:Wi1zFHQTamoc9lj5XQq1AK1SB8SvbnrE:CamoclJ1fSm6nrE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebProxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c254228fda9d6c4869a39040ba95ae9a51265d5a7990083168b07251302ea04
MD5 3f7ad35c9e024c0d7e97425a047e0b6c
SHA1 ae0efa232c8f53bd478fad1247f897271ca7600c
SHA512 de5875b4c5a62b482c4413bb706f7a1ec63c5efac0b049197d2d79d2cea271ebf882d53bc01c3c1c24defc142126c90eee56b6671aa86dacd63b625499d238aa
SSDEEP 192:aVvCGwUTASSbEBch3Z4Gh6agWA3WprnW:gG94BmGGwarA3WprnW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebSockets.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f8384d0a3cefe42ddc09030c281c14f7204ad2b82ce89a1f3efb80f63801f7c
MD5 309109fbe4c44fa5c71af3e9fd266e2a
SHA1 05453b93560911bdbcc6782750faf3d3f1156657
SHA512 8f695b2796c3d3eea56ae4969053857f1368fcd9e7d6f9f436efcf6c56d2cdc0ea7f21264a014ac5277647cfcea63a6b0b2e8acdb551a1345c7c5383d49f760f
SSDEEP 384:nSaqJtTMg5ynAw1KWEobT4pj1C1/fY0044koqB4sYcWqovaErmDg51EI111jUdaK:0oGIAwIjIZff9oqccWKEr3EpENWsVEV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.WebSockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 343e8f7d9bdbae163147781ee3d18e621d36358e512e1cce5b7733b9edefc3a8
MD5 0ad34522f168f866d09b43ba0c3869de
SHA1 6e2b3665e1cea39a75cf697d460a0f7214fdbd90
SHA512 a55c73a0f8b232695df97e6d6123c96652fc63490e84368b7de9bf75888fc8d3eba4a4b1b6588322c717a5a9af5e356dee8570b8339d6f464ce03de007beb583
SSDEEP 1536:Nk87cgAteFF6majUmKCHjYfbIpYDvlJnqSRw+:TY+TjdoYfbIpYDvlJnqy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

56126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.dll

SHA256 2d76431b8c1836c217eb6fe840289b5bec6ae98f72e80ab657bd487be573c7e5
MD5 c487a49ad997c54bdd1966260b54b545
SHA1 029e74af432792b4d95817ede916d420bcc20d1b
SHA512 fbd37e62e2f6e49c3d6058a34af817984eca0bdee0920abaf7af2b943748ddd8ead24f3fd16a8ff97d2ec4f6de7167dcf6c8d6919f4b9d7a378b5a6fb7e18f71
SSDEEP 384:aWobV9WO313QglWK0dg1O7HRN7l6zaHeR9zgNO:m713261ibC9zH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

aa:c1:a3:33:26:1c:51:df:d7:e9:78:44:05:e1:8d:61:9b:32:9a:f2:c2:61:c9:39:9f:8f:63:de:77:24:7f:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Net.ni.pdb System.Net.pdb

System.Numerics.Vectors.dll

SHA256 daf899631e7d2b6e5a8676bf4ca454ea3a59feac100a8bb1b207ea23f7628284
MD5 6e03d9590582406ea0566f40a5d3c37e
SHA1 c533c0c100089dc318b7bb51ef419d18b5b6dd02
SHA512 20163b500d14d10b44394692c98f43ef2036c6f9067d5b8fec00d69aaa45226be32042060daddd3cf2c778c242eff7d49f75c636f626f0d21c9f79f657728f43
SSDEEP 3072:XfuHmcSg4eGY3mIqKJDbtrrkYLFQw73XNbrj7562Ij4L:mHmcSg4eGchz1RU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

32:51:e7:b0:7f:82:53:f2:ad:5c:0e:4e:f7:ed:7f:d8:8c:c0:af:d1:d5:a1:71:0d:24:74:06:02:ae:fb:79:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Numerics.Vectors.ni.pdb System.Numerics.Vectors.pdb

System.Numerics.dll

SHA256 12eba928f088dec978f00b1347454afd6e417b338e54e4aee56d92bf328cde5b
MD5 99134c6ce77dbd04a8b90475d7eccb1d
SHA1 2bc6d296ac0e9ef48bb3b74c000f0e4d1d123db9
SHA512 1ee73622dc0194fff68d91054843742364f8fcd1f934a0e742d3c7820c805f4cc519f1cc06d9533b432c13cf74d13ad944b7e40dd5d01b70c4d68fb58f6267ee
SSDEEP 192:tWek6WSj0+d3p+eWvcuyjS7HnhWgN7aMWhp9MMBdRgjLX01k9z3AzsylH:tWek6WGd3pY7HRN7GleLR9zusylH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ae:56:f3:1c:b9:aa:f7:ec:1c:ac:04:ed:f5:93:11:e0:01:69:12:d0:77:32:0c:09:23:7a:7a:e8:6e:a1:ec:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Numerics.ni.pdb System.Numerics.pdb

System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c035a4384cdf0c6b7f5c086f0c7c55158f1a216365ea775e6805152440c73513
MD5 dc462d00352c359a0d975c786193ab82
SHA1 f4a64dc0c845e8f1fa88e789da532b5c7ea93eca
SHA512 1afc5c23e8a6386ccdf4167d722937b9a29d5975be9d3faf2dac3922024bfab608802f6731902e5ce9ca5edb3a2ba5a38301c97af68eb09aad3bc1546cd95386
SSDEEP 384:XIjgf2esahsGrZpibree6YqeuT1Td25tNPGXrPpoZbARXLapa9a98ktPMGaHWlso:X12esaiyZp4+haPGXTOUAZ+HT1Wy7wp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Printing.dll

SHA256 ceaeb79be44b248b44bb9c65cb775f39dd4438f4f19ab2b1d65ddc20870f02b8
MD5 2f6247bf408a36601aeac1d9c61f2650
SHA1 ead05e4ae65a2265867a1ea7f9dae90df1d05199
SHA512 60b124a3f8ad4797bef1b0431293b593f4d1835db7f12aa3779c29e844d9a8206bd13af659fdaab1e7e16fc6ba37f7f8e9eaee38789f2f5f6a9fec0ab935bc62
SSDEEP 12288:XAe3WKGayUNV0JERuxjoB/Jk40OnqVd3uy/9xXBA3ebo4a/:RiU/0J52Jk40OnqvTlxX+4a/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

76:66:67:b2:df:6d:29:02:e3:9f:48:aa:1e:7e:0d:94:ad:03:90:18:36:fb:6c:d1:10:71:23:ae:7e:55:e8:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Printing.ni.pdb D:\a\_work\1\s\artifacts\bin\System.Printing\Release\netcoreapp3.1\System.Printing.pdb

System.Private.CoreLib.dll

SHA256 9ce4d015b9350831a05fc43ca0230148efac40ad0f3f2e7483c5bf131cc458ce
MD5 d7cf959f116b764db8a0d8d556b50925
SHA1 dff30b342248adae4801d17e0310648dba4ea63d
SHA512 d145561ea7d7312c81d59a56ee4f884fa8fe6ac82b6a2eff76c8ed09021fb16ab73722d800bab9318467798693c926b9a8c05c68e1441fa5c3bae2e1ae60a86c
SSDEEP 98304:wuDmchAUU3w/8bzZ85eUL0FBUSiAkCH4BXFHLiKpdrQ:wotcg/SzH1BUSiA0X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

83:59:f1:93:5f:9b:51:80:cd:1c:46:b7:d4:f4:8d:6f:5d:41:df:c1:d4:4c:ec:ee:75:fe:96:92:a1:88:61:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.CoreLib.ni.pdb System.Private.CoreLib.pdb

System.Private.DataContractSerialization.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 09b69203bb0daac0c4ac93c2f893d23e4d6094ec66135543509524f5631d3571
MD5 b42c8007542aac0fef1855253d220b9d
SHA1 415701bd5ca1e6c2b56775513505b302e6226526
SHA512 98ff9f7c795081c32b7d1dd4f8dc5abf040ebd412afca7a977f50e38ec7d7ba3b6be46fc121b202a17fcd618d75ada6f06466a24bb790b203886b6dd3bbc0919
SSDEEP 12288:vqPWD9DLWJh1GBWIkakMOQFnl3F/eda8VZQuRX1bZrYdISbfDYa6gNT3NIod4Yc9:v/RxX4XTrH/ynmvfv3URvObvR0O2lkLX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

760030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.ServiceModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 83fd67d7d2e8e044a26d6135b95956e9aea8f4d075430cb05bd6bd8a84d3f0ad
MD5 494ed53a8d6211fdd5320ed8b525e1f1
SHA1 d2397e0b1c5ede5bac7a8bb63a5f6d65ed009108
SHA512 a13e10fa36580de442d9cab85c16f1f3969becb50a024b8f31c75d6b5953c5a1719771cc7a676df92095ca087b5c4650391043958a0539674c1522477e1d2570
SSDEEP 49152:jWNyY35MeyPAjzRi0HDBSRzTxLz5S2Br:jWAYpMJ0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2306014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Uri.dll

SHA256 14c68463ab43820e1c3948c47ec18ddaa43d7b92dac676559252e7d4ba820aa2
MD5 933b4b3ff0a4ebc4bfd3965dbb14c04b
SHA1 c9d81317e4ecfedba340c4e30a94f5fe3b7e4b15
SHA512 02da3cec351a6c4ad2d45fc3baa1e335c5fdeb3ae36af071e45e410e24c66f23c55a50c4c833cd0d1ab23f35f5b09d56e30a852cd49fe0cb8059fe345c03c7c7
SSDEEP 6144:D6n0hhQLAIN3TZ0b69lgbdTwdRiksjIwKtM33d+dCMfMPMhMpENpQxxHwugtvRmL:DFBG2w0aLiBJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

df:f5:e5:ea:0a:39:8c:e9:95:ce:20:0a:84:55:79:73:d2:03:e8:61:d5:f0:b6:7d:40:05:d8:8c:d5:eb:37:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Uri.ni.pdb System.Private.Uri.pdb

System.Private.Xml.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 052da987d586b6aacd43052c7fe7bba4a2f5a6a826c0f9b7408b4c55147425d0
MD5 08a50ffc3b27f22f7ff624d56a6cea26
SHA1 ba77cba86e6eb375c0f4c1ab5784a96f9e912a49
SHA512 ce612f7292397ed37eb620c51f1c80d49cd70a92beb90ff0c5feca9ec486b40a274b2d158850e1c64e51ed10e5e27baaf242cad2ff586bd7df5a591100662a6a
SSDEEP 3072:B9/tzI+k4o0IIsXQSaPROlZIVz1SPEWm8Ki:lo4o4D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

138830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Private.Xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 29a24c9fd56a226b3ddb7edc3bf2a0dfdc222461ab9361a0940119bf0bf046c6
MD5 7991f035cdde82e5db55b201147d12e1
SHA1 f02d22818956fb2c309cec9c1083a92b5101e6e9
SHA512 fdfee6e6ef3ea71844b900d771be9a538de0ddebfa51d7b5de5707b2b7b48969aeea3e7d6196975dbd022d6aaf09ea4db9b4af5bf2be978059abd327341bc9d0
SSDEEP 49152:WSnsNtxn2m0+lUicJncwYqB2x4FhOvomb:WSns/xL0cU2wYqS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a7:ba:86:df:a8:c5:b6:cf:87:08:ec:00:0f:c9:c3:1f:35:77:9b:85:d2:d5:88:b7:3e:31:34:75:aa:3b:17:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

3059470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6b05773621a83cca542e4f38e2d2d44c5325e88b75ea43a0eed7df38521f4b9
MD5 bee24da2f0c8eecba68a7cc8db032064
SHA1 8f372aaf605c12b5d366d5165514db1cf746b8d2
SHA512 0f6942b2b3d8bb3f104b5f95131142658571364c121173593741e2fbb3ccb602998e0cb6042cf4d2dbc09392d89cfd04889b32d5eec36d94abc4c1a1b152826f
SSDEEP 768:/IvrtAhlwUmVDAPM2Dd8bhpCCxWbm3fsdlJJVLwK6OHf6BW0kXxHINkxnaG:/IvrfDchqSb7j7HfVxJcG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

73486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.DispatchProxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bbfe484ea179575c0815c8303e7ca6b07d3b91f11bda053b01ff2268681150d2
MD5 54fb3aeda26fe053ed3b0e5131d1ff97
SHA1 9e4df1aec361f6c842d4eb942e93618a45452fa9
SHA512 139468ecc83c37d30fee8ccc78b53255463b6ee59dc8cee9989b679df2d1fcec3831bb8a660ee816704a70ff9dc8cffd3a8d5a8f9b3cde56ecc767144dcb29e0
SSDEEP 768:Juwrfz8RGcKkZ62WaFXLWCbPrz+g3LySe:Ew/kGcKslNikjz1e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ILGeneration.dll

SHA256 fea02e9917a29f1caef5387506583ed8d2c9f2d7c01eb5f7ad7fcd0da01a3804
MD5 628bd7e0e3efb7172ccd55b66f615aab
SHA1 9a312cd8062ed4f0c3ec21646c2fefc18c6aba3a
SHA512 de3c370585ee4e66d1d9ccb77d80d12194d9224fdbc782251e087ad68df66a6f2906da9abfff381fb39d590cc42a288ec6d0dd4224064376f6e64624a9a1b04e
SSDEEP 384:yCWV3DWg9g3dCS7HRN7iyle6zaHeR9zgNd7hM:yBBgM+iylaC9zEtM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7c:44:eb:17:09:65:82:ce:6b:a7:b0:b9:64:20:2d:0f:ed:c4:4d:31:01:4e:19:70:b3:d6:5d:e8:34:7f:a2:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ILGeneration.ni.pdb System.Reflection.Emit.ILGeneration.pdb

System.Reflection.Emit.Lightweight.dll

SHA256 143b6dd989b9b8b1166a941538d8bebc5404b9af8961791060ce1fe68a01bde5
MD5 447a3f7a38834f4605828b22f7fbac52
SHA1 c724b1dcb513fdf4f8dd91aa1b2967ab05988ee1
SHA512 ec276b1ce26dbbd013b1572249d8f803829eedb8e9418e9ae1c5a2e141a350d20f9a34f0125c02c3821fcb4f2d6f18c2621e2312df4d49d45db713182b50291e
SSDEEP 384:qVWxYV+W73+d1x7HRN7lE3X+R9zusrSWgusD:CTmVWXi9zu6by
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7f:35:9d:fa:07:b4:eb:ad:8a:95:43:4d:4d:36:4b:de:4e:99:56:98:3e:97:e0:bf:3e:f8:02:51:da:9c:75:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.Lightweight.ni.pdb System.Reflection.Emit.Lightweight.pdb

System.Reflection.Emit.dll

SHA256 cf4013d5dcd32b6c39f964775e98a5513146b30da2317d4636fa4af4e151131a
MD5 17408c5a752130433d3d6af8d2807e5c
SHA1 a9d49188e8410741de610e795d0a64b73f0c2f31
SHA512 c306f5f86f0ffc7e223a16f3fece29e97453e6bbcf732b09f027599437748c2e3c95f9757a45d2900733cd58261ed0cc8196fe632d7f7bb896583af3f2d7fa98
SSDEEP 384:qLLW6MgWWursUwdPj7HRN7gzG50ZSxR9zZwc4UweB:IdUuf750Zi9zg8B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a1:61:50:dc:45:03:55:df:52:59:8d:7b:e9:f9:53:38:05:6b:6b:3c:c8:5a:66:ae:c1:e9:76:a7:0c:75:f5:ff

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Emit.ni.pdb System.Reflection.Emit.pdb

System.Reflection.Extensions.dll

SHA256 2d55789e85194ab4fec5de696b9bdc329505ad37e231ed84e81df7d449bb74cf
MD5 e7dc57b5b650fb11b3045b1332228802
SHA1 9c311afa635b0a20e7fde6254b727b5d029bd499
SHA512 ba5f2503db4224883370a08d89925210c2d33b7b514f0698e1852e63215b11e09cbfa3522f9d851d29078102eadc5dcb52616b677ebb5d89d5d997f11364e4a4
SSDEEP 384:MWK9BW3WdoNBE7HRN7gk6zaHeR9zgNb3l:a8dBggUC9zE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

67:8c:87:1a:12:b1:76:ca:69:c6:5a:cc:03:3a:6f:ea:f8:d1:2b:c5:c2:23:72:f2:10:58:1e:9c:8a:fd:f8:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Extensions.ni.pdb System.Reflection.Extensions.pdb

System.Reflection.Metadata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0f245089855c80a8721cdf9a27bfa3bdb05a0189dc3f02965223a8aedf86f282
MD5 6af1e722cc4a9d95182aa2a424f2dac3
SHA1 3643e6962fce9e22432ea7ae1ec2bc487c603c33
SHA512 d0f425e157ee66c610d37f1c1945df4e79ca333ae421fb2e575327e8327944ce8a401a4a6d0107335d2a931e60fcdcb8e17c79c98795ec87f661336651a61de9
SSDEEP 6144:ulyP5TcGa7o17Xg8ZldLTnCp6hvwAebPidk:ulw1TldLTnyNPw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

439838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Primitives.dll

SHA256 a40b9c13765d8d472b8efc72e7c3c096c4891d6a401d86bc2ae572d5c935ca86
MD5 f06e221e71bee1cd85a4bab2204edd8b
SHA1 993e991da4b157737570ef35804a21df698ddfed
SHA512 6ac740b1e824a87454c0ea2bf9a705f03cefc083a61378671a7b2fb52c87eb36a113a97a214b762d16f09be048d839b737a558246993daf590075a8b50740f0b
SSDEEP 192:9WSFZWK4lUjxrdHSeWvcuyjS7HnhWgN7aMWhOzSMMBdRgjLX01k9z3Azsyz0PvI:9WSFZWNlSrdH87HRN7tuleLR9zusywXI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

87:2a:ec:4e:af:69:4a:3a:95:cf:e1:a6:bb:00:e6:13:99:19:be:cb:63:37:e1:c1:b9:ca:d2:a9:e6:30:39:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.Primitives.ni.pdb System.Reflection.Primitives.pdb

System.Reflection.TypeExtensions.dll

SHA256 5fc95a1f86ff697dc5014b63a5a83e1caa14e32c5f8338fda4d44f800ab6300e
MD5 3e8f4b0637df5aecc3c5f3657670e57b
SHA1 a8cab6969397ef22d62ba58c13af23ce8c735838
SHA512 7214812d6eae65bf3112aa1b37df80688644bed47506435eb81c09ba1ea91a6953b277cdebb3f50ed4bccdc198414c3b1afcc8360d77d260e8899e1425fd2b28
SSDEEP 768:S5kdbrDGaNPNmSux3UU4d7hIKeJoXE8Cpp6IXEUoyBp7p+yV2R1NIAG750Zi9zG:S5kdbr7NPHli2SAGNzG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

63:33:66:0d:a6:0f:20:5a:3d:be:e3:03:ac:52:46:67:3c:bd:ee:33:b7:c9:18:83:2a:98:8b:62:ad:4e:36:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.TypeExtensions.ni.pdb System.Reflection.TypeExtensions.pdb

System.Reflection.dll

SHA256 f942b4322db97ef98d5793f6065a749fafbd6ddceedc36293329529e0b0d48c9
MD5 f47c4db395043d3067eeaaa9a1363b0f
SHA1 af1680d600a7f297d072f822cd57e393e7cfa293
SHA512 5f7ef9a1e92906a9028f3c120004211a5b6cf9892040f44cde5abf98545d3cd1d939dd2a0d2fd161e492c1a108f35f51a1bcde19e108e866c87eead590cc4f6a
SSDEEP 192:UWhR1WdgbK4btExV7dr6eWvcuyjS7HnhWgN7aYWhHFVd1wqF9e+X01k9z3AeJX9w:UWhR1Wy6V7drE7HRN7q1/99R9z/V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

66:e1:3a:85:d1:3b:06:25:b4:aa:64:ed:8d:65:dd:64:0a:8c:53:92:07:d6:5f:37:e0:c7:f9:f8:61:93:1f:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Reflection.ni.pdb System.Reflection.pdb

System.Resources.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 62616f161c44c7ebf81096a1a988a03382390ebc584188ed850a86ae9132da0e
MD5 32c8ed263f97917cad7006a047366338
SHA1 1479c22419fe7665cc4190eca2fdd7b01b19faf6
SHA512 959b600000a43dd1448940afae67a31f0922dc1186a1f881914dd11f25b6de46924aa406788ce79bdd2970c5706c6e0a3eb170bfd600f5405d2eb6a7d2aa4e49
SSDEEP 768:3yfUxAAOW/XzXQmD6OSbt+tiTsos10MYhZTaiSrVzzxbv0U/TPYCDO:kUu9GoxanQe9tBv7y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

50446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.Reader.dll

SHA256 97bbd447452e22a0f6efaa7ae954e12972862d5f145f5ac5e6bd89a724004315
MD5 db9be5a675c27c3372c3a4fe6e9d8ab0
SHA1 3aea5e6da260603a0bc1fd7c5d88d11fab90309b
SHA512 49867ce81552d45e8b8cd783ec40f5eee7d5ad41cafb964c518fa4df41ff9ce8330a58fe23e35df89ee13f37822a3bd87172588d6c92d6f22485db833fa4c98b
SSDEEP 384:8W4iwWr3dHhK7HRN7MMmE3X+R9zusr7yKzMk:TZthmMGXi9zuiyuMk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

53:20:aa:cd:86:34:63:f9:45:4e:d8:04:a1:ec:f4:84:1d:82:ab:15:54:87:a4:26:5b:8a:ab:75:98:89:a3:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.Reader.ni.pdb System.Resources.Reader.pdb

System.Resources.ResourceManager.dll

SHA256 794aeb7db6dc66a2bcc6f4f008fd36fa85b845ee34a17608ae50866e2d8ec475
MD5 4a6103f73c8d1d09f2cb9e3cdc36e8d3
SHA1 10f1254be423afb56b69e9de283aa580440d5ed6
SHA512 508f0a592b50a2cc95ee2c7a5ee2927dc0eecd1e7366b321ebfca27c428118266e191165ec1c2398e68316f24acc8d7fced69172ea676a5551e28dfd4b0e0402
SSDEEP 384:bWV20WrZ9SdoF7HRN7HoTg8M8/fi/GR9zZ8B8j:vb9fBHaMufiC9zu8j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:46:66:c2:92:d3:7c:ec:32:eb:57:b3:ab:56:f3:d7:3d:96:c8:5d:42:33:8a:db:a6:da:dc:4b:a6:6c:45:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Resources.ResourceManager.ni.pdb System.Resources.ResourceManager.pdb

System.Resources.Writer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b8642692a063153c1259ed3bd3da86f29e97a36e79464f89d5e41c75f1d2297a
MD5 b5182580bed8747fce8e6da01b48a711
SHA1 6bca497bc286bef465b7a213b99d32543960fe1a
SHA512 1bb4c94ab69aff6f20449cd3ac2dfbef6ae4645f032180aabd4df87a2a4ec9e2e2b58c61e6c4802af708a2bd88254a271da5a520982b57d3528a9234259b308e
SSDEEP 384:0vIToQKTFHRqVak0VzDhdFqmSj0QPuSOCWeMSW:0vIToTTFHRdv1qvV8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Caching.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 53827519463567379b65ac781b0c3088910eb62d4519069a0b138209ab840463
MD5 ba1e94ef700f2aa38291e841394f139b
SHA1 422f5514e43624f9d4292898a0d95166dcaf2889
SHA512 1c32be97b2b407ddad30b2f8c7d91518d77b28572e52313f72e4d3239383f12cb94759c23e3fa357eb4d1c7f242a47b67635f9f7d53ddc80a5d7cbeb98a1a23f
SSDEEP 1536:3jxDkeE3sMiZpRjp5TxySpovQIlZkUaVuH+usRr:l4eHMiZpRj/TxVpo4IlxaMH+umr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

82078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.CompilerServices.Unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ca3f57881e415d61a43100a8ea77e69d983f9d1de14971381d240a1e21b3370
MD5 b37ee0006a7af7ea6019953bc6a61b78
SHA1 ea2cb754391e2708065dd4cfcd87188de4015aa5
SHA512 005bd3670bcb0f848bbdbdf673980a2f086c2844b0f7db72c400487d67cabfd80922d0ba09b93623ad942ea057132146e4869844d7fa2c9086b5b0b4b7c408e1
SSDEEP 96:zHnzzY24ZxcE0+B7xvOuKDPbqDwWgdhWE:v01V97xLAWgdhW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.CompilerServices.VisualC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5dab8eee6f0a678e2ac77070dfdc69f6e69710097411b636106b3dd43e636305
MD5 9a8eaa5b280e82638af452ebd25f78c2
SHA1 984d46c36fc3f65266930fffffc5634eb04ebba8
SHA512 190e66d9187031a7d059367e99f1b719b411a8bc03798ec06a75459284fdd4f234f28fe87330500ad42caa272f9b50a28b27ab41e6989a31283a1788e452e40f
SSDEEP 48:6EmSILXKd0w4GExkvf/UQUKVdJKGXBZLxObGP+Iv3H1HuKqP0DzDVQxc8mZWcJL0:bNfEiMKVdXzxv3VHuzP0DzDjWsO8WE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Extensions.dll

SHA256 f52450c3184f1657de8110428f92930f0ee4acba19c030573bf72fe2f30b8499
MD5 4ebe62c159d77fe4f61e33f9770d5934
SHA1 74ceb072d4db9160e8e02bbee0a9540a47dd791f
SHA512 13404234a035523ca3867681a5cb926b8df3db3030e49d170db816a4fc4919e13d7f42d288d7b6c791c850bea0f562edcf5aebd6be0f8e779fc3f9e966e43e93
SSDEEP 3072:+O4/RerJ2UiL9ebKKKn3MJmlc74vVJDS+FP1ihB8EkdqVCVvgYSJf9XF:Z2Sw1Znn3x5XSkykdOCBgY49V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:a1:1a:fc:43:15:7e:49:65:9e:4c:9b:cd:a9:4b:e7:c5:bd:74:8f:d2:d5:88:02:aa:90:98:e6:5d:d8:1e:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Extensions.ni.pdb System.Runtime.Extensions.pdb

System.Runtime.Handles.dll

SHA256 220235cf56edb06973c7c234b03a242f0dd3aa01032222ef295c798d589c68b8
MD5 f5d7e2631a4d8005681c499790e78c57
SHA1 66604e689fe487539a95e9967fb9906f28a492c2
SHA512 6de423361c8a7a034d7d6878a3415e163a2c1c71abc09bb39076e71a9ff7d0ea4f1c36a342d1d99083ea2e8636ebfe968742428977fb5e4ff9db0a21e33d02ac
SSDEEP 384:JIWAtRWZCkYdsw67HRN7x172vH3rPR9z/GE3:OLksWa3l9zr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ed:c8:7b:8e:92:98:a4:33:a6:44:cd:93:ed:97:c7:fb:76:04:67:2a:0e:86:2b:c3:ee:ef:b4:cd:ef:99:ed:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Handles.ni.pdb System.Runtime.Handles.pdb

System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8c95905d412d406cbb9ef03536cd6b83a474b1d630187ae0b85d483df6aec38b
MD5 c199b752c2fd8153b1f3bb3ae1d0dbdb
SHA1 8be64ddf412ed4ef3988562c0e2a5903febe2ea7
SHA512 7116db56f6da057c6b9e5462c3b06331c96b52659de7df7bf09297822ae7f1d9eca4ba76456ec7e5d01e28183a2a80f173ad62e9eb653782a281bc2accc420da
SSDEEP 192:a9g05Og2uPPUxRiAz4umIskSxc3+piQYWHXDW:c5xV3XO7mIQc3+iQYWHXDW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.WindowsRuntime.dll

SHA256 5cb4242180d7f0e6e5f2148fbfe8e1f5e0e796ea0151648f6990bd2ba3ddc9b9
MD5 339e490c340e20e9b763cb2e3ce44fff
SHA1 0cd8d1aaaa95a1b1fe942e41177f1988c3245168
SHA512 a28e7837cbadf3b9dd0b7efd67d4b18156aaa59f76488c0c8016882701ce73e4e60e0cdea41254ac1c3be3baf00828385969cc97cee9be908e8dc5fdf347fb56
SSDEEP 192:BW2yQWr3p0q+Uo2zCx+dhOJeWvcuyjS7HnhWgN7aMWhi90MMBdRgjLX01k9z3Az2:BW2yQWP+FoI+dhOJ7HRN7YleLR9zusy+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2e:20:e9:b4:d6:b3:5b:cc:1d:82:9c:4c:9b:f2:57:92:ca:3f:d9:da:ec:fb:c8:7f:65:94:9c:2d:a2:78:0a:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.WindowsRuntime.ni.pdb System.Runtime.InteropServices.WindowsRuntime.pdb

System.Runtime.InteropServices.dll

SHA256 458fd4466f84acbfa5a84cf9a403ec8ed2dda111fe985523a3d51081a3e63b24
MD5 b57f607811243f83f754a6bf8908ea69
SHA1 f1d7286352ae7c3d69aa30ff190a5fde8ffd8b96
SHA512 cd3b375174940b4e8a13aa7184911789d4d6c67f01f02f7f085c0a27c94309bf7231515784e06bfea21e84c903cf318f42c542c9eb8cbccf3f67f451d47081be
SSDEEP 768:u+XO81UgyABoc9R1xnL+jxYNfkIMADBQAYgMQPzYKhuLdibn6K9z:u+e81HyACcaXADBQP4f0RibnXz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f7:82:59:e5:fe:8d:bb:c4:40:67:06:1d:3a:2e:96:cb:f9:6e:13:fb:dd:e1:a9:db:46:f8:ff:48:c4:f7:f4:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.InteropServices.ni.pdb System.Runtime.InteropServices.pdb

System.Runtime.Intrinsics.dll

SHA256 6ce5ead1e4819e5ad89096c854b771a4871889bc99d30390622e76d6f76e99db
MD5 a4e941e6c7db06ce5bf1681ac107c1f4
SHA1 33abf5f6c201adc05f404ba7f50107762a8c2b35
SHA512 9db864a06c48885a4f21776cfe42d47b20edc5a6d6dbed38407e3c6c3bfade2b9670ce5ef59275d12275c0b9816750520482c4c884c152350276499ff4b44935
SSDEEP 192:5Wmu8WK3XKXd0sueWvcuyjS7HnhWgN7aB+WhK3cH+BEg7X01k9z3APDWP:5Wmu8WuOdfI7HRN720LR9zwiP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

73:b2:10:c2:e8:6b:8e:ce:a1:e7:28:85:9b:e5:89:da:31:00:15:91:83:e0:16:c9:a7:da:41:2f:63:8b:94:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Intrinsics.ni.pdb System.Runtime.Intrinsics.pdb

System.Runtime.Loader.dll

SHA256 488e674e338ee83eceb170e8eed9dcc642107497525a93899a45e7b7361a7212
MD5 0fe7d237ca3d177478dc6ea208452639
SHA1 d675e3c84b15848b9181a5fc2777e8ae09c81ec8
SHA512 59c8ce0e7b4cc8ffccc613983360d1896ee70354ee3e9a5c26d9842e85e9afae542fe0f44b630376e12f6cc4fa6ca2357107cb68e7b84ff89490678d731c32d3
SSDEEP 384:XW59xWP0pd117HRN7yE3X+R9zusrJiHsF:g+09xJXi9zuhMF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f8:19:1b:3b:03:d0:b5:54:1d:f7:9a:a4:68:37:35:ac:e4:34:3b:5b:ed:4b:53:2b:84:e5:76:ef:dd:a1:de:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Loader.ni.pdb System.Runtime.Loader.pdb

System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 62970baf18704fce939507f9598c5729a875d4d22809a62d866ac6323fd0673f
MD5 11972116657eed33217092eae504ef2f
SHA1 552c49a29e63cf50c85250c944cd4445e1defd56
SHA512 5762df11fffc75ef6bb0be36e663f89e3fa7992613cf0f49025e6de3ba1f0e349792c3f376018c88e2dae6a4fc54293a2a0f052b47b1ba2d631b6d585cc432c3
SSDEEP 1536:Wymq/xtRguiMPUY86M+VmbMMfVzoxqtH8FKp4ihXkxNw:WC6uiy+6M+VaMMfVzoqcryXp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

8d:11:42:b9:d1:d8:d5:41:72:b8:6c:8a:af:1a:54:bb:e9:28:90:c5:75:2c:89:48:d8:7a:61:ab:09:43:b6:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

68238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Formatters.dll

SHA256 cab5210a66f89d054e31a4204467c3f384c1fa2d308dade5344577c7369f9828
MD5 e593f58dea6a2a5ea87c4a05178e3306
SHA1 a718d75bd070227daf4611c684ed0a4dae60c372
SHA512 ac1b4adc0c793b1ca5bfd47d68ee92d77be0c53eade54e25b845846458b376c25b66fc23342e065d019aafc303b388f7bbb7fedfa73645b93ac49477d2331850
SSDEEP 6144:Wpxkk+J54F0rhL8O0QsvN+LLIOFfqIVPTAvPHJU:Ak14DdN+LLIbiqPHu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

80:d4:a1:f1:35:dc:1d:88:c9:55:9a:a0:02:c7:0d:38:d7:97:e6:92:dd:a4:b4:64:d1:b7:c1:a5:12:c3:4c:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Formatters.ni.pdb System.Runtime.Serialization.Formatters.pdb

System.Runtime.Serialization.Json.dll

SHA256 03cffd90eb6c909adfb24eb1b017aaa6e752765aa232d154e7668f4f0fcf5b00
MD5 f0e4bf6c66891eb5255a95d251f23e00
SHA1 f05c447926d29f8a7dfcfdbc9aa22592205d1761
SHA512 ae8f4ab4d104c122ad7a29a476237cbb08ee3f7a7119788a7e3589c5b3a714ad5c9a0266f56b6e375aa89bef0acf84b15a2d8771b5a8550c1565d9fd9a8f4dca
SSDEEP 384:XVWbuMdBuWS+pDdED7HRN786zaHeR9zgNL:XWxdBCIS/8C9zi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

73:f3:6b:4b:8e:02:f6:e5:da:c1:37:d9:89:63:00:f1:e0:c0:71:b3:25:0f:e5:39:75:de:b5:78:69:3d:93:5d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Json.ni.pdb System.Runtime.Serialization.Json.pdb

System.Runtime.Serialization.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40055cbf3662422998e9052106562383c634c1c7be21b2e7ea5c10c1a4b74522
MD5 b1ac878b1603bc42deb8f1202f4ce38e
SHA1 9e565041902fee54b889cfed6ea6459e92fdc9c6
SHA512 ad6698ef7818b7f6ac4d34ebf1035819b4d61cb8f3c2fa6b8b12e8fbe4daacfef05e2e383f1b00900c8ee34bf57a5d9c587ef70ed5de9e5b596c53c796edfe61
SSDEEP 192:mlUBfukRLycfxxsy7z+9B+N8VkOzCfCkNFoNkHHDawxMPVyYQ3Gx2HWFIuJBcW:aALyeKh9BnkO2akXJHHD5MqC2HWFIuJD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Xml.dll

SHA256 be6577e9a5c0b5912fff18e6980f091baba819c07489244ff6e71af818f5dba0
MD5 da0ce89fbe65aad22491dfcda27b3932
SHA1 1044b5ae24cae2e5024e85ee23c0352b258995bf
SHA512 73805aaa93e103c0ae23462737a40e64653708f5a0265f273da1ba363f0d26e2594420ef0da97919e94a3f0f27fc0e17b540e4594f566597814ad9317e9f9042
SSDEEP 384:mMWsBLBBXWfRlmI8NXYdc27HRN77HR9zHOttS:miNBB0RlmI8NX5a7x9zua
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c1:d8:e0:c4:61:1d:00:f5:9a:b4:f5:7e:54:9d:19:01:d4:b3:6a:1e:dc:45:e1:ba:fe:2c:03:70:02:38:60:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.Xml.ni.pdb System.Runtime.Serialization.Xml.pdb

System.Runtime.Serialization.dll

SHA256 33485af8118d494ca489a89f8f2e21c3759ea0317ea6c8a5fe541338f5c3d1f8
MD5 b932a7eff5de419f286a7325cc0befa6
SHA1 e3aa45ebb2ffec8c1681134f54d0f533d541c899
SHA512 6708fa3eec64a927145dd5bd174902f5c612700f0fdf782e577a7a7dcfb07256d3a43098aa9415cf038baac840194fa43ba0865fd451c49520e45efc4f6f64dd
SSDEEP 384:RLWgM/4BAWCDNDj8N0dZT7HRN7pU6zaHeR9zgNaJ:RP84BQDNDj8NqP2C9zP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:36:8c:0e:37:90:2d:11:d1:62:2b:5c:07:74:93:06:ff:b1:0e:10:a3:70:f9:c5:13:1f:b2:71:e6:13:b4:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.Serialization.ni.pdb System.Runtime.Serialization.pdb

System.Runtime.WindowsRuntime.UI.Xaml.dll

SHA256 d7ba2132369c971fd9e5aa47be4f378f6030b42bcd73669bd7d09e7a0aec6347
MD5 d309bd3de14a64e331408b0be88d098a
SHA1 98b40667de331481624b3d964738b012c9f21e00
SHA512 b25abb1cd779ec823e71511360dee34b27765480e1982eb1e37ab727c0bb59b97323d5524e76244c8e2e27f8fb6e1893b006ea2c1e25ccd7133a12a0c7a80f0b
SSDEEP 1536:XN7kr3y4KvS8oFRHVX2eh1Hnxpo/8qJm6Ea5z:XNgzzKvSVFTdB7Kr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

97:ce:0c:36:cc:9f:1c:dc:09:79:1c:03:ef:bb:e1:b0:85:09:61:f4:9f:f3:ec:25:f1:77:52:75:92:e8:94:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.WindowsRuntime.UI.Xaml.ni.pdb System.Runtime.WindowsRuntime.UI.Xaml.pdb

System.Runtime.WindowsRuntime.dll

SHA256 1eab2a5ea074dec1a6ead80d1361a9fd4317e1cd334672c9d877cf49ccfe5730
MD5 56edd7e41e06bea54a9259aaff12168b
SHA1 4f6439904a1ce70d806ad1016a2c6bce72718a62
SHA512 e21f42d166fb5a62b2ea1dcf92eb60b910c5a3ccc2426c2d0d47491805371206ba04032de661277cdc479ea9064fff8a0e61835a69388b976a2724a8a831b339
SSDEEP 6144:Mf6YoWGxeGMc2fDu2WFLz7mXDaRTKlTOZPwnPqP7fPi+ubbrze2vQQZm5tMnf:QW2y6THrzC0f
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d3:9a:47:da:51:e4:10:e5:da:cd:e2:4f:c5:92:41:96:9b:b2:07:b3:1a:25:79:d9:74:b7:fb:fc:a0:a6:0b:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.WindowsRuntime.ni.pdb /_/artifacts/obj/System.Runtime.WindowsRuntime/netcoreapp-Windows_NT-Release/System.Runtime.WindowsRuntime.pdb

System.Runtime.dll

SHA256 9e1b4b18ea91fee6a83957212e2c33ca1b332d56726e45482e00dc28d82e4444
MD5 64b6db4e5edc35b1f0f4f8661b1bb5e8
SHA1 816f75651ce029b26284796f1436e229e06da9f3
SHA512 219d8163df984415d580737dc23720f1b2d64b4ebb03ee40a5aef94b50e5b6b2ce206cf307d58dd9690ef021ca9df1cdb35380256bfce637212f4695b57032e3
SSDEEP 768:1xGYe544b916CVbYLNn9vYAv50o2+XURlaUIx9z7m:1xGYe544b91ifZ0ofERlnIjz7m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cf:7d:96:ee:69:25:64:79:68:75:8c:c6:bc:24:f5:0f:b7:38:5e:bf:fc:d2:d7:88:e8:a8:ba:c0:70:18:ee:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Runtime.ni.pdb System.Runtime.pdb

System.Security.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7ce09376a9b66e23f1566a77a3f6327f08365fe10f887d349754b427a5f48f57
MD5 c868b7b695fd2bee34bc2795827a7b46
SHA1 928c996e6074f4e5e457048a98a7251f76a6d004
SHA512 410c5d404390743de89a8934fc1d65d3eafde2f4b72e774cc02511859e219b6f2c5cabe6260d067b93f699858bba0e77444de652a72fa263898d2c16522d9227
SSDEEP 768:bSCeWMIdeSynI5v4jganXhhUESHbCupCupsWBkyDR5yzXbREKucEyYvAu7tiayOs:XOSy+Og8nUvpB7KzoAuEWHyQ+cAR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

84222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Claims.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a89235d45ec5c580d55c38be3b77f7fc73213e566d63dbc036d5f6a6e7e7b6de
MD5 0e5656d6538cf7f0286836ad02e5c22e
SHA1 da92d7516015fbc7b9e2756b86ef9329ac7acf9a
SHA512 188aeba2cf98c0d03e8a32bd325f02ffad92c259875a9b83513c75dc42a73f84e380282f08a4c1525f8b1a2ea7a3ba7d3fb0a4253a3228dd6bb8bc7a3265cd2b
SSDEEP 768:OQ9wLspB+iMgvW4Tsiozu7bSw75Axl3OQwQ7rzUU3q2bP6nD:OQ9wc+DgvW4Tsiozgbh5AXOQwQ7rzUUs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e76a624c648a84d39e18b1887d2c33f45d73d208d430dfa5ea9d60fc82645237
MD5 e0b3ecfd227f05c61bb86977ac1f56d0
SHA1 6a5d800d9ed13444d6ba09656e6dff58afe55879
SHA512 623fa65d6ac1ce6b438a7d333b9f519a1c2a5d0609e69651b86eef483deb32b2d346492366264e4d99ebb375aefc54ba51da70a610d4e8aad500604d10c4d17b
SSDEEP 3072:rSfXxEah7CQCE16utmq1j60BJjM6zyOz3XyOUPxnEhG4kOuZd8cYIhpn6lqOEccP:gKmHmqW6dz3rUPxXQ+pc193G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e1:88:d6:a3:fe:32:7e:51:43:83:44:ea:ea:62:ad:4a:35:5e:c8:04:a4:4d:a5:06:90:62:f2:1e:9c:6d:9c:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

230862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Cng.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 643e1cb8fc16d1267926f66a6bd89c899044d84468a250f6fa56c6d92eb2f207
MD5 6597bbf8e129be4e2352297bfb245ff6
SHA1 398dcb8a9108c2ae946581f6349c5b6a6549b639
SHA512 f73a919dadf9ef23d5731865a6d007d41d5db9acb73f631317146cbad4953e1e8d0f9a5df0455cec1c0217efbe6edd8888f32a7196b5e73e3165ba24ce023f41
SSDEEP 3072:6hxnwABgSgQguptbia3KOAGixWgXhG4kOuZGTc/py7pgvPco+7:6hxna8O3OmxXcpWpz3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

155262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Csp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a9ae1a4c697236fb6a9e46b66e1a14a7b60110a83ee80ea641b5808c5c9ba9f
MD5 40d546a58e8392bcedf356ddf917b1d6
SHA1 f018a1c76e1c4fa5c7eafbca6f47c1e6eb6fdabc
SHA512 68e77532768a21d39e0dd7083dbb2c1251e3e397d819ee3f95a72da0d22b88cc37021888ad15ae10db82583513497efd889506223056e3716c84d75add141cde
SSDEEP 1536:WCJ4Re75Ko5/1UUjDH0CeM/hWRRR8HxE5mTUQ3WO0lDt0ig:3JTU+UUHH0rWwmUQ3WzDt0ig
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

72574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4092f04906e3ad585fb8defb60dbbd2e1ea6574ac885948370600d0d4d558748
MD5 c44b46d68b9360efccd51360c5efba29
SHA1 7149dcc6ae7c34cc52699cae1cade7dd36d5f9f5
SHA512 f8c37f51bbb0141ba409d816c79f1807b6235ab658c3f74c0ef2ddfa550504ac66207b84dc62c1fb9c327e4aeaf6a518d6fb6b85c44ce5cf8bdd6d2eb95816d9
SSDEEP 768:UuSboZ+0NaJDr68JWuJVy/NcsvZl8dS/:2bS+waJf6eWsoc4l84/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.OpenSsl.dll

SHA256 497e1c7d7f02b4d534be4084873ba80b051b935212d36aefec83c6cd6a40e2b3
MD5 37beec6e6ee2e9d4128e855578bc8c22
SHA1 8a6b7fe922f32846ccf353a328a2b61cadc95894
SHA512 79127813b66d282a8f5417cd1d4823d53be8dce711d9017905ca6881376eecd200fd76be5454d89965452dfe8c50c3609ee2a02cd7875508d8f2ef8c3396bf88
SSDEEP 384:2jy9WAmlijWWb1IxNfHiRZGJ7MTsPQ7vz8zlPKU4WagQqIfLDUBtjSmY7HRN789r:2jmn1I6RZ+agQqELDUBtuV8jC9z9K
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

86:84:5e:99:93:c7:b8:2c:70:66:97:b2:2d:39:fa:13:1f:46:8d:8e:a7:d6:62:68:94:90:ad:f1:f0:99:42:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.OpenSsl.ni.pdb System.Security.Cryptography.OpenSsl.pdb

System.Security.Cryptography.Pkcs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 48250c7249b9dfeffc6d87450dc086586d986af22728a7902e91340f747266a9
MD5 2751a3e9dcb2d59ec23b3399144e384f
SHA1 d0f4ed9de306f0343fa826ac00d1c63537c7be0d
SHA512 b77cb8de7bf3ad96bd2a5aafe16898ebbe3d66b587e3e15bd5b9c2d941e7f9aa4de0ca6f4ee61b095a0921e51ba12c1253d6c95018f810d00c37e66ce9adf1d9
SSDEEP 6144:RKDJrX4NXwVVLEBL/AEm8qwF/FWnU5QEgETM2Y2FYCRqAijSj2yxlMWcAGWRhm7:INrh0GJyxncAjI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

283022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0354425cf86ebd7340e12c9dbf897353c0136924f465f1555613241f0b665a87
MD5 32ed8c74973590db20d66fe3220c0c6c
SHA1 b6299dae4c247ed68fe735de450785aee9320c68
SHA512 c001f4b13d3c4781e83bba0a04f1134c6d7f6e3bd6a9dc240ad8e8313aaefb3f2e9d3c24adeaaab8c29420ffa31d34e7ee892f15d1bd1e3b7514d35bcfda459f
SSDEEP 768:LSMr7aKPsay1SS3ObXcSNgHgbEA050FKhBzXb+TaXVxAMxkE:3r7aKPnSOFb+50FyR+T4vx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

37:c0:d0:cc:38:26:f0:80:d0:51:99:72:be:33:94:8f:92:f9:ee:76:98:5b:a1:67:36:45:31:82:2f:eb:d2:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

46526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.ProtectedData.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a1768b5b1b181aa32dea75961f6e101ad53d7f955e79ad4527d0f4cb2ee5b16a
MD5 5468e9d3b7e8fa1b6dd4f089f5d3b995
SHA1 6ed6314272b6d423d3ebad99beabe6268bdc7588
SHA512 9d0466e8ede0dfabb5ebd49d2d4f250f653329eadc6b7792a62a5e46568cf3c85252f8ca57ca3f5f4007317fb292e6e04e90adadde1a7b88a1b7febf65c58f87
SSDEEP 384:D1RGUsBEtrS9B9SwYnq0iQBNqPWAgZ6jEW:D3n1y9j0q0HY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edaf16ab027878bfc46a236017ec02aa2a5d107458b5f0243742aba82aa06959
MD5 0618942ca628d87a2f5acdef59d5f63f
SHA1 8d3087cdd271aab64cdbb44db7d9a24ea0fb26a3
SHA512 8618c6f0f8c215112f406cab110e5bef1649a34e1dfb53e4943fd4920b929af1df9510db5dcbd6d23fb4c2e36438f3864ac3e9c206573e288efdf957f6c18640
SSDEEP 3072:JhxfjoxQMMyEW6+zGGoNWJhpPP6KPqJBmfbWxU9ZvZFXbWGyQVBufo8SrOzRkOux:JT7oxQ0EW6+0QpiBmDqGeQjufiU7rqk7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

185902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Cryptography.Xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8f51e84959e39b24e71e5439fc4daf57b31ab1f09d80e6782a9766668ad77ce4
MD5 372e7871a9928b27522252ba7b286a52
SHA1 f8e88da036bff12203ba5e13a138d9645b72dd65
SHA512 e008de243bec5597eaa50cf120f95c9a28dd5c354cd72693a537e1c0cceb25fa4985c100d7b9fcc022ef3ca7408d6222c004b5be9d7ed2099d37a86242ba2274
SSDEEP 3072:mrHIx+Npb3ikJFzUVqQbBE+qN358trq6KF2IDFSKZI5sAF93iUee6KQRvXDzVsSy:oIsjHKqQLocsAF93fee3uE5d8bO58
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

156958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Permissions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78835b8707b4cd259036c433412b1686acfdd858e39f003cc7f881bdf213f952
MD5 8777398255b941a954d48ecf8b78e2ee
SHA1 8378428d9979aab355c91e768a66cf927a60b51a
SHA512 c75be5d2b0918eded3b83c6d0de1f9fb6cfc80b9048426e87baf381133a782c7cc2526c3cef1d26c5ce28cb4395519906de558f60ad3363078125cb8e411f75e
SSDEEP 1536:16fkxbt06VjqfCwDGV4B27OXWBiha+F6Xn:n7gCtV4B2ymBiha+F6X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

84686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.Windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe964cd7d8778f39f72a5cde81e80052770fd9633c9cafc53c5253832386f545
MD5 3a25b04b46da74e0af05b71574d0ac97
SHA1 992104a3aa3bbd94a22cb16e9e86fdfd51e686c3
SHA512 21d27296d1de1596f36bf9f810ba00dcf7bd4f4deb5511b7ac6aaf98ff1cd11550c52ae14b93e65e39c591a25491eb5f33e464512831fccc8b3aad8d482f660a
SSDEEP 1536:CS8Pfa0roJWDggldpxv1MVx9haS6mMqd:CS8PS+1Xdbv1uRMqd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

66030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.dll

SHA256 3b6b0520402df1a0543118c78c82435b61bf9111b2824fd31e59a3fe67e69e03
MD5 ce0388e8f0d85d7c601e246e5985966e
SHA1 bfbc0e729b85ca27e4de3f0903022a1716201689
SHA512 730ed920fced564e28404d2733b963b29b9210806fcfde0b73accd06cd4225ece06f9dca2d06d2fe9b8f350db85ec30249964d82c49cddd4e8f3e54451403473
SSDEEP 192:KjWVU6IWddwBbxEdTXVeWvcuyjS7HnhWgN7aB+WhV+hH+BEg7X01k9z3APDQ:YWi6IWb2EdTV7HRN72pR9zwc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

91:a6:2c:6d:05:94:dd:84:8d:77:b2:95:86:3f:d3:88:63:1d:6d:8c:97:ce:2f:a1:c8:a4:09:8d:7c:59:30:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.Principal.ni.pdb System.Security.Principal.pdb

System.Security.SecureString.dll

SHA256 762dd98815885030474f9d327c34f9f35978de4918ad51d0ff167f64947910b0
MD5 f5c40794c808da71de1c4e1ab4faf16c
SHA1 fc614bdc2bd9a4cbc91a3bbf92346fc0fea4b499
SHA512 c628480c5c1935b44d03a6532d1881dd8a800fc1f9ae6b53c858cf3b9fb0f945e24f3a65e1b1a0b1a5e1ab1ca9077ef790a912b67f1644c5b01a6d92f88ff222
SSDEEP 384:oW1iwWiXdEs7HRN7w6Z6zaHeR9zgNpdzw:OkaY9/C9za8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b8:13:50:bc:e6:93:db:ed:5d:a4:9d:59:31:83:e1:4f:2c:87:94:8a:3f:1c:14:46:b4:b9:1e:4c:36:a7:17:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.SecureString.ni.pdb System.Security.SecureString.pdb

System.Security.dll

SHA256 b623c4a5e0d96b3ff3945db3e5bb8d235b3b0c2f6d23b8636bd68bb72fdc9e2a
MD5 ca27405a8a1dd64467867dd9e703d039
SHA1 0f6d2a2a6daf160182afa73140321200069fb68b
SHA512 019962fdf434d7bcaadb739ff35b300dd3c125ee9b31f4f60e475c80fc2b02a0b0b9012fbb6da0a0aad9dd5f65be07cddf0c4b965b0d7a8da1c915a77134a9bc
SSDEEP 192:j3Ws2EWENXHku3jDvupZFiVyJEVoxh0JxUd3FmPBeWvcuyjS7HnhWgN7aMWhlNyY:j3Ws2EWGUJh0TUd3A57HRN72iR9zR+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:80:c4:e0:21:78:6e:4c:89:a4:5d:15:08:f4:f0:9e:30:9e:63:80:02:7f:6d:60:97:b3:ce:97:55:fc:e4:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Security.ni.pdb System.Security.pdb

System.ServiceModel.Duplex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78ac27f0813479dca9092c1160e699a22d3e4a322448d0efcf68ca1762a37730
MD5 118ee20f1160428ec506f9fe57c80225
SHA1 69649b52167fadf1c94005fa8f6d9ae9f0a84962
SHA512 8efbe1fd607236bc9d9e4ba05cde426e6b49c5fe73267b018a439db7824bf24077fbb2f68b9f1a03386f0e7b2f1f4031c52e95f7ee9d2587b95254ac5fed2648
SSDEEP 48:6zZCK4FZAcedQiwcw0+IvvWqwWk2zDmDYDCJ851ZWx0kK/mh05WxfG:QiFZvexvvamDmDYmMW5zOW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e5ee987c419900517173a5ce5b4215396faa8fbcad7c5d45a7699dfc6fb8f174
MD5 3708250f24df059d4814a560aa348a25
SHA1 fd9da7f8cc293513e7add9e7dd62ef6ba9074a03
SHA512 430567a2603a96a9d68094f93abcc7bb75ec0363b46d13e045c32858b465bcb39471d0967dc800839546d4932e8173a85c02b53809de5e008b127389acad5523
SSDEEP 48:6Odu829ordYliXlbdjmiDpDBsgn+Ivddk2zDmDYDFQ0LZWHPKUTe5WxfG:F29kdB19pFxvkmDmDYHWvHT+W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.NetTcp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 093704aded9db781a65a234b7e8fbff649e112599056115ae5120b5e2b194559
MD5 41cedc634a584887a57ca22be8b29b3f
SHA1 eb1c0c22cd6b447c6814f24f5895a3c52a2be93e
SHA512 57f5ef0a95b2e0fcf4cd29be381628b29f4b52b430ad4b573c2241d61124df81cba5dd76e2c4ad16a59c6897025ffba63aea0625f36cab8d1ba971a33bca1066
SSDEEP 48:6WmcGlj0HGPML9uiwbdaXmiyBy9wBTUtJH+IvvWqHk2zDmDYDaJ8MQZWxBhKGP0H:xSteQ89GEXazt0HxvvOmDmDYekWRrWW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9d10f481254515208b78209309db31a804f55c742a45aa843fde4e7ed3e02341
MD5 8757fa6120b249a4dabf41f1e86c1a88
SHA1 090aeb4e0e18393df97a6daf6bb2ea7c4e512349
SHA512 69c515ced32a8539907523e63372fcbeaee1433fcf6a2578f894bf61c474920498951f3e60cf3e7af5a5044edf3b926a20d3cd7062f447e4a41d326a8bb30efc
SSDEEP 192:bInSbiz8GdMhb+MSpDosKB630mkj/LBemSZfyxdZQWvhEW:MSbiE+3pUsKmCtemLdZQWvhEW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dba1d155da566afc2bf4d131f47f6e770374b7f2d5e6679e978cf5ee099bb73b
MD5 99a41bbee6e343283929baf92b1eddac
SHA1 1e174d3b47efabbd683cc6577a8ed6e77d42bfbe
SHA512 41064b29dbdc320a4b7f53d39dacc8faa864059a6dd114ede610427ac7aa2c73a15e7bf11193d6d026bf3ff0dc237e410001c8c048f5899ca8baf9b570dc99c4
SSDEEP 192:v/KM3MAmvXbTFeFF8A8ei6DRb6xamW1NgW:v/cJGF8A89/amW1NgW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Syndication.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 48d6d299813cad6fece7bfa7a2674404750be32dfa541cabacb1b9502b7fa11c
MD5 42aa1719a875f869c067ada18f516934
SHA1 4e3724a54926395370bbde2bc9d0363c23dfe9b1
SHA512 1c1df8fd476d513ce019e5ffb0a872cf420e0668e547d276b87d3bcc8b997d07958b0301d5bb575e59e2b279c78d45426b11d6387f9158c93cc81f6dbdfd3e32
SSDEEP 1536:ec269zaeQhBxhgBtYkc9d9Cnic1zALtHijSQqi25H8wy4ze:lp9zvMJVLlCic6LtH2F9Ye
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

115262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Web.dll

SHA256 7f0f6b6db85fcc9739cf3256a0bc20574842f3e7f833b4e64cd45faa7e4e5a45
MD5 52b3c9e708baeac9d218001b93e1cef5
SHA1 4554ff7982595d29c9526029870e596ecd045fbc
SHA512 a90734f6ae0ab78805614d9899e1f0137280b4e02a41789c55e8aa8f21fbf2333c35c2298465b84c3b83344917bf63fa7943143959c143f15b7a02880b10ec04
SSDEEP 192:RjWGlouWZb/Ndix6beWvcuyjS7HnhWgN7aMWhMVOxgV8FGecX01k9z3AKDVrK4oD:1WyouWh1dix67HRN7LHR9zHDtK4s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:1a:8c:d5:36:dd:7f:29:1c:fe:89:65:33:81:5c:52:91:64:31:b2:84:96:be:db:f2:b3:a8:d8:b6:25:72:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceModel.Web.ni.pdb System.ServiceModel.Web.pdb

System.ServiceModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ddfc838ba2ff3f30118a557f47a9fa8483a36e0f639e016715bda0474008712
MD5 faabbb1dded66aac765f0e75e816e1a7
SHA1 25641af23c12c660853315a0244f2186e92cd1c3
SHA512 3a71ce89c17a5cdaa41d761f179eaef8ad62cc3dd74e07a1eff21a64fd4929c9e02c511de046397c02d91449e4ef35edea8da571d4c91d1834ad8d0e5d1e6a5e
SSDEEP 96:YYApLV9qWUVobHI6GsQdJwaGfVl6EffsfJ4fYYQqJiNQpmDmDY2WsV4W:fA30WUybHIjsyjy63IQqJiNQp9WsV4W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.ServiceController.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9dbe0b2f7ef9a38367cfe8840481d860543ae9d01f3a12666237f3b939c38423
MD5 e511e16aa643e720e81da59b95b5467b
SHA1 8f46cfb8847ffe8221dbcb2535025618d04eab83
SHA512 0cc2991ace59ffeed327bcaac1507522dd8127067bbfcc936af06104ba27fe84bb60ac878f26f46c1872085a8250c9560f8c16c6999321959a43a8907625ea04
SSDEEP 768:R7I92ID1ClMzGiz44Jk4G2ssT9Gry+cRb/6OOd7biXCRVeAMxkEGmX:a9pBSAn24usTJb/6Vd7biXCR6xyG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b8:0c:85:b8:d1:63:d4:00:77:3b:f4:e8:db:96:4c:49:2a:7f:45:d0:0d:90:b6:a4:54:fb:b0:e6:3b:ef:7a:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

55598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.dll

SHA256 49fa12bee017d82a95f0cdc2267b06588ce8f592774dcfbbcd68cfcadf5b4ab0
MD5 baff65fe62f0297fde0ca86c1a45a52b
SHA1 2707c063ab78c88326276fe72f401c59ce5b4bb2
SHA512 8a3dd74a52585f284f869d44e964df9327f968986aa6d03fa2b6fa763b87cd9e0979404a89c06441b135154fd72d2dfb73cad58768246ae3bc9ee75ce0c08ad5
SSDEEP 384:4pWniilpCWto7ydboKJs7HRN7GiR9zRBsk:bzo7NKCf9zfsk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b8:36:67:a1:87:bd:1d:e7:0a:50:91:53:3f:40:7d:00:60:94:4e:52:91:10:2a:2b:1c:b0:56:de:ab:91:2d:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ServiceProcess.ni.pdb System.ServiceProcess.pdb

System.Text.Encoding.CodePages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6cd6df23521771e17e24dab563dc5816403f87c86e5c0948320aca5cdf18e271
MD5 d1f3cbca19f67eb146480b577b931fcd
SHA1 acfc89c89166d1c588ecfc281ded70d5aa439d21
SHA512 3026ff16006257672dde064a330885408229eae6d37cd126c7c6a7ce7b6f63e65a087f0cf3331772a77dbae2f0cb66065369908e462a49fb4d0f19ac87b68495
SSDEEP 12288:CkMzb7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rVr:Cnz9km6k/IwRYbiBeKGCar
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

731646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.Extensions.dll

SHA256 c2c9f41c1be3596afb8eb4fce6e21867917a14351d2ab01faf9d81395f6c976a
MD5 97841b84d7abdc787982ef00e8e8cb50
SHA1 0b49222bd54cd700709ebda224df72248c85cf27
SHA512 0a07c2df770f569702c2a2fb8d26faa0fa62d1b8b83be003433f2f60e2ce366fc8393cf5d1337d136797fc28eec9753e609acf5c5a223ea1b012162153024ddc
SSDEEP 384:bW6Y+WB1YdWq7HRN7nyv6zaHeR9zgNNHY:Ch1BGiC9zgHY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

54:66:18:eb:66:0a:20:b2:0b:7d:63:90:50:a3:d9:ce:56:16:1b:f5:9c:72:fb:f6:de:eb:41:8d:02:37:85:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.Extensions.ni.pdb System.Text.Encoding.Extensions.pdb

System.Text.Encoding.dll

SHA256 d2e860bf41fba3b7aa9641e2121adef6a797353b31e7d14a581d250436669fa8
MD5 f6171bd56f8697584d4df2a4b3866ae1
SHA1 62afd05f2f293dafbab3a2aa3c039b057cfab6cc
SHA512 8e3139a36ebb37a722837148da9d1858082966ae986f57a30a9a118d83022e1cf08521d385f4f0582ade74ee1e18ba63dcd9c9647b5bebb2f32be32672b5df31
SSDEEP 192:dWfE6Wzz6tAPxod2ICveWvcuyjS7HnhWgN7aB+WhVyVH+BEg7X01k9z3APDl:dWfE6WIiodfC37HRN727yqR9zw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

30:7e:bc:8d:3e:4c:c4:01:e8:f1:0d:23:1c:62:37:41:5e:a1:78:c3:92:f2:dd:ff:2f:1d:00:d4:8e:38:1c:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encoding.ni.pdb System.Text.Encoding.pdb

System.Text.Encodings.Web.dll

SHA256 b3507c7ef158f6c8b53ae24067c0f47cebca9c8c809021952d0e7eb8b13ebd54
MD5 d77768c5b136738822dc17848759c273
SHA1 74030398f47c2fccc1b7ea397f14b7c5fb9c8f44
SHA512 987ea9241fc320cb246f1b8347ab99248642dafc718a83c5e00dfc17ac9668bae35cf6c26f90b45c9ffa5654ed88f52803f41ed8c75090fe8194abb2b7f07010
SSDEEP 1536:73bNf+9ecUx1HmrxYtr3C6C32wY9LGJ+rkyEb3kamFiDx48JPFT4smz:73/cUxdyx2bCx32x9CXyEb3kamFiD2q2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9e:8b:8f:b3:4a:32:09:30:f0:88:15:98:61:b6:c0:f2:57:df:50:b2:fe:0a:5b:95:2d:0b:34:b1:9c:37:28:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.Encodings.Web.ni.pdb System.Text.Encodings.Web.pdb

System.Text.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cac807ba6fac5a4143b0a566af8b74837063c6d5f7d6ff768152e7894bc066b0
MD5 48112a26c30f6ab0e3147c19781f9a95
SHA1 f74bdc8fedd5155b6f6b05396d4d71761420104b
SHA512 a151b2356def8e14e30a22b08e604fbf63d45edac819ed972924c2f636768c01a4f75e72d911c2d96515098357c1d54d03600d949c87e90a69fcf6ad314a68b9
SSDEEP 6144:nBB++WYqyNCGEaJlUySNkpWHqup6McVsBDp0iTb57ZVjn7:vnWkNCGEaJlUySNkpWHqup6McVsBDp06
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

274654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff9f8437cb6dc61622705abae3256da2f16d37424eaba056539bd71c26f8a737
MD5 38ff1bd9169ca8640c706da0020ce6f8
SHA1 2d1181dede1fc663c306fdf9cd3eee2e3d9ccaaa
SHA512 a6dcfcbaabe7ecafa4e5c056d88fd6da16397e6a4658f5b1073391964fe2d6fc1a9f35182ea95d2fcc51d01213d6b1188c9a0474fec53ef37cd7a47a5349a0bd
SSDEEP 1536:4w9A2ayyLmGHrlTtX8+uXRbXSUkCse0RWVgeUXTgR1PwJbYFAZToJLWubqaPTfCG:4ctnn2d6vRP2bYGZEHb5LfCcj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6f:04:da:b5:85:a4:1f:0c:39:20:1c:2b:25:44:2a:3f:00:a3:84:9b:50:08:6c:e3:f8:b6:2c:68:06:ec:22:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

142430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.AccessControl.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3dbc176f20cb9dcd3a66c4d45d7b473d7ddf5945fecc5b3a824e511f4296563d
MD5 6d46a78535c08c1cc0b2bb1743f2e978
SHA1 2b6dcec3e8f8db4a61ea6c388853220ad5ebb445
SHA512 3a08b5cf784d9b1e927d68096a8e961744b3d48d845ed757e4c5c786f6e932d124470d8f56c62ba75b74cceae77f4239f0d302d0c0bf9f89bf17298d9e96cc6a
SSDEEP 384:/fMqUkBijXUNf5Rf5Rf5b99exHy8qqO6YXWJWArpW:/fn0Q59j3e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Channels.dll

SHA256 0772931ecddc0f337c8702ddab477e37f72d779a225a4cc147067d23a5542f14
MD5 4681fd45a6a89eb8440962b37bd343f9
SHA1 dfe9f5e674bfba072e4f5b469f55773093457e7f
SHA512 fdf2ac6a72d2e8c7a6777a7ab08349877b876694af90af79db344558d2d9c2b86bbd0537cb1ae6ebf3035624428881760d9fc3d852b59644a8d5fb817487c0aa
SSDEEP 3072:GavmC4BFA1dzOA4LChe7W5TehDq/7j4lnqM:4mbQCqW5ehyM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e5:db:f0:04:b8:1b:b1:a8:ed:9c:89:b9:19:58:d9:6d:18:69:9b:1b:08:1c:5a:23:3d:fd:ca:02:a4:df:76:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Channels.ni.pdb System.Threading.Channels.pdb

System.Threading.Overlapped.dll

SHA256 f9c7b710fc12daab8851a6b7dac3a44283269283765a991e7d740b8309c49104
MD5 69302840464fd65d319287c61c6a3cc3
SHA1 3b880344c5e371f3cdfd266686854d94a580ce7a
SHA512 827f4921d08137f3f165ccb14a18e2b7c197977009b65ddef6473d8e47859d6d6b914c43ad6e6d2b158c8a31635554f43dfa1f416051739cc0f9303a444a78c7
SSDEEP 384:tWcSAWfHiH+zHgcqHVdA7sgH/HJTHd7HRN7+diR9zRh:c+coGN+M9zj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0c:30:2a:9d:36:4a:f2:a4:03:ae:df:a6:a9:c3:95:bb:9a:88:f5:46:34:ee:c6:69:fa:eb:95:da:cc:1c:13:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Overlapped.ni.pdb System.Threading.Overlapped.pdb

System.Threading.Tasks.Dataflow.dll

SHA256 07b35ebd9a0581ab44d458c53f13268e8aacb98763148f90b77f267400c6bbf4
MD5 e7d3f3d33047878beefcac595ee8b1c6
SHA1 c2fcfcf09b18aec9b9e4d77f57894720339befed
SHA512 8da9059d3937e857682a766d9ae9cfcc9f7ea0638ba30e683226b5582fbcb333381f8f3e7f10c8d7b27944fba2166fc30b80ac72c349e589486c0b12fa10112a
SSDEEP 6144:axyV+a0ZJ2q5BLeNp/1x1tBB1x12LAVYRkoq4mQb9y+Z1d+NNBWfxH+URr:9V+a0r2q5BLwoU6q4mQb9yY1mWfxegr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

10:b9:f8:3d:5c:7d:d3:88:4e:a6:11:fa:b1:a9:b8:52:60:68:e7:b6:47:e1:3d:b6:4b:cf:d2:17:ac:39:4b:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Dataflow.ni.pdb System.Threading.Tasks.Dataflow.pdb

System.Threading.Tasks.Extensions.dll

SHA256 abd6518b314792fac1c281e61ebd9d0ffc654a7b9204cecd3fc5927641c5bbe4
MD5 8755ebd05994248ed598bf950c089d58
SHA1 382e2679a2db822d814742f6a67c1d655823b09b
SHA512 69653bfd8687f82384ed24b21a64541be1e1165e1832a817d48b6da0c35b6d2a3559cd669cea4ea1482e707e5e62fd8d0b77707784ed99d7282f1cbea5480267
SSDEEP 384:oWSiQWS0530k1ncm+43DdN8iT87HRN7CDciR9zR06Wu:RLqz4ls8l9zZWu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

21:84:34:7c:f4:8a:ae:d5:b8:3f:5f:12:c9:4e:54:2d:7e:91:1f:6f:c5:ab:31:ef:93:08:69:06:e0:88:a4:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Extensions.ni.pdb System.Threading.Tasks.Extensions.pdb

System.Threading.Tasks.Parallel.dll

SHA256 af07e133114232ef98bb98348916ae7eec8c46ef2a1b12e572d2b728c76bb19f
MD5 6dcbc3f77f425b548c5a9e7b2a47c38e
SHA1 1f094ab1a99ca6a0743771429e8fea52cd60d9f8
SHA512 19ec425392790c3f3eba4042e23afe0e019368df0b3206861bcf1a38023358d1ae6a685f99710983042d2fe6ffc6320053f8117ba8a34515c1e9335d7d64298e
SSDEEP 3072:rMUvcVnLdOg9jBtt+a3rZNTYqUko0OEqojRf:8v3rZl7UkoSf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a2:bd:62:5c:f2:a3:94:3f:50:32:a8:71:65:e5:ed:45:70:fb:59:ce:2e:69:0f:5c:04:b5:d8:4c:39:4d:a0:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.Parallel.ni.pdb System.Threading.Tasks.Parallel.pdb

System.Threading.Tasks.dll

SHA256 8d2942e975aaf6cf8217f65611b4f64b0dfa15e06fad1eb621d368f3e77fd1b4
MD5 0dc41a0a77de30d1838cf6f183133089
SHA1 dc0db3350fce11c3e742117816db053e72a61a23
SHA512 3ff9968ca53c8e011d2c9a8ddb73d1457923961d16665ec72ebbc725c5aa456605727a74af7716b7ec22cebb06346b765ef0722525d6d66f99c6e7c9f84a8c0e
SSDEEP 384:/9WH20Wza42T3/ZqvuJuFdPXwqTF7HRN7LmHR9zHFPb:Dxa4mYvKa9FKx9zlPb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fd:85:9c:3d:bc:b9:a0:3a:75:93:34:fa:3e:f6:dd:d4:21:09:69:93:d2:82:d9:69:b0:88:98:83:65:4b:a2:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Tasks.ni.pdb System.Threading.Tasks.pdb

System.Threading.Thread.dll

SHA256 926e642b0b6cadfbc3a4cb11bb81454eed8adf50acbaf19385c2ca40decd40d1
MD5 520073af46143bc7128f8b3a6de0a2b8
SHA1 a9639dcf892633231b65552ef7c748feb9362435
SHA512 aa086ba704a3f75a761af0e265271abcdd10fda6d66076c4462bd74eefc3987ecf42230dac6df05a0d56b79b8bf8664163dccc1ce87e05c5f4e5dd886932353d
SSDEEP 384:YWc+sWRoGmJOIVd7sCTi7HRN7+UleLR9zusyRKG:vWcES++ed9zuQG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ec:ef:fa:3e:f7:b3:ae:cc:99:58:25:de:0a:ca:2c:49:ea:4a:87:f6:12:46:39:98:e3:e9:8d:67:30:b2:df:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Thread.ni.pdb System.Threading.Thread.pdb

System.Threading.ThreadPool.dll

SHA256 3358e61263af81d99e8995441d012a8f75ca8d5d35e8c7c3aa6685c89f52a691
MD5 fa937c62a0c52445b021bdd6ede175f7
SHA1 b91c8d10f971bfc9e12f846bd1be7cf29ae6c89a
SHA512 9e1fc7726447611182ecddca0f578b657cfe2e9cc8f4685050f3edada8b4b28e619f81fcc343e1be4da4ba98aa8f6a823e3f82bd1ef5c0e6d0010479d7fa8d22
SSDEEP 384:+WEKYWgs2ezNqTdmE4Te7HRN7XkGER9zRdStOD:NPzNT2X+9zytS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

37:e4:ec:03:2e:e8:4a:15:16:69:49:b3:fd:0d:9f:0c:f6:68:29:98:ee:3e:c2:e8:fe:d5:8c:49:59:3c:88:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.ThreadPool.ni.pdb System.Threading.ThreadPool.pdb

System.Threading.Timer.dll

SHA256 e3ccf9d37b3e20427067285f8588e28613ff705310da9eef67fa36e9da6ec8a2
MD5 daf144d20e5066d5c95dccb158c88a97
SHA1 366151dc10a7bb7a789d2eefbafa0df567e515ec
SHA512 87e3f313be23e54f7821ac054cb1cf09ec0f01665d533406477abcca6e5ee50e70e6095d72c3ee405e0ff078f8ad98cf5fd355f2f46d78b01b20c332b199b517
SSDEEP 384:JMWsh1W0Q6ZQuMdlLPT47HRN7+OOP5AR9zhwu9c3:KrQ7I+OOPO9zM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

55:eb:19:8f:53:44:17:33:d2:41:b3:d6:74:56:be:8c:c4:f3:7f:bd:77:51:20:db:fc:2c:0a:d0:ea:27:33:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.Timer.ni.pdb System.Threading.Timer.pdb

System.Threading.dll

SHA256 7bce0d29f5456cd7455afbd97d71089c1802ed423ff9c9299cebef30978f3c62
MD5 14407fd6873558448a79d6937dda51da
SHA1 94f506b0d0109c62fd218b904d9366bbe50d8751
SHA512 e0c56f4c35a8500f4515b2250cdab445697ab3f15fc59e33c991b962422569a0bd1bfa563b785d705f4554fdb0f8f32b12733321ee8046f65b95d00b326cc642
SSDEEP 1536:1QaHb/K7uGqhVp6/DmoTduufAYh1/7X5Jc1FYz:1QaHb/K7uGqhVpiduaAYhxXgC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

81:f4:de:3f:4c:8f:c9:b6:91:94:3d:7d:fa:d8:31:e2:d7:f9:49:d1:26:86:cb:61:3b:d2:bb:7d:34:54:c7:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Threading.ni.pdb System.Threading.pdb

System.Transactions.Local.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 abe8f895ad18cfd50fa1705f50855ca563a92d8bba6ad649f2bd39aab3930625
MD5 e658b1851e7774c15a7069dd044bbed9
SHA1 53124d5141719c688986d2a5aed0843f5e983b05
SHA512 a67bf210a901b3b17fed576bf9ffae11faf9d66e2c102abb52225b257c392baefc31955bf98dde175308fd727c056e8c7567e71d409404a6c10df0145c14ee52
SSDEEP 1536:PDL/bTpWRdA+me+dYQfXUg4Ud/5ACTynsdjFA1Zzf5XpK7EPBNIbkaezBdPY1Dq1:PnBe+dYQfXUg5/CGwaq81WNW7/pdQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

146590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Transactions.dll

SHA256 b0b1767ee54ff87659839a260f1553d4cadc0ec402b121328c0918757ff5787f
MD5 26bc0a5c83fbaa630d58e4c37b30c200
SHA1 bfefb3fe6b366377b20806f24b1bf1d486e03d85
SHA512 5903a91ee5f6308677c3f39afae26ddec90caa1a8b5fbf261097b3530a8733a78ef80bcb2b61ffb372ec740995197bd84be5cd458efce880c066f55d8a6f08b2
SSDEEP 384:uWzRVWK3R0p1VhN3jSFhOYmblc8Nm+ylqQZxez7tOtydvA7HRN752rE3X+R9zuse:Fn3RUUVXi9zuT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7d:2b:3c:4e:67:2a:a4:26:12:fa:0d:e2:f4:1d:a9:2b:6a:7e:17:2e:93:9c:58:5a:b2:97:32:62:be:61:44:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Transactions.ni.pdb System.Transactions.pdb

System.ValueTuple.dll

SHA256 38d2f423a1aa49679bb8ca8dd29efda20573fb43d387373e96dbfe173cfdf7a7
MD5 b1c7225340b294d227ed9ac1f6e6415e
SHA1 06f19581321691f11ceb47cf68d1ecf26ac615d1
SHA512 a079999aeb6ef1e29915e4fcfd0a86af14cef90b03cf6dbb5508c59b89732cb4cb97d98afcaaf4cb64d24c2b2aaf113aaa8bd30602e3f55df815f314563979d3
SSDEEP 192:WWtvVWmWSaRVbHzdrSneWvcuyjS7HnhWgN7awWh9v6gqzGslX01k9z3Aelutcyy:WWttxW9RNzdrSP7HRN72kGER9zR6c3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

18:47:e6:41:bf:ac:63:09:09:ed:c4:1f:f5:2c:b9:90:2b:b3:1e:bf:43:69:c5:8e:35:ff:4f:13:e3:c2:bc:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ValueTuple.ni.pdb System.ValueTuple.pdb

System.Web.HttpUtility.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e78eb3300d85ca6619670c01a7331403fac62b009eb1bb23e1df557602b24bf
MD5 5452b0c5e2a0e6fd12f30e9db446a67a
SHA1 4fd804bc62445073a3493b2d4afce8b39dcf69b8
SHA512 06553acd0e0055600d1b4a02e357fb5d5dbc58dff5d821b1f128b2f2d02fcdbd4377a3f46b3fff0ebc748b2b96f3fe92d7bf002b8bfc767cb4f5134b48923c3e
SSDEEP 384:gpS0d/GENeRBczn+am7ne53dOXvXhXQmtQKOWTL0BU1W:gpS0YGeRBI58eGXvXhXXS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Web.dll

SHA256 609e02ad9d44a40a448b886acae4b593bd6e8ab34ba308e9da80e377a7401ef2
MD5 ee3c4a983ef4ee5e709458bbfe276823
SHA1 cfcdc2d90c5f6591d404a869120468ebb59ef97d
SHA512 5fd35478021ead442e595ae95a35225e10952c909af461d250e03558d37c2e18fa7082d8fd18f3ff91b7748b6973460e86283115cf92cd8511f9d8db861cda5d
SSDEEP 192:OWVboqWSl1uxKLd6teWvcuyjS7HnhWgN7aEWhaZc3KD1Y6uHX01k9z3A3TSVH:OWVboqWK1UKLd6d7HRN7j/DeZR9z4ex
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2e:81:59:8f:68:0d:21:4d:80:58:52:1f:38:58:b9:fc:08:f1:b7:69:14:41:22:5e:18:ac:0e:7a:7b:9c:c7:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Web.ni.pdb System.Web.pdb

System.Windows.Controls.Ribbon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcb319f1e12b5082950402efc159ccaba132b32135294ae3883dfd0326cb2e9f
MD5 359717d50a5029f8dbca072716138250
SHA1 d43be955d0d7dc0fdcc2fc24b5764b5a9eb7eb0e
SHA512 90b65f57e8b1af5f1cf239a83ecca6f6e3f024ea7b9e75b2b42dd2bb0b36ab93546c43fa5bc1331919e26128b6b0693f178041ab45a63feadf2a95e92d3be507
SSDEEP 6144:KkPMVzklPsz+XpsdGwolRWvS616HJ6sPjdVsmx0eMaco1T3gh4mH:RCnsdlRYS616HJ6odmolm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

739758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8f5587ce58efdd95d3e07077b56ceb0a34f42613f10458138e4a446aedc7d3a5
MD5 d22b23b27ea42e5cb673474bdfeb4177
SHA1 fed248f1c6b4f9c726cc82d68b2f44f7d9597142
SHA512 b06873684c7e30432ecf0981a997c168462039913a097375919da2329bdc16896e9dfb626c1564d6f331339ee46efbb78f36a2039c2f86b9ef751ff89beee0f6
SSDEEP 768:Hj3LxxcKeREGN6fP3LLc88IjC9+SsfvecaHUX9FdtAXE:D3LcHEGAH3p2+Pmca0tTeXE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.Design.Editors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75bdb451824e01c715f233f830238ade3e272be34c71bd7a2df7aa1b7efce2e6
MD5 59a01daff776bbfbd979bde411b3f560
SHA1 3c74c9b82065a232e281d90b8f822c9cf81d4cbf
SHA512 ccccddea85489c9687b32f66f0a0db638243d739693e7a66fce67b4801053ecd01c8a52eabf00fbcd0018d9f5f0b60da3a5910d26814846675299f8651f90d9a
SSDEEP 6144:/oor7kaW8zasL0f/8vVyrB/qPXwCoMGeTcaSe+:AYwJHwoMGAx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

252750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.Design.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5ea9190a7c0b339365d03c0c48866746cf2ad3f0e7640ad54b80db954fd64d96
MD5 9e214e42857781903f5be6b42ac89ddd
SHA1 185c472431ca8c94ea9c49da9edd4a981a2a7cc6
SHA512 22b545d8429f0317a75662bf3640fbd88d7587d4fa1a3bb0f79778e7d326b25ba23a8ea0213b43a962bf2b7f0a72105891f346f15fcd12c6f8bdb0743f0b9274
SSDEEP 12288:ROmjjh9Dz6oJfvTmCQJTQhOs/hmjyMkpboHWwfpwVP2uwEO6pQ0qH2iZ4tb+:H6oJfvTmPT8O8MBfpwQh96pQGiyb+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3241438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Forms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 213a19405936ff7f98c369d9c4b7af3020d827c88f824404d4d687ee564280ed
MD5 b23ebc765bbf79f1cb70981735568939
SHA1 c92b7f9466ad1027d8a8c728797b6934e0a7bb10
SHA512 f6f67773ca8afd7cc990be3f76a0600fb1be7565d3fb6bdf1f6c9301e8e11e9cdd10d273215503e9066ea632f561bdd20296a35e638cc1bf503d0531b3a199cb
SSDEEP 49152:vl0C6QHDwnGqQVp1nrXJNpjJFVoqFLN+AvDU/B8RbvQIRF/:aC6QHMnHQBJLOILdRF/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c3:31:d8:1a:25:0a:a5:36:f5:dd:cb:ee:ec:29:4e:a1:8d:00:23:2a:4a:09:90:69:76:dd:31:d6:21:b0:dd:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

6721134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Input.Manipulations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d030c8145d86fc3e2765c89765ea15cbb157c06c7faea155f26ed39e2e50cdfb
MD5 21a4ed44f42411c0eabbcb9d557ffe75
SHA1 72d6911b4a9e2c18f47c31bd036694edbe05aa10
SHA512 e70e97002a9f447147535ffcda5ed9fc1942209e2bb95588551006692cf76b07204d33f906ec219ce2fa67ee574a44c910dd293ac6037260753a692e584f9600
SSDEEP 1536:wOxN1JPd1h47Iyr59/ojWtU6HnoVn7xkVBzo:wSX1iEy9tkSm7xkVy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

55502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.Presentation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1e26e9e1dc838a2daa84ca5aa4102d0fa0e2b2003d0bb4f28265f18725e3b019
MD5 b0026d4bc150bfcfaa635cce3c0274c1
SHA1 554e69420dc20dacaf714627c67be5580d192835
SHA512 7bccfa7e72fd89bbe2e020e83a241a1b2967d7c741cb83be95d25486e4a97d8e0097e88cf09fb80b16491ec0ffb55a4a7f793f03c54b684cb0be240acde88eb8
SSDEEP 96:qVRdI0u2wyHw8PqkoidIuywtVjLm4Q+xGD/D6fJVbxNWBj:oRd5fSb+ztVjq43NWBj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.dll

SHA256 2c0db98ff26ed75ff5a0363d71437fd68f2aa32d07fe191ee3d5682d2e067f5a
MD5 718ad855af94c8999ed3ef8d6c6bd425
SHA1 12c6ef3b222cbfb39270733519857562fa2d0953
SHA512 fb5d1f5af77d6c4beacf44dbc9d3168457419465f03c1420916512e57c4718967aa5b58b3ac665c54ab75d8c9fc5ab3a72c0be03d7b7c19d8f273ba3e662c30b
SSDEEP 384:JWEBFW+TaVthkd6+h7HRN7NpFkGER9zRbH:fUdeF7F+9zB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

46:1c:f8:3a:70:eb:6a:ba:61:54:18:1c:8e:6f:95:c3:bc:cb:7c:d2:da:82:6f:9e:10:7a:1e:9e:58:51:76:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Windows.ni.pdb System.Windows.pdb

System.Xaml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c00761f3ae97b3925442e25654dba81a033e89a678109c276668202d12878b5
MD5 0eafae3a741222c0c70c684f95ba0ca4
SHA1 d637d064819f6e9c26c42646f3c20c113ebea664
SHA512 9e669c28f9e242d409b167f4e16217ce40b6daced6bfee9b201f9596de748043631d6edf3b743253d36cef43314c006869d3944117b88239e07682bced0a9dcd
SSDEEP 6144:Ab8SCbASWB+aBFCuWBSF2lj68Bk5YCzS3PDQspzSPQc//fNcuVYuBXbt:AlWn2/SAGFGSrpzSPQc//fM+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

570062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Linq.dll

SHA256 ba4fceca075f4bc010a20506237f939903f4b0dd39fc707cc2ac9678bef88bce
MD5 992c84a8940aa608d19b3d8a7de37250
SHA1 1408d2e802e482b028e0a74893b76f24050b0e35
SHA512 673bac1579366398faf5a620e664b72f51d567692a729ea4c5d1a1c93b1e62149c5d2bf31cef9da23a571c95074a438cfa1aafd97693ddc35bcff1d536c342be
SSDEEP 192:VW1DfW8LOmaPdgQy3eWvcuyjS7HnhWgN7awWhLnje6gqzGslX01k9z3AelJH/l:VW1DfWzdgFf7HRN72gkGER9zRL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

95:5b:fd:52:2d:1c:18:93:9d:39:70:cc:bf:fd:b6:8f:48:11:8e:83:d5:0a:62:eb:c8:ce:9c:21:a4:05:f8:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Linq.ni.pdb System.Xml.Linq.pdb

System.Xml.ReaderWriter.dll

SHA256 e5d1bc0eca4b452c6bf1ac792c9296397d8dc072195147cb66413748c12e3318
MD5 b9e09b548bdb184b83a5588f598bc4aa
SHA1 5aad884ec792fc88fd610663aac11adf3fc7de13
SHA512 a8b4cc181d15638c5e82c28b51d23631780395ff5945de6ea25547498a7f43fbcf3c12b0877b5bbbb60d08e42aa3f63306396047919bb9f626eca9df7e6234f1
SSDEEP 384:BW1b3Wd5q5xK67ex4FCJjaYlhd00bPAXXN7HRN7bG50ZSxR9zZwcW:sPLeaYlPbPAH5650Zi9z+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

59:c4:b4:ca:4c:7b:0b:f3:54:6e:41:99:1a:cc:ab:f6:56:b0:12:1f:c2:b8:78:1b:d4:85:fb:30:54:fb:f1:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.ReaderWriter.ni.pdb System.Xml.ReaderWriter.pdb

System.Xml.Serialization.dll

SHA256 fc6423505981d34502ec151c12e462dd87614167a7652f1cdec3964ac41757fe
MD5 f3e53f561f28a72396d8880b5fd43061
SHA1 e6600eb8b032ed4b45aae94d0b16a92e316079ac
SHA512 886000f017296a211de5dd020c0ec0529f5fc483231e2391506e56a23961ada65b0f8d05b48e5ba2160ae0ed11c3c3bd014e222cdf903111a24368e3ef04ea0f
SSDEEP 384:CLW7M8EqAWLdNKf7HRN7+oW72vH3rPR9z/G5s2:CkPEqtKj+a3l9zo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

78:be:1e:a0:d0:d8:cf:da:f7:15:2e:57:51:b3:dc:4f:dc:dd:6c:2a:10:9b:8b:25:71:34:ea:f9:15:0c:e4:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.Serialization.ni.pdb System.Xml.Serialization.pdb

System.Xml.XDocument.dll

SHA256 a284999ea5a18a713ce7f63565bb8c089d70b261de5b9835825e37b295b510e3
MD5 0bbaf643f66860420adf5ebb16fad642
SHA1 27221e1ed6c03613792ad6c14b3446902d624b4c
SHA512 c0ab539ba2018ba06aee3050724ab0be2e463b7b63b227d544fa4f415dad624ae3f938872983be28deb31ae81f6e0cd10db71acaa8d1492c0fc90d2aa37a1132
SSDEEP 384:lW/0KWRuodx67HRN7A0G50ZSxR9zZwcCtmX:lFuOWm50Zi9z1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c5:ed:3a:9d:bb:9d:0f:02:1b:0f:91:dd:ec:42:f3:7a:5d:92:a7:a9:7e:aa:99:57:c8:94:a8:21:2c:f3:c2:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XDocument.ni.pdb System.Xml.XDocument.pdb

System.Xml.XPath.XDocument.dll

SHA256 8ba41be47a40f344928c92181640b5db841fb325500e3fbf772e3cf4ce78d056
MD5 85df03f8eea82a8997ae5d5e7216f516
SHA1 c7651ce2617239ad1fb2efc0d7afdf586a6e4309
SHA512 62d2d220d9e1ae36c5c88af9740ccce186548deda39089a9c7703b8a4855ef3d24666608d2ba5b8a97a6779ac75d5286c667fa8380a12e49d4c2cc8a026d50d9
SSDEEP 384:YAW0V5WWVNxd8USh7HRN7fxRmuTcR9zDr22:YIdVNyFpRmuU9zm2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

76:9f:b2:fa:13:19:ba:4a:9f:83:4e:37:66:9a:e4:94:cd:7e:5a:1a:18:65:d9:f6:84:60:a7:09:c3:59:74:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.XDocument.ni.pdb System.Xml.XPath.XDocument.pdb

System.Xml.XPath.XmlDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5aef6270411213995e83fc1c886c2545ae7f69d3f484f0320a7ca373f66a95b7
MD5 f9b0a48e6992380cc8bc1125ee3b7df1
SHA1 4eb18e5115c8be53a61bf8a7092c479917c1ce37
SHA512 db762dfe8d4724416dc5924e3d1aa1f7685aa20788a8bb30b8b2135265a03281182adb730bb122364676088bfe6cc2f19deade4bcb53f4943b2e60182a57c88c
SSDEEP 1536:Y951R5MZ7fQMgXB0ldID4y3tZ8CA3859UJHjQJZF0f43RahBXuLNaR:wjD7XSldIDl9ZjAvBjgZF0fThBsNm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

107246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.dll

SHA256 fb076cbc2c2998fdf3fb59c1a8a3ee7bbebf9def922466f8f200b93076263ca4
MD5 fd7b5de88e17c734cd46495addd2e9b5
SHA1 6bdfff284a9039ad0baf1c01ed5a1b16465ad9b5
SHA512 2f67c81c64d1d5b99d2c36bbfcff87eec7c22a70c744dba1e67a8040464db883aa0a5ccd268aac15803bbded3a309c4ca7b5d04415c7fcb6e8e3e2d6ab476ba2
SSDEEP 384:IWBaYWVizBS6dTF7HRN7J2Jk5+R9zusoz9Q:6ABSqB0Wg9zu59Q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ff:a5:50:ae:7f:b9:61:40:40:02:17:9c:c7:0a:4f:cc:c7:53:5b:0b:eb:15:94:2c:dc:ee:30:fa:61:72:6f:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XPath.ni.pdb System.Xml.XPath.pdb

System.Xml.XmlDocument.dll

SHA256 a5f438c4e21d1739df9595a0a9fb064de2b74fea35755a74633cca5f875d4dda
MD5 b4fedbf764780b7dce28da95a420d697
SHA1 4941b0a0e9511694b5d27cda36877b4dad89cdad
SHA512 55200562f072f04acd2c9e03fd0b8ce379e329e9e7435d8d0d97864712ea4f774ff1b92bbef30b3856fbdf7ea80323dad4738ce6f36baef642b75ed4914303c2
SSDEEP 384:piWe/LWruwzdQ927HRN7/6zaHeR9zgNr1:QkteaBC9z81
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:a8:9a:5b:f9:fd:7b:43:08:b9:7b:73:b9:21:6e:28:f8:10:df:d6:47:12:84:89:fe:1a:2d:73:2d:4a:53:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XmlDocument.ni.pdb System.Xml.XmlDocument.pdb

System.Xml.XmlSerializer.dll

SHA256 38019b08132f45e928cebdc0312a0aeba3f71572192a682f207e43bb860048e6
MD5 c89966f292c5e6b479c2b3aad9c8cd86
SHA1 836c1db80dfbfab4453df6d7eb01f82ee7c3d5f4
SHA512 6ee43e72c97263423c415af8e013595ffa35fdd41c4e992913b69280d86a4af4b28ed3b8996cf873c135aee0c0dd1ce0ccc2ea47be09641307cd91bcc3a35574
SSDEEP 384:BWpKYWXweSdFssdjLhrz7HRN7zwYmfWojR9zDw4VI:lRweaFsUN7ufWoF9zU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b0:89:b1:13:b0:7b:d0:33:fb:c8:08:92:25:f2:d6:a9:f9:fe:5a:a2:20:ca:b6:6d:7b:ee:9a:89:d0:dd:b6:31

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.XmlSerializer.ni.pdb System.Xml.XmlSerializer.pdb

System.Xml.dll

SHA256 ac8617f3ea708d5c8ccd5801030713ea7366a80f99ee0f4bab74212e98ba917b
MD5 29619d04b8d76177ac3aa6531850d780
SHA1 74663ff0da33fee097e640efe61ea7ac3ef5c0c4
SHA512 2b7769ba99166d5eaf56142ec495c2f39c5b9bbc56bf115ecb73b82c18b2421fa722c8293666de337d3d28f599e21778a30944e04a5d42f8eb3b8c37056a3469
SSDEEP 384:4WKbjLWE5q/7A8bhUVGfbho9SdI2Xi/7HRN7GXdg8M8/fi/GR9zZ8BSX:wkO2tSDGXLMufiC9zuSX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6d:5a:64:60:58:dd:bf:74:a8:9e:8a:c2:f1:16:ce:20:fe:53:db:2a:18:9a:00:1c:c1:9c:36:02:a1:92:e9:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.Xml.ni.pdb System.Xml.pdb

System.dll

SHA256 f0336b00407efd004cc5f7a8d47ceb16bbb89d1edadc951ef090f5c97e4f3f26
MD5 693e8bd37b77003f5be42ae1bbe8ee16
SHA1 7e8e04c3419e2f73f686b21c8380eb8cd0f560c8
SHA512 03948a81c406d3c800ab1580e78aa698e8aa61f49e1a147a6bfaa3b2bf688f7dc472e2f80cba497acc2dbc866a3291c709373239dd2579c0a94f0aa21ef440f8
SSDEEP 768:4Ul1eiS4RNB5JVbOd502zq1SntVRirQDdwmbWkkt7/P71C9zDi:4EeiSn5jzCyMkamvc7/P5eze
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

PE Signature issue

Digest

de:8b:02:ad:7e:74:b8:4d:12:c1:f5:1f:42:19:75:a7:cd:73:9c:37:88:cf:31:97:88:76:35:0e:42:e5:a7:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

System.ni.pdb System.pdb

SystemToolsWindows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08738f49b75a00dd920b7410ff929be032e97a4f5cbc4e49d003b699c1813a0f
MD5 a202e92b76e7a5a04e327403c9669189
SHA1 b06b164b55991a1eb4e9bd87b7bca3cdd7b9cee8
SHA512 13c843abe42ab5c5da07067cb84a0daec294b8ef2bc0c3d72c8a6e3969dfcc5360692be478e8e9f7b66f6af7e480fccddf639dce72da0d5498106e59af370118
SSDEEP 3072:t9YlhCe0JX4H2bGvanFGSJOG8YrqYLUF4Iw2YtCgm4WbIVmH/WGc+FWIwQzM:NXY2V/OFYrNUF4Iw2YAgmFbnWG1wIdg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

8a:ae:14:6f:7f:3a:e8:94:38:bb:6c:0b:84:5b:8f:51:ce:6f:db:1e:ed:1f:a6:de:73:3d:77:74:26:ce:22:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

268574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Trinet.Core.IO.Ntfs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f750952c56bc9800cf7436c90ef983dcec12b5d156223522c9c2156d59b12c5
MD5 bea773dcb85e63a9bade222269c62367
SHA1 1572e3baa0c7d7335222acd435cab3616dc08c10
SHA512 a9c592a8675c96df544d20a0d0c004614789e034a2add26515fb4974d8c7caa98c018e92cb6e6df682f0f6e01c01e2d23395313b3564ef34315f0b4dab0ef1a0
SSDEEP 384:3/t4aXdbHz7ipPW3IflQolQrGk26qtT70P0Oqh/rpv82kSGpBEx1Nh9NBI:3ui36+gZQr46YhhzZ6E1n9NBI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

24610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\netstandard2.0\Trinet.Core.IO.Ntfs.pdb

UIAutomationClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 df0dd3fa1a3463a0e94a44b70bd9fa9f4e4e91ca7a9e0229ac86442614c42268
MD5 f9115542337c422922173108f35f6a98
SHA1 fee4b41a513c3061f4bb040f26c9af39f0c7de96
SHA512 b3d29a436582f86aee4c204fbe814a8d934a45e265e0144ca8e209e269dbf554bae281164cf687bce777547c67e20bc7052210e3335b8e1ba30176da53da53dc
SSDEEP 3072:/xzMMxHE3EOEoubXNz71FDxQFzkF1jp6V9epr:ZDeUXpNz1r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

165310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationClientSideProviders.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fe614bc0fc3a928c692aa9a124ad23df2e8340589812128dadd175a5a7aa16ee
MD5 774dbd0432c038e0cd1f12bd9815b406
SHA1 dde22f173c178920b0c680d59ac692ec12170395
SHA512 f14f72318203e126ff0e1d97e6d5d27e37dbaf1961246cb5022032fd80e44cce1b4c7bb015291d6e9ac614c4defb3a379d9b1d71c359b9a158e977040a235fd8
SSDEEP 3072:PL5BrEdf+eZQE0YmCf0vl0okcdl0LUowsZGdmVWVDQpTZS40V1l2KrKrhrar6rKz:PEJ0YmvvGc70LxWxQpfdPNRpYEl4C14
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

347438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationProvider.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f1cd0d5ecd1b5cba7f0e13c47201368f1e2670a274f51ab3a6f6352b5472988
MD5 c38441a8d1c6af274c9dcaa36371ca37
SHA1 67d327632db75839da87a85859452943e8fdc83c
SHA512 c280c3d75d1d083337465a60c6ae1a1833039b925eac5066ffe423706cddbcf3dd66e61aad782829edcf59d160df963d5e5977726f12a4b64d7845ef1a532b07
SSDEEP 384:wL7o5TJ+EREt4EidWtchSNSzuOKyyXXkdYLwmT7FiypOUnMeXeHAQIjDZBv0gAxy:wwTTut44cK8WwYnMRH/P4iw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

38014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UIAutomationTypes.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6b78e5d676aafef787cd80e53d346e00d32d4c4b5f538b2bb4bf73aecd4fb44
MD5 ac463388a5bd074e0c5f78faedae7a3f
SHA1 aa76fbb442eaa382551166d24ca7c484b9815235
SHA512 91703a92529ef366de0d13a0621fa0a6ef96d19144d33156b79472e0e28fbb79c00603e245daaabf73848190f04c3b13d4e1dbdb316c7037633c64f714aa80b5
SSDEEP 3072:U7QRqWWx7zg8vpLB1B9aO73uz3Vfa9/xoEviy0gVQZLnIJLTjtcXBtecZ5c:UsRP8hGUuzcPpviyJ+ZL1R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

206158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UiPath.CoreIpc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b29fa15517e04ab895560bea488ec36b8ffcc1870a9f00217a048930a81c5ab8
MD5 1130d201974bff1341b6e48abc8fa415
SHA1 7aa60c71bdae65b78490e00ddcb34cc2fac1a576
SHA512 37f13db621d365491b4865c127f87438854c96f2f8aff24cda0163dbe13c9a3fc731b2a6f50d741b7c723d4df93dfd61310ed7665429babcaa94d09b75b8de0e
SSDEEP 1536:GWUHRIc4tcqG5X6gfG7ZJF4RGnXNYm4qjH5hojdHMZFwp9f/LZMhx:GWUHucqG5XLfoJWRGnXNYnqdhojdsLyD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d2:f1:a0:33:35:0b:6c:9a:bb:5d:fd:04:27:14:d4:69:37:2a:ff:4f:af:ae:dd:f6:24:14:51:c8:f2:47:6a:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

81502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.Native.Win.dll

IMPHASH ad0a365cdf6eb2218bc4df6249f04c4f
SHA256 a76eb98b7826d6b28ab9f5a71dccab63981226c9f457f531ce1e3174b40aa0db
MD5 0ceb23f77757d4bd6235f6c74f052c92
SHA1 37b956d6ce1b21f96801e92da1ad360d47f3cd0a
SHA512 9cd0a34eb0bb2b164dd91b9cff6be8e7f9c6c92c6162f5da14253e6d52be27a4479a75f852914e1d3a893b0730154be8c3a6e16c2ebed0c809cdb87a9c3e7b82
SSDEEP 1536:TK/FIJj6Koetvoji3ILIXRQmYiYO5ILtFaaewHVXHHSwsW87cdB171k+waU50AmV:Td6KoEYLIXRNILnXHHwqB171k+waU50B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

87:64:07:d8:3f:ef:87:a1:2c:44:cb:8b:9c:53:f7:2c:b6:3e:46:54:06:eb:ae:0b:bc:82:1f:d9:51:48:87:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

10318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Utilizr.Native.Win.pdb

kernel32

MultiByteToWideChar RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle GetStringTypeW HeapReAlloc HeapSize GetFileType GetStdHandle GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EnterCriticalSection LeaveCriticalSection RtlUnwind InterlockedFlushSList SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree WideCharToMultiByte HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW WriteConsoleW

shell32

SHGetKnownFolderItem

ole32

CoTaskMemFree CoUninitialize CoInitialize

oleaut32

SafeArrayCreate SafeArrayDestroy SafeArrayUnlock SafeArrayGetLBound SafeArrayLock SysFreeString SysAllocStringLen SafeArrayGetUBound

Utilizr.NotifyIcon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 671bd4aad1a91b134c2fd4e1c4a48a82d667d936a49a60b4c41de2552d9fa868
MD5 1e3feed90d5602cd617ab521ac90212f
SHA1 45f96effea4fee95c2ffc733724e42a988d70ede
SHA512 1b792747d6b8086d25828b22a329367bc59172b23297daa235436e0591fde5cad3738169f6a3c8eecdde18d88c2eb00ea2965b631bad2dd09c01c3a5247f0685
SSDEEP 768:hM3egafC584bnXoklRjg3f98BZ4UdnRpVxDdp:Ahaz99SBrp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

48370

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Utilizr.OpenVPN.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 81322aeeef6a98186dceb13ea714194feff82bc2d33b5c42409d45f912fe1a11
MD5 3bba1a6b2a0a573013004def7d072f85
SHA1 15899568a637f3ec4df7f7bd1b23b9edf02aaa9a
SHA512 53205b4fb7d54d0aab67141d6209b6e8f9cf2974cddd7ca0f5f6eb95184760d89af6b628652ee49483f3ba7db59e6aa67294cf483af91a7ec74c2609e2053a49
SSDEEP 768:fPdHr9+OJdTM4Pzk4fCHQjhVcHtB10mq4hOl01jF1H7:f19M47zjhVcHtB8W1f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

39758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.Ras.dll

IMPHASH d57f33daabde0c29d7e55211428722d6
SHA256 70fc55268ca3276bcc599c3b3f10a39d2bcd1fcb493a6d74a12931211e0e0670
MD5 8fe9be2a19880199b1b2289e4e0b3e93
SHA1 f7d4a4b989ec416fa5ef3ac8b01e1197b9d1872c
SHA512 af248740b64314eee6e6da88bffd0d5f8f2a1adb170a2908f1e432b7bc2a2d8228497b5b1f6b733a36a0ab4db9ac7207b6650953a8932904ceef024eb3e58c13
SSDEEP 3072:uNa2Dukzm3oJ+z3jUa+VhPqbb73PJ58+LfF7eE4+rGzdDA:+aiJ+z35+Vlq37R58wA0rGzdDA
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

15:a5:b0:26:e7:37:7d:00:24:c8:b2:ef:42:ee:bb:16:65:f9:be:5a:d1:ce:82:04:76:dc:66:d6:c6:37:2b:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

7441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Utilizr.Ras.pdb

rasapi32

RasGetEntryDialParamsW RasGetConnectionStatistics RasGetConnectStatusW RasEnumConnectionsW RasDialW RasGetEntryPropertiesW RasHangUpW RasSetEntryPropertiesW RasEnumDevicesW RasValidateEntryNameW

kernel32

RaiseException DecodePointer WriteConsoleW CreateFileW CloseHandle HeapSize GetStringTypeW SetFilePointerEx HeapAlloc GetProcessHeap HeapReAlloc GetLastError lstrcmpiW HeapFree Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer SetStdHandle ExitProcess GetModuleHandleExW GetModuleFileNameW LCMapStringW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode

Utilizr.VPN.RasSharp.NetCore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5b9a3b0d0348b33271caaac006b2205d0128a246d74086d230501e53ec907732
MD5 2958f26b0902352fc73b3816efad4e4a
SHA1 38b9d9a075dc9fd24c9b18baf2068f3f67daead4
SHA512 f993ad41614986e72310e10b414c3e232c4bc6e3f55ff1d15d4df731224063dbcf55ead14d57724ca39f75b9df60e34d4de3211ccfbb5d7d9895faab51364bac
SSDEEP 384:3hTHdFRhpKlYZTRXufg9IMXbMB4/BR2xOujSsDUs3j81eTv:3rTXKl8TRtIMXItGa73jw4v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.VPN.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3fa75b420ebad7391fcf771eb019c44f9af56fb31c7ab53bf55c660400e842be
MD5 c944a7f980d8e47077b1aed876f90ba8
SHA1 db9963ce916277d0e38d032bd4fdfdd441de592e
SHA512 919272b1a03fe8764ae4aa079563afc479d5f64105e8798901743a2950e21f852ad2ea4af078bf6095d2d58d7d607659e4d46105dfc37169534472eb19ed1237
SSDEEP 768:Vk4hrfcxRwxOb1bAEpUnhwL7fcAvL2NNNx4eOmw2u10mHUFWHMqbVy0JAMxkEj+:u00Rxahuftv12u1FpsqbYQxG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

02:d9:1e:81:98:70:c1:fc:17:20:d3:d1:a2:88:b4:7f:29:fa:d8:24:ce:d2:5a:b2:0a:b3:c5:5a:1e:53:1b:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

47246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilizr.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 862695d65d8d14211f39783a9a626d6ff620d4c4fe17a03af6267ac962794d66
MD5 671415e5524e4b12eec3140992fd51e4
SHA1 517eaf8c4da4ba3827e96d422da9cb4bb6c38c73
SHA512 ff464b50774863a8d88a9a8b71b5576a06169a48479fe703470e705b86578e8b7491cdfddb76d50e5afe42134e85cc1bd0b65c25340366632cef7cd1739977da
SSDEEP 6144:xBFP1rPm67HkkbDlbiJridY5G8GCKklSR7zGjJ6nwaaGb5lo96kF0b1c84PmMPu:91rPh7HLDlbiJlq7zA6nwP6vJwmMPu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

64:36:15:a3:66:37:3c:2c:f4:58:35:70:5b:89:e7:7b:c4:5e:ef:ea:54:f0:a1:18:24:a1:11:f1:7f:c0:2d:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

416542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Utilzr.WPF.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 69465cb04f9d591f2fbeac213b9e4c2ca61b3f17f2e537528ec48b1205ef591b
MD5 263efe529fce04baa4860e5114aa847d
SHA1 132451c90e386912941b95d74f709679acfc4a74
SHA512 a7c83396cf84f0ca0bd7e1fab10a57b998016ffa73af7466ecc10b13ecc711473c0567125217b99f74de311296b54d4f841a248ab6571fa835e8e7926cd99892
SSDEEP 6144:3RiAfD+ApbwQJk/8DHJi5RGOJHhboz51vDHUnoARrYvwV5j3Mm:QAaANSMoHTBboz51vDHEj3Mm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

406142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Webshield.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b29bd93b6e919f7098f0eacdc66d72ed25b3e9472e3c61a17ae5cb43419b8c6
MD5 61de4c9a5119a54f7c114817b2cc362a
SHA1 3f3b0776526746bad4775482ad17c20821f99ce1
SHA512 a6b6bfc70a1cb7fd810dbf4b320eff94beefe2a8f1846e7acc709ed92cbe9d6b5b750782ef189608a2e44011cbd5924fc34a088fbefab17fe8c1dab61b00be6b
SSDEEP 768:XZyVmVFGwsjrgrqqnt1mkfX6dup8VgGzrJeHhYpFSmudok+n:XydvFkfX6VJedm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

41278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WindowsBase.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8f6d8283bbc65f2e5d101b6465a80b130060e27ed304301aefac5e370b4ee74c
MD5 d1ba0f8dcdb06bbdb31b92f21557aa92
SHA1 41d096383c3334429ecf27309c496142c09b59bd
SHA512 811b671d4d7271e682d5f94a0e1605784866f27545abe9dbe6fe10bc2a8a80240b15dbc9949f3bcba056fabca402707c732f32488f60d11029863073a350331c
SSDEEP 12288:TyIB++WPyR0vkXLDywcEvmNA08m7J9dQQVsbKBCTRc8g9sgD9VMuVGdLlESOLWQT:GIa6eC2wBmNA8J9dQQpdquOpXRwXSfy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1052206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WindowsFormsIntegration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1bc138863ad0bd5ad76cbe133e6091e774c875e02cf070653eaf10dde099c299
MD5 0a90d6f7745945ac8b4ab943117a2997
SHA1 3bfc301f7c1fe06d24ae75792985ce0ff96d0b5a
SHA512 63825e8a0a5f085b9b513d14e8e3103921f2cf3a0250cea3bfcb03bc2e562543c89cb5ea92bb4bf12cf0b885dbf5248203ea59500bc0ef55788f2bae1498e346
SSDEEP 1536:HA4yZgAOFEDPIptdL8a9ZlrmmMeIUGMp/zWtDxVf8oTIA4999rjrl5qT0B98KuJl:HDy6AHQ99rBIUGMp/zW5xVfD4999Tl5k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

91374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-console-l1-1-0.dll

SHA256 24b07028c1e38b9ca2f197750654a0dfb7d33c2e52c9dd67100609499e8028db
MD5 aabbb38c4110cc0bf7203a567734a7e7
SHA1 5df8d0cdd3e1977ffacca08faf8b1c92c13c6d48
SHA512 c66c98d2669d7a180510c57bab707d1e224c12ab7e2b08994eb5fd5be2f3dee3dbdb934bcb9db168845e4d726114bce317045027215419d3f13dcfa0f143d713
SSDEEP 192:aBgW1hWi7u7jCjdks/nGfe4pBjSYpP4W5RKTt3E2sVWQ4GWc6CT7yqnaj/6g6dyh:dW1hWLam0GftpBjhFm3S4xltZEU
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

78:01:8f:1a:1e:e5:e3:d8:12:34:d0:63:8c:e3:c0:73:5e:2c:98:83:9a:54:39:85:48:6f:ed:ce:f5:13:0b:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

1f:1a:e3:ca:4c:2a:c2:0d:00:a4:8c:51:18:6b:d2:53:27:5d:be:bb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-console-l1-1-0.pdb

api-ms-win-core-datetime-l1-1-0.dll

SHA256 c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
MD5 8894176af3ea65a09ae5cf4c0e6ff50f
SHA1 46858ea9029d7fc57318d27ca14e011327502910
SHA512 64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a
SSDEEP 192:fW1hWiH+49Cjdks/nGfe4pBjSY285a+W5RKTt3E2sVWQ4GW2TwE9qnajuZDAJaaj:fW1hWZ4wm0GftpBj8m3SLwwlUKTf
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:2c:95:94:4c:b1:1b:99:46:db:28:c1:f2:10:db:14:7b:5d:6a:8b:30:76:fc:f3:a3:cc:f0:15:b0:ba:a6:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

1c:49:85:91:05:43:17:cb:f1:63:7f:31:a2:21:c8:d3:38:1c:0d:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-datetime-l1-1-0.pdb

api-ms-win-core-debug-l1-1-0.dll

SHA256 7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8
MD5 879920c7fa905036856bcb10875121d9
SHA1 a82787ea553eefa0e7c3bb3aedb2f2c60e39459a
SHA512 06650248ddbc68529ef51c8b3bc3185a22cf1685c5fa9904aee766a24e12d8a2a359b1efd7f49cc2f91471015e7c1516c71ba9d6961850553d424fa400b7ea91
SSDEEP 384:uW1hWcFm0GftpBjOQElEm3SQalndaYhppz:llVijElEXj
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e7:92:28:8a:ca:d5:86:28:22:34:3d:dc:71:26:1f:9d:a6:2d:8a:4f:4c:5c:6f:29:5a:3e:64:d1:ad:e3:1b:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

6f:d7:34:01:66:da:08:66:42:62:d4:44:cd:4d:29:4c:c7:3b:16:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-debug-l1-1-0.pdb

api-ms-win-core-errorhandling-l1-1-0.dll

SHA256 f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492
MD5 d91bf81cf5178d47d1a588b0df98eb24
SHA1 75f9f2da06aa2735906b1c572dd556a3c30e7717
SHA512 93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706
SSDEEP 192:cnmxD3jW1hWiRcvHCjdks/nGfe4pBjSYrteMMPiW5RKTt3E2sVWQ4GWCxMfqnaj9:cn4W1hWiQim0GftpBj9eXm3SR6lPp/
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:bd:7c:32:14:8c:fe:34:06:44:f9:bb:b2:e3:0b:5f:a3:a0:72:57:55:36:7c:38:4e:ec:57:3e:06:0a:70:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

9b:f6:ae:be:57:bd:40:80:95:1a:31:a9:b5:23:73:64:80:3d:61:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-errorhandling-l1-1-0.pdb

api-ms-win-core-file-l1-1-0.dll

SHA256 1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15
MD5 eefe86b5a3ab256beed8621a05210df2
SHA1 90c1623a85c519adbc5ef67b63354f881507b8a7
SHA512 c326a2ca190db24e8e96c43d1df58a4859a32eb64b0363f9778a8902f1ac0307dca585be04f831a66bc32df54499681ad952ce654d607f5fdb93e9b4504d653f
SSDEEP 384:Y6PvVX7W1hWC1m0GftpBj4xm3SBvlmTwhsH:jPvVXeTVic1i
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

00:c4:35:21:a2:04:3b:c9:c5:7f:4d:4b:6c:da:d0:38:aa:75:92:91:c1:c5:66:86:8f:32:c8:78:79:05:e4:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

6d:7c:e4:74:3d:15:aa:58:38:90:db:48:88:42:62:88:c5:8a:8a:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l1-1-0.pdb

CompareFileTime CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DefineDosDeviceW DeleteFileA DeleteFileW DeleteVolumeMountPointW FileTimeToLocalFileTime FindClose FindCloseChangeNotification FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileExA FindFirstFileExW FindFirstFileW FindFirstVolumeW FindNextChangeNotification FindNextFileA FindNextFileW FindNextVolumeW FindVolumeClose FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeA GetDriveTypeW GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFinalPathNameByHandleA GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLogicalDriveStringsW GetLogicalDrives GetLongPathNameA GetLongPathNameW GetShortPathNameW GetTempFileNameW GetVolumeInformationByHandleW GetVolumeInformationW GetVolumePathNameW LocalFileTimeToFileTime LockFile LockFileEx QueryDosDeviceW ReadFile ReadFileEx ReadFileScatter RemoveDirectoryA RemoveDirectoryW SetEndOfFile SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetFileValidData UnlockFile UnlockFileEx WriteFile WriteFileEx WriteFileGather

api-ms-win-core-file-l1-2-0.dll

SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
MD5 79ee4a2fcbe24e9a65106de834ccda4a
SHA1 fd1ba674371af7116ea06ad42886185f98ba137b
SHA512 6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c
SSDEEP 192:Y+W1hWifcvHCjdks/nGfe4pBjSYA89sX5W5RKTt3E2sVWQ4GWFuLOgVqnaj6uDp6:Y+W1hWoQim0GftpBj7sIm3SFOslD16hP
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:8c:97:81:85:48:aa:1d:d4:f2:e3:3e:90:c1:c6:db:8f:cb:ab:59:89:3c:de:f2:e9:8e:7e:b7:37:31:4c:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

c7:5a:78:70:ff:34:aa:28:49:4d:2c:57:ae:ad:99:8b:9a:85:88:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l1-2-0.pdb

api-ms-win-core-file-l2-1-0.dll

SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
MD5 3f224766fe9b090333fdb43d5a22f9ea
SHA1 548d1bb707ae7a3dfccc0c2d99908561a305f57b
SHA512 c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca
SSDEEP 192:FZkW1hWiecvHCjdks/nGfe4pBjSYo3Vq34W5RKTt3E2sVWQ4GW2rOqnajd2siD+k:MW1hWdQim0GftpBj4VuFm3SWlg+0mw
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7e:ce:c2:e0:6e:f8:7f:0a:cf:3a:5b:44:ba:ed:d5:c2:a1:a7:dd:90:87:4e:3e:15:a0:56:c5:06:b1:c7:85:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

78:3a:91:1b:dd:8f:2c:2f:d3:a3:7d:86:9c:dd:87:9c:03:05:b4:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-file-l2-1-0.pdb

api-ms-win-core-handle-l1-1-0.dll

SHA256 dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b
MD5 18fd51821d0a6f3e94e3fa71db6de3af
SHA1 7d9700e98ef2d93fdbf8f27592678194b740f4e0
SHA512 4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d
SSDEEP 384:4W1hWypFm0GftpBjTnom3S4tOlDCEY5kD:zvViFoUtQ1Y5kD
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:29:82:a9:07:32:c9:dd:95:e1:2d:ac:d6:88:12:65:ad:a0:ed:14:92:66:ef:2a:89:ad:c4:c7:fc:e2:c4:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

3f:32:f2:4a:32:77:c7:b4:c2:76:97:8f:6b:5c:71:99:fe:4e:c2:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-handle-l1-1-0.pdb

api-ms-win-core-heap-l1-1-0.dll

SHA256 535e9d20f00a2f1a62f843a4a26cfb763138d5dfe358b0126d33996fba9ca4d1
MD5 ff8026dab5d3dabca8f72b6fa7d258fa
SHA1 075c8719e226a34d7b883fd62b2d7f8823d70f1a
SHA512 9c56ff11d5843ba09cd29e3bc6c6b9396926c6a588194193ba220cfa784b770ab6756076f16f18cfea75b51a8184a1063ef47f63804839530382f8d39d5cf006
SSDEEP 384:nEleW1hW59XRm0GftpBjywVpm3SJflndaYhp6a:uADVig69F3
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:fd:cd:0d:02:b1:73:f7:b5:2d:8f:6a:60:f9:7e:2b:7b:8b:52:af:9a:68:ed:d3:51:2e:5a:ab:37:70:1d:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

47:78:05:72:78:49:45:96:58:01:fb:ef:6b:52:d2:51:0b:ee:77:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-heap-l1-1-0.pdb

api-ms-win-core-interlocked-l1-1-0.dll

SHA256 4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
MD5 cfe87d58f973daeda4ee7d2cf4ae521d
SHA1 fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
SHA512 40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b
SSDEEP 384:l5iYsFqW1hWfsngm0GftpBjWfshFIvgCcm3SHlg+0Ix:loZngViwfsh6gxfx
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

43:ba:ca:fd:b1:e3:f6:6e:41:1d:89:2b:d7:34:51:5c:30:ee:5f:90:5e:49:24:67:2e:ba:88:36:5c:1f:63:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

7d:aa:52:4d:98:7c:0a:aa:11:33:5e:75:9f:40:7b:a8:bf:cd:77:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-interlocked-l1-1-0.pdb

api-ms-win-core-libraryloader-l1-1-0.dll

SHA256 2dd4ebaa12cbba142b5d61a0ebf84a14d0d1bb8826ba42b63e303fe6721408df
MD5 0c48220a4485f36feed84ef5dd0a5e9c
SHA1 1e7d4038c2765cffa6d4255737a2a8aa86b5551c
SHA512 e09951785b09f535340e1e6c256df1919485b4dad302b30d90126411cc49a13807b580fa2fcd0d6f7b64aac4f5b5ea3e250b66035a0e2f664d865408c9b43d48
SSDEEP 384:b+g4vuBL3BmW1hWZ1m0GftpBjLOoZm3SNvVlgCopp3y:b+YBL3BdOViUyRv4Hn3y
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b7:67:8f:9d:8b:64:26:b6:50:45:14:4d:a8:58:14:21:d7:75:1d:4d:bf:90:46:16:10:01:cd:8f:aa:b0:1f:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

8b:9a:c0:f8:b6:9e:4a:89:bd:33:82:f4:99:5f:54:27:0d:38:0c:62

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-libraryloader-l1-1-0.pdb

api-ms-win-core-localization-l1-2-0.dll

SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
MD5 23bd405a6cfd1e38c74c5150eec28d0a
SHA1 1d3be98e7dfe565e297e837a7085731ecd368c7b
SHA512 c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21
SSDEEP 384:9OMw3zdp3bwjGjue9/0jCRrndb5W1hW54wm0GftpBjvTNvwm3SBMltZ2m:9OMwBprwjGjue9/0jCRrndboUFViZ2Vu
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

cd:fd:93:90:2f:62:5a:8c:a9:17:2f:38:d4:53:83:78:49:3d:28:7e:b0:0a:13:5d:81:27:49:1e:b9:b1:32:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

b5:c8:23:76:1e:eb:6a:89:52:d9:4d:5c:c3:0f:e6:f4:1e:ae:05:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-localization-l1-2-0.pdb

api-ms-win-core-memory-l1-1-0.dll

SHA256 ec573431338371504b7b9e57b2d91382b856aabf25d2b4ad96486efb794c198e
MD5 3940167ffb4383992e73f9a10e4b8b1e
SHA1 53541c824003b0f90b236eda83b06bec5e1acbf5
SHA512 9732acaa4db773f4f99f423d9feaebb35c197bbd468922348e0ad086f7131d83f6d9714dc7d375183e7cb8920cfe37f3da19b0041a9063cc60abe183375b1929
SSDEEP 384:tbtW1hWwDzDm0GftpBjQxY8m3SSlPpT2R:OzViiDqp2R
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

64:4f:5f:ec:c3:70:6b:7a:33:e3:79:1e:12:71:74:34:cc:ae:40:40:69:68:37:bd:70:72:ef:23:dd:3c:42:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

a2:3c:79:d1:08:d2:8d:fa:b7:08:c5:8a:92:d2:bf:a3:fd:67:ba:e4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-memory-l1-1-0.pdb

api-ms-win-core-namedpipe-l1-1-0.dll

SHA256 dbd788b1c5694d65fa6f6e2202bfabb30adf77eb1973ceb9a737efb16e9edae2
MD5 990ac84ae2d83eeb532a28fe29602827
SHA1 0916f85cc6cc1f01dc08bdf71517a1dc1b8eaf78
SHA512 f0e4705a6890b4f81b7d46f66ca6b8ee82f647e163bce9ecad11d0bbd69caf4ff3c4f15e0d3f829c048b6849b99a7641861e6caf319904d4d61a6084f10da353
SSDEEP 192:DW1hWBuI2WksSrCjdks/nGfe4pBjSY7ecjkUA/W5RKTt3E2sVWQ4GWZ0MVqnaj6f:DW1hWQ3szm0GftpBjH2Wm3SPAlD16h9
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

23:ae:39:00:e6:ae:18:b5:f8:c4:39:3b:d7:95:df:b2:08:60:73:9f:ba:1f:88:80:da:eb:c3:6b:43:4f:06:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

34:5d:e5:e5:a8:b7:2e:25:0c:f3:dc:e6:42:b3:13:ba:db:54:fb:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 2, 2017 - Jan 2, 2019

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-namedpipe-l1-1-0.pdb

api-ms-win-core-processenvironment-l1-1-0.dll

SHA256 9f1f26794fd664e0a8b6fbd53bfca33dcf7b0dc37faf3eb7782bc38dff62cd8c
MD5 0c700b07c3497df4863c3f2fe37cd526
SHA1 f835118244d02304de9eb3a355420ba9d0bd9c13
SHA512 8042dbd9e80e33e41993887b0289e143e967544389500ada9296b89bda37bb26918e4f370f8a1bdab8faacc4e0a6980794d6a3b5320e170ad4ef751384c9f0a8
SSDEEP 192:qHW1hWinluZCCjdks/nGfe4pBjSYUe0DFtct2W5RKTt3E2sVWQ4GWMZ6k8xL9qnP:qHW1hWRFm0GftpBjqt2m3Sn6R5lUKT4
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

5f:79:ef:1d:94:3a:28:42:c9:3d:20:bb:e8:62:53:50:8f:8f:79:1e:fe:80:80:e2:9a:b9:88:3c:28:4f:51:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

d1:6e:99:7e:0a:cf:c6:7b:4b:69:75:5d:08:cf:69:e1:7e:f2:43:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processenvironment-l1-1-0.pdb

api-ms-win-core-processthreads-l1-1-0.dll

SHA256 4f187f1b4b14763360c325df6b04d3ec3cc6d2cecc9b796bc52a6c7196b0b2cc
MD5 1dda9cb13449ce2c6bb670598fc09dc8
SHA1 0a91fe11b9a8321ca369f665a623270e5ac23176
SHA512 4e106c8a52033352c91b65cf65ec459de764c125136333a2f4ba026efdde65f3f71b1f6f11e4c580150ac8a9779825ba5e2af0e14df999a198cfe244e522c28d
SSDEEP 384:Sfk1JzNcKSIdW1hWuQim0GftpBjuksUm3SlSlDCE4E:pcKS1/fVi4Uy14E
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2f:da:90:4d:d6:ce:cf:1c:30:ab:54:fb:28:86:0f:ae:c8:fb:3a:e8:be:53:f0:42:94:4e:9d:9e:c3:14:19:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

38:89:85:fc:bf:3f:6e:91:48:3f:d5:20:49:5b:3a:bf:21:d5:7a:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-0.pdb

api-ms-win-core-processthreads-l1-1-1.dll

SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
MD5 95c5b49af7f2c7d3cd0bc14b1e9efacb
SHA1 c400205c81140e60dffa8811c1906ce87c58971e
SHA512 f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3
SSDEEP 384:NS8DfIelW1hWu4wm0GftpBjBFm3SzlJrI:NSLecfFViRTs
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

56:2c:25:6c:9d:a9:0a:3c:ab:98:f6:67:6b:55:d8:f3:82:39:31:90:c8:62:16:44:1b:23:f6:43:77:30:f5:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

9d:ea:4a:07:4e:a9:ca:3c:27:4a:3c:c3:43:34:1d:c5:26:39:e6:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-1.pdb

api-ms-win-core-profile-l1-1-0.dll

SHA256 f941c232964d01e4680e54ab04955ec6264058011b03889fe29db86509511eba
MD5 cedefd460bc1e36ae111668f3b658052
SHA1 9bd529fe189e0b214b9e0e51717bdf62f1da44ea
SHA512 2c845642b054bc12c2911bfe2b850f06fecafef022180c22f6ffd670f821e84fcad041c4d81ddadb781ddb36cb3e98dfe4eb75ec02b88306ef1d410cbb021454
SSDEEP 192:DgW1hWiIOuDz7eCjdks/nGfe4pBjSYpRrW5RKTt3E2sVWQ4GWN/VWkqnajTWOwCd:DgW1hW7DzDm0GftpBjem3SShlgCopp2
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

36:ce:a9:d1:a1:79:ef:9a:99:f7:17:f2:06:55:64:c8:8f:ec:83:c2:33:b7:11:fd:d7:89:95:b7:c3:64:af:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

5b:3c:1a:8b:f2:0a:e4:63:15:a2:1b:3b:00:54:09:c5:f7:f2:c7:f4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-profile-l1-1-0.pdb

api-ms-win-core-rtlsupport-l1-1-0.dll

SHA256 966a38ed7034f8d355e1e8772dfc92f23fb3c8a669780ed4ac3b075625d09744
MD5 65fc0b6c2ceff31336983e33b84a9313
SHA1 980de034cc3a36021fd8bafff3846b0731b7068e
SHA512 f4ebc7a6d12ae6afa5b96c06413a3438e1678b276b1517da07d33912818fc863b4d35cb46280f12cf90e37bc93e3ab5e44ea6f75767a314c59222b7d397e5b6a
SSDEEP 384:A6uGZW1hWZ4wm0GftpBjfNDm3S3xlgCoppl8uOf7:wGIQFVi3DsHnlVOf7
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c8:c8:c2:cf:b8:4e:cc:05:89:3b:a3:4b:50:a0:d6:81:27:c9:48:9f:1b:e2:46:4e:ca:91:0f:15:07:88:12:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

f0:77:4d:4d:1f:01:e9:6b:f2:cf:96:cf:a9:2d:b3:7f:c2:d7:4d:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-rtlsupport-l1-1-0.pdb

api-ms-win-core-string-l1-1-0.dll

SHA256 339966ae75675a03f628c4ddd5d3218abb36cbcf6ddce83b88c07336d732b8ae
MD5 e7a266dd3a2a1e03d8716f92bede582d
SHA1 d4b97ce87c96de1f39fea97cca3992d292b2c14e
SHA512 31168663fd71b901b1b9152ff288d4e1567003e5fcd1f1c9dfe36d26d2eb16b0932ec8cd34833dab25531f768a01de45c2483f92d4e79f92a89389c02bc05156
SSDEEP 384:EyMvlW1hWBYBm0GftpBjnmm3SC1lDCE9xt:EyMvcNViYm19xt
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d0:c3:94:fb:5b:b7:25:2a:1e:07:11:83:b1:63:0a:93:cc:29:8e:7b:16:e6:21:e1:e2:0d:e5:85:04:85:a2:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

41:45:7d:08:bb:e9:93:df:35:44:b8:20:69:8f:04:66:14:95:d9:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-string-l1-1-0.pdb

api-ms-win-core-synch-l1-1-0.dll

SHA256 cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb
MD5 c1dcdb0fabc8ae671a7c7a94f42fb79a
SHA1 99355912d7a7d622753b2a855cae4f5a4e50146f
SHA512 6d92e7520aeebfe60aab43d6616b76a2dd385edcaa217db60003a0c0cbcb0e367063d240e38a19d0b8bee2f2e7d4b982c4f08c8e9ccf34c7f670cb49f6561fff
SSDEEP 384:rdv3V0dfpkXc0vVa7W1hWf1m0GftpBjum3Su5TlD16ho:rdv3VqpkXc0vVaewVi4a5l
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

2d:f5:22:84:1c:25:3f:6c:9d:51:6e:b5:80:cd:e5:1a:60:57:f9:de:69:2f:d3:fd:b6:5a:1e:bc:e7:e9:6a:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

63:bb:37:03:dc:c2:3a:ff:fe:88:77:de:4e:57:ce:7d:4a:c8:33:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-1-0.pdb

api-ms-win-core-synch-l1-2-0.dll

SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
MD5 6e704280d632c2f8f2cadefcae25ad85
SHA1 699c5a1c553d64d7ff3cf4fe57da72bb151caede
SHA512 ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6
SSDEEP 384:DtZ3UW1hWxDzDm0GftpBjEILkm3ScrlPpU9:n0ViIQxi
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4b:fb:31:6b:fb:ab:16:71:db:ab:01:04:73:51:ce:7c:46:23:ad:cb:9d:bf:e4:9e:e2:11:22:a4:b8:cd:93:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

99:f4:e2:aa:40:53:a0:1a:eb:76:a7:89:ae:04:44:c4:3b:71:68:2d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-synch-l1-2-0.pdb

api-ms-win-core-sysinfo-l1-1-0.dll

SHA256 f94210b39cdc812beb7342a47e68673ea2116d0ad9266fcf8d7cedaa9561fc38
MD5 887995a73bc7dde7b764afabce57efe7
SHA1 363fd4e7ad4a57224e8410154697df5e8629f526
SHA512 d088eb1c6958774e20f0e2884136b4e2b978efd16f557dbc55e64011abbce0768054f7e6d881c110182824143a39101fdae273ed614738aa7ba5c727b27f6677
SSDEEP 192:4Lv12KIMFAW1hWBATVCEmCjdks/nGfe4pBjSYeXwfFzW5RKTt3E2sVWQ4GWURDPV:4LN2NW1hWavm0GftpBjtfFam3SvrlJrV
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

57:a9:6b:9b:b3:a9:d7:19:ee:c9:3f:19:48:7a:55:62:fb:69:71:c5:3d:91:fe:e6:d4:67:aa:69:01:70:77:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

b5:77:64:1a:5b:2d:70:49:d9:5e:e4:17:a8:f7:98:8b:a7:f5:8f:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-sysinfo-l1-1-0.pdb

api-ms-win-core-timezone-l1-1-0.dll

SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
MD5 c9a55de62e53d747c5a7fddedef874f9
SHA1 c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
SHA512 adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb
SSDEEP 384:rWW1hWv4wm0GftpBjgpm3SSP9lndaYhpwe/:ReFVi02vZ
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

67:35:00:8b:0e:3d:24:43:61:28:fd:99:c1:81:a4:d4:aa:2e:82:99:d2:67:27:49:7b:f9:79:99:cd:de:26:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

78:03:56:c4:15:66:e4:ee:ed:d9:e5:a4:bc:02:16:44:28:25:a2:71

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-timezone-l1-1-0.pdb

api-ms-win-core-util-l1-1-0.dll

SHA256 34c5dee6d566252c0ceb7d9a21e24d5f297af2b26c32e0c7808bbd088aa9a6a9
MD5 29e1922b32e5312a948e6d8b1b34e2d9
SHA1 912f54be8438f45e1562a47294091d522cd89356
SHA512 837cd03ee0195dc94bab0662ff3b8cd1be2dedd8a3254318d25dfea6e88d07211186fa367f41ab864560e10a22220deb3ed05ccf82d60ac80c71dfed08afbea3
SSDEEP 384:dW1hWxDzDm0GftpBjDNtfm3SXl4aRGW6acyjR:0oVitL2GjR
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d0:0e:b7:5a:65:1e:9b:bd:09:fc:95:29:0e:83:9d:65:3f:5b:c2:37:d0:70:54:23:9e:f3:bf:dc:2c:10:83:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

d0:8c:e9:f5:b1:5d:d9:eb:91:51:f9:0f:2c:c4:17:15:04:51:4c:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-util-l1-1-0.pdb

api-ms-win-crt-conio-l1-1-0.dll

SHA256 a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503
MD5 a668c5ee307457729203ae00edebb6b3
SHA1 2114d84cf3ec576785ebbe6b2184b0d634b86d71
SHA512 73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730
SSDEEP 384:tW1hWv4wm0GftpBjp+m3S1ZXlndaYhpt1:k+FVib+ZvN
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e0:98:8a:0f:b5:85:21:2a:4c:7f:b0:c7:bf:07:42:35:a0:48:87:da:d8:a1:02:2e:39:5b:45:ef:79:1d:3e:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

dc:7f:be:ee:70:52:ba:ad:5c:69:dd:8c:b2:8a:2d:b4:3b:72:12:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-conio-l1-1-0.pdb

api-ms-win-crt-convert-l1-1-0.dll

SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
MD5 9ddea3cc96e0fdd3443cc60d649931b3
SHA1 af3cb7036318a8427f20b8561079e279119dca0e
SHA512 1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162
SSDEEP 384:FuyhW1hWF4wm0GftpBjErIm3StlndaYhpFeD:4cFViUIbi
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8d:a7:76:c4:c6:f5:cd:7a:4c:9e:0f:01:75:35:55:73:32:a5:1f:21:95:96:82:5e:96:32:9c:59:13:5a:8f:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

49:f8:c7:c9:dc:a2:e5:42:6d:03:6f:5d:76:82:cf:72:ff:d2:8e:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-convert-l1-1-0.pdb

__toascii _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _ecvt _ecvt_s _fcvt _fcvt_s _gcvt _gcvt_s _i64toa _i64toa_s _i64tow _i64tow_s _itoa _itoa_s _itow _itow_s _ltoa _ltoa_s _ltow _ltow_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wctomb_l _wctomb_s_l _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l atof atoi atol atoll btowc c16rtomb c32rtomb mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc strtod strtof strtoimax strtol strtold strtoll strtoul strtoull strtoumax wcrtomb wcrtomb_s wcsrtombs wcsrtombs_s wcstod wcstof wcstoimax wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wctob wctomb wctomb_s wctrans

api-ms-win-crt-environment-l1-1-0.dll

SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
MD5 39325e5f023eb564c87d30f7e06dff23
SHA1 03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
SHA512 087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
SSDEEP 192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

28:c1:a4:2b:1d:91:ea:be:3a:d3:3f:5c:90:ea:09:b4:05:5f:5a:c5:92:7f:1d:e5:82:9c:8b:3a:b3:ce:5d:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

e3:ab:0a:72:3e:e1:d0:34:5f:22:81:e5:aa:fb:a5:b4:12:e6:93:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-environment-l1-1-0.pdb

api-ms-win-crt-filesystem-l1-1-0.dll

SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
MD5 228c6bbe1bce84315e4927392a3baee5
SHA1 ba274aa567ad1ec663a2f9284af2e3cb232698fb
SHA512 37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab
SSDEEP 384:Cq6nWm5CZW1hW9YBm0GftpBjVem3SuPvlg+0Pd:T6nWm5CIhViDeKPmd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4f:bb:d0:ab:a0:f5:83:f3:48:6d:e9:4a:b5:28:2f:6e:35:8d:ce:a2:e8:b8:f0:f1:17:80:78:f5:a8:86:a9:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

01:38:64:ee:29:b6:ac:ca:90:af:a5:85:c6:5f:83:b9:16:59:07:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-filesystem-l1-1-0.pdb

api-ms-win-crt-heap-l1-1-0.dll

SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
MD5 1776a2b85378b27825cf5e5a3a132d9a
SHA1 626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df
SHA512 541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348
SSDEEP 384:XY3eBW1hWqvm0GftpBjtzsxm3SKulndaYhp6s:zQzViATv
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

47:ef:42:8b:ca:b7:de:34:29:47:8c:f4:03:4c:b1:bf:45:5b:d9:0f:5f:8a:e9:30:47:eb:83:ac:dc:59:a2:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

df:a8:71:5e:de:27:0f:ab:bc:5f:46:c2:d2:b8:8b:bb:64:45:ce:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-heap-l1-1-0.pdb

api-ms-win-crt-locale-l1-1-0.dll

SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
MD5 034379bcea45eb99db8cdfeacbc5e281
SHA1 bbf93d82e7e306e827efeb9612e8eab2b760e2b7
SHA512 7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
SSDEEP 192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c4:9e:7c:72:02:bd:96:0b:21:f1:d5:4b:83:e8:0a:83:ee:1b:ad:36:75:78:a1:cc:50:6e:70:b5:77:2e:5c:b7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

55:40:1f:9c:58:bd:a7:92:7e:cc:54:e0:c5:0c:36:47:a3:91:9a:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-locale-l1-1-0.pdb

api-ms-win-crt-math-l1-1-0.dll

SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
MD5 8da414c3524a869e5679c0678d1640c1
SHA1 60cf28792c68e9894878c31b323e68feb4676865
SHA512 6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa
SSDEEP 384:jOTEmbM4Oe5grykfIgTmLmW1hWSsngm0GftpBjGm3SAlD16hX:lEMq5grxfIndCngVis5
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b4:81:a9:e2:bf:77:48:ad:a2:83:51:23:75:b7:75:be:1d:a6:6a:78:f5:17:6a:b4:45:b0:03:89:ec:c9:a8:d2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

4a:5d:3e:6b:77:5b:7a:3e:d6:e5:62:4f:2e:9f:4c:b0:f8:3f:d1:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-math-l1-1-0.pdb

_CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _Cbuild _Cmulcc _Cmulcr _FCbuild _FCmulcc _FCmulcr _LCbuild _LCmulcc _LCmulcr __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __setusermatherr _cabs _chgsign _chgsignf _copysign _copysignf _d_int _dclass _dexp _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _except1 _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _finite _fpclass _ftol _hypot _hypotf _isnan _j0 _j1 _jn _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _logb _nextafter _scalb _set_SSE2_enable _y0 _y1 _yn acos acosh acoshf acoshl asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl erf erfc erfcf erfcl erff erfl exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fdim fdimf fdiml floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod frexp hypot ilogb ilogbf ilogbl ldexp lgamma lgammaf lgammal llrint llrintf llrintl llround llroundf llroundl log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl lrint lrintf lrintl lround lroundf lroundl modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml pow powf remainder remainderf remainderl remquo remquof remquol rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl sin sinh sqrt tan tanh tgamma tgammaf tgammal trunc truncf truncl

api-ms-win-crt-multibyte-l1-1-0.dll

SHA256 a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15
MD5 19d7f2d6424c98c45702489a375d9e17
SHA1 310bc4ed49492383e7c669ac9145bda2956c7564
SHA512 01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e
SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWOXRm0GftpBjVm3SKlDCEIy:2ZKrZPmIHJI6abVi/Q1Iy
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d8:52:c0:6f:2f:9c:98:18:86:30:8a:4f:cc:7b:47:bb:64:84:85:b0:d0:fd:f3:bd:51:04:4b:16:74:d1:82:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

c7:51:bf:93:d9:26:4a:9c:a3:a1:6e:e4:b6:51:e0:90:12:1b:56:07

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-multibyte-l1-1-0.pdb

__p__mbcasemap __p__mbctype _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l

api-ms-win-crt-private-l1-1-0.dll

SHA256 dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
MD5 3d139f57ed79d2c788e422ca26950446
SHA1 788e4fb5d1f46b0f1802761d0ae3addb8611c238
SHA512 12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765
SSDEEP 1536:g0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPL9VG:XjDe5c4bFE2Jy2cvxXWpD9d3334BkZnI
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

17:e8:a5:1f:4e:4f:ea:b3:1a:b1:27:a3:ba:d9:af:1d:b5:79:ea:1e:70:b1:d5:0d:86:a6:69:9b:bd:b7:68:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

24:d4:41:f4:86:c6:03:42:bf:9f:07:10:9c:5d:60:bb:45:58:ff:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-private-l1-1-0.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __intrinsic_abnormal_termination __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __unDName __unDNameEx __uncaught_exception __uncaught_exceptions _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _o__CIacos _o__CIasin _o__CIatan _o__CIatan2 _o__CIcos _o__CIcosh _o__CIexp _o__CIfmod _o__CIlog _o__CIlog10 _o__CIpow _o__CIsin _o__CIsinh _o__CIsqrt _o__CItan _o__CItanh _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___libm_sse2_acos _o___libm_sse2_acosf _o___libm_sse2_asin _o___libm_sse2_asinf _o___libm_sse2_atan _o___libm_sse2_atan2 _o___libm_sse2_atanf _o___libm_sse2_cos _o___libm_sse2_cosf _o___libm_sse2_exp _o___libm_sse2_expf _o___libm_sse2_log _o___libm_sse2_log10 _o___libm_sse2_log10f _o___libm_sse2_logf _o___libm_sse2_pow _o___libm_sse2_powf _o___libm_sse2_sin _o___libm_sse2_sinf _o___libm_sse2_tan _o___libm_sse2_tanf _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__libm_sse2_acos_precise _o__libm_sse2_asin_precise _o__libm_sse2_atan_precise _o__libm_sse2_cos_precise _o__libm_sse2_exp_precise _o__libm_sse2_log10_precise _o__libm_sse2_log_precise _o__libm_sse2_pow_precise _o__libm_sse2_sin_precise _o__libm_sse2_sqrt_precise _o__libm_sse2_tan_precise _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_clearerr _o_clearerr_s _o_cos _o_cosh _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_fma _o_fmaf _o_fmal _o_fmod _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_modf _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinh _o_sqrt _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanh _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

api-ms-win-crt-process-l1-1-0.dll

SHA256 707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb
MD5 9d3d6f938c8672a12aea03f85d5330de
SHA1 6a7d6e84527eaf54d6f78dd1a5f20503e766a66c
SHA512 0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb
SSDEEP 192:hRQqjd7hW1hWif+49Cjdks/nGfe4pBjSYr+c24QLW5RKTt3E2sVWQ4GWw899qnaP:hKwW1hWZ4wm0GftpBjh24Jm3SwlUKTw2
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

69:69:7b:ab:9a:ae:0c:c5:99:03:98:6e:77:1c:b4:69:99:f6:4e:22:88:ec:f0:57:6c:07:86:4a:90:1a:41:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

3c:c9:27:de:6e:c2:16:2c:63:ea:3d:66:f4:ba:30:5f:e8:f5:3b:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-process-l1-1-0.pdb

api-ms-win-crt-runtime-l1-1-0.dll

SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
MD5 fb0ca6cbfff46be87ad729a1c4fde138
SHA1 2c302d1c535d5c40f31c3a75393118b40e1b2af9
SHA512 99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83
SSDEEP 384:Lb7hrKkW1hW54wm0GftpBjGOm3SdWlmTwhctW:LbNrKn8FVinhZW
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0d:da:f7:91:ec:8c:d6:bc:9c:d3:ca:0b:d3:34:13:64:97:35:9e:df:bf:b6:c0:ad:59:ce:3e:f1:fe:f3:42:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

38:d0:bb:ce:4f:3b:91:fe:01:52:6f:59:bb:69:68:62:c4:4a:78:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-runtime-l1-1-0.pdb

_Exit __control87_2 __doserrno __fpe_flt_rounds __fpecode __p___argc __p___argv __p___wargv __p__acmdln __p__pgmptr __p__wcmdln __p__wpgmptr __pxcptinfoptrs __sys_errlist __sys_nerr __threadhandle __threadid __wcserror __wcserror_s _assert _beginthread _beginthreadex _c_exit _cexit _clearfp _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _crt_at_quick_exit _crt_atexit _crt_debugger_hook _endthread _endthreadex _errno _execute_onexit_table _exit _fpieee_flt _fpreset _get_doserrno _get_errno _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_pgmptr _get_terminate _get_thread_local_invalid_parameter_handler _get_wide_winmain_command_line _get_wpgmptr _getdllprocaddr _getpid _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _query_app_type _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _seh_filter_dll _seh_filter_exe _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_invalid_parameter_handler _set_new_handler _set_thread_local_invalid_parameter_handler _seterrormode _sleep _statusfp _statusfp2 _strerror _strerror_s _wassert _wcserror _wcserror_s _wperror _wsystem abort exit feclearexcept fegetenv fegetexceptflag fegetround feholdexcept fesetenv fesetexceptflag fesetround fetestexcept perror quick_exit raise set_terminate signal strerror strerror_s system terminate

api-ms-win-crt-stdio-l1-1-0.dll

SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
MD5 d5166ab3034f0e1aa679bfa1907e5844
SHA1 851dd640cb34177c43b5f47b218a686c09fa6b4c
SHA512 8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e
SSDEEP 384:/ZpFVhHW1hWxgYBm0GftpBjMm3SNlndaYhpn3p:boEVi6DBp
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

06:6a:c5:48:de:6e:e8:ec:f5:6d:b2:e4:7d:c8:0f:e8:50:a7:f5:6b:6e:95:33:49:2d:a2:ba:7c:d7:ae:f3:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

cd:d6:f2:d2:ca:df:e3:a6:28:86:42:e0:c0:2c:cc:ac:55:18:39:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-stdio-l1-1-0.pdb

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf _chsize _chsize_s _close _commit _creat _dup _dup2 _eof _fclose_nolock _fcloseall _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _flushall _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _ftell_nolock _ftelli64 _ftelli64_nolock _fwrite_nolock _get_fmode _get_osfhandle _get_printf_count_output _get_stream_buffer_pointers _getc_nolock _getcwd _getdcwd _getmaxstdio _getw _getwc_nolock _getws _getws_s _isatty _kbhit _locking _lseek _lseeki64 _mktemp _mktemp_s _open _open_osfhandle _pclose _pipe _popen _putc_nolock _putw _putwc_nolock _putws _read _rmtmp _set_fmode _set_printf_count_output _setmaxstdio _setmode _sopen _sopen_dispatch _sopen_s _tell _telli64 _tempnam _ungetc_nolock _ungetwc_nolock _wcreat _wfdopen _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wmktemp _wmktemp_s _wopen _wpopen _write _wsopen _wsopen_dispatch _wsopen_s _wtempnam _wtmpnam _wtmpnam_s clearerr clearerr_s fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws fopen fopen_s fputc fputs fputwc fputws fread fread_s freopen freopen_s fseek fsetpos ftell fwrite getc getchar gets gets_s getwc getwchar putc putchar puts putwc putwchar rewind setbuf setvbuf tmpfile tmpfile_s tmpnam tmpnam_s ungetc ungetwc

api-ms-win-crt-string-l1-1-0.dll

SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
MD5 ad99c2362f64cde7756b16f9a016a60f
SHA1 07c9a78ee658bfa81db61dab039cffc9145cc6cb
SHA512 9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
SSDEEP 384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4a:f7:b2:a8:7c:0d:32:af:2c:96:ea:a5:fe:83:44:27:53:a1:05:26:3b:78:e6:6e:92:ce:a4:2c:39:01:4b:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

15:fc:7d:e6:b7:e4:21:f5:f7:05:fb:44:ff:49:64:30:bf:80:c9:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-string-l1-1-0.pdb

__isascii __iscsym __iscsymf __iswcsym __iswcsymf __strncnt __wcsncnt _isalnum_l _isalpha_l _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _memccpy _memicmp _memicmp_l _strcoll_l _strdup _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsdup _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctype is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit mblen mbrlen memcpy_s memmove_s memset strcat strcat_s strcmp strcoll strcpy strcpy_s strcspn strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s strxfrm tolower toupper towctrans towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcscspn wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsspn wcstok wcstok_s wcsxfrm wctype wmemcpy_s wmemmove_s

api-ms-win-crt-time-l1-1-0.dll

SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
MD5 9b79fda359a269c63dcac69b2c81caa4
SHA1 a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
SHA512 e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541
SSDEEP 384:iUW1hWQ4wm0GftpBjddQxm3SLDlD16h1S:eRFViexn1
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:78:0a:48:f4:90:dc:4c:3c:d4:1c:48:df:dc:fe:5d:ff:e8:28:d6:07:53:5e:c7:ef:a4:6d:6f:ed:cb:95:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

a2:ab:93:be:71:e1:28:d5:c7:c0:87:3a:24:66:31:da:b0:d7:78:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-time-l1-1-0.pdb

api-ms-win-crt-utility-l1-1-0.dll

SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
MD5 70e9104e743069b573ca12a3cd87ec33
SHA1 4290755b6a49212b2e969200e7a088d1713b84a2
SHA512 e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9
SSDEEP 192:UfHQdurW1hWiSuDz7eCjdks/nGfe4pBjSYp2VZGW5RKTt3E2sVWQ4GWO3uDVqna9:UfVW1hWKDzDm0GftpBjYLm3Sy5lD16hC
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:29:f2:b0:ff:a2:cf:91:b1:6c:4e:69:19:d2:b2:7d:bb:36:1d:90:42:5c:d9:2e:5f:9b:17:27:0c:99:8b:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

f9:85:fe:cd:4a:c1:4c:f2:60:3c:23:21:01:f5:0d:02:73:c7:f3:f1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-utility-l1-1-0.pdb

avira.managed.remediation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aa29dbc7d98ed50bcc56b057f877b9e0dc1c38af62a87993576295da65a68967
MD5 cbfe8189d00825dc1ffbb123cd0d235a
SHA1 f1fcf30f996ad41fbf1564065437e2e45456e179
SHA512 5efd02f7770d611d12372096727b2d7839d1e101482fb1e7dd6dbc088b1aa3773d09613c8331e2d2c8e824c803130ba03f801065edb1950f93dc04af6b6a086c
SSDEEP 384:qNxFtMyMG0NPmP8NPHZKO2Lx4ZXK7I9ZgoW5X:0xPMyMvdNPHZgl7QRUX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

avira.managed.sdk.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8f875895c08f07bcb4816e5b5b52d1004ef0f26ffc81dc6a0f6dc43c5a77aaf7
MD5 6ecd66884c2033bea3db38a866538776
SHA1 23d1d5795e4f06c249527677f51a25084ad1da68
SHA512 ef95e273d70f08ebb6727ad027d0c890ac6f8f07aaf550b6efe04a11219e8c9bfbbf2fbf292545638d86051d7bd0545e4d5dcaa8b33c1e162aea0c13eb1ca160
SSDEEP 768:aTVGLzrueC2m9h0QnmgemjP4DkysZj3Mtd3zyY5CiIH:aTsLzxC2mrySy47MtFyP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

45070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

avira.managed.update.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f9b75353fdfc424eb57e438e49c247dfc111f1494319e2336086588ce47330
MD5 4e509553baec78324665c02e52632f0f
SHA1 460baa72abce39d6bf6341f410af02d0aef2c9fc
SHA512 5b8f5b94d158770eb39091d9d1a688b117431c092e7e22bdce5f8f5d54290d8b600a4c720fce673c8789bb68cf9a9bf2a430d8e75b3efe6d20022d511143f917
SSDEEP 384:0oG1uXYsh/QUZP9dM7EeulBEFhUjvCvnmikzCveXn8AObfSiHdXD:vGz8zZF0ulBEFhUj6/V12XWOIdT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

29150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bins/subinacl.exe

IMPHASH 2eaf7681cf60327cff49f2244e0aa8b4
SHA256 371cd9c35282843d572a3186975cc749e425fd4eeae1bb93a9b0cf20c22a9dc8
MD5 7bd591f56af173edc8ca01bd62df6eac
SHA1 43e88cd5cee3b9c66de428c84501d8660ea0586b
SHA512 b88d0c26a6f17d7b2d5483fc9a54002ea9fe26eabf10e5385ce4a13d81db5d7e8421d09bb5eaff453a6f5a210d547cf625fef74d209b2b5f0031621e9796366a
SSDEEP 3072:W856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOi:Z56+Aq4WBTWpSqXhpeEioU2UJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a3:06:29:c2:59:10:a9:3d:2f:3a:60:9f:38:a3:30:d5:8c:9e:a8:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

2

Major OS version

5

Entry point

254419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb

kernel32

WriteConsoleOutputW FormatMessageW CloseHandle GetLastError GetCurrentProcess GetCurrentThread GetConsoleScreenBufferInfo GetStdHandle SetLastError MultiByteToWideChar WriteFile WriteConsoleW SetConsoleTextAttribute GetProcAddress GetModuleHandleW LoadLibraryW GetFileInformationByHandle CreateFileW DeviceIoControl GetCompressedFileSizeW GetFileSizeEx GetComputerNameW WideCharToMultiByte OpenProcess GetFullPathNameW FindClose FindNextFileW FindFirstFileW ExitProcess ExpandEnvironmentStringsW GetCommandLineW SetConsoleCtrlHandler ReadFile GetLargestConsoleWindowSize GetModuleFileNameW FreeLibrary FileTimeToSystemTime FileTimeToLocalFileTime QueryDosDeviceW ReadConsoleW GetSystemTime GetTickCount SetConsoleActiveScreenBuffer LocalFree SystemTimeToFileTime SetConsoleScreenBufferSize CreateConsoleScreenBuffer QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter

mfc42u

ord861 ord800 ord540 ord535 ord3658 ord823 ord538 ord2836 ord825 ord2910 ord858 ord5446 ord6390 ord2099 ord5436 ord6379 ord4199 ord5679 ord4273 ord6279 ord6278 ord5706 ord1863 ord5826 ord3722 ord542 ord802 ord5597 ord6563 ord3898 ord2036 ord5830 ord2440 ord537 ord2756 ord2755 ord2810 ord940 ord925 ord922 ord941 ord942 ord924 ord536 ord4197 ord927 ord4124 ord4272

msvcrt

malloc wprintf _getch wcsstr _wcsicmp wcsncat sprintf wcschr _wtoi __RTDynamicCast iswprint printf _c_exit _exit wcsncmp swscanf wcsrchr towupper _purecall wcsncpy wcscmp fclose _wfopen _setmode fread fwrite fseek swprintf free __CxxFrameHandler _CxxThrowException _XcptFilter _cexit exit __winitenv __wgetmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 ??1type_info@@UAE@XZ ?terminate@@YAXXZ __dllonexit _onexit wcscpy wcslen wcscat _controlfp

msvcirt

??6ostream@@QAEAAV0@PBX@Z ?cout@@3Vostream_withassign@@A

msvcp60

?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ ??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z ??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ ?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z ??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ ?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ ??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ ?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A ?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z ??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ ??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z ??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ ??1_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A ??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z ??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z

advapi32

SetSecurityDescriptorGroup RegGetKeySecurity GetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorSacl SetSecurityDescriptorDacl GetAclInformation GetAce InitializeAcl AddAce RegConnectRegistryW SetNamedSecurityInfoW SetSecurityInfo EnumServicesStatusW OpenServiceW RegSetKeySecurity RegOpenKeyExW RegCreateKeyExW RegCloseKey MakeSelfRelativeSD GetSecurityDescriptorLength SetKernelObjectSecurity QueryUsersOnEncryptedFile QueryRecoveryAgentsOnEncryptedFile FreeEncryptionCertificateHashList ConvertSecurityDescriptorToStringSecurityDescriptorW EqualSid LookupPrivilegeValueW AdjustTokenPrivileges PrivilegeCheck LookupAccountSidW GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority OpenThreadToken OpenProcessToken SetSecurityDescriptorOwner GetSecurityInfo AddAccessAllowedAce InitializeSid GetKernelObjectSecurity GetSecurityDescriptorControl CopySid GetLengthSid GetSecurityDescriptorOwner GetSecurityDescriptorGroup AccessCheck MapGenericMask DeleteAce FreeSid EqualPrefixSid AllocateAndInitializeSid GetSecurityDescriptorSacl GetSecurityDescriptorDacl IsValidSid LookupAccountNameW ConvertSidToStringSidW RegEnumKeyExW RegQueryInfoKeyW OpenSCManagerW LogonUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LsaFreeMemory LsaClose LsaQueryInformationPolicy LsaOpenPolicy

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

netapi32

NetShareSetInfo NetApiBufferFree NetWkstaGetInfo NetGetAnyDCName NetServerGetInfo NetUserModalsGet

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum

winspool.drv

ClosePrinter EnumPrintersW GetPrinterW OpenPrinterW SetPrinterW

clusapi

CloseCluster CloseClusterResource ClusterCloseEnum ClusterResourceControl OpenClusterResource ClusterEnum ClusterOpenEnum OpenCluster

ole32

CoInitialize CoCreateInstanceEx

user32

wsprintfW

samlib

SamSetSecurityObject SamLookupNamesInDomain SamOpenUser SamOpenAlias SamOpenGroup SamOpenDomain SamCloseHandle SamEnumerateGroupsInDomain SamEnumerateUsersInDomain SamEnumerateAliasesInDomain SamFreeMemory SamConnect SamQuerySecurityObject

ntdll

RtlInitUnicodeString RtlNtStatusToDosError

shell32

CommandLineToArgvW

cachey-bashi.netcore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9be51e9fbffff4fcc7b6e50d214809f27dde875ad3c3b94961ce46c67cf253f1
MD5 4882fa6dc7bdb4591967d65dd08e0437
SHA1 4c9ea0e2b4c03bfc62d35adc3003d41c5c33839a
SHA512 eddeadd43369d5b03ebd4b6b98063f28e09f0895d4b42d4ab9e81e3adf3f098402449a6b95469bce9ffc228f74216bac066f90805510eb40fca44abdb6c6569a
SSDEEP 384:WshHZppWYoM/aCQFrS9D+gFOIdGqGedGPryhtp/C+XYHGqtsSMJE39PNj2oqIeYW:Ws9ZNoMiC4rQPdG1kkc/C+omqtO7IeYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

clrcompression.dll

IMPHASH 1dc31de28c38c94cf081a786f0ef0ce1
SHA256 bac1f0fd328051c956b95714b5498acd1be6707130be500a9188829a740a186f
MD5 6cd5a2b4d0a555bbb94858e64659111c
SHA1 b5ddcbd91bbe232cf7e7ba5dcf0b75e80dea41ef
SHA512 4a47fab547e185f022d90eaf6d587ad1bf78f248e5cd467081c957cfe2ae3ab1e451b2fa94cc076cb66e2753dba577f2489a1fca14f2075afa9dca371b623f61
SSDEEP 12288:vOCcyRJ25Yk2Bik2v3fF47gZ1DottjcEhTZ56AHhly88UXTw05nmZfRt8:vOzyRJ25Yk2Bik2v3fFCgTUnc6TP6AAa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bd:de:30:4b:8b:fe:43:ec:25:2f:08:d4:52:31:d9:b5:0b:6b:e4:73:09:47:2c:f4:c6:7f:62:f2:30:95:2c:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

248992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\native\netcoreapp-Windows_NT-Release-x86\clrcompression\Release\clrcompression.pdb

clretwrc.dll

SHA256 03a286bfc61bb4e6cef1cad40043bb9f161e5810b5ac56f81e6d0a7533f3d3e6
MD5 3a0d7de8c93cb55a2b694066d52908db
SHA1 9b54438352427d94fad53a0a8310a415d8b8d70b
SHA512 7f6b68347a445b114b2a358629c58c35e83c661733376e779d1453d481ebb0ffac6d697e7d2083b38182d67d48a1662cd2bd31480ab0dda350bd1cba5709f5eb
SSDEEP 1536:5NopyV7oPFArm7larFdZqRXqFn4Kn3EOF2wyOtfUDdFbz:Xonmrm78dZqRXqGKScfUDT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7a:86:b3:06:0a:72:3f:b5:c7:4e:e6:2c:b9:87:08:f2:d4:c0:65:04:d0:b8:ff:38:ad:fa:fe:6b:59:12:99:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\clretwrc\Release\clretwrc.pdb

clrjit.dll

IMPHASH a0aa19c8566cbd21b4879ca7daf0d648
SHA256 520ef22ad5cdc40025f8964d0cefb39b0c88cec4e0f7d49863f004887adecc95
MD5 a873ebf8b135192456bb47edffa641c9
SHA1 533375c44d5f0ed5a194975817972ca5e2e646ab
SHA512 c8a46a050530287451101ebe89b2ee4149d3d3402127c78be5b201d8a66c1b2c3adbdf33f7fc866008e8d4920a24635719baa1c172c84089afeb8019c76c8f17
SSDEEP 24576:9FyE2xhxLypEes7c8cEoxqjzmwAgoJvFLpFWwp77svVJWS0o8Iy4r:9FyX7esxcEyqj6Vd74vVJ7y4r
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c7:8c:5f:3a:99:97:29:24:39:17:65:43:ba:41:6e:43:e3:e3:b1:be:29:6d:20:46:ad:9b:03:ff:54:89:51:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

683504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\jit\standalone\Release\clrjit.pdb

kernel32

TlsFree TlsSetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW CloseHandle SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate GetACP MultiByteToWideChar FormatMessageW LocalFree SetLastError GetCurrentThreadId GetSystemTimeAsFileTime FreeLibrary GetProcAddress GetCurrentProcess TlsGetValue GetFullPathNameW LoadLibraryExW TerminateProcess IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc GetLastError GetCurrentThread QueryThreadCycleTime HeapFree HeapAlloc GetProcessHeap QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte OutputDebugStringA DebugBreak RaiseException DisableThreadLibraryCalls

oleaut32

SetErrorInfo

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

_libm_sse2_cos_precise _fdopen _libm_sse2_sin_precise _libm_sse2_sqrt_precise ceil floor _except1 _isnan _CIfmod _finite _copysign

api-ms-win-crt-stdio-l1-1-0

_setmode _fileno _dup __acrt_iob_func setvbuf _wfopen fseek fclose __stdio_common_vsnwprintf_s ftell __stdio_common_vfprintf __stdio_common_vsnprintf_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm _errno _cexit terminate _initterm_e abort _execute_onexit_table

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscpy_s strcpy_s strcat_s strncmp wcsncmp

api-ms-win-crt-heap-l1-1-0

free calloc malloc

coreclr.dll

IMPHASH 67af7c652fb00d16aa20d360e9e2cfa8
SHA256 d8877ba978e5ffb733026d15fc6e7b60862c8c43ad04ca3e5b663b6dcc7dd6bc
MD5 fdb0d51a8c7ad31a75001ec87efc2039
SHA1 264a5dd57656841987f6f73d2b15290340049ad5
SHA512 590d8d45c59cd42ba0d0be068baf5d339228f6ff38f7282909679f3a2ea3f25f5110c072276888c986f020bbddeef48b69917900e7c94bcaa22bc3d0d6c978c1
SSDEEP 98304:HpgECqGbaRzV9hf/qHzhSDru9FuBkCRpYwovo8NjlZefX2:HpgEpGmBUHzmuLykCslo8N5Z02
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

26:4d:32:55:1d:c9:2e:da:a7:fb:25:2a:c0:ca:b1:a1:f6:40:74:67:33:72:8e:20:2c:85:1d:5d:db:05:28:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

1019312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb

kernel32

WideCharToMultiByte FormatMessageW LocalFree GetCurrentThreadId GetSystemTimeAsFileTime RaiseException FreeLibrary GetCurrentProcessId OutputDebugStringW IsDebuggerPresent GetProcAddress DebugBreak RaiseFailFastException CloseHandle GetSystemInfo VirtualAllocExNuma GetNumaProcessorNodeEx GetNumaHighestNodeNumber SetThreadGroupAffinity GetSystemTimes GetProcessAffinityMask GetCurrentProcess SwitchToThread FlushInstructionCache GetCurrentThread VerSetConditionMask VerifyVersionInfoW TerminateProcess IsWow64Process GetEnvironmentStringsW FreeEnvironmentStringsW SetErrorMode CreateProcessW GetCPInfo WaitForSingleObject CreateFileMappingW GetFileSize GlobalMemoryStatusEx HeapAlloc GetProcessHeap HeapFree ReleaseMutex SetEvent ReleaseSemaphore WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateSemaphoreExW OpenProcess GetModuleHandleW GetTickCount SetConsoleCtrlHandler CreateThread GetTickCount64 GetLocaleInfoEx GetUserDefaultLocaleName InterlockedPushEntrySList VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SleepEx GetThreadContext SuspendThread ResumeThread SetThreadContext GetEnabledXStateFeatures InitializeContext Sleep CopyContext SetXStateFeaturesMask FlushProcessWriteBuffers LCMapStringEx QueryPerformanceCounter DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc SignalObjectAndWait SetThreadStackGuarantee ResetEvent CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExW SetFilePointer ReadFile GetCommandLineW GetProcessTimes WriteFile InterlockedPopEntrySList UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer GetStdHandle GetConsoleOutputCP GetLogicalProcessorInformation MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateMemoryResourceNotification GetActiveProcessorGroupCount GetActiveProcessorCount InitializeSListHead InterlockedFlushSList ExitProcess TlsGetValue RtlUnwind GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcessorNumber ReadProcessMemory OutputDebugStringA SetEnvironmentVariableW GetCurrentProcessorNumberEx SetThreadIdealProcessorEx GetThreadIdealProcessorEx GetLargePageMinimum VirtualUnlock ResetWriteWatch GetWriteWatch SetThreadAffinityMask IsProcessInJob QueryInformationJobObject GetSystemTime MapViewOfFile FlushFileBuffers TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetLocalTime GetTimeFormatW GetDateFormatW IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount EncodePointer TlsFree GetACP GetFullPathNameW GetEnvironmentVariableW GetCurrentDirectoryW GetModuleFileNameW CreateDirectoryW GetFileAttributesExW GetFileAttributesW IsDBCSLeadByte LoadLibraryW OpenEventW ExitThread HeapReAlloc CreateNamedPipeA DisconnectNamedPipe ConnectNamedPipe CreateFileW LoadLibraryExW SetLastError LoadLibraryExA MultiByteToWideChar QueryPerformanceFrequency GetLastError

advapi32

SetKernelObjectSecurity AdjustTokenPrivileges LookupPrivilegeValueW EventRegister EventWriteTransfer EventWrite RegEnumValueW DeregisterEventSource ReportEventW RegisterEventSourceW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken SetThreadToken RevertToSelf OpenThreadToken RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoCreateGuid CreateStreamOnHGlobal CoGetClassObject CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoGetContextToken CoGetObjectContext StringFromGUID2 CoReleaseMarshalData CLSIDFromProgID IIDFromString CoTaskMemFree CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemAlloc CoCreateFreeThreadedMarshaler

oleaut32

VariantInit SysAllocStringByteLen SysStringByteLen SetErrorInfo LoadRegTypeLi SysAllocString GetErrorInfo SysFreeString SysStringLen SysAllocStringLen QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx SafeArrayDestroy SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound VariantClear CreateErrorInfo VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SafeArrayGetRecordInfo

user32

LoadStringW

shlwapi

PathFindFileNameW

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGetProperty

api-ms-win-crt-string-l1-1-0

strcat_s strcmp strlen strcpy_s strnlen _strnicmp strncpy_s wcsncpy_s _wcsicmp isalpha wcsncmp isdigit strncmp towlower wcscat_s wcsnlen _stricmp iswspace strncat_s wcsncat_s iswascii iswupper wcsncpy wcscpy_s _strdup towupper

api-ms-win-crt-stdio-l1-1-0

_flushall _putws __stdio_common_vswprintf_s __stdio_common_vfwprintf __stdio_common_vswscanf __stdio_common_vsprintf_s _wfopen fputs fclose _wfopen_s fflush __acrt_iob_func __stdio_common_vsnwprintf_s fopen fwrite __stdio_common_vsnprintf_s __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initialize_narrow_environment _errno _configure_narrow_argv _initterm_e _initterm _crt_atexit _cexit terminate _invalid_parameter_noinfo abort _controlfp_s _execute_onexit_table _register_onexit_function

api-ms-win-crt-convert-l1-1-0

atoi _wtoi atol strtoul _wcstoui64 wcstoul _ltow_s _itow_s

api-ms-win-crt-utility-l1-1-0

bsearch ldiv qsort

api-ms-win-crt-math-l1-1-0

_libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _CItanh __libm_sse2_acos __libm_sse2_asin _libm_sse2_tan_precise _except1 ceil floor __libm_sse2_atan _libm_sse2_acos_precise __libm_sse2_sin __libm_sse2_pow _CIsinh _CIfmod _CIatan2 _CIcosh _libm_sse2_sqrt_precise asinh __libm_sse2_atan2 cbrt ilogb acosh scalbn fma atanh log2 log2f scalbnf acoshf cbrtf __libm_sse2_cos atanhf modf _copysign ilogbf fmaf asinhf _isnan __libm_sse2_exp __libm_sse2_log __libm_sse2_tan __libm_sse2_log10

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-heap-l1-1-0

calloc free malloc

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

65B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

645KB

Virtual Size

645KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dbgshim.dll

IMPHASH 00f465c788682fb5c56632d6cd17ef2f
SHA256 23d45e43b4e54b12dc7f8029ae785e6a2a666e94b0b749c878502cd89ce4b50d
MD5 25527d0dc8c76052d6af0062809b19db
SHA1 9743537cf72993b29cc01e98c535b01e3448707d
SHA512 b8e596d004b40122eafbc0425383fda061b5c27c892260631bb77aeb79b25316b86ca57c443d3c0494484ce3ed0329882588a418e0773559a06a2a2566a7041a
SSDEEP 1536:sAlEPSl7UXlsxueJNcyjqCIW4gHyStZi1IXgO41muCQutLn38qdxv5MRNe7H04d2:sWwU7I04m3ZXwMV3L5MPeo4dx4SKBFx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9b:e4:9d:33:94:09:24:44:9d:33:19:3e:95:61:41:6d:2d:54:72:78:56:f8:8e:db:d2:d0:19:11:0d:8e:6d:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

53776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\dbgshim\Release\dbgshim.pdb

kernel32

HeapAlloc HeapFree RaiseException GetACP LCMapStringEx MultiByteToWideChar IsDBCSLeadByte FormatMessageW LocalFree SetLastError LoadLibraryExW CreateFileW GetEnvironmentVariableW GetFullPathNameW GetSystemTimeAsFileTime TlsGetValue TlsAlloc TlsFree TlsSetValue InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ResetEvent GetProcessHeap CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate GetSystemInfo TerminateProcess IsDebuggerPresent EncodePointer InterlockedFlushSList LoadLibraryW MapViewOfFile CreateFileMappingW K32EnumProcessModules FreeLibrary CreateProcessW GetCurrentProcessId ReadProcessMemory GetFileSize GetProcAddress CreateThread CloseHandle SetEvent GetLastError Sleep ProcessIdToSessionId CreateEventW OpenProcess DuplicateHandle UnmapViewOfFile ResumeThread OpenEventW GetCurrentThreadId WaitForSingleObject K32GetModuleFileNameExW WaitForSingleObjectEx GetCurrentProcess RtlUnwind InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount

user32

LoadStringW

advapi32

CopySid RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorSacl GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid

ole32

CoTaskMemFree

oleaut32

SetErrorInfo

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscat_s strncmp wcsncmp strcpy_s wcsncpy_s wcscpy_s _stricmp

api-ms-win-crt-runtime-l1-1-0

terminate _cexit abort _errno _execute_onexit_table _initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free calloc malloc

api-ms-win-crt-convert-l1-1-0

wcstoul

driver/amd64/LICENSE.txt

SHA256 fa8e8f02f81de56cbf470b91de1f6fa69c3b39a996c6e1f057df6212324cc564
MD5 747025499b4a05d19a0e3431c634cdc0
SHA1 c93725625c81fef7ff8663bdc5d5df501a3586a4
SHA512 2b4eb9ef2ef7dd28fa0b30f268c1ed53130ad79686a1f785ccaa925a3015eb1617fde45ffe14068a08ac2ceea34579aa07f0199da57ca057783d193759bf8b49
SSDEEP 384:Pq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0lx2:PzuVLiY+rTZo0lx2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/amd64/OemWin2k.inf

SHA256 a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707
MD5 b6aada0cbed06889053a05b66f146979
SHA1 823025f02b355b37df7d7657b0f2b4d3584891a5
SHA512 9f8a6b0ad5ae4ea4c14043d663fd5aca2f1884ece0975b13c0533eb93103eb89120c1884121d71c8f9d09f5d210926fdba3b29fc6cf87f601bbc0f359c31d4ad
SSDEEP 192:nr8tW9yCTi394vlQdqKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGZdUWo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/amd64/devcon.exe

IMPHASH ce4a5cfcfb0452b87e013f07f4d59f9c
SHA256 118e04049f21d272c8005e1e746248a4654b305a41b29e5c735231d2b83bbaa6
MD5 9ab7634bb81f326d489e453c358ae8ea
SHA1 5ea9dfa805f1ae952cb3b66712126ac9c3c985c0
SHA512 c90ab0182709cbf9ea2ba58565fcc6c72b52bc500b5f16a7eba1f107350550725f0ba40bf64102e9e0c8fdc347e0833f67a8bfe4779b3654d0e7d42f7b8bb74d
SSDEEP 1536:EP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WO:EePOYe4bu1epDh8RWO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

3f:4a:34:d7:f1:29:71:aa:cf:ff:c3:17:27:f4:15:7d:33:16:41:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

29456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

devcon.pdb

advapi32

OpenProcessToken RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges InitiateSystemShutdownExW RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW RegDeleteValueW RegSetValueExW

kernel32

GetCurrentProcess FormatMessageW lstrlenW GetLastError CloseHandle LocalFree GetDateFormatW FreeLibrary LoadLibraryW FileTimeToSystemTime GetProcAddress GetFullPathNameW FindFirstFileW GetFileAttributesW FindClose FindNextFileW GetWindowsDirectoryW Sleep TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter

msvcrt

wcschr _wcsicmp towlower _wcsnicmp fputs __iob_func wcsrchr fputws ?terminate@@YAXXZ memset __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __C_specific_handler __wgetmainargs wprintf ??2@YAPEAX_K@Z towupper ??3@YAXPEAX@Z iswalpha

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ole32

CLSIDFromString

setupapi

SetupScanFileQueueW SetupDiGetClassDevsExW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiClassNameFromGuidExW CM_Reenumerate_DevNode_Ex SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyW SetupDiGetINFClassW CM_Disconnect_Machine SetupDiBuildClassInfoListExW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Get_DevNode_Status_Ex SetupDiBuildDriverInfoList SetupDiGetDeviceInstallParamsW SetupDiOpenDevRegKey SetupDiSetSelectedDriverW SetupGetStringFieldW CM_Get_Res_Des_Data_Size_Ex SetupDiEnumDriverInfoW CM_Free_Log_Conf_Handle CM_Get_Device_ID_ExW CM_Get_Next_Res_Des_Ex SetupCloseFileQueue SetupDiGetDriverInstallParamsW CM_Get_Res_Des_Data_Ex SetupDiOpenClassRegKeyExW SetupCloseInfFile SetupOpenFileQueue SetupDiCallClassInstaller SetupDiDestroyDriverInfoList SetupOpenInfFileW CM_Free_Res_Des_Handle CM_Get_First_Log_Conf_Ex SetupDiSetDeviceInstallParamsW SetupFindFirstLineW SetupDiGetDriverInfoDetailW SetupDiGetClassDescriptionExW SetupDiClassGuidsFromNameExW SetupDiOpenDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoListExW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

user32

CharNextW CharPrevW LoadStringW

driver/amd64/tap0901.cat

SHA256 b8913d43b03ecf24f466b7bd5046b0c35ec9c43620d10ce3d5dd6538356a85a8
MD5 e0762d9f662614cdc930e211884e9443
SHA1 8016a500b268f2263aa26996f92cad4a9bfe153d
SHA512 618fbf5488f2eeba35b46e4eeabb901b40be20bd9447d49920ad22a9adb23d6dd366556430e24005543bd2ee501848ff7b24bcebf7b15b8ee8543091b73bb449
SSDEEP 192:JLdBt9jnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJ8y4r:rhjnYPL+StZsZZvjJ8P
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/amd64/tap0901.sys

IMPHASH 741e65dbed0bdb03af558a33e0336da1
SHA256 89cb62e73fbd0500a8b811a632602c504753777313d7e424cca68f1619b55211
MD5 54cb62322b7b1210cb317c4462691b10
SHA1 728cccf1e337641cfe06df85aaa667270c2f540f
SHA512 b9dec2e015659ccd9683ef504f6a912f55e41e87d0d9c698670b1b2db358a1f4997fcc112cf04e850d7b226582a3d234b57ad68b4afd9cff9c9df63b5f2c08fd
SSDEEP 768:JIOPCr6ghD8JTbddDChKSfl4FUFqa0XFC1bRbq0FlCbxG95ux7hqiyc:acCr6gYTb/DoBfi60a0XFC1UP+5ux7jV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

68:e4:62:d0:04:58:56:db:19:4b:bd:8b:f5:13:6c:ca:bf:05:ed:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

41520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samuli\tap-windows-github\src\amd64\tap0901.pdb

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

60B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

driver/i386/LICENSE.txt

SHA256 fa8e8f02f81de56cbf470b91de1f6fa69c3b39a996c6e1f057df6212324cc564
MD5 747025499b4a05d19a0e3431c634cdc0
SHA1 c93725625c81fef7ff8663bdc5d5df501a3586a4
SHA512 2b4eb9ef2ef7dd28fa0b30f268c1ed53130ad79686a1f785ccaa925a3015eb1617fde45ffe14068a08ac2ceea34579aa07f0199da57ca057783d193759bf8b49
SSDEEP 384:Pq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0lx2:PzuVLiY+rTZo0lx2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/i386/OemWin2k.inf

SHA256 8892d224ae879cc35ffe216691fc6ba3266d88b6239838f7d38b3a4ff4ad74b6
MD5 35589b966c65a52a1c95791bbcd80543
SHA1 d65994dd38de0e1971f8c99a048c46acc284e8bf
SHA512 ece01e898527ae2ce3039457ea1823bda6351871900c1a7a20057ff3250e33ed8ed216af3318edaa1c3825c17d348dee06078e946d10332e87af8ec45795fd5f
SSDEEP 192:nr8tW9yCTi394vlFKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGcWo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/i386/devcon.exe

IMPHASH 4a8b1b3af5ed6b972156a2972693a918
SHA256 f228844f92969a6c88ec6b9168815c259881f436f3188f9b038eb0b1dce08bbf
MD5 d0006c3ec1f8b894e41667355b088448
SHA1 8c478cd72bd52bec1283fed9186a9d07a58a084c
SHA512 85424d30cd0607cae58ec1b9053ba6b2f087e148ad6ba029ddcabc4ff33fc97d3a6dddb0f49e5a39cfbe011ae2f9b165ba0490ed9365f081afdf4ab0c15b3c4d
SSDEEP 768:ggEuhGUsQ9Z7lVQpjagwpKsQt2IJU1evxHs4gZWkbqc:t1/9ZisQtBU4xHeWY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4d:32:a9:b6:bc:ff:ee:65:9b:b0:12:c5:5f:79:50:25:94:1b:f0:55

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

2

Major OS version

5

Entry point

21009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress LoadLibraryW GetFileAttributesW GetFullPathNameW TerminateProcess GetModuleHandleA FreeLibrary GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime lstrcpynW FileTimeToSystemTime GetDateFormatW lstrcpyW lstrlenW GetLastError GetCurrentProcess CloseHandle LocalFree FormatMessageW QueryPerformanceCounter

msvcrt

fputws fputs _iob ??3@YAXPAX@Z ??2@YAPAXI@Z wcschr towlower towupper iswalpha _wcsnicmp _wcsicmp _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __wgetmainargs __winitenv exit _cexit _XcptFilter _exit _c_exit wcscmp wprintf wcsrchr

advapi32

OpenProcessToken LookupPrivilegeValueW RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW CloseServiceHandle OpenServiceW OpenSCManagerW AdjustTokenPrivileges

setupapi

SetupDiClassGuidsFromNameExW CM_Free_Log_Conf_Handle CM_Get_Next_Res_Des_Ex CM_Free_Res_Des_Handle CM_Get_Res_Des_Data_Size_Ex CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex CM_Disconnect_Machine SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiBuildClassInfoListExW SetupDiClassNameFromGuidExW SetupDiGetClassDescriptionExW SetupDiOpenClassRegKeyExW SetupDiGetDriverInstallParamsW SetupDiSetSelectedDriverW SetupOpenFileQueue SetupDiCallClassInstaller SetupScanFileQueueW SetupCloseFileQueue SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_ID_ExW SetupDiGetDeviceInfoListDetailW SetupDiOpenDeviceInfoW SetupDiGetClassDevsExW SetupDiCreateDeviceInfoListExW CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex CM_Get_First_Log_Conf_Ex

user32

ExitWindowsEx CharNextW LoadStringW CharPrevW

driver/i386/tap0901.cat

SHA256 825cc3efc86cd13fa1bda7d0413d5ca8b208c3a18834ef02637834352ef386fc
MD5 7f49202c5a71e1dd7c85923a5dd45764
SHA1 7e8c115faad3ab2cc53ecfc05cf09e8eabfbffa6
SHA512 62497068c4ed428772ac6236c1383540cf7c48a7ee20b06e0b0e873c51fe69718969ab218f953001403d2e2170e7f29cd84947722e15f55985863a2e79d66d63
SSDEEP 192:XPC9NdKnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJqTqnG:fgKnYPL+StZsZZvjJMqG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

driver/i386/tap0901.sys

IMPHASH 7bc0e747b3ccfdebdacc897735028b04
SHA256 c43a60e16a011622a963cb93264c7e1365a10fce8c43d5c4fad895880af4dd91
MD5 a23d03a5eb0b221bcd33d98ff30e4dbf
SHA1 9da49918647cf25bcae9538ebf60833d0a3488ea
SHA512 77e9c8e1cd4d7670a9439d006f45ddebb62a33ab4aa7999cf9a0536bd9ae860a0d1a2c7ff50f5e0e50345b7c64619761fa545d10657b6f8fcc31db6d593aea41
SSDEEP 384:lfMsa/mI7L1ypn49O1U1dLn3kDPQXDg8rvfCVUR4KYRGcdq3zhZPvZDsr3549F4o:l09UUPL3sQXDg6iiWA3LZem4L9qDEI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6e:03:12:b3:2a:4f:df:48:c0:cc:8f:e1:86:58:a2:d0:73:7c:c2:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Chains

Oct 19, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK

Serial Number

0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 13, 2014 - Jul 19, 2017

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Minor OS version

1

Major OS version

6

Entry point

22495

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Samuli\tap-windows-github\src\i386\tap0901.pdb

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

896B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

994B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e_sqlite3.dll

IMPHASH 3c733b5675643aad72c3f03ebfb1a5b6
SHA256 9877f703ce3fb9669d656d24726159b616b2df25522225bf41bfafe89954c58a
MD5 1aa2fb5e420379a7a50cd650232c6a08
SHA1 e9bb12599f60032a160a00a04203bd73680940cd
SHA512 f908c146cc7299815424debe4d40643864ce442eb30adf148ce05dc2f48e8a9db0697943af55b1c5260f5341ebce57cd804a7b19e71b66510bac085a3f800a59
SSDEEP 24576:FNtiWRtuKKPAq5NY6VxFKolweGUbqf9CTfO3eo2:FNttRtuKQ/V7cejNpo2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

797392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo CloseHandle HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetTimeZoneInformation CompareStringW LCMapStringW DecodePointer FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle GetFileType GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_pointer sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_create_window_function sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_fts3_may_be_corrupt sqlite3_fts5_may_be_corrupt sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_key sqlite3_key_v2 sqlite3_keyword_check sqlite3_keyword_count sqlite3_keyword_name sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare16_v3 sqlite3_prepare_v2 sqlite3_prepare_v3 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_pointer sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_set_last_insert_rowid sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_isexplain sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_str_append sqlite3_str_appendall sqlite3_str_appendchar sqlite3_str_appendf sqlite3_str_errcode sqlite3_str_finish sqlite3_str_length sqlite3_str_new sqlite3_str_reset sqlite3_str_value sqlite3_str_vappendf sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_dup sqlite3_value_free sqlite3_value_frombind sqlite3_value_int sqlite3_value_int64 sqlite3_value_nochange sqlite3_value_numeric_type sqlite3_value_pointer sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_collation sqlite3_vtab_config sqlite3_vtab_nochange sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_set_directory sqlite3_win32_set_directory16 sqlite3_win32_set_directory8 sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug

hostfxr.dll

IMPHASH a667f7519ae9b5f0c5661223222badfa
SHA256 26ed6778f4d368df211d035b548fa9b3d22976def5055d33c0f2a2d7086ed54a
MD5 36e668a570def150bc37c64bcc824af5
SHA1 c475d9bbfbf8e71197c06d86515cb84d06be0ff8
SHA512 cf728f060688cc2a19186f029ecbe2f11c68dc56ed12e2759af0b21a74ef69d1a6f40d777efed4eb32b581acdee5bd5c668339c928556987dbf1cdb2533143db
SSDEEP 6144:+2Iga52hQloNLV11Tt24BqxDPr9VQRQawQ57rEnInqb3huPLCYbNX7jrSxgU:bI+hQloxE+Qa97AnR3hMLCYb9SOU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ab:06:dd:58:aa:47:9d:2c:4a:a9:37:f5:73:26:18:82:88:c0:13:3b:4d:b0:64:d2:44:21:4f:98:c8:72:ce:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

225328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdb

kernel32

GetCurrentDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError InitializeCriticalSection GetEnvironmentVariableW LeaveCriticalSection DeleteCriticalSection GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary OutputDebugStringW EnterCriticalSection TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList RtlUnwind RaiseException InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime QueryPerformanceCounter LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetCurrentThreadId TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitOnceComplete InitOnceBeginInitialize FormatMessageA LocalFree GetStringTypeW

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _initialize_narrow_environment _configure_narrow_argv _errno _crt_atexit _initterm_e _cexit abort _execute_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _initterm _initialize_onexit_table terminate

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc calloc

api-ms-win-crt-stdio-l1-1-0

_fseeki64 ungetc fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers fsetpos fwrite __stdio_common_vsnprintf_s __stdio_common_vswprintf_s __acrt_iob_func fputwc fputws _wfopen __stdio_common_vfwprintf __stdio_common_vswprintf _wfsopen fseek __stdio_common_vsprintf_s setvbuf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

_wcsdup isupper memset __strncnt strcspn iswspace _isctype_l wcsnlen strnlen wcsncmp _wcsnicmp towlower strcpy_s islower _wcsicmp

api-ms-win-crt-math-l1-1-0

ceil frexp

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func ___lc_locale_name_func _free_locale ___lc_codepage_func setlocale localeconv _lock_locales _unlock_locales __pctype_func _create_locale

api-ms-win-crt-convert-l1-1-0

_i64toa_s _ui64toa_s _i64tow_s _strtod_l wcstoul _wtoi _ui64tow_s

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64 _time64

hostpolicy.dll

IMPHASH e459434b524faf87b6a14cf00c22215b
SHA256 1f81009336fed33b50bf187d70a16929f4d1b4f78b4d1e16bbbf7f6a87ec5bb1
MD5 862514252dc75f2275445ca4798eea1f
SHA1 6241c1ef41b521a7766a87732382e0c940c96dee
SHA512 b070c5a4d4d649da59df88ef0030f74a7e1096da21f27fccb72d3027e7b9cc87193fde695b32419982249b8e7fce7d5fea679a6c085a4605a09bfdd976a26a7d
SSDEEP 6144:YYDZt7+PjyNcLRAToe+rshxF7c7W656McOUvdgaROgjNojQ66O6hom0b+NQG/:zt5NcLRAToe+rshxFO56VM6Dh2s/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e4:4f:0c:b9:97:16:18:93:3a:70:8e:fb:7e:50:ed:82:0e:17:eb:43:fc:f1:a9:fe:5c:2d:e2:a7:4a:5a:55:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

220208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb

kernel32

CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError InitializeCriticalSection GetEnvironmentVariableW LeaveCriticalSection DeleteCriticalSection GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte FreeLibrary OutputDebugStringW EnterCriticalSection TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedFlushSList RtlUnwind RaiseException InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime QueryPerformanceCounter InitOnceComplete InitOnceBeginInitialize LocalFree SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStringTypeW FormatMessageA TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _execute_onexit_table _register_onexit_function _crt_atexit abort _cexit _errno _initialize_narrow_environment terminate _beginthreadex _configure_narrow_argv _initterm _initterm_e _seh_filter_dll _initialize_onexit_table

api-ms-win-crt-math-l1-1-0

ceil frexp

api-ms-win-crt-string-l1-1-0

isupper memset _wcsicmp __strncnt strcspn iswspace _isctype_l _wcsdup strnlen wcsncmp _wcsnicmp towlower strcpy_s wcsnlen islower

api-ms-win-crt-heap-l1-1-0

calloc _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

fputc fflush fclose _get_stream_buffer_pointers fread fsetpos _fseeki64 fwrite setvbuf ungetc __stdio_common_vsprintf_s __stdio_common_vsnprintf_s __stdio_common_vswprintf_s __acrt_iob_func fputwc fputws _wfopen __stdio_common_vfwprintf __stdio_common_vswprintf fgetpos fseek _wfsopen fgetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _lock_locales _free_locale _create_locale setlocale __pctype_func localeconv ___lc_locale_name_func _unlock_locales ___mb_cur_max_func

api-ms-win-crt-convert-l1-1-0

_ui64toa_s _ui64tow_s _i64toa_s _strtod_l _i64tow_s wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64 _time64

installoptions.jdat

SHA256 dd723d37ef9d85b28d2183484b7fc1acef76e7113719ecb9b74c0791e57de6be
MD5 dd3ae3168a12ad7f0dc03648dc46eb7a
SHA1 86d9b32fbd9b77a7b9c80f9d53be88799aaf0bfc
SHA512 833a10f34cbb5fa2209b4dd55c72fe46c8d82ad6652bfd3574dff4f00ade746f172aaa0ecf8c6e5926785d240c1bd50882521a4e4ea973d50dab6b1a5072840f
MD5 SHA1 SHA512

NSIS installer

installer

lib_SCAPI.dll

IMPHASH 916a383506048c69ca2577373c760d2b
SHA256 3383e176c42695fd3cabc06f1c92b7a4cbf9ade4c36d42f16831d7543d29eaa0
MD5 67ac86c8db324014c5d7f7c5079eb71a
SHA1 d45583d43d21c2b8e88ed5ed73464fdd27597092
SHA512 43385d78aab5cae15c9c55211e5db821fb0fec14ffda0d11c0c2344d9ab2b1174098389b2a716b7f8fa99784f7e4717fd9b16efc821cdeff87c059af6b445875
SSDEEP 6144:JwLwULisgBW4p3DqsjuvA+BIAOVrIIqU2:JwjxGW4p3DKIfDq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

ae:87:23:8d:29:7a:73:7d:47:3a:33:ad:95:a8:61:11:63:c5:b4:b6:ef:94:39:2b:82:19:6b:16:41:d5:9d:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

31025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\lib_SCAPI.pdb

wintrust

CryptCATAdminAddCatalog CryptCATAdminReleaseContext CryptCATAdminAcquireContext

kernel32

HeapFree InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc ReadConsoleW DeleteCriticalSection GetProcessHeap LoadLibraryW GetProcAddress SetFilePointerEx GetFileSizeEx ReadFile SetStdHandle CreateFileW DecodePointer MultiByteToWideChar GetConsoleMode GetConsoleOutputCP IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CloseHandle InitializeCriticalSectionAndSpinCount CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EncodePointer WriteConsoleW LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers WriteFile

advapi32

ChangeServiceConfig2W OpenServiceW OpenSCManagerW CloseServiceHandle

ole32

CoCreateInstance

lib_SCAPISharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a6481730bec2bf9450871047ca5d7aaead6cf9d4cb8214e6b5cebeec3b0be720
MD5 56f01e42355773c2fac468357d0ee1d3
SHA1 862b68c388ee0aff853f8997ffd3e88e1b5597be
SHA512 2860f254c37cd2343bc95a9d0d3c5205e901f13391e70b7992a89623fc4555ac016f22fa2c616fa3ee3148d4ab86b1e07cd851df98290cb370d2b21992e794e1
SSDEEP 384:ZJYKB/NQHizcYdNKs9IUntTq9Q9vZzHoNZsHL0YAM+o/8E9VF0NyzBS:Z60/SHizcYHK6PtbnVXAMxkEy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b5:5e:69:21:c6:20:32:f3:fa:e5:f1:1b:d8:32:42:f8:72:7d:63:08:cf:20:2d:79:a5:1f:71:fe:50:08:e6:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

18062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libcrypto-1_1.dll

IMPHASH 840d1b19809c82962b8c90c5984d27e8
SHA256 34f14e8ac45755105a464dc4e93014c1e9778cd88e57463df8cf83f0db820411
MD5 f77ebf3bb87a6b7e6fc52071609cd88e
SHA1 d41ce9a2f1dc351ac0adcb45030a86043dc79128
SHA512 e043669989e28c4b7179e765bd65ae25a16d71bb76467faf812ff7078b228b676e16d64b6dfebb480f78e2a131b6cbbc8715a7cafa2bed5c7863ec5835c9ddf2
SSDEEP 49152:RqLV4BJ3u/v45t9XVM1CPwDv3uFZjkQSHE:sLVwJeo5t9Xa1CPwDv3uFZjk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

1772622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libcrypto-1_1.pdb

ws2_32

getaddrinfo listen sendto recvfrom WSASetLastError send recv shutdown socket setsockopt ntohs connect closesocket bind accept WSAGetLastError WSACleanup WSAStartup gethostbyname getsockopt getsockname ioctlsocket getnameinfo freeaddrinfo

advapi32

CryptCreateHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

SetFileAttributesW GetModuleFileNameA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW OutputDebugStringW SetEnvironmentVariableA GetTimeZoneInformation SetEndOfFile GetFullPathNameA GetFileAttributesExW GetCurrentThreadId RtlUnwind HeapSize LoadLibraryExW GetModuleFileNameW GetProcessHeap GetDriveTypeW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber FormatMessageW GetSystemTime SystemTimeToFileTime GetLastError SetLastError GetStdHandle GetEnvironmentVariableW GetFileType WriteFile GetVersion GetModuleHandleW GetProcAddress MultiByteToWideChar CloseHandle FreeLibrary LoadLibraryA LoadLibraryW GetModuleHandleExW FindClose FindFirstFileW FindNextFileW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedExchangeAdd InterlockedCompareExchange TlsAlloc TlsGetValue TlsSetValue TlsFree GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetCurrentProcess TerminateProcess IsDebuggerPresent IsProcessorFeaturePresent ReadFile InterlockedExchange HeapFree HeapAlloc EncodePointer DecodePointer InterlockedDecrement ExitProcess AreFileApisANSI SetConsoleCtrlHandler HeapReAlloc FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe FileTimeToSystemTime GetCommandLineA GetConsoleCP InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateSemaphoreW FatalAppExitA Sleep SetStdHandle FlushFileBuffers SetFilePointer SetFilePointerEx FindFirstFileExW

ACCESS_DESCRIPTION_free ACCESS_DESCRIPTION_it ACCESS_DESCRIPTION_new ADMISSIONS_free ADMISSIONS_get0_admissionAuthority ADMISSIONS_get0_namingAuthority ADMISSIONS_get0_professionInfos ADMISSIONS_it ADMISSIONS_new ADMISSIONS_set0_admissionAuthority ADMISSIONS_set0_namingAuthority ADMISSIONS_set0_professionInfos ADMISSION_SYNTAX_free ADMISSION_SYNTAX_get0_admissionAuthority ADMISSION_SYNTAX_get0_contentsOfAdmissions ADMISSION_SYNTAX_it ADMISSION_SYNTAX_new ADMISSION_SYNTAX_set0_admissionAuthority ADMISSION_SYNTAX_set0_contentsOfAdmissions AES_bi_ige_encrypt AES_cbc_encrypt AES_cfb128_encrypt AES_cfb1_encrypt AES_cfb8_encrypt AES_decrypt AES_ecb_encrypt AES_encrypt AES_ige_encrypt AES_ofb128_encrypt AES_options AES_set_decrypt_key AES_set_encrypt_key AES_unwrap_key AES_wrap_key ASIdOrRange_free ASIdOrRange_it ASIdOrRange_new ASIdentifierChoice_free ASIdentifierChoice_it ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_it ASIdentifiers_new ASN1_ANY_it ASN1_BIT_STRING_check ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_BIT_STRING_it ASN1_BIT_STRING_name_print ASN1_BIT_STRING_new ASN1_BIT_STRING_num_asc ASN1_BIT_STRING_set ASN1_BIT_STRING_set_asc ASN1_BIT_STRING_set_bit ASN1_BMPSTRING_free ASN1_BMPSTRING_it ASN1_BMPSTRING_new ASN1_BOOLEAN_it ASN1_ENUMERATED_free ASN1_ENUMERATED_get ASN1_ENUMERATED_get_int64 ASN1_ENUMERATED_it ASN1_ENUMERATED_new ASN1_ENUMERATED_set ASN1_ENUMERATED_set_int64 ASN1_ENUMERATED_to_BN ASN1_FBOOLEAN_it ASN1_GENERALIZEDTIME_adj ASN1_GENERALIZEDTIME_check ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_it ASN1_GENERALIZEDTIME_new ASN1_GENERALIZEDTIME_print ASN1_GENERALIZEDTIME_set ASN1_GENERALIZEDTIME_set_string ASN1_GENERALSTRING_free ASN1_GENERALSTRING_it ASN1_GENERALSTRING_new ASN1_IA5STRING_free ASN1_IA5STRING_it ASN1_IA5STRING_new ASN1_INTEGER_cmp ASN1_INTEGER_dup ASN1_INTEGER_free ASN1_INTEGER_get ASN1_INTEGER_get_int64 ASN1_INTEGER_get_uint64 ASN1_INTEGER_it ASN1_INTEGER_new ASN1_INTEGER_set ASN1_INTEGER_set_int64 ASN1_INTEGER_set_uint64 ASN1_INTEGER_to_BN ASN1_ITEM_get ASN1_ITEM_lookup ASN1_NULL_free ASN1_NULL_it ASN1_NULL_new ASN1_OBJECT_create ASN1_OBJECT_free ASN1_OBJECT_it ASN1_OBJECT_new ASN1_OCTET_STRING_NDEF_it ASN1_OCTET_STRING_cmp ASN1_OCTET_STRING_dup ASN1_OCTET_STRING_free ASN1_OCTET_STRING_it ASN1_OCTET_STRING_new ASN1_OCTET_STRING_set ASN1_PCTX_free ASN1_PCTX_get_cert_flags ASN1_PCTX_get_flags ASN1_PCTX_get_nm_flags ASN1_PCTX_get_oid_flags ASN1_PCTX_get_str_flags ASN1_PCTX_new ASN1_PCTX_set_cert_flags ASN1_PCTX_set_flags ASN1_PCTX_set_nm_flags ASN1_PCTX_set_oid_flags ASN1_PCTX_set_str_flags ASN1_PRINTABLESTRING_free ASN1_PRINTABLESTRING_it ASN1_PRINTABLESTRING_new ASN1_PRINTABLE_free ASN1_PRINTABLE_it ASN1_PRINTABLE_new ASN1_PRINTABLE_type ASN1_SCTX_free ASN1_SCTX_get_app_data ASN1_SCTX_get_flags ASN1_SCTX_get_item ASN1_SCTX_get_template ASN1_SCTX_new ASN1_SCTX_set_app_data ASN1_SEQUENCE_ANY_it ASN1_SEQUENCE_it ASN1_SET_ANY_it ASN1_STRING_TABLE_add ASN1_STRING_TABLE_cleanup ASN1_STRING_TABLE_get ASN1_STRING_clear_free ASN1_STRING_cmp ASN1_STRING_copy ASN1_STRING_data ASN1_STRING_dup ASN1_STRING_free ASN1_STRING_get0_data ASN1_STRING_get_default_mask ASN1_STRING_length ASN1_STRING_length_set ASN1_STRING_new ASN1_STRING_print ASN1_STRING_print_ex ASN1_STRING_print_ex_fp ASN1_STRING_set ASN1_STRING_set0 ASN1_STRING_set_by_NID ASN1_STRING_set_default_mask ASN1_STRING_set_default_mask_asc ASN1_STRING_to_UTF8 ASN1_STRING_type ASN1_STRING_type_new ASN1_T61STRING_free ASN1_T61STRING_it ASN1_T61STRING_new ASN1_TBOOLEAN_it ASN1_TIME_adj ASN1_TIME_check ASN1_TIME_cmp_time_t ASN1_TIME_compare ASN1_TIME_diff ASN1_TIME_free ASN1_TIME_it ASN1_TIME_new ASN1_TIME_normalize ASN1_TIME_print ASN1_TIME_set ASN1_TIME_set_string ASN1_TIME_set_string_X509 ASN1_TIME_to_generalizedtime ASN1_TIME_to_tm ASN1_TYPE_cmp ASN1_TYPE_free ASN1_TYPE_get ASN1_TYPE_get_int_octetstring ASN1_TYPE_get_octetstring ASN1_TYPE_new ASN1_TYPE_pack_sequence ASN1_TYPE_set ASN1_TYPE_set1 ASN1_TYPE_set_int_octetstring ASN1_TYPE_set_octetstring ASN1_TYPE_unpack_sequence ASN1_UNIVERSALSTRING_free ASN1_UNIVERSALSTRING_it ASN1_UNIVERSALSTRING_new ASN1_UNIVERSALSTRING_to_string ASN1_UTCTIME_adj ASN1_UTCTIME_check ASN1_UTCTIME_cmp_time_t ASN1_UTCTIME_free ASN1_UTCTIME_it ASN1_UTCTIME_new ASN1_UTCTIME_print ASN1_UTCTIME_set ASN1_UTCTIME_set_string ASN1_UTF8STRING_free ASN1_UTF8STRING_it ASN1_UTF8STRING_new ASN1_VISIBLESTRING_free ASN1_VISIBLESTRING_it ASN1_VISIBLESTRING_new ASN1_add_oid_module ASN1_add_stable_module ASN1_bn_print ASN1_buf_print ASN1_check_infinite_end ASN1_const_check_infinite_end ASN1_d2i_bio ASN1_d2i_fp ASN1_digest ASN1_dup ASN1_generate_nconf ASN1_generate_v3 ASN1_get_object ASN1_i2d_bio ASN1_i2d_fp ASN1_item_d2i ASN1_item_d2i_bio ASN1_item_d2i_fp ASN1_item_digest ASN1_item_dup ASN1_item_ex_d2i ASN1_item_ex_free ASN1_item_ex_i2d ASN1_item_ex_new ASN1_item_free ASN1_item_i2d ASN1_item_i2d_bio ASN1_item_i2d_fp ASN1_item_ndef_i2d ASN1_item_new ASN1_item_pack ASN1_item_print ASN1_item_sign ASN1_item_sign_ctx ASN1_item_unpack ASN1_item_verify ASN1_mbstring_copy ASN1_mbstring_ncopy ASN1_object_size ASN1_parse ASN1_parse_dump ASN1_put_eoc ASN1_put_object ASN1_sign ASN1_str2mask ASN1_tag2bit ASN1_tag2str ASN1_verify ASRange_free ASRange_it ASRange_new ASYNC_WAIT_CTX_clear_fd ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_get_fd ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_set_wait_fd ASYNC_block_pause ASYNC_cleanup_thread ASYNC_get_current_job ASYNC_get_wait_ctx ASYNC_init_thread ASYNC_is_capable ASYNC_pause_job ASYNC_start_job ASYNC_unblock_pause AUTHORITY_INFO_ACCESS_free AUTHORITY_INFO_ACCESS_it AUTHORITY_INFO_ACCESS_new AUTHORITY_KEYID_free AUTHORITY_KEYID_it AUTHORITY_KEYID_new BASIC_CONSTRAINTS_free BASIC_CONSTRAINTS_it BASIC_CONSTRAINTS_new BF_cbc_encrypt BF_cfb64_encrypt BF_decrypt BF_ecb_encrypt BF_encrypt BF_ofb64_encrypt BF_options BF_set_key BIGNUM_it BIO_ADDRINFO_address BIO_ADDRINFO_family BIO_ADDRINFO_free BIO_ADDRINFO_next BIO_ADDRINFO_protocol BIO_ADDRINFO_socktype BIO_ADDR_clear BIO_ADDR_family BIO_ADDR_free BIO_ADDR_hostname_string BIO_ADDR_new BIO_ADDR_path_string BIO_ADDR_rawaddress BIO_ADDR_rawmake BIO_ADDR_rawport BIO_ADDR_service_string BIO_accept BIO_accept_ex BIO_asn1_get_prefix BIO_asn1_get_suffix BIO_asn1_set_prefix BIO_asn1_set_suffix BIO_bind BIO_callback_ctrl BIO_clear_flags BIO_closesocket BIO_connect BIO_copy_next_retry BIO_ctrl BIO_ctrl_get_read_request BIO_ctrl_get_write_guarantee BIO_ctrl_pending BIO_ctrl_reset_read_request BIO_ctrl_wpending BIO_debug_callback BIO_dgram_non_fatal_error BIO_dump BIO_dump_cb BIO_dump_fp BIO_dump_indent BIO_dump_indent_cb BIO_dump_indent_fp BIO_dup_chain BIO_f_asn1 BIO_f_base64 BIO_f_buffer BIO_f_cipher BIO_f_linebuffer BIO_f_md BIO_f_nbio_test BIO_f_null BIO_f_reliable BIO_fd_non_fatal_error BIO_fd_should_retry BIO_find_type BIO_free BIO_free_all BIO_get_accept_socket BIO_get_callback BIO_get_callback_arg BIO_get_callback_ex BIO_get_data BIO_get_ex_data BIO_get_host_ip BIO_get_init BIO_get_new_index BIO_get_port BIO_get_retry_BIO BIO_get_retry_reason BIO_get_shutdown BIO_gethostbyname BIO_gets BIO_hex_string BIO_indent BIO_int_ctrl BIO_listen BIO_lookup BIO_lookup_ex BIO_meth_free BIO_meth_get_callback_ctrl BIO_meth_get_create BIO_meth_get_ctrl BIO_meth_get_destroy BIO_meth_get_gets BIO_meth_get_puts BIO_meth_get_read BIO_meth_get_read_ex BIO_meth_get_write BIO_meth_get_write_ex BIO_meth_new BIO_meth_set_callback_ctrl BIO_meth_set_create BIO_meth_set_ctrl BIO_meth_set_destroy BIO_meth_set_gets BIO_meth_set_puts BIO_meth_set_read BIO_meth_set_read_ex BIO_meth_set_write BIO_meth_set_write_ex BIO_method_name BIO_method_type BIO_new BIO_new_CMS BIO_new_NDEF BIO_new_PKCS7 BIO_new_accept BIO_new_bio_pair BIO_new_connect BIO_new_dgram BIO_new_fd BIO_new_file BIO_new_fp BIO_new_mem_buf BIO_new_socket BIO_next BIO_nread BIO_nread0 BIO_number_read BIO_number_written BIO_nwrite BIO_nwrite0 BIO_parse_hostserv BIO_pop BIO_printf BIO_ptr_ctrl BIO_push BIO_puts BIO_read BIO_read_ex BIO_s_accept BIO_s_bio BIO_s_connect BIO_s_datagram BIO_s_fd BIO_s_file BIO_s_log BIO_s_mem BIO_s_null BIO_s_secmem BIO_s_socket BIO_set_callback BIO_set_callback_arg BIO_set_callback_ex BIO_set_cipher BIO_set_data BIO_set_ex_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_set_tcp_ndelay BIO_snprintf BIO_sock_error BIO_sock_info BIO_sock_init BIO_sock_non_fatal_error BIO_sock_should_retry BIO_socket BIO_socket_ioctl BIO_socket_nbio BIO_test_flags BIO_up_ref BIO_vfree BIO_vprintf BIO_vsnprintf BIO_write BIO_write_ex BN_BLINDING_convert BN_BLINDING_convert_ex BN_BLINDING_create_param BN_BLINDING_free BN_BLINDING_get_flags BN_BLINDING_invert BN_BLINDING_invert_ex BN_BLINDING_is_current_thread BN_BLINDING_lock BN_BLINDING_new BN_BLINDING_set_current_thread BN_BLINDING_set_flags BN_BLINDING_unlock BN_BLINDING_update BN_CTX_end BN_CTX_free BN_CTX_get BN_CTX_new BN_CTX_secure_new BN_CTX_start BN_GENCB_call BN_GENCB_free BN_GENCB_get_arg BN_GENCB_new BN_GENCB_set BN_GENCB_set_old BN_GF2m_add BN_GF2m_arr2poly BN_GF2m_mod BN_GF2m_mod_arr BN_GF2m_mod_div BN_GF2m_mod_div_arr BN_GF2m_mod_exp BN_GF2m_mod_exp_arr BN_GF2m_mod_inv BN_GF2m_mod_inv_arr BN_GF2m_mod_mul BN_GF2m_mod_mul_arr BN_GF2m_mod_solve_quad BN_GF2m_mod_solve_quad_arr BN_GF2m_mod_sqr BN_GF2m_mod_sqr_arr BN_GF2m_mod_sqrt BN_GF2m_mod_sqrt_arr BN_GF2m_poly2arr BN_MONT_CTX_copy BN_MONT_CTX_free BN_MONT_CTX_new BN_MONT_CTX_set BN_MONT_CTX_set_locked BN_RECP_CTX_free BN_RECP_CTX_new BN_RECP_CTX_set BN_X931_derive_prime_ex BN_X931_generate_Xpq BN_X931_generate_prime_ex BN_abs_is_word BN_add BN_add_word BN_asc2bn BN_bin2bn BN_bn2bin BN_bn2binpad BN_bn2dec BN_bn2hex BN_bn2lebinpad BN_bn2mpi BN_bntest_rand BN_clear BN_clear_bit BN_clear_free BN_cmp BN_consttime_swap BN_copy BN_dec2bn BN_div BN_div_recp BN_div_word BN_dup BN_exp BN_free BN_from_montgomery BN_gcd BN_generate_dsa_nonce BN_generate_prime BN_generate_prime_ex BN_get0_nist_prime_192 BN_get0_nist_prime_224 BN_get0_nist_prime_256 BN_get0_nist_prime_384 BN_get0_nist_prime_521 BN_get_flags BN_get_params BN_get_rfc2409_prime_1024 BN_get_rfc2409_prime_768 BN_get_rfc3526_prime_1536 BN_get_rfc3526_prime_2048 BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_4096 BN_get_rfc3526_prime_6144 BN_get_rfc3526_prime_8192 BN_get_word BN_hex2bn BN_is_bit_set BN_is_negative BN_is_odd BN_is_one BN_is_prime BN_is_prime_ex BN_is_prime_fasttest BN_is_prime_fasttest_ex BN_is_word BN_is_zero BN_kronecker BN_lebin2bn BN_lshift BN_lshift1 BN_mask_bits BN_mod_add BN_mod_add_quick BN_mod_exp BN_mod_exp2_mont BN_mod_exp_mont BN_mod_exp_mont_consttime BN_mod_exp_mont_word BN_mod_exp_recp BN_mod_exp_simple BN_mod_inverse BN_mod_lshift BN_mod_lshift1 BN_mod_lshift1_quick BN_mod_lshift_quick BN_mod_mul BN_mod_mul_montgomery BN_mod_mul_reciprocal BN_mod_sqr BN_mod_sqrt BN_mod_sub BN_mod_sub_quick BN_mod_word BN_mpi2bn BN_mul BN_mul_word BN_new BN_nist_mod_192 BN_nist_mod_224 BN_nist_mod_256 BN_nist_mod_384 BN_nist_mod_521 BN_nist_mod_func BN_nnmod BN_num_bits BN_num_bits_word BN_options BN_print BN_print_fp BN_priv_rand BN_priv_rand_range BN_pseudo_rand BN_pseudo_rand_range BN_rand BN_rand_range BN_reciprocal BN_rshift BN_rshift1 BN_secure_new BN_security_bits BN_set_bit BN_set_flags BN_set_negative BN_set_params BN_set_word BN_sqr BN_sub BN_sub_word BN_swap BN_to_ASN1_ENUMERATED BN_to_ASN1_INTEGER BN_to_montgomery BN_uadd BN_ucmp BN_usub BN_value_one BN_with_flags BN_zero_ex BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_MEM_new_ex BUF_reverse CAST_cbc_encrypt CAST_cfb64_encrypt CAST_decrypt CAST_ecb_encrypt CAST_encrypt CAST_ofb64_encrypt CAST_set_key CBIGNUM_it CERTIFICATEPOLICIES_free CERTIFICATEPOLICIES_it CERTIFICATEPOLICIES_new CMAC_CTX_cleanup CMAC_CTX_copy CMAC_CTX_free CMAC_CTX_get0_cipher_ctx CMAC_CTX_new CMAC_Final CMAC_Init CMAC_Update CMAC_resume CMS_ContentInfo_free CMS_ContentInfo_it CMS_ContentInfo_new CMS_ContentInfo_print_ctx CMS_EncryptedData_decrypt CMS_EncryptedData_encrypt CMS_EncryptedData_set1_key CMS_EnvelopedData_create CMS_ReceiptRequest_create0 CMS_ReceiptRequest_free CMS_ReceiptRequest_get0_values CMS_ReceiptRequest_it CMS_ReceiptRequest_new CMS_RecipientEncryptedKey_cert_cmp CMS_RecipientEncryptedKey_get0_id CMS_RecipientInfo_decrypt CMS_RecipientInfo_encrypt CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_kari_decrypt CMS_RecipientInfo_kari_get0_alg CMS_RecipientInfo_kari_get0_ctx CMS_RecipientInfo_kari_get0_orig_id CMS_RecipientInfo_kari_get0_reks CMS_RecipientInfo_kari_orig_id_cmp CMS_RecipientInfo_kari_set0_pkey CMS_RecipientInfo_kekri_get0_id CMS_RecipientInfo_kekri_id_cmp CMS_RecipientInfo_ktri_cert_cmp CMS_RecipientInfo_ktri_get0_algs CMS_RecipientInfo_ktri_get0_signer_id CMS_RecipientInfo_set0_key CMS_RecipientInfo_set0_password CMS_RecipientInfo_set0_pkey CMS_RecipientInfo_type CMS_SharedInfo_encode CMS_SignedData_init CMS_SignerInfo_cert_cmp CMS_SignerInfo_get0_algs CMS_SignerInfo_get0_md_ctx CMS_SignerInfo_get0_pkey_ctx CMS_SignerInfo_get0_signature CMS_SignerInfo_get0_signer_id CMS_SignerInfo_set1_signer_cert CMS_SignerInfo_sign CMS_SignerInfo_verify CMS_SignerInfo_verify_content CMS_add0_CertificateChoices CMS_add0_RevocationInfoChoice CMS_add0_cert CMS_add0_crl CMS_add0_recipient_key CMS_add0_recipient_password CMS_add1_ReceiptRequest CMS_add1_cert CMS_add1_crl CMS_add1_recipient_cert CMS_add1_signer CMS_add_simple_smimecap CMS_add_smimecap CMS_add_standard_smimecap CMS_compress CMS_data CMS_dataFinal CMS_dataInit CMS_data_create CMS_decrypt CMS_decrypt_set1_key CMS_decrypt_set1_password CMS_decrypt_set1_pkey CMS_digest_create CMS_digest_verify CMS_encrypt CMS_final CMS_get0_RecipientInfos CMS_get0_SignerInfos CMS_get0_content CMS_get0_eContentType CMS_get0_signers CMS_get0_type CMS_get1_ReceiptRequest CMS_get1_certs CMS_get1_crls CMS_is_detached CMS_set1_eContentType CMS_set1_signers_certs CMS_set_detached CMS_sign CMS_sign_receipt CMS_signed_add1_attr CMS_signed_add1_attr_by_NID CMS_signed_add1_attr_by_OBJ CMS_signed_add1_attr_by_txt CMS_signed_delete_attr CMS_signed_get0_data_by_OBJ CMS_signed_get_attr CMS_signed_get_attr_by_NID CMS_signed_get_attr_by_OBJ CMS_signed_get_attr_count CMS_stream CMS_uncompress CMS_unsigned_add1_attr CMS_unsigned_add1_attr_by_NID CMS_unsigned_add1_attr_by_OBJ CMS_unsigned_add1_attr_by_txt CMS_unsigned_delete_attr CMS_unsigned_get0_data_by_OBJ CMS_unsigned_get_attr CMS_unsigned_get_attr_by_NID CMS_unsigned_get_attr_by_OBJ CMS_unsigned_get_attr_count CMS_verify CMS_verify_receipt COMP_CTX_free COMP_CTX_get_method COMP_CTX_get_type COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_dump_bio CONF_dump_fp CONF_free CONF_get1_default_config_file CONF_get_number CONF_get_section CONF_get_string CONF_imodule_get_flags CONF_imodule_get_module CONF_imodule_get_name CONF_imodule_get_usr_data CONF_imodule_get_value CONF_imodule_set_flags CONF_imodule_set_usr_data CONF_load CONF_load_bio CONF_load_fp CONF_module_add CONF_module_get_usr_data CONF_module_set_usr_data CONF_modules_finish CONF_modules_load CONF_modules_load_file CONF_modules_unload CONF_parse_list CONF_set_default_method CONF_set_nconf CRL_DIST_POINTS_free CRL_DIST_POINTS_it CRL_DIST_POINTS_new CRYPTO_128_unwrap CRYPTO_128_unwrap_pad CRYPTO_128_wrap CRYPTO_128_wrap_pad CRYPTO_THREAD_cleanup_local CRYPTO_THREAD_compare_id CRYPTO_THREAD_get_current_id CRYPTO_THREAD_get_local CRYPTO_THREAD_init_local CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_set_local CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_atomic_add CRYPTO_cbc128_decrypt CRYPTO_cbc128_encrypt CRYPTO_ccm128_aad CRYPTO_ccm128_decrypt CRYPTO_ccm128_decrypt_ccm64 CRYPTO_ccm128_encrypt CRYPTO_ccm128_encrypt_ccm64 CRYPTO_ccm128_init CRYPTO_ccm128_setiv CRYPTO_ccm128_tag CRYPTO_cfb128_1_encrypt CRYPTO_cfb128_8_encrypt CRYPTO_cfb128_encrypt CRYPTO_clear_free CRYPTO_clear_realloc CRYPTO_ctr128_encrypt CRYPTO_ctr128_encrypt_ctr32 CRYPTO_cts128_decrypt CRYPTO_cts128_decrypt_block CRYPTO_cts128_encrypt CRYPTO_cts128_encrypt_block CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_free_ex_index CRYPTO_gcm128_aad CRYPTO_gcm128_decrypt CRYPTO_gcm128_decrypt_ctr32 CRYPTO_gcm128_encrypt CRYPTO_gcm128_encrypt_ctr32 CRYPTO_gcm128_finish CRYPTO_gcm128_init CRYPTO_gcm128_new CRYPTO_gcm128_release CRYPTO_gcm128_setiv CRYPTO_gcm128_tag CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_get_mem_functions CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_nistcts128_decrypt CRYPTO_nistcts128_decrypt_block CRYPTO_nistcts128_encrypt CRYPTO_nistcts128_encrypt_block CRYPTO_ocb128_aad CRYPTO_ocb128_cleanup CRYPTO_ocb128_copy_ctx CRYPTO_ocb128_decrypt CRYPTO_ocb128_encrypt CRYPTO_ocb128_finish CRYPTO_ocb128_init CRYPTO_ocb128_new CRYPTO_ocb128_setiv CRYPTO_ocb128_tag CRYPTO_ofb128_encrypt CRYPTO_realloc CRYPTO_secure_actual_size CRYPTO_secure_allocated CRYPTO_secure_clear_free CRYPTO_secure_free CRYPTO_secure_malloc CRYPTO_secure_malloc_done CRYPTO_secure_malloc_init CRYPTO_secure_malloc_initialized CRYPTO_secure_used CRYPTO_secure_zalloc CRYPTO_set_ex_data CRYPTO_set_mem_debug CRYPTO_set_mem_functions CRYPTO_strdup CRYPTO_strndup CRYPTO_xts128_encrypt CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time Camellia_cbc_encrypt Camellia_cfb128_encrypt Camellia_cfb1_encrypt Camellia_cfb8_encrypt Camellia_ctr128_encrypt Camellia_decrypt Camellia_ecb_encrypt Camellia_encrypt Camellia_ofb128_encrypt Camellia_set_key DES_cbc_cksum DES_cbc_encrypt DES_cfb64_encrypt DES_cfb_encrypt DES_check_key_parity DES_crypt DES_decrypt3 DES_ecb3_encrypt DES_ecb_encrypt DES_ede3_cbc_encrypt DES_ede3_cfb64_encrypt DES_ede3_cfb_encrypt DES_ede3_ofb64_encrypt DES_encrypt1 DES_encrypt2 DES_encrypt3 DES_fcrypt DES_is_weak_key DES_key_sched DES_ncbc_encrypt DES_ofb64_encrypt DES_ofb_encrypt DES_options DES_pcbc_encrypt DES_quad_cksum DES_random_key DES_set_key DES_set_key_checked DES_set_key_unchecked DES_set_odd_parity DES_string_to_2keys DES_string_to_key DES_xcbc_encrypt DH_KDF_X9_42 DH_OpenSSL DH_bits DH_check DH_check_ex DH_check_params DH_check_params_ex DH_check_pub_key DH_check_pub_key_ex DH_clear_flags DH_compute_key DH_compute_key_padded DH_free DH_generate_key DH_generate_parameters DH_generate_parameters_ex DH_get0_engine DH_get0_g DH_get0_key DH_get0_p DH_get0_pqg DH_get0_priv_key DH_get0_pub_key DH_get0_q DH_get_1024_160 DH_get_2048_224 DH_get_2048_256 DH_get_default_method DH_get_ex_data DH_get_length DH_get_nid DH_meth_dup DH_meth_free DH_meth_get0_app_data DH_meth_get0_name DH_meth_get_bn_mod_exp DH_meth_get_compute_key DH_meth_get_finish DH_meth_get_flags DH_meth_get_generate_key DH_meth_get_generate_params DH_meth_get_init DH_meth_new DH_meth_set0_app_data DH_meth_set1_name DH_meth_set_bn_mod_exp DH_meth_set_compute_key DH_meth_set_finish DH_meth_set_flags DH_meth_set_generate_key DH_meth_set_generate_params DH_meth_set_init DH_new DH_new_by_nid DH_new_method DH_security_bits DH_set0_key DH_set0_pqg DH_set_default_method DH_set_ex_data DH_set_flags DH_set_length DH_set_method DH_size DH_test_flags DH_up_ref DHparams_dup DHparams_it DHparams_print DHparams_print_fp DIRECTORYSTRING_free DIRECTORYSTRING_it DIRECTORYSTRING_new DISPLAYTEXT_free DISPLAYTEXT_it DISPLAYTEXT_new DIST_POINT_NAME_free DIST_POINT_NAME_it DIST_POINT_NAME_new DIST_POINT_free DIST_POINT_it DIST_POINT_new DIST_POINT_set_dpname DSA_OpenSSL DSA_SIG_free DSA_SIG_get0 DSA_SIG_new DSA_SIG_set0 DSA_bits DSA_clear_flags DSA_do_sign DSA_do_verify DSA_dup_DH DSA_free DSA_generate_key DSA_generate_parameters DSA_generate_parameters_ex DSA_get0_engine DSA_get0_g DSA_get0_key DSA_get0_p DSA_get0_pqg DSA_get0_priv_key DSA_get0_pub_key DSA_get0_q DSA_get_default_method DSA_get_ex_data DSA_get_method DSA_meth_dup DSA_meth_free DSA_meth_get0_app_data DSA_meth_get0_name DSA_meth_get_bn_mod_exp DSA_meth_get_finish DSA_meth_get_flags DSA_meth_get_init DSA_meth_get_keygen DSA_meth_get_mod_exp DSA_meth_get_paramgen DSA_meth_get_sign DSA_meth_get_sign_setup DSA_meth_get_verify DSA_meth_new DSA_meth_set0_app_data DSA_meth_set1_name DSA_meth_set_bn_mod_exp DSA_meth_set_finish DSA_meth_set_flags DSA_meth_set_init DSA_meth_set_keygen DSA_meth_set_mod_exp DSA_meth_set_paramgen DSA_meth_set_sign DSA_meth_set_sign_setup DSA_meth_set_verify DSA_new DSA_new_method DSA_print DSA_print_fp DSA_security_bits DSA_set0_key DSA_set0_pqg DSA_set_default_method DSA_set_ex_data DSA_set_flags DSA_set_method DSA_sign DSA_sign_setup DSA_size DSA_test_flags DSA_up_ref DSA_verify DSAparams_dup DSAparams_print DSAparams_print_fp DSO_METHOD_openssl DSO_bind_func DSO_convert_filename DSO_ctrl DSO_dsobyaddr DSO_flags DSO_free DSO_get_filename DSO_global_lookup DSO_load DSO_merge DSO_new DSO_pathbyaddr DSO_set_filename DSO_up_ref ECDH_KDF_X9_62 ECDH_compute_key ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_get0_r ECDSA_SIG_get0_s ECDSA_SIG_new ECDSA_SIG_set0 ECDSA_do_sign ECDSA_do_sign_ex ECDSA_do_verify ECDSA_sign ECDSA_sign_ex ECDSA_sign_setup ECDSA_size ECDSA_verify ECPARAMETERS_free ECPARAMETERS_it ECPARAMETERS_new ECPKPARAMETERS_free ECPKPARAMETERS_it ECPKPARAMETERS_new ECPKParameters_print ECPKParameters_print_fp ECParameters_print ECParameters_print_fp EC_GF2m_simple_method EC_GFp_mont_method EC_GFp_nist_method EC_GFp_simple_method EC_GROUP_check EC_GROUP_check_discriminant EC_GROUP_clear_free EC_GROUP_cmp EC_GROUP_copy EC_GROUP_dup EC_GROUP_free EC_GROUP_get0_cofactor EC_GROUP_get0_generator EC_GROUP_get0_order EC_GROUP_get0_seed EC_GROUP_get_asn1_flag EC_GROUP_get_basis_type EC_GROUP_get_cofactor EC_GROUP_get_curve EC_GROUP_get_curve_GF2m EC_GROUP_get_curve_GFp EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_get_ecparameters EC_GROUP_get_ecpkparameters EC_GROUP_get_mont_data EC_GROUP_get_order EC_GROUP_get_pentanomial_basis EC_GROUP_get_point_conversion_form EC_GROUP_get_seed_len EC_GROUP_get_trinomial_basis EC_GROUP_have_precompute_mult EC_GROUP_method_of EC_GROUP_new EC_GROUP_new_by_curve_name EC_GROUP_new_curve_GF2m EC_GROUP_new_curve_GFp EC_GROUP_new_from_ecparameters EC_GROUP_new_from_ecpkparameters EC_GROUP_order_bits EC_GROUP_precompute_mult EC_GROUP_set_asn1_flag EC_GROUP_set_curve EC_GROUP_set_curve_GF2m EC_GROUP_set_curve_GFp EC_GROUP_set_curve_name EC_GROUP_set_generator EC_GROUP_set_point_conversion_form EC_GROUP_set_seed EC_KEY_METHOD_free EC_KEY_METHOD_get_compute_key EC_KEY_METHOD_get_init EC_KEY_METHOD_get_keygen EC_KEY_METHOD_get_sign EC_KEY_METHOD_get_verify EC_KEY_METHOD_new EC_KEY_METHOD_set_compute_key EC_KEY_METHOD_set_init EC_KEY_METHOD_set_keygen EC_KEY_METHOD_set_sign EC_KEY_METHOD_set_verify EC_KEY_OpenSSL EC_KEY_can_sign EC_KEY_check_key EC_KEY_clear_flags EC_KEY_copy EC_KEY_dup EC_KEY_free EC_KEY_generate_key EC_KEY_get0_engine EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_get_conv_form EC_KEY_get_default_method EC_KEY_get_enc_flags EC_KEY_get_ex_data EC_KEY_get_flags EC_KEY_get_method EC_KEY_key2buf EC_KEY_new EC_KEY_new_by_curve_name EC_KEY_new_method EC_KEY_oct2key EC_KEY_oct2priv EC_KEY_precompute_mult EC_KEY_print EC_KEY_print_fp EC_KEY_priv2buf EC_KEY_priv2oct EC_KEY_set_asn1_flag EC_KEY_set_conv_form EC_KEY_set_default_method EC_KEY_set_enc_flags EC_KEY_set_ex_data EC_KEY_set_flags EC_KEY_set_group EC_KEY_set_method EC_KEY_set_private_key EC_KEY_set_public_key EC_KEY_set_public_key_affine_coordinates EC_KEY_up_ref EC_METHOD_get_field_type EC_POINT_add EC_POINT_bn2point EC_POINT_clear_free EC_POINT_cmp EC_POINT_copy EC_POINT_dbl EC_POINT_dup EC_POINT_free EC_POINT_get_Jprojective_coordinates_GFp EC_POINT_get_affine_coordinates EC_POINT_get_affine_coordinates_GF2m EC_POINT_get_affine_coordinates_GFp EC_POINT_hex2point EC_POINT_invert EC_POINT_is_at_infinity EC_POINT_is_on_curve EC_POINT_make_affine EC_POINT_method_of EC_POINT_mul EC_POINT_new EC_POINT_oct2point EC_POINT_point2bn EC_POINT_point2buf EC_POINT_point2hex EC_POINT_point2oct EC_POINT_set_Jprojective_coordinates_GFp EC_POINT_set_affine_coordinates EC_POINT_set_affine_coordinates_GF2m EC_POINT_set_affine_coordinates_GFp EC_POINT_set_compressed_coordinates EC_POINT_set_compressed_coordinates_GF2m EC_POINT_set_compressed_coordinates_GFp EC_POINT_set_to_infinity EC_POINTs_make_affine EC_POINTs_mul EC_curve_nid2nist EC_curve_nist2nid EC_get_builtin_curves EDIPARTYNAME_free EDIPARTYNAME_it EDIPARTYNAME_new ENGINE_add ENGINE_add_conf_module ENGINE_by_id ENGINE_cmd_is_executable ENGINE_ctrl ENGINE_ctrl_cmd ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_DH ENGINE_get_DSA ENGINE_get_EC ENGINE_get_RAND ENGINE_get_RSA ENGINE_get_cipher ENGINE_get_cipher_engine ENGINE_get_ciphers ENGINE_get_cmd_defns ENGINE_get_ctrl_function ENGINE_get_default_DH ENGINE_get_default_DSA ENGINE_get_default_EC ENGINE_get_default_RAND ENGINE_get_default_RSA ENGINE_get_destroy_function ENGINE_get_digest ENGINE_get_digest_engine ENGINE_get_digests ENGINE_get_ex_data ENGINE_get_finish_function ENGINE_get_first ENGINE_get_flags ENGINE_get_id ENGINE_get_init_function ENGINE_get_last ENGINE_get_load_privkey_function ENGINE_get_load_pubkey_function ENGINE_get_name ENGINE_get_next ENGINE_get_pkey_asn1_meth ENGINE_get_pkey_asn1_meth_engine ENGINE_get_pkey_asn1_meth_str ENGINE_get_pkey_asn1_meths ENGINE_get_pkey_meth ENGINE_get_pkey_meth_engine ENGINE_get_pkey_meths ENGINE_get_prev ENGINE_get_ssl_client_cert_function ENGINE_get_static_state ENGINE_get_table_flags ENGINE_init ENGINE_load_builtin_engines ENGINE_load_private_key ENGINE_load_public_key ENGINE_load_ssl_client_cert ENGINE_new ENGINE_pkey_asn1_find_str ENGINE_register_DH ENGINE_register_DSA ENGINE_register_EC ENGINE_register_RAND ENGINE_register_RSA ENGINE_register_all_DH ENGINE_register_all_DSA ENGINE_register_all_EC ENGINE_register_all_RAND ENGINE_register_all_RSA ENGINE_register_all_ciphers ENGINE_register_all_complete ENGINE_register_all_digests ENGINE_register_all_pkey_asn1_meths ENGINE_register_all_pkey_meths ENGINE_register_ciphers ENGINE_register_complete ENGINE_register_digests ENGINE_register_pkey_asn1_meths ENGINE_register_pkey_meths ENGINE_remove ENGINE_set_DH ENGINE_set_DSA ENGINE_set_EC ENGINE_set_RAND ENGINE_set_RSA ENGINE_set_ciphers ENGINE_set_cmd_defns ENGINE_set_ctrl_function ENGINE_set_default ENGINE_set_default_DH ENGINE_set_default_DSA ENGINE_set_default_EC ENGINE_set_default_RAND ENGINE_set_default_RSA ENGINE_set_default_ciphers ENGINE_set_default_digests ENGINE_set_default_pkey_asn1_meths ENGINE_set_default_pkey_meths ENGINE_set_default_string ENGINE_set_destroy_function ENGINE_set_digests ENGINE_set_ex_data ENGINE_set_finish_function ENGINE_set_flags ENGINE_set_id ENGINE_set_init_function ENGINE_set_load_privkey_function ENGINE_set_load_pubkey_function ENGINE_set_load_ssl_client_cert_function ENGINE_set_name ENGINE_set_pkey_asn1_meths ENGINE_set_pkey_meths ENGINE_set_table_flags ENGINE_unregister_DH ENGINE_unregister_DSA ENGINE_unregister_EC ENGINE_unregister_RAND ENGINE_unregister_RSA ENGINE_unregister_ciphers ENGINE_unregister_digests ENGINE_unregister_pkey_asn1_meths ENGINE_unregister_pkey_meths ENGINE_up_ref ERR_add_error_data ERR_add_error_vdata ERR_clear_error ERR_clear_last_mark ERR_error_string ERR_error_string_n ERR_func_error_string ERR_get_error ERR_get_error_line ERR_get_error_line_data ERR_get_next_error_library ERR_get_state ERR_lib_error_string ERR_load_ASN1_strings ERR_load_ASYNC_strings ERR_load_BIO_strings ERR_load_BN_strings ERR_load_BUF_strings ERR_load_CMS_strings ERR_load_COMP_strings ERR_load_CONF_strings ERR_load_CRYPTO_strings ERR_load_CT_strings ERR_load_DH_strings ERR_load_DSA_strings ERR_load_DSO_strings ERR_load_EC_strings ERR_load_ENGINE_strings ERR_load_ERR_strings ERR_load_EVP_strings ERR_load_KDF_strings ERR_load_OBJ_strings ERR_load_OCSP_strings ERR_load_OSSL_STORE_strings ERR_load_PEM_strings ERR_load_PKCS12_strings ERR_load_PKCS7_strings ERR_load_RAND_strings ERR_load_RSA_strings ERR_load_TS_strings ERR_load_UI_strings ERR_load_X509V3_strings ERR_load_X509_strings ERR_load_strings ERR_load_strings_const ERR_peek_error ERR_peek_error_line ERR_peek_error_line_data ERR_peek_last_error ERR_peek_last_error_line ERR_peek_last_error_line_data ERR_pop_to_mark ERR_print_errors ERR_print_errors_cb ERR_print_errors_fp ERR_put_error ERR_reason_error_string ERR_remove_state ERR_remove_thread_state ERR_set_error_data ERR_set_mark ERR_unload_strings ESS_CERT_ID_V2_dup ESS_CERT_ID_V2_free ESS_CERT_ID_V2_new ESS_CERT_ID_dup ESS_CERT_ID_free ESS_CERT_ID_new ESS_ISSUER_SERIAL_dup ESS_ISSUER_SERIAL_free ESS_ISSUER_SERIAL_new ESS_SIGNING_CERT_V2_dup ESS_SIGNING_CERT_V2_free ESS_SIGNING_CERT_V2_new ESS_SIGNING_CERT_dup ESS_SIGNING_CERT_free ESS_SIGNING_CERT_new EVP_BytesToKey EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_buf_noconst EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_clear_flags EVP_CIPHER_CTX_copy EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_encrypting EVP_CIPHER_CTX_free EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_nid EVP_CIPHER_CTX_num EVP_CIPHER_CTX_original_iv EVP_CIPHER_CTX_rand_key EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_set_cipher_data EVP_CIPHER_CTX_set_flags EVP_CIPHER_CTX_set_key_length EVP_CIPHER_CTX_set_num EVP_CIPHER_CTX_set_padding EVP_CIPHER_CTX_test_flags EVP_CIPHER_asn1_to_param EVP_CIPHER_block_size EVP_CIPHER_do_all EVP_CIPHER_do_all_sorted EVP_CIPHER_flags EVP_CIPHER_get_asn1_iv EVP_CIPHER_impl_ctx_size EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_meth_dup EVP_CIPHER_meth_free EVP_CIPHER_meth_get_cleanup EVP_CIPHER_meth_get_ctrl EVP_CIPHER_meth_get_do_cipher EVP_CIPHER_meth_get_get_asn1_params EVP_CIPHER_meth_get_init EVP_CIPHER_meth_get_set_asn1_params EVP_CIPHER_meth_new EVP_CIPHER_meth_set_cleanup EVP_CIPHER_meth_set_ctrl EVP_CIPHER_meth_set_do_cipher EVP_CIPHER_meth_set_flags EVP_CIPHER_meth_set_get_asn1_params EVP_CIPHER_meth_set_impl_ctx_size EVP_CIPHER_meth_set_init EVP_CIPHER_meth_set_iv_length EVP_CIPHER_meth_set_set_asn1_params EVP_CIPHER_nid EVP_CIPHER_param_to_asn1 EVP_CIPHER_set_asn1_iv EVP_CIPHER_type EVP_Cipher EVP_CipherFinal EVP_CipherFinal_ex EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_DecodeBlock EVP_DecodeFinal EVP_DecodeInit EVP_DecodeUpdate EVP_DecryptFinal EVP_DecryptFinal_ex EVP_DecryptInit EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinalXOF EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSign EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerify EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_ENCODE_CTX_copy EVP_ENCODE_CTX_free EVP_ENCODE_CTX_new EVP_ENCODE_CTX_num EVP_EncodeBlock EVP_EncodeFinal EVP_EncodeInit EVP_EncodeUpdate EVP_EncryptFinal EVP_EncryptFinal_ex EVP_EncryptInit EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_clear_flags EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_md_data EVP_MD_CTX_new EVP_MD_CTX_pkey_ctx EVP_MD_CTX_reset EVP_MD_CTX_set_flags EVP_MD_CTX_set_pkey_ctx EVP_MD_CTX_set_update_fn EVP_MD_CTX_test_flags EVP_MD_CTX_update_fn EVP_MD_block_size EVP_MD_do_all EVP_MD_do_all_sorted EVP_MD_flags EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_get_app_datasize EVP_MD_meth_get_cleanup EVP_MD_meth_get_copy EVP_MD_meth_get_ctrl EVP_MD_meth_get_final EVP_MD_meth_get_flags EVP_MD_meth_get_init EVP_MD_meth_get_input_blocksize EVP_MD_meth_get_result_size EVP_MD_meth_get_update EVP_MD_meth_new EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final EVP_MD_meth_set_flags EVP_MD_meth_set_init EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size EVP_MD_meth_set_update EVP_MD_pkey_type EVP_MD_size EVP_MD_type EVP_OpenFinal EVP_OpenInit EVP_PBE_CipherInit EVP_PBE_alg_add EVP_PBE_alg_add_type EVP_PBE_cleanup EVP_PBE_find EVP_PBE_get EVP_PBE_scrypt EVP_PKCS82PKEY EVP_PKEY2PKCS8 EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_ctrl_uint64 EVP_PKEY_CTX_dup EVP_PKEY_CTX_free EVP_PKEY_CTX_get0_peerkey EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get_app_data EVP_PKEY_CTX_get_cb EVP_PKEY_CTX_get_data EVP_PKEY_CTX_get_keygen_info EVP_PKEY_CTX_get_operation EVP_PKEY_CTX_hex2ctrl EVP_PKEY_CTX_md EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set0_keygen_info EVP_PKEY_CTX_set_app_data EVP_PKEY_CTX_set_cb EVP_PKEY_CTX_set_data EVP_PKEY_CTX_str2ctrl EVP_PKEY_add1_attr EVP_PKEY_add1_attr_by_NID EVP_PKEY_add1_attr_by_OBJ EVP_PKEY_add1_attr_by_txt EVP_PKEY_asn1_add0 EVP_PKEY_asn1_add_alias EVP_PKEY_asn1_copy EVP_PKEY_asn1_find EVP_PKEY_asn1_find_str EVP_PKEY_asn1_free EVP_PKEY_asn1_get0 EVP_PKEY_asn1_get0_info EVP_PKEY_asn1_get_count EVP_PKEY_asn1_new EVP_PKEY_asn1_set_check EVP_PKEY_asn1_set_ctrl EVP_PKEY_asn1_set_free EVP_PKEY_asn1_set_get_priv_key EVP_PKEY_asn1_set_get_pub_key EVP_PKEY_asn1_set_item EVP_PKEY_asn1_set_param EVP_PKEY_asn1_set_param_check EVP_PKEY_asn1_set_private EVP_PKEY_asn1_set_public EVP_PKEY_asn1_set_public_check EVP_PKEY_asn1_set_security_bits EVP_PKEY_asn1_set_set_priv_key EVP_PKEY_asn1_set_set_pub_key EVP_PKEY_asn1_set_siginf EVP_PKEY_assign EVP_PKEY_base_id EVP_PKEY_bits EVP_PKEY_check EVP_PKEY_cmp EVP_PKEY_cmp_parameters EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_decrypt_old EVP_PKEY_delete_attr EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_encrypt_old EVP_PKEY_free EVP_PKEY_get0 EVP_PKEY_get0_DH EVP_PKEY_get0_DSA EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get0_asn1 EVP_PKEY_get0_engine EVP_PKEY_get0_hmac EVP_PKEY_get0_poly1305 EVP_PKEY_get0_siphash EVP_PKEY_get1_DH EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_get_attr EVP_PKEY_get_attr_by_NID EVP_PKEY_get_attr_by_OBJ EVP_PKEY_get_attr_count EVP_PKEY_get_default_digest_nid EVP_PKEY_get_raw_private_key EVP_PKEY_get_raw_public_key EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_meth_add0 EVP_PKEY_meth_copy EVP_PKEY_meth_find EVP_PKEY_meth_free EVP_PKEY_meth_get0 EVP_PKEY_meth_get0_info EVP_PKEY_meth_get_check EVP_PKEY_meth_get_cleanup EVP_PKEY_meth_get_copy EVP_PKEY_meth_get_count EVP_PKEY_meth_get_ctrl EVP_PKEY_meth_get_decrypt EVP_PKEY_meth_get_derive EVP_PKEY_meth_get_digest_custom EVP_PKEY_meth_get_encrypt EVP_PKEY_meth_get_init EVP_PKEY_meth_get_keygen EVP_PKEY_meth_get_param_check EVP_PKEY_meth_get_paramgen EVP_PKEY_meth_get_public_check EVP_PKEY_meth_get_sign EVP_PKEY_meth_get_signctx EVP_PKEY_meth_get_verify EVP_PKEY_meth_get_verify_recover EVP_PKEY_meth_get_verifyctx EVP_PKEY_meth_new EVP_PKEY_meth_remove EVP_PKEY_meth_set_check EVP_PKEY_meth_set_cleanup EVP_PKEY_meth_set_copy EVP_PKEY_meth_set_ctrl EVP_PKEY_meth_set_decrypt EVP_PKEY_meth_set_derive EVP_PKEY_meth_set_digest_custom EVP_PKEY_meth_set_encrypt EVP_PKEY_meth_set_init EVP_PKEY_meth_set_keygen EVP_PKEY_meth_set_param_check EVP_PKEY_meth_set_paramgen EVP_PKEY_meth_set_public_check EVP_PKEY_meth_set_sign EVP_PKEY_meth_set_signctx EVP_PKEY_meth_set_verify EVP_PKEY_meth_set_verify_recover EVP_PKEY_meth_set_verifyctx EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_CMAC_key EVP_PKEY_new_mac_key EVP_PKEY_new_raw_private_key EVP_PKEY_new_raw_public_key EVP_PKEY_param_check EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_print_params EVP_PKEY_print_private EVP_PKEY_print_public EVP_PKEY_public_check EVP_PKEY_save_parameters EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_DSA EVP_PKEY_set1_EC_KEY EVP_PKEY_set1_RSA EVP_PKEY_set1_engine EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_alias_type EVP_PKEY_set_type EVP_PKEY_set_type_str EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_type EVP_PKEY_up_ref EVP_PKEY_verify EVP_PKEY_verify_init EVP_PKEY_verify_recover EVP_PKEY_verify_recover_init EVP_SealFinal EVP_SealInit EVP_SignFinal EVP_VerifyFinal EVP_add_alg_module EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_cfb1 EVP_aes_128_cfb128 EVP_aes_128_cfb8 EVP_aes_128_ctr EVP_aes_128_ecb EVP_aes_128_gcm EVP_aes_128_ocb EVP_aes_128_ofb EVP_aes_128_wrap EVP_aes_128_wrap_pad EVP_aes_128_xts EVP_aes_192_cbc EVP_aes_192_ccm EVP_aes_192_cfb1 EVP_aes_192_cfb128 EVP_aes_192_cfb8 EVP_aes_192_ctr EVP_aes_192_ecb EVP_aes_192_gcm EVP_aes_192_ocb EVP_aes_192_ofb EVP_aes_192_wrap EVP_aes_192_wrap_pad EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_cfb1 EVP_aes_256_cfb128 EVP_aes_256_cfb8 EVP_aes_256_ctr EVP_aes_256_ecb EVP_aes_256_gcm EVP_aes_256_ocb EVP_aes_256_ofb EVP_aes_256_wrap EVP_aes_256_wrap_pad EVP_aes_256_xts EVP_aria_128_cbc EVP_aria_128_ccm EVP_aria_128_cfb1 EVP_aria_128_cfb128 EVP_aria_128_cfb8 EVP_aria_128_ctr EVP_aria_128_ecb EVP_aria_128_gcm EVP_aria_128_ofb EVP_aria_192_cbc EVP_aria_192_ccm EVP_aria_192_cfb1 EVP_aria_192_cfb128 EVP_aria_192_cfb8 EVP_aria_192_ctr EVP_aria_192_ecb EVP_aria_192_gcm EVP_aria_192_ofb EVP_aria_256_cbc EVP_aria_256_ccm EVP_aria_256_cfb1 EVP_aria_256_cfb128 EVP_aria_256_cfb8 EVP_aria_256_ctr EVP_aria_256_ecb EVP_aria_256_gcm EVP_aria_256_ofb EVP_bf_cbc EVP_bf_cfb64 EVP_bf_ecb EVP_bf_ofb EVP_blake2b512 EVP_blake2s256 EVP_camellia_128_cbc EVP_camellia_128_cfb1 EVP_camellia_128_cfb128 EVP_camellia_128_cfb8 EVP_camellia_128_ctr EVP_camellia_128_ecb EVP_camellia_128_ofb EVP_camellia_192_cbc EVP_camellia_192_cfb1 EVP_camellia_192_cfb128 EVP_camellia_192_cfb8 EVP_camellia_192_ctr EVP_camellia_192_ecb EVP_camellia_192_ofb EVP_camellia_256_cbc EVP_camellia_256_cfb1 EVP_camellia_256_cfb128 EVP_camellia_256_cfb8 EVP_camellia_256_ctr EVP_camellia_256_ecb EVP_camellia_256_ofb EVP_cast5_cbc EVP_cast5_cfb64 EVP_cast5_ecb EVP_cast5_ofb EVP_chacha20 EVP_chacha20_poly1305 EVP_des_cbc EVP_des_cfb1 EVP_des_cfb64 EVP_des_cfb8 EVP_des_ecb EVP_des_ede EVP_des_ede3 EVP_des_ede3_cbc EVP_des_ede3_cfb1 EVP_des_ede3_cfb64 EVP_des_ede3_cfb8 EVP_des_ede3_ecb EVP_des_ede3_ofb EVP_des_ede3_wrap EVP_des_ede_cbc EVP_des_ede_cfb64 EVP_des_ede_ecb EVP_des_ede_ofb EVP_des_ofb EVP_desx_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_get_pw_prompt EVP_idea_cbc EVP_idea_cfb64 EVP_idea_ecb EVP_idea_ofb EVP_md4 EVP_md5 EVP_md5_sha1 EVP_md_null EVP_mdc2 EVP_rc2_40_cbc EVP_rc2_64_cbc EVP_rc2_cbc EVP_rc2_cfb64 EVP_rc2_ecb EVP_rc2_ofb EVP_rc4 EVP_rc4_40 EVP_rc4_hmac_md5 EVP_read_pw_string EVP_read_pw_string_min EVP_ripemd160 EVP_seed_cbc EVP_seed_cfb128 EVP_seed_ecb EVP_seed_ofb EVP_set_pw_prompt EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha3_224 EVP_sha3_256 EVP_sha3_384 EVP_sha3_512 EVP_sha512 EVP_sha512_224 EVP_sha512_256 EVP_shake128 EVP_shake256 EVP_sm3 EVP_sm4_cbc EVP_sm4_cfb128 EVP_sm4_ctr EVP_sm4_ecb EVP_sm4_ofb EVP_whirlpool EXTENDED_KEY_USAGE_free EXTENDED_KEY_USAGE_it EXTENDED_KEY_USAGE_new FIPS_mode FIPS_mode_set GENERAL_NAMES_free GENERAL_NAMES_it GENERAL_NAMES_new GENERAL_NAME_cmp GENERAL_NAME_dup GENERAL_NAME_free GENERAL_NAME_get0_otherName GENERAL_NAME_get0_value GENERAL_NAME_it GENERAL_NAME_new GENERAL_NAME_print GENERAL_NAME_set0_othername GENERAL_NAME_set0_value GENERAL_SUBTREE_free GENERAL_SUBTREE_it GENERAL_SUBTREE_new HMAC HMAC_CTX_copy HMAC_CTX_free HMAC_CTX_get_md HMAC_CTX_new HMAC_CTX_reset HMAC_CTX_set_flags HMAC_Final HMAC_Init HMAC_Init_ex HMAC_Update HMAC_size IDEA_cbc_encrypt IDEA_cfb64_encrypt IDEA_ecb_encrypt IDEA_encrypt IDEA_ofb64_encrypt IDEA_options IDEA_set_decrypt_key IDEA_set_encrypt_key INT32_it INT64_it IPAddressChoice_free IPAddressChoice_it IPAddressChoice_new IPAddressFamily_free IPAddressFamily_it IPAddressFamily_new IPAddressOrRange_free IPAddressOrRange_it IPAddressOrRange_new IPAddressRange_free IPAddressRange_it IPAddressRange_new ISSUING_DIST_POINT_free ISSUING_DIST_POINT_it ISSUING_DIST_POINT_new LONG_it MD4 MD4_Final MD4_Init MD4_Transform MD4_Update MD5 MD5_Final MD5_Init MD5_Transform MD5_Update MDC2 MDC2_Final MDC2_Init MDC2_Update NAME_CONSTRAINTS_check NAME_CONSTRAINTS_check_CN NAME_CONSTRAINTS_free NAME_CONSTRAINTS_it NAME_CONSTRAINTS_new NAMING_AUTHORITY_free NAMING_AUTHORITY_get0_authorityId NAMING_AUTHORITY_get0_authorityText NAMING_AUTHORITY_get0_authorityURL NAMING_AUTHORITY_it NAMING_AUTHORITY_new NAMING_AUTHORITY_set0_authorityId NAMING_AUTHORITY_set0_authorityText NAMING_AUTHORITY_set0_authorityURL NCONF_WIN32 NCONF_default NCONF_dump_bio NCONF_dump_fp NCONF_free NCONF_free_data NCONF_get_number_e NCONF_get_section NCONF_get_string NCONF_load NCONF_load_bio NCONF_load_fp NCONF_new NETSCAPE_CERT_SEQUENCE_free NETSCAPE_CERT_SEQUENCE_it NETSCAPE_CERT_SEQUENCE_new NETSCAPE_SPKAC_free NETSCAPE_SPKAC_it NETSCAPE_SPKAC_new NETSCAPE_SPKI_b64_decode NETSCAPE_SPKI_b64_encode NETSCAPE_SPKI_free NETSCAPE_SPKI_get_pubkey NETSCAPE_SPKI_it NETSCAPE_SPKI_new NETSCAPE_SPKI_print NETSCAPE_SPKI_set_pubkey NETSCAPE_SPKI_sign NETSCAPE_SPKI_verify NOTICEREF_free NOTICEREF_it NOTICEREF_new OBJ_NAME_add OBJ_NAME_cleanup OBJ_NAME_do_all OBJ_NAME_do_all_sorted OBJ_NAME_get OBJ_NAME_init OBJ_NAME_new_index OBJ_NAME_remove OBJ_add_object OBJ_add_sigid OBJ_bsearch_ OBJ_bsearch_ex_ OBJ_cmp OBJ_create OBJ_create_objects OBJ_dup OBJ_find_sigid_algs OBJ_find_sigid_by_algs OBJ_get0_data OBJ_length OBJ_ln2nid OBJ_new_nid OBJ_nid2ln OBJ_nid2obj OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sigid_free OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OCSP_BASICRESP_add1_ext_i2d OCSP_BASICRESP_add_ext OCSP_BASICRESP_delete_ext OCSP_BASICRESP_free OCSP_BASICRESP_get1_ext_d2i OCSP_BASICRESP_get_ext OCSP_BASICRESP_get_ext_by_NID OCSP_BASICRESP_get_ext_by_OBJ OCSP_BASICRESP_get_ext_by_critical OCSP_BASICRESP_get_ext_count OCSP_BASICRESP_it OCSP_BASICRESP_new OCSP_CERTID_dup OCSP_CERTID_free OCSP_CERTID_it OCSP_CERTID_new OCSP_CERTSTATUS_free OCSP_CERTSTATUS_it OCSP_CERTSTATUS_new OCSP_CRLID_free OCSP_CRLID_it OCSP_CRLID_new OCSP_ONEREQ_add1_ext_i2d OCSP_ONEREQ_add_ext OCSP_ONEREQ_delete_ext OCSP_ONEREQ_free OCSP_ONEREQ_get1_ext_d2i OCSP_ONEREQ_get_ext OCSP_ONEREQ_get_ext_by_NID OCSP_ONEREQ_get_ext_by_OBJ OCSP_ONEREQ_get_ext_by_critical OCSP_ONEREQ_get_ext_count OCSP_ONEREQ_it OCSP_ONEREQ_new OCSP_REQINFO_free OCSP_REQINFO_it OCSP_REQINFO_new OCSP_REQUEST_add1_ext_i2d OCSP_REQUEST_add_ext OCSP_REQUEST_delete_ext OCSP_REQUEST_free OCSP_REQUEST_get1_ext_d2i OCSP_REQUEST_get_ext OCSP_REQUEST_get_ext_by_NID OCSP_REQUEST_get_ext_by_OBJ OCSP_REQUEST_get_ext_by_critical OCSP_REQUEST_get_ext_count OCSP_REQUEST_it OCSP_REQUEST_new OCSP_REQUEST_print OCSP_REQ_CTX_add1_header OCSP_REQ_CTX_free OCSP_REQ_CTX_get0_mem_bio OCSP_REQ_CTX_http OCSP_REQ_CTX_i2d OCSP_REQ_CTX_nbio OCSP_REQ_CTX_nbio_d2i OCSP_REQ_CTX_new OCSP_REQ_CTX_set1_req OCSP_RESPBYTES_free OCSP_RESPBYTES_it OCSP_RESPBYTES_new OCSP_RESPDATA_free OCSP_RESPDATA_it OCSP_RESPDATA_new OCSP_RESPID_free OCSP_RESPID_it OCSP_RESPID_match OCSP_RESPID_new OCSP_RESPID_set_by_key OCSP_RESPID_set_by_name OCSP_RESPONSE_free OCSP_RESPONSE_it OCSP_RESPONSE_new OCSP_RESPONSE_print OCSP_REVOKEDINFO_free OCSP_REVOKEDINFO_it OCSP_REVOKEDINFO_new OCSP_SERVICELOC_free OCSP_SERVICELOC_it OCSP_SERVICELOC_new OCSP_SIGNATURE_free OCSP_SIGNATURE_it OCSP_SIGNATURE_new OCSP_SINGLERESP_add1_ext_i2d OCSP_SINGLERESP_add_ext OCSP_SINGLERESP_delete_ext OCSP_SINGLERESP_free OCSP_SINGLERESP_get0_id OCSP_SINGLERESP_get1_ext_d2i OCSP_SINGLERESP_get_ext OCSP_SINGLERESP_get_ext_by_NID OCSP_SINGLERESP_get_ext_by_OBJ OCSP_SINGLERESP_get_ext_by_critical OCSP_SINGLERESP_get_ext_count OCSP_SINGLERESP_it OCSP_SINGLERESP_new OCSP_accept_responses_new OCSP_archive_cutoff_new OCSP_basic_add1_cert OCSP_basic_add1_nonce OCSP_basic_add1_status OCSP_basic_sign OCSP_basic_sign_ctx OCSP_basic_verify OCSP_cert_id_new OCSP_cert_status_str OCSP_cert_to_id OCSP_check_nonce OCSP_check_validity OCSP_copy_nonce OCSP_crlID_new OCSP_crl_reason_str OCSP_id_cmp OCSP_id_get0_info OCSP_id_issuer_cmp OCSP_onereq_get0_id OCSP_parse_url OCSP_request_add0_id OCSP_request_add1_cert OCSP_request_add1_nonce OCSP_request_is_signed OCSP_request_onereq_count OCSP_request_onereq_get0 OCSP_request_set1_name OCSP_request_sign OCSP_request_verify OCSP_resp_count OCSP_resp_find OCSP_resp_find_status OCSP_resp_get0 OCSP_resp_get0_certs OCSP_resp_get0_id OCSP_resp_get0_produced_at OCSP_resp_get0_respdata OCSP_resp_get0_signature OCSP_resp_get0_signer OCSP_resp_get0_tbs_sigalg OCSP_resp_get1_id OCSP_response_create OCSP_response_get1_basic OCSP_response_status OCSP_response_status_str OCSP_sendreq_bio OCSP_sendreq_nbio OCSP_sendreq_new OCSP_set_max_response_length OCSP_single_get0_status OCSP_url_svcloc_new OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_INIT_free OPENSSL_INIT_new OPENSSL_INIT_set_config_appname OPENSSL_INIT_set_config_file_flags OPENSSL_INIT_set_config_filename OPENSSL_LH_delete OPENSSL_LH_doall OPENSSL_LH_doall_arg OPENSSL_LH_error OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_node_stats OPENSSL_LH_node_stats_bio OPENSSL_LH_node_usage_stats OPENSSL_LH_node_usage_stats_bio OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_LH_stats OPENSSL_LH_stats_bio OPENSSL_LH_strhash OPENSSL_asc2uni OPENSSL_atexit OPENSSL_buf2hexstr OPENSSL_cleanse OPENSSL_cleanup OPENSSL_config OPENSSL_die OPENSSL_gmtime OPENSSL_gmtime_adj OPENSSL_gmtime_diff OPENSSL_hexchar2int OPENSSL_hexstr2buf OPENSSL_init OPENSSL_init_crypto OPENSSL_isservice OPENSSL_issetugid OPENSSL_load_builtin_modules OPENSSL_memcmp OPENSSL_sk_deep_copy OPENSSL_sk_delete OPENSSL_sk_delete_ptr OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_find_ex OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_is_sorted OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_new_reserve OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_reserve OPENSSL_sk_set OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_unshift OPENSSL_sk_value OPENSSL_sk_zero OPENSSL_strlcat OPENSSL_strlcpy OPENSSL_strnlen OPENSSL_thread_stop OPENSSL_uni2asc OPENSSL_uni2utf8 OPENSSL_utf82uni OSSL_STORE_INFO_free OSSL_STORE_INFO_get0_CERT OSSL_STORE_INFO_get0_CRL OSSL_STORE_INFO_get0_NAME OSSL_STORE_INFO_get0_NAME_description OSSL_STORE_INFO_get0_PARAMS OSSL_STORE_INFO_get0_PKEY OSSL_STORE_INFO_get1_CERT OSSL_STORE_INFO_get1_CRL OSSL_STORE_INFO_get1_NAME OSSL_STORE_INFO_get1_NAME_description OSSL_STORE_INFO_get1_PARAMS OSSL_STORE_INFO_get1_PKEY OSSL_STORE_INFO_get_type OSSL_STORE_INFO_new_CERT OSSL_STORE_INFO_new_CRL OSSL_STORE_INFO_new_NAME OSSL_STORE_INFO_new_PARAMS OSSL_STORE_INFO_new_PKEY OSSL_STORE_INFO_set0_NAME_description OSSL_STORE_INFO_type_string OSSL_STORE_LOADER_free OSSL_STORE_LOADER_get0_engine OSSL_STORE_LOADER_get0_scheme OSSL_STORE_LOADER_new OSSL_STORE_LOADER_set_close OSSL_STORE_LOADER_set_ctrl OSSL_STORE_LOADER_set_eof OSSL_STORE_LOADER_set_error OSSL_STORE_LOADER_set_expect OSSL_STORE_LOADER_set_find OSSL_STORE_LOADER_set_load OSSL_STORE_LOADER_set_open OSSL_STORE_SEARCH_by_alias OSSL_STORE_SEARCH_by_issuer_serial OSSL_STORE_SEARCH_by_key_fingerprint OSSL_STORE_SEARCH_by_name OSSL_STORE_SEARCH_free OSSL_STORE_SEARCH_get0_bytes OSSL_STORE_SEARCH_get0_digest OSSL_STORE_SEARCH_get0_name OSSL_STORE_SEARCH_get0_serial OSSL_STORE_SEARCH_get0_string OSSL_STORE_SEARCH_get_type OSSL_STORE_close OSSL_STORE_ctrl OSSL_STORE_do_all_loaders OSSL_STORE_eof OSSL_STORE_error OSSL_STORE_expect OSSL_STORE_find OSSL_STORE_load OSSL_STORE_open OSSL_STORE_register_loader OSSL_STORE_supports_search OSSL_STORE_unregister_loader OSSL_STORE_vctrl OTHERNAME_cmp OTHERNAME_free OTHERNAME_it OTHERNAME_new OpenSSL_version OpenSSL_version_num PBE2PARAM_free PBE2PARAM_it PBE2PARAM_new PBEPARAM_free PBEPARAM_it PBEPARAM_new PBKDF2PARAM_free PBKDF2PARAM_it PBKDF2PARAM_new PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_SignFinal PEM_SignInit PEM_SignUpdate PEM_X509_INFO_read PEM_X509_INFO_read_bio PEM_X509_INFO_write_bio PEM_bytes_read_bio PEM_bytes_read_bio_secmem PEM_def_callback PEM_dek_info PEM_do_header PEM_get_EVP_CIPHER_INFO PEM_proc_type PEM_read PEM_read_CMS PEM_read_DHparams PEM_read_DSAPrivateKey PEM_read_DSA_PUBKEY PEM_read_DSAparams PEM_read_ECPKParameters PEM_read_ECPrivateKey PEM_read_EC_PUBKEY PEM_read_NETSCAPE_CERT_SEQUENCE PEM_read_PKCS7 PEM_read_PKCS8 PEM_read_PKCS8_PRIV_KEY_INFO PEM_read_PUBKEY PEM_read_PrivateKey PEM_read_RSAPrivateKey PEM_read_RSAPublicKey PEM_read_RSA_PUBKEY PEM_read_X509 PEM_read_X509_AUX PEM_read_X509_CRL PEM_read_X509_REQ PEM_read_bio PEM_read_bio_CMS PEM_read_bio_DHparams PEM_read_bio_DSAPrivateKey PEM_read_bio_DSA_PUBKEY PEM_read_bio_DSAparams PEM_read_bio_ECPKParameters PEM_read_bio_ECPrivateKey PEM_read_bio_EC_PUBKEY PEM_read_bio_NETSCAPE_CERT_SEQUENCE PEM_read_bio_PKCS7 PEM_read_bio_PKCS8 PEM_read_bio_PKCS8_PRIV_KEY_INFO PEM_read_bio_PUBKEY PEM_read_bio_Parameters PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_RSAPublicKey PEM_read_bio_RSA_PUBKEY PEM_read_bio_X509 PEM_read_bio_X509_AUX PEM_read_bio_X509_CRL PEM_read_bio_X509_REQ PEM_read_bio_ex PEM_write PEM_write_CMS PEM_write_DHparams PEM_write_DHxparams PEM_write_DSAPrivateKey PEM_write_DSA_PUBKEY PEM_write_DSAparams PEM_write_ECPKParameters PEM_write_ECPrivateKey PEM_write_EC_PUBKEY PEM_write_NETSCAPE_CERT_SEQUENCE PEM_write_PKCS7 PEM_write_PKCS8 PEM_write_PKCS8PrivateKey PEM_write_PKCS8PrivateKey_nid PEM_write_PKCS8_PRIV_KEY_INFO PEM_write_PUBKEY PEM_write_PrivateKey PEM_write_RSAPrivateKey PEM_write_RSAPublicKey PEM_write_RSA_PUBKEY PEM_write_X509 PEM_write_X509_AUX PEM_write_X509_CRL PEM_write_X509_REQ PEM_write_X509_REQ_NEW PEM_write_bio PEM_write_bio_ASN1_stream PEM_write_bio_CMS PEM_write_bio_CMS_stream PEM_write_bio_DHparams PEM_write_bio_DHxparams PEM_write_bio_DSAPrivateKey PEM_write_bio_DSA_PUBKEY PEM_write_bio_DSAparams PEM_write_bio_ECPKParameters PEM_write_bio_ECPrivateKey PEM_write_bio_EC_PUBKEY PEM_write_bio_NETSCAPE_CERT_SEQUENCE PEM_write_bio_PKCS7 PEM_write_bio_PKCS7_stream PEM_write_bio_PKCS8 PEM_write_bio_PKCS8PrivateKey PEM_write_bio_PKCS8PrivateKey_nid PEM_write_bio_PKCS8_PRIV_KEY_INFO PEM_write_bio_PUBKEY PEM_write_bio_Parameters PEM_write_bio_PrivateKey PEM_write_bio_PrivateKey_traditional PEM_write_bio_RSAPrivateKey PEM_write_bio_RSAPublicKey PEM_write_bio_RSA_PUBKEY PEM_write_bio_X509 PEM_write_bio_X509_AUX PEM_write_bio_X509_CRL PEM_write_bio_X509_REQ PEM_write_bio_X509_REQ_NEW PKCS12_AUTHSAFES_it PKCS12_BAGS_free PKCS12_BAGS_it PKCS12_BAGS_new PKCS12_MAC_DATA_free PKCS12_MAC_DATA_it PKCS12_MAC_DATA_new PKCS12_PBE_add PKCS12_PBE_keyivgen PKCS12_SAFEBAGS_it PKCS12_SAFEBAG_create0_p8inf PKCS12_SAFEBAG_create0_pkcs8 PKCS12_SAFEBAG_create_cert PKCS12_SAFEBAG_create_crl PKCS12_SAFEBAG_create_pkcs8_encrypt PKCS12_SAFEBAG_free PKCS12_SAFEBAG_get0_attr PKCS12_SAFEBAG_get0_attrs PKCS12_SAFEBAG_get0_p8inf PKCS12_SAFEBAG_get0_pkcs8 PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_type PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get1_crl PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_it PKCS12_SAFEBAG_new PKCS12_add_CSPName_asc PKCS12_add_cert PKCS12_add_friendlyname_asc PKCS12_add_friendlyname_uni PKCS12_add_friendlyname_utf8 PKCS12_add_key PKCS12_add_localkeyid PKCS12_add_safe PKCS12_add_safes PKCS12_create PKCS12_decrypt_skey PKCS12_free PKCS12_gen_mac PKCS12_get0_mac PKCS12_get_attr PKCS12_get_attr_gen PKCS12_get_friendlyname PKCS12_init PKCS12_it PKCS12_item_decrypt_d2i PKCS12_item_i2d_encrypt PKCS12_item_pack_safebag PKCS12_key_gen_asc PKCS12_key_gen_uni PKCS12_key_gen_utf8 PKCS12_mac_present PKCS12_new PKCS12_newpass PKCS12_pack_authsafes PKCS12_pack_p7data PKCS12_pack_p7encdata PKCS12_parse PKCS12_pbe_crypt PKCS12_set_mac PKCS12_setup_mac PKCS12_unpack_authsafes PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_verify_mac PKCS1_MGF1 PKCS5_PBE_add PKCS5_PBE_keyivgen PKCS5_PBKDF2_HMAC PKCS5_PBKDF2_HMAC_SHA1 PKCS5_pbe2_set PKCS5_pbe2_set_iv PKCS5_pbe2_set_scrypt PKCS5_pbe_set PKCS5_pbe_set0_algor PKCS5_pbkdf2_set PKCS5_v2_PBE_keyivgen PKCS5_v2_scrypt_keyivgen PKCS7_ATTR_SIGN_it PKCS7_ATTR_VERIFY_it PKCS7_DIGEST_free PKCS7_DIGEST_it PKCS7_DIGEST_new PKCS7_ENCRYPT_free PKCS7_ENCRYPT_it PKCS7_ENCRYPT_new PKCS7_ENC_CONTENT_free PKCS7_ENC_CONTENT_it PKCS7_ENC_CONTENT_new PKCS7_ENVELOPE_free PKCS7_ENVELOPE_it PKCS7_ENVELOPE_new PKCS7_ISSUER_AND_SERIAL_digest PKCS7_ISSUER_AND_SERIAL_free PKCS7_ISSUER_AND_SERIAL_it PKCS7_ISSUER_AND_SERIAL_new PKCS7_RECIP_INFO_free PKCS7_RECIP_INFO_get0_alg PKCS7_RECIP_INFO_it PKCS7_RECIP_INFO_new PKCS7_RECIP_INFO_set PKCS7_SIGNED_free PKCS7_SIGNED_it PKCS7_SIGNED_new PKCS7_SIGNER_INFO_free PKCS7_SIGNER_INFO_get0_algs PKCS7_SIGNER_INFO_it PKCS7_SIGNER_INFO_new PKCS7_SIGNER_INFO_set PKCS7_SIGNER_INFO_sign PKCS7_SIGN_ENVELOPE_free PKCS7_SIGN_ENVELOPE_it PKCS7_SIGN_ENVELOPE_new PKCS7_add0_attrib_signing_time PKCS7_add1_attrib_digest PKCS7_add_attrib_content_type PKCS7_add_attrib_smimecap PKCS7_add_attribute PKCS7_add_certificate PKCS7_add_crl PKCS7_add_recipient PKCS7_add_recipient_info PKCS7_add_signature PKCS7_add_signed_attribute PKCS7_add_signer PKCS7_cert_from_signer_info PKCS7_content_new PKCS7_ctrl PKCS7_dataDecode PKCS7_dataFinal PKCS7_dataInit PKCS7_dataVerify PKCS7_decrypt PKCS7_digest_from_attributes PKCS7_dup PKCS7_encrypt PKCS7_final PKCS7_free PKCS7_get0_signers PKCS7_get_attribute PKCS7_get_issuer_and_serial PKCS7_get_signed_attribute PKCS7_get_signer_info PKCS7_get_smimecap PKCS7_it PKCS7_new PKCS7_print_ctx PKCS7_set0_type_other PKCS7_set_attributes PKCS7_set_cipher PKCS7_set_content PKCS7_set_digest PKCS7_set_signed_attributes PKCS7_set_type PKCS7_sign PKCS7_sign_add_signer PKCS7_signatureVerify PKCS7_simple_smimecap PKCS7_stream PKCS7_to_TS_TST_INFO PKCS7_verify PKCS8_PRIV_KEY_INFO_free PKCS8_PRIV_KEY_INFO_it PKCS8_PRIV_KEY_INFO_new PKCS8_add_keyusage PKCS8_decrypt PKCS8_encrypt PKCS8_get_attr PKCS8_pkey_add1_attr_by_NID PKCS8_pkey_get0 PKCS8_pkey_get0_attrs PKCS8_pkey_set0 PKCS8_set0_pbe PKEY_USAGE_PERIOD_free PKEY_USAGE_PERIOD_it PKEY_USAGE_PERIOD_new POLICYINFO_free POLICYINFO_it POLICYINFO_new POLICYQUALINFO_free POLICYQUALINFO_it POLICYQUALINFO_new POLICY_CONSTRAINTS_free POLICY_CONSTRAINTS_it POLICY_CONSTRAINTS_new POLICY_MAPPINGS_it POLICY_MAPPING_free POLICY_MAPPING_it POLICY_MAPPING_new PROFESSION_INFO_free PROFESSION_INFO_get0_addProfessionInfo PROFESSION_INFO_get0_namingAuthority PROFESSION_INFO_get0_professionItems PROFESSION_INFO_get0_professionOIDs PROFESSION_INFO_get0_registrationNumber PROFESSION_INFO_it PROFESSION_INFO_new PROFESSION_INFO_set0_addProfessionInfo PROFESSION_INFO_set0_namingAuthority PROFESSION_INFO_set0_professionItems PROFESSION_INFO_set0_professionOIDs PROFESSION_INFO_set0_registrationNumber PROXY_CERT_INFO_EXTENSION_free PROXY_CERT_INFO_EXTENSION_it PROXY_CERT_INFO_EXTENSION_new PROXY_POLICY_free PROXY_POLICY_it PROXY_POLICY_new RAND_DRBG_bytes RAND_DRBG_free RAND_DRBG_generate RAND_DRBG_get0_master RAND_DRBG_get0_private RAND_DRBG_get0_public RAND_DRBG_get_ex_data RAND_DRBG_instantiate RAND_DRBG_new RAND_DRBG_reseed RAND_DRBG_secure_new RAND_DRBG_set RAND_DRBG_set_callbacks RAND_DRBG_set_defaults RAND_DRBG_set_ex_data RAND_DRBG_set_reseed_defaults RAND_DRBG_set_reseed_interval RAND_DRBG_set_reseed_time_interval RAND_DRBG_uninstantiate RAND_OpenSSL RAND_add RAND_bytes RAND_event RAND_file_name RAND_get_rand_method RAND_keep_random_devices_open RAND_load_file RAND_poll RAND_priv_bytes RAND_pseudo_bytes RAND_screen RAND_seed RAND_set_rand_engine RAND_set_rand_method RAND_status RAND_write_file RC2_cbc_encrypt RC2_cfb64_encrypt RC2_decrypt RC2_ecb_encrypt RC2_encrypt RC2_ofb64_encrypt RC2_set_key RC4 RC4_options RC4_set_key RIPEMD160 RIPEMD160_Final RIPEMD160_Init RIPEMD160_Transform RIPEMD160_Update RSAPrivateKey_dup RSAPrivateKey_it RSAPublicKey_dup RSAPublicKey_it RSA_OAEP_PARAMS_free RSA_OAEP_PARAMS_it RSA_OAEP_PARAMS_new RSA_PKCS1_OpenSSL RSA_PSS_PARAMS_free RSA_PSS_PARAMS_it RSA_PSS_PARAMS_new RSA_X931_derive_ex RSA_X931_generate_key_ex RSA_X931_hash_id RSA_bits RSA_blinding_off RSA_blinding_on RSA_check_key RSA_check_key_ex RSA_clear_flags RSA_flags RSA_free RSA_generate_key RSA_generate_key_ex RSA_generate_multi_prime_key RSA_get0_crt_params RSA_get0_d RSA_get0_dmp1 RSA_get0_dmq1 RSA_get0_e RSA_get0_engine RSA_get0_factors RSA_get0_iqmp RSA_get0_key RSA_get0_multi_prime_crt_params RSA_get0_multi_prime_factors RSA_get0_n RSA_get0_p RSA_get0_q RSA_get_default_method RSA_get_ex_data RSA_get_method RSA_get_multi_prime_extra_count RSA_get_version RSA_meth_dup RSA_meth_free RSA_meth_get0_app_data RSA_meth_get0_name RSA_meth_get_bn_mod_exp RSA_meth_get_finish RSA_meth_get_flags RSA_meth_get_init RSA_meth_get_keygen RSA_meth_get_mod_exp RSA_meth_get_multi_prime_keygen RSA_meth_get_priv_dec RSA_meth_get_priv_enc RSA_meth_get_pub_dec RSA_meth_get_pub_enc RSA_meth_get_sign RSA_meth_get_verify RSA_meth_new RSA_meth_set0_app_data RSA_meth_set1_name RSA_meth_set_bn_mod_exp RSA_meth_set_finish RSA_meth_set_flags RSA_meth_set_init RSA_meth_set_keygen RSA_meth_set_mod_exp RSA_meth_set_multi_prime_keygen RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_meth_set_sign RSA_meth_set_verify RSA_new RSA_new_method RSA_null_method RSA_padding_add_PKCS1_OAEP RSA_padding_add_PKCS1_OAEP_mgf1 RSA_padding_add_PKCS1_PSS RSA_padding_add_PKCS1_PSS_mgf1 RSA_padding_add_PKCS1_type_1 RSA_padding_add_PKCS1_type_2 RSA_padding_add_SSLv23 RSA_padding_add_X931 RSA_padding_add_none RSA_padding_check_PKCS1_OAEP RSA_padding_check_PKCS1_OAEP_mgf1 RSA_padding_check_PKCS1_type_1 RSA_padding_check_PKCS1_type_2 RSA_padding_check_SSLv23 RSA_padding_check_X931 RSA_padding_check_none RSA_pkey_ctx_ctrl RSA_print RSA_print_fp RSA_private_decrypt RSA_private_encrypt RSA_public_decrypt RSA_public_encrypt RSA_security_bits RSA_set0_crt_params RSA_set0_factors RSA_set0_key RSA_set0_multi_prime_params RSA_set_default_method RSA_set_ex_data RSA_set_flags RSA_set_method RSA_setup_blinding RSA_sign RSA_sign_ASN1_OCTET_STRING RSA_size RSA_test_flags RSA_up_ref RSA_verify RSA_verify_ASN1_OCTET_STRING RSA_verify_PKCS1_PSS RSA_verify_PKCS1_PSS_mgf1 SCRYPT_PARAMS_free SCRYPT_PARAMS_it SCRYPT_PARAMS_new SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free SCT_get0_extensions SCT_get0_log_id SCT_get0_signature SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source SCT_get_timestamp SCT_get_validation_status SCT_get_version SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions SCT_set0_log_id SCT_set0_signature SCT_set1_extensions SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type SCT_set_signature_nid SCT_set_source SCT_set_timestamp SCT_set_version SCT_validate SCT_validation_status_string SEED_cbc_encrypt SEED_cfb128_encrypt SEED_decrypt SEED_ecb_encrypt SEED_encrypt SEED_ofb128_encrypt SEED_set_key SHA1 SHA1_Final SHA1_Init SHA1_Transform SHA1_Update SHA224 SHA224_Final SHA224_Init SHA224_Update SHA256 SHA256_Final SHA256_Init SHA256_Transform SHA256_Update SHA384 SHA384_Final SHA384_Init SHA384_Update SHA512 SHA512_Final SHA512_Init SHA512_Transform SHA512_Update SMIME_crlf_copy SMIME_read_ASN1 SMIME_read_CMS SMIME_read_PKCS7 SMIME_text SMIME_write_ASN1 SMIME_write_CMS SMIME_write_PKCS7 SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_VBASE_free SRP_VBASE_get1_by_user SRP_VBASE_get_by_user SRP_VBASE_init SRP_VBASE_new SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier SRP_create_verifier_BN SRP_get_default_gN SRP_user_pwd_free SXNETID_free SXNETID_it SXNETID_new SXNET_add_id_INTEGER SXNET_add_id_asc SXNET_add_id_ulong SXNET_free SXNET_get_id_INTEGER SXNET_get_id_asc SXNET_get_id_ulong SXNET_it SXNET_new TLS_FEATURE_free TLS_FEATURE_new TS_ACCURACY_dup TS_ACCURACY_free TS_ACCURACY_get_micros TS_ACCURACY_get_millis TS_ACCURACY_get_seconds TS_ACCURACY_new TS_ACCURACY_set_micros TS_ACCURACY_set_millis TS_ACCURACY_set_seconds TS_ASN1_INTEGER_print_bio TS_CONF_get_tsa_section TS_CONF_load_cert TS_CONF_load_certs TS_CONF_load_key TS_CONF_set_accuracy TS_CONF_set_certs TS_CONF_set_clock_precision_digits TS_CONF_set_crypto_device TS_CONF_set_def_policy TS_CONF_set_default_engine TS_CONF_set_digests TS_CONF_set_ess_cert_id_chain TS_CONF_set_ess_cert_id_digest TS_CONF_set_ordering TS_CONF_set_policies TS_CONF_set_serial TS_CONF_set_signer_cert TS_CONF_set_signer_digest TS_CONF_set_signer_key TS_CONF_set_tsa_name TS_MSG_IMPRINT_dup TS_MSG_IMPRINT_free TS_MSG_IMPRINT_get_algo TS_MSG_IMPRINT_get_msg TS_MSG_IMPRINT_new TS_MSG_IMPRINT_print_bio TS_MSG_IMPRINT_set_algo TS_MSG_IMPRINT_set_msg TS_OBJ_print_bio TS_REQ_add_ext TS_REQ_delete_ext TS_REQ_dup TS_REQ_ext_free TS_REQ_free TS_REQ_get_cert_req TS_REQ_get_ext TS_REQ_get_ext_by_NID TS_REQ_get_ext_by_OBJ TS_REQ_get_ext_by_critical TS_REQ_get_ext_count TS_REQ_get_ext_d2i TS_REQ_get_exts TS_REQ_get_msg_imprint TS_REQ_get_nonce TS_REQ_get_policy_id TS_REQ_get_version TS_REQ_new TS_REQ_print_bio TS_REQ_set_cert_req TS_REQ_set_msg_imprint TS_REQ_set_nonce TS_REQ_set_policy_id TS_REQ_set_version TS_REQ_to_TS_VERIFY_CTX TS_RESP_CTX_add_failure_info TS_RESP_CTX_add_flags TS_RESP_CTX_add_md TS_RESP_CTX_add_policy TS_RESP_CTX_free TS_RESP_CTX_get_request TS_RESP_CTX_get_tst_info TS_RESP_CTX_new TS_RESP_CTX_set_accuracy TS_RESP_CTX_set_certs TS_RESP_CTX_set_clock_precision_digits TS_RESP_CTX_set_def_policy TS_RESP_CTX_set_ess_cert_id_digest TS_RESP_CTX_set_extension_cb TS_RESP_CTX_set_serial_cb TS_RESP_CTX_set_signer_cert TS_RESP_CTX_set_signer_digest TS_RESP_CTX_set_signer_key TS_RESP_CTX_set_status_info TS_RESP_CTX_set_status_info_cond TS_RESP_CTX_set_time_cb TS_RESP_create_response TS_RESP_dup TS_RESP_free TS_RESP_get_status_info TS_RESP_get_token TS_RESP_get_tst_info TS_RESP_new TS_RESP_print_bio TS_RESP_set_status_info TS_RESP_set_tst_info TS_RESP_verify_response TS_RESP_verify_signature TS_RESP_verify_token TS_STATUS_INFO_dup TS_STATUS_INFO_free TS_STATUS_INFO_get0_failure_info TS_STATUS_INFO_get0_status TS_STATUS_INFO_get0_text TS_STATUS_INFO_new TS_STATUS_INFO_print_bio TS_STATUS_INFO_set_status TS_TST_INFO_add_ext TS_TST_INFO_delete_ext TS_TST_INFO_dup TS_TST_INFO_ext_free TS_TST_INFO_free TS_TST_INFO_get_accuracy TS_TST_INFO_get_ext TS_TST_INFO_get_ext_by_NID TS_TST_INFO_get_ext_by_OBJ TS_TST_INFO_get_ext_by_critical TS_TST_INFO_get_ext_count TS_TST_INFO_get_ext_d2i TS_TST_INFO_get_exts TS_TST_INFO_get_msg_imprint TS_TST_INFO_get_nonce TS_TST_INFO_get_ordering TS_TST_INFO_get_policy_id TS_TST_INFO_get_serial TS_TST_INFO_get_time TS_TST_INFO_get_tsa TS_TST_INFO_get_version TS_TST_INFO_new TS_TST_INFO_print_bio TS_TST_INFO_set_accuracy TS_TST_INFO_set_msg_imprint TS_TST_INFO_set_nonce TS_TST_INFO_set_ordering TS_TST_INFO_set_policy_id TS_TST_INFO_set_serial TS_TST_INFO_set_time TS_TST_INFO_set_tsa TS_TST_INFO_set_version TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_add_flags TS_VERIFY_CTX_cleanup TS_VERIFY_CTX_free TS_VERIFY_CTX_init TS_VERIFY_CTX_new TS_VERIFY_CTX_set_data TS_VERIFY_CTX_set_flags TS_VERIFY_CTX_set_imprint TS_VERIFY_CTX_set_store TS_X509_ALGOR_print_bio TS_ext_print_bio TXT_DB_create_index TXT_DB_free TXT_DB_get_by_index TXT_DB_insert TXT_DB_read TXT_DB_write UINT32_it UINT64_it UI_OpenSSL UI_UTIL_read_pw UI_UTIL_read_pw_string UI_UTIL_wrap_read_pem_callback UI_add_error_string UI_add_info_string UI_add_input_boolean UI_add_input_string UI_add_user_data UI_add_verify_string UI_construct_prompt UI_create_method UI_ctrl UI_destroy_method UI_dup_error_string UI_dup_info_string UI_dup_input_boolean UI_dup_input_string UI_dup_user_data UI_dup_verify_string UI_free UI_get0_action_string UI_get0_output_string UI_get0_result UI_get0_result_string UI_get0_test_string UI_get0_user_data UI_get_default_method UI_get_ex_data UI_get_input_flags UI_get_method UI_get_result_length UI_get_result_maxsize UI_get_result_minsize UI_get_result_string_length UI_get_string_type UI_method_get_closer UI_method_get_data_destructor UI_method_get_data_duplicator UI_method_get_ex_data UI_method_get_flusher UI_method_get_opener UI_method_get_prompt_constructor UI_method_get_reader UI_method_get_writer UI_method_set_closer UI_method_set_data_duplicator UI_method_set_ex_data UI_method_set_flusher UI_method_set_opener UI_method_set_prompt_constructor UI_method_set_reader UI_method_set_writer UI_new UI_new_method UI_null UI_process UI_set_default_method UI_set_ex_data UI_set_method UI_set_result UI_set_result_ex USERNOTICE_free USERNOTICE_it USERNOTICE_new UTF8_getc UTF8_putc WHIRLPOOL WHIRLPOOL_BitUpdate WHIRLPOOL_Final WHIRLPOOL_Init WHIRLPOOL_Update X509V3_EXT_CRL_add_conf X509V3_EXT_CRL_add_nconf X509V3_EXT_REQ_add_conf X509V3_EXT_REQ_add_nconf X509V3_EXT_add X509V3_EXT_add_alias X509V3_EXT_add_conf X509V3_EXT_add_list X509V3_EXT_add_nconf X509V3_EXT_add_nconf_sk X509V3_EXT_cleanup X509V3_EXT_conf X509V3_EXT_conf_nid X509V3_EXT_d2i X509V3_EXT_get X509V3_EXT_get_nid X509V3_EXT_i2d X509V3_EXT_nconf X509V3_EXT_nconf_nid X509V3_EXT_print X509V3_EXT_print_fp X509V3_EXT_val_prn X509V3_NAME_from_section X509V3_add1_i2d X509V3_add_standard_extensions X509V3_add_value X509V3_add_value_bool X509V3_add_value_bool_nf X509V3_add_value_int X509V3_add_value_uchar X509V3_conf_free X509V3_extensions_print X509V3_get_d2i X509V3_get_section X509V3_get_string X509V3_get_value_bool X509V3_get_value_int X509V3_parse_list X509V3_section_free X509V3_set_conf_lhash X509V3_set_ctx X509V3_set_nconf X509V3_string_free X509_ALGORS_it X509_ALGOR_cmp X509_ALGOR_dup X509_ALGOR_free X509_ALGOR_get0 X509_ALGOR_it X509_ALGOR_new X509_ALGOR_set0 X509_ALGOR_set_md X509_ATTRIBUTE_count X509_ATTRIBUTE_create X509_ATTRIBUTE_create_by_NID X509_ATTRIBUTE_create_by_OBJ X509_ATTRIBUTE_create_by_txt X509_ATTRIBUTE_dup X509_ATTRIBUTE_free X509_ATTRIBUTE_get0_data X509_ATTRIBUTE_get0_object X509_ATTRIBUTE_get0_type X509_ATTRIBUTE_it X509_ATTRIBUTE_new X509_ATTRIBUTE_set1_data X509_ATTRIBUTE_set1_object X509_CERT_AUX_free X509_CERT_AUX_it X509_CERT_AUX_new X509_CINF_free X509_CINF_it X509_CINF_new X509_CRL_INFO_free X509_CRL_INFO_it X509_CRL_INFO_new X509_CRL_METHOD_free X509_CRL_METHOD_new X509_CRL_add0_revoked X509_CRL_add1_ext_i2d X509_CRL_add_ext X509_CRL_check_suiteb X509_CRL_cmp X509_CRL_delete_ext X509_CRL_diff X509_CRL_digest X509_CRL_dup X509_CRL_free X509_CRL_get0_by_cert X509_CRL_get0_by_serial X509_CRL_get0_extensions X509_CRL_get0_lastUpdate X509_CRL_get0_nextUpdate X509_CRL_get0_signature X509_CRL_get_REVOKED X509_CRL_get_ext X509_CRL_get_ext_by_NID X509_CRL_get_ext_by_OBJ X509_CRL_get_ext_by_critical X509_CRL_get_ext_count X509_CRL_get_ext_d2i X509_CRL_get_issuer X509_CRL_get_lastUpdate X509_CRL_get_meth_data X509_CRL_get_nextUpdate X509_CRL_get_signature_nid X509_CRL_get_version X509_CRL_http_nbio X509_CRL_it X509_CRL_match X509_CRL_new X509_CRL_print X509_CRL_print_ex X509_CRL_print_fp X509_CRL_set1_lastUpdate X509_CRL_set1_nextUpdate X509_CRL_set_default_method X509_CRL_set_issuer_name X509_CRL_set_meth_data X509_CRL_set_version X509_CRL_sign X509_CRL_sign_ctx X509_CRL_sort X509_CRL_up_ref X509_CRL_verify X509_EXTENSIONS_it X509_EXTENSION_create_by_NID X509_EXTENSION_create_by_OBJ X509_EXTENSION_dup X509_EXTENSION_free X509_EXTENSION_get_critical X509_EXTENSION_get_data X509_EXTENSION_get_object X509_EXTENSION_it X509_EXTENSION_new X509_EXTENSION_set_critical X509_EXTENSION_set_data X509_EXTENSION_set_object X509_INFO_free X509_INFO_new X509_LOOKUP_by_alias X509_LOOKUP_by_fingerprint X509_LOOKUP_by_issuer_serial X509_LOOKUP_by_subject X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_free X509_LOOKUP_get_method_data X509_LOOKUP_get_store X509_LOOKUP_hash_dir X509_LOOKUP_init X509_LOOKUP_meth_free X509_LOOKUP_meth_get_ctrl X509_LOOKUP_meth_get_free X509_LOOKUP_meth_get_get_by_alias X509_LOOKUP_meth_get_get_by_fingerprint X509_LOOKUP_meth_get_get_by_issuer_serial X509_LOOKUP_meth_get_get_by_subject X509_LOOKUP_meth_get_init X509_LOOKUP_meth_get_new_item X509_LOOKUP_meth_get_shutdown X509_LOOKUP_meth_new X509_LOOKUP_meth_set_ctrl X509_LOOKUP_meth_set_free X509_LOOKUP_meth_set_get_by_alias X509_LOOKUP_meth_set_get_by_fingerprint X509_LOOKUP_meth_set_get_by_issuer_serial X509_LOOKUP_meth_set_get_by_subject X509_LOOKUP_meth_set_init X509_LOOKUP_meth_set_new_item X509_LOOKUP_meth_set_shutdown X509_LOOKUP_new X509_LOOKUP_set_method_data X509_LOOKUP_shutdown X509_NAME_ENTRY_create_by_NID X509_NAME_ENTRY_create_by_OBJ X509_NAME_ENTRY_create_by_txt X509_NAME_ENTRY_dup X509_NAME_ENTRY_free X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_ENTRY_it X509_NAME_ENTRY_new X509_NAME_ENTRY_set X509_NAME_ENTRY_set_data X509_NAME_ENTRY_set_object X509_NAME_add_entry X509_NAME_add_entry_by_NID X509_NAME_add_entry_by_OBJ X509_NAME_add_entry_by_txt X509_NAME_cmp X509_NAME_delete_entry X509_NAME_digest X509_NAME_dup X509_NAME_entry_count X509_NAME_free X509_NAME_get0_der X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_get_text_by_NID X509_NAME_get_text_by_OBJ X509_NAME_hash X509_NAME_hash_old X509_NAME_it X509_NAME_new X509_NAME_oneline X509_NAME_print X509_NAME_print_ex X509_NAME_print_ex_fp X509_NAME_set X509_OBJECT_free X509_OBJECT_get0_X509 X509_OBJECT_get0_X509_CRL X509_OBJECT_get_type X509_OBJECT_idx_by_subject X509_OBJECT_new X509_OBJECT_retrieve_by_subject X509_OBJECT_retrieve_match X509_OBJECT_set1_X509 X509_OBJECT_set1_X509_CRL X509_OBJECT_up_ref_count X509_PKEY_free X509_PKEY_new X509_POLICY_NODE_print X509_PUBKEY_free X509_PUBKEY_get X509_PUBKEY_get0 X509_PUBKEY_get0_param X509_PUBKEY_it X509_PUBKEY_new X509_PUBKEY_set X509_PUBKEY_set0_param X509_PURPOSE_add X509_PURPOSE_cleanup X509_PURPOSE_get0 X509_PURPOSE_get0_name X509_PURPOSE_get0_sname X509_PURPOSE_get_by_id X509_PURPOSE_get_by_sname X509_PURPOSE_get_count X509_PURPOSE_get_id X509_PURPOSE_get_trust X509_PURPOSE_set X509_REQ_INFO_free X509_REQ_INFO_it X509_REQ_INFO_new X509_REQ_add1_attr X509_REQ_add1_attr_by_NID X509_REQ_add1_attr_by_OBJ X509_REQ_add1_attr_by_txt X509_REQ_add_extensions X509_REQ_add_extensions_nid X509_REQ_check_private_key X509_REQ_delete_attr X509_REQ_digest X509_REQ_dup X509_REQ_extension_nid X509_REQ_free X509_REQ_get0_pubkey X509_REQ_get0_signature X509_REQ_get1_email X509_REQ_get_X509_PUBKEY X509_REQ_get_attr X509_REQ_get_attr_by_NID X509_REQ_get_attr_by_OBJ X509_REQ_get_attr_count X509_REQ_get_extension_nids X509_REQ_get_extensions X509_REQ_get_pubkey X509_REQ_get_signature_nid X509_REQ_get_subject_name X509_REQ_get_version X509_REQ_it X509_REQ_new X509_REQ_print X509_REQ_print_ex X509_REQ_print_fp X509_REQ_set_extension_nids X509_REQ_set_pubkey X509_REQ_set_subject_name X509_REQ_set_version X509_REQ_sign X509_REQ_sign_ctx X509_REQ_to_X509 X509_REQ_verify X509_REVOKED_add1_ext_i2d X509_REVOKED_add_ext X509_REVOKED_delete_ext X509_REVOKED_dup X509_REVOKED_free X509_REVOKED_get0_extensions X509_REVOKED_get0_revocationDate X509_REVOKED_get0_serialNumber X509_REVOKED_get_ext X509_REVOKED_get_ext_by_NID X509_REVOKED_get_ext_by_OBJ X509_REVOKED_get_ext_by_critical X509_REVOKED_get_ext_count X509_REVOKED_get_ext_d2i X509_REVOKED_it X509_REVOKED_new X509_REVOKED_set_revocationDate X509_REVOKED_set_serialNumber X509_SIG_INFO_get X509_SIG_INFO_set X509_SIG_free X509_SIG_get0 X509_SIG_getm X509_SIG_it X509_SIG_new X509_STORE_CTX_cleanup X509_STORE_CTX_free X509_STORE_CTX_get0_cert X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_current_crl X509_STORE_CTX_get0_current_issuer X509_STORE_CTX_get0_param X509_STORE_CTX_get0_parent_ctx X509_STORE_CTX_get0_policy_tree X509_STORE_CTX_get0_store X509_STORE_CTX_get0_untrusted X509_STORE_CTX_get1_certs X509_STORE_CTX_get1_chain X509_STORE_CTX_get1_crls X509_STORE_CTX_get1_issuer X509_STORE_CTX_get_by_subject X509_STORE_CTX_get_cert_crl X509_STORE_CTX_get_check_crl X509_STORE_CTX_get_check_issued X509_STORE_CTX_get_check_policy X509_STORE_CTX_get_check_revocation X509_STORE_CTX_get_cleanup X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_CTX_get_explicit_policy X509_STORE_CTX_get_get_crl X509_STORE_CTX_get_get_issuer X509_STORE_CTX_get_lookup_certs X509_STORE_CTX_get_lookup_crls X509_STORE_CTX_get_num_untrusted X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify X509_STORE_CTX_get_verify_cb X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_purpose_inherit X509_STORE_CTX_set0_crls X509_STORE_CTX_set0_dane X509_STORE_CTX_set0_param X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set0_verified_chain X509_STORE_CTX_set_cert X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_default X509_STORE_CTX_set_depth X509_STORE_CTX_set_error X509_STORE_CTX_set_error_depth X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_purpose X509_STORE_CTX_set_time X509_STORE_CTX_set_trust X509_STORE_CTX_set_verify X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_free X509_STORE_get0_objects X509_STORE_get0_param X509_STORE_get_cert_crl X509_STORE_get_check_crl X509_STORE_get_check_issued X509_STORE_get_check_policy X509_STORE_get_check_revocation X509_STORE_get_cleanup X509_STORE_get_ex_data X509_STORE_get_get_crl X509_STORE_get_get_issuer X509_STORE_get_lookup_certs X509_STORE_get_lookup_crls X509_STORE_get_verify X509_STORE_get_verify_cb X509_STORE_load_locations X509_STORE_lock X509_STORE_new X509_STORE_set1_param X509_STORE_set_cert_crl X509_STORE_set_check_crl X509_STORE_set_check_issued X509_STORE_set_check_policy X509_STORE_set_check_revocation X509_STORE_set_cleanup X509_STORE_set_default_paths X509_STORE_set_depth X509_STORE_set_ex_data X509_STORE_set_flags X509_STORE_set_get_crl X509_STORE_set_get_issuer X509_STORE_set_lookup_certs X509_STORE_set_lookup_crls X509_STORE_set_purpose X509_STORE_set_trust X509_STORE_set_verify X509_STORE_set_verify_cb X509_STORE_unlock X509_STORE_up_ref X509_TRUST_add X509_TRUST_cleanup X509_TRUST_get0 X509_TRUST_get0_name X509_TRUST_get_by_id X509_TRUST_get_count X509_TRUST_get_flags X509_TRUST_get_trust X509_TRUST_set X509_TRUST_set_default X509_VAL_free X509_VAL_it X509_VAL_new X509_VERIFY_PARAM_add0_policy X509_VERIFY_PARAM_add0_table X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_clear_flags X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0 X509_VERIFY_PARAM_get0_name X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_auth_level X509_VERIFY_PARAM_get_count X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_get_flags X509_VERIFY_PARAM_get_hostflags X509_VERIFY_PARAM_get_inh_flags X509_VERIFY_PARAM_get_time X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_lookup X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_email X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set1_ip X509_VERIFY_PARAM_set1_ip_asc X509_VERIFY_PARAM_set1_name X509_VERIFY_PARAM_set1_policies X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_flags X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_inh_flags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_time X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_table_cleanup X509_add1_ext_i2d X509_add1_reject_object X509_add1_trust_object X509_add_ext X509_alias_get0 X509_alias_set1 X509_aux_print X509_certificate_type X509_chain_check_suiteb X509_chain_up_ref X509_check_akid X509_check_ca X509_check_email X509_check_host X509_check_ip X509_check_ip_asc X509_check_issued X509_check_private_key X509_check_purpose X509_check_trust X509_cmp X509_cmp_current_time X509_cmp_time X509_delete_ext X509_digest X509_dup X509_email_free X509_find_by_issuer_and_serial X509_find_by_subject X509_free X509_get0_authority_issuer X509_get0_authority_key_id X509_get0_authority_serial X509_get0_extensions X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get0_pubkey_bitstr X509_get0_reject_objects X509_get0_serialNumber X509_get0_signature X509_get0_subject_key_id X509_get0_tbs_sigalg X509_get0_trust_objects X509_get0_uids X509_get1_email X509_get1_ocsp X509_get_X509_PUBKEY X509_get_default_cert_area X509_get_default_cert_dir X509_get_default_cert_dir_env X509_get_default_cert_file X509_get_default_cert_file_env X509_get_default_private_dir X509_get_ex_data X509_get_ext X509_get_ext_by_NID X509_get_ext_by_OBJ X509_get_ext_by_critical X509_get_ext_count X509_get_ext_d2i X509_get_extended_key_usage X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_pathlen X509_get_proxy_pathlen X509_get_pubkey X509_get_pubkey_parameters X509_get_serialNumber X509_get_signature_info X509_get_signature_nid X509_get_signature_type X509_get_subject_name X509_get_version X509_getm_notAfter X509_getm_notBefore X509_gmtime_adj X509_http_nbio X509_issuer_and_serial_cmp X509_issuer_and_serial_hash X509_issuer_name_cmp X509_issuer_name_hash X509_issuer_name_hash_old X509_it X509_keyid_get0 X509_keyid_set1 X509_load_cert_crl_file X509_load_cert_file X509_load_crl_file X509_new X509_ocspid_print X509_policy_check X509_policy_level_get0_node X509_policy_level_node_count X509_policy_node_get0_parent X509_policy_node_get0_policy X509_policy_node_get0_qualifiers X509_policy_tree_free X509_policy_tree_get0_level X509_policy_tree_get0_policies X509_policy_tree_get0_user_policies X509_policy_tree_level_count X509_print X509_print_ex X509_print_ex_fp X509_print_fp X509_pubkey_digest X509_reject_clear X509_set1_notAfter X509_set1_notBefore X509_set_ex_data X509_set_issuer_name X509_set_proxy_flag X509_set_proxy_pathlen X509_set_pubkey X509_set_serialNumber X509_set_subject_name X509_set_version X509_sign X509_sign_ctx X509_signature_dump X509_signature_print X509_subject_name_cmp X509_subject_name_hash X509_subject_name_hash_old X509_supported_extension X509_time_adj X509_time_adj_ex X509_to_X509_REQ X509_trust_clear X509_trusted X509_up_ref X509_verify X509_verify_cert X509_verify_cert_error_string X509at_add1_attr X509at_add1_attr_by_NID X509at_add1_attr_by_OBJ X509at_add1_attr_by_txt X509at_delete_attr X509at_get0_data_by_OBJ X509at_get_attr X509at_get_attr_by_NID X509at_get_attr_by_OBJ X509at_get_attr_count X509v3_add_ext X509v3_addr_add_inherit X509v3_addr_add_prefix X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi X509v3_addr_get_range X509v3_addr_inherits X509v3_addr_is_canonical X509v3_addr_subset X509v3_addr_validate_path X509v3_addr_validate_resource_set X509v3_asid_add_id_or_range X509v3_asid_add_inherit X509v3_asid_canonize X509v3_asid_inherits X509v3_asid_is_canonical X509v3_asid_subset X509v3_asid_validate_path X509v3_asid_validate_resource_set X509v3_delete_ext X509v3_get_ext X509v3_get_ext_by_NID X509v3_get_ext_by_OBJ X509v3_get_ext_by_critical X509v3_get_ext_count ZINT32_it ZINT64_it ZLONG_it ZUINT32_it ZUINT64_it _shadow_DES_check_key a2d_ASN1_OBJECT a2i_ASN1_ENUMERATED a2i_ASN1_INTEGER a2i_ASN1_STRING a2i_GENERAL_NAME a2i_IPADDRESS a2i_IPADDRESS_NC b2i_PVK_bio b2i_PrivateKey b2i_PrivateKey_bio b2i_PublicKey b2i_PublicKey_bio conf_ssl_get conf_ssl_get_cmd conf_ssl_name_find d2i_ACCESS_DESCRIPTION d2i_ADMISSIONS d2i_ADMISSION_SYNTAX d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers d2i_ASN1_BIT_STRING d2i_ASN1_BMPSTRING d2i_ASN1_ENUMERATED d2i_ASN1_GENERALIZEDTIME d2i_ASN1_GENERALSTRING d2i_ASN1_IA5STRING d2i_ASN1_INTEGER d2i_ASN1_NULL d2i_ASN1_OBJECT d2i_ASN1_OCTET_STRING d2i_ASN1_PRINTABLE d2i_ASN1_PRINTABLESTRING d2i_ASN1_SEQUENCE_ANY d2i_ASN1_SET_ANY d2i_ASN1_T61STRING d2i_ASN1_TIME d2i_ASN1_TYPE d2i_ASN1_UINTEGER d2i_ASN1_UNIVERSALSTRING d2i_ASN1_UTCTIME d2i_ASN1_UTF8STRING d2i_ASN1_VISIBLESTRING d2i_ASRange d2i_AUTHORITY_INFO_ACCESS d2i_AUTHORITY_KEYID d2i_AutoPrivateKey d2i_BASIC_CONSTRAINTS d2i_CERTIFICATEPOLICIES d2i_CMS_ContentInfo d2i_CMS_ReceiptRequest d2i_CMS_bio d2i_CRL_DIST_POINTS d2i_DHparams d2i_DHxparams d2i_DIRECTORYSTRING d2i_DISPLAYTEXT d2i_DIST_POINT d2i_DIST_POINT_NAME d2i_DSAPrivateKey d2i_DSAPrivateKey_bio d2i_DSAPrivateKey_fp d2i_DSAPublicKey d2i_DSA_PUBKEY d2i_DSA_PUBKEY_bio d2i_DSA_PUBKEY_fp d2i_DSA_SIG d2i_DSAparams d2i_ECDSA_SIG d2i_ECPKParameters d2i_ECParameters d2i_ECPrivateKey d2i_ECPrivateKey_bio d2i_ECPrivateKey_fp d2i_EC_PUBKEY d2i_EC_PUBKEY_bio d2i_EC_PUBKEY_fp d2i_EDIPARTYNAME d2i_ESS_CERT_ID d2i_ESS_CERT_ID_V2 d2i_ESS_ISSUER_SERIAL d2i_ESS_SIGNING_CERT d2i_ESS_SIGNING_CERT_V2 d2i_EXTENDED_KEY_USAGE d2i_GENERAL_NAME d2i_GENERAL_NAMES d2i_IPAddressChoice d2i_IPAddressFamily d2i_IPAddressOrRange d2i_IPAddressRange d2i_ISSUING_DIST_POINT d2i_NAMING_AUTHORITY d2i_NETSCAPE_CERT_SEQUENCE d2i_NETSCAPE_SPKAC d2i_NETSCAPE_SPKI d2i_NOTICEREF d2i_OCSP_BASICRESP d2i_OCSP_CERTID d2i_OCSP_CERTSTATUS d2i_OCSP_CRLID d2i_OCSP_ONEREQ d2i_OCSP_REQINFO d2i_OCSP_REQUEST d2i_OCSP_RESPBYTES d2i_OCSP_RESPDATA d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_OCSP_REVOKEDINFO d2i_OCSP_SERVICELOC d2i_OCSP_SIGNATURE d2i_OCSP_SINGLERESP d2i_OTHERNAME d2i_PBE2PARAM d2i_PBEPARAM d2i_PBKDF2PARAM d2i_PKCS12 d2i_PKCS12_BAGS d2i_PKCS12_MAC_DATA d2i_PKCS12_SAFEBAG d2i_PKCS12_bio d2i_PKCS12_fp d2i_PKCS7 d2i_PKCS7_DIGEST d2i_PKCS7_ENCRYPT d2i_PKCS7_ENC_CONTENT d2i_PKCS7_ENVELOPE d2i_PKCS7_ISSUER_AND_SERIAL d2i_PKCS7_RECIP_INFO d2i_PKCS7_SIGNED d2i_PKCS7_SIGNER_INFO d2i_PKCS7_SIGN_ENVELOPE d2i_PKCS7_bio d2i_PKCS7_fp d2i_PKCS8PrivateKey_bio d2i_PKCS8PrivateKey_fp d2i_PKCS8_PRIV_KEY_INFO d2i_PKCS8_PRIV_KEY_INFO_bio d2i_PKCS8_PRIV_KEY_INFO_fp d2i_PKCS8_bio d2i_PKCS8_fp d2i_PKEY_USAGE_PERIOD d2i_POLICYINFO d2i_POLICYQUALINFO d2i_PROFESSION_INFO d2i_PROXY_CERT_INFO_EXTENSION d2i_PROXY_POLICY d2i_PUBKEY d2i_PUBKEY_bio d2i_PUBKEY_fp d2i_PrivateKey d2i_PrivateKey_bio d2i_PrivateKey_fp d2i_PublicKey d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_RSAPrivateKey_fp d2i_RSAPublicKey d2i_RSAPublicKey_bio d2i_RSAPublicKey_fp d2i_RSA_OAEP_PARAMS d2i_RSA_PSS_PARAMS d2i_RSA_PUBKEY d2i_RSA_PUBKEY_bio d2i_RSA_PUBKEY_fp d2i_SCRYPT_PARAMS d2i_SCT_LIST d2i_SXNET d2i_SXNETID d2i_TS_ACCURACY d2i_TS_MSG_IMPRINT d2i_TS_MSG_IMPRINT_bio d2i_TS_MSG_IMPRINT_fp d2i_TS_REQ d2i_TS_REQ_bio d2i_TS_REQ_fp d2i_TS_RESP d2i_TS_RESP_bio d2i_TS_RESP_fp d2i_TS_STATUS_INFO d2i_TS_TST_INFO d2i_TS_TST_INFO_bio d2i_TS_TST_INFO_fp d2i_USERNOTICE d2i_X509 d2i_X509_ALGOR d2i_X509_ALGORS d2i_X509_ATTRIBUTE d2i_X509_AUX d2i_X509_CERT_AUX d2i_X509_CINF d2i_X509_CRL d2i_X509_CRL_INFO d2i_X509_CRL_bio d2i_X509_CRL_fp d2i_X509_EXTENSION d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_NAME_ENTRY d2i_X509_PUBKEY d2i_X509_REQ d2i_X509_REQ_INFO d2i_X509_REQ_bio d2i_X509_REQ_fp d2i_X509_REVOKED d2i_X509_SIG d2i_X509_VAL d2i_X509_bio d2i_X509_fp err_free_strings_int i2a_ACCESS_DESCRIPTION i2a_ASN1_ENUMERATED i2a_ASN1_INTEGER i2a_ASN1_OBJECT i2a_ASN1_STRING i2b_PVK_bio i2b_PrivateKey_bio i2b_PublicKey_bio i2d_ACCESS_DESCRIPTION i2d_ADMISSIONS i2d_ADMISSION_SYNTAX i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers i2d_ASN1_BIT_STRING i2d_ASN1_BMPSTRING i2d_ASN1_ENUMERATED i2d_ASN1_GENERALIZEDTIME i2d_ASN1_GENERALSTRING i2d_ASN1_IA5STRING i2d_ASN1_INTEGER i2d_ASN1_NULL i2d_ASN1_OBJECT i2d_ASN1_OCTET_STRING i2d_ASN1_PRINTABLE i2d_ASN1_PRINTABLESTRING i2d_ASN1_SEQUENCE_ANY i2d_ASN1_SET_ANY i2d_ASN1_T61STRING i2d_ASN1_TIME i2d_ASN1_TYPE i2d_ASN1_UNIVERSALSTRING i2d_ASN1_UTCTIME i2d_ASN1_UTF8STRING i2d_ASN1_VISIBLESTRING i2d_ASN1_bio_stream i2d_ASRange i2d_AUTHORITY_INFO_ACCESS i2d_AUTHORITY_KEYID i2d_BASIC_CONSTRAINTS i2d_CERTIFICATEPOLICIES i2d_CMS_ContentInfo i2d_CMS_ReceiptRequest i2d_CMS_bio i2d_CMS_bio_stream i2d_CRL_DIST_POINTS i2d_DHparams i2d_DHxparams i2d_DIRECTORYSTRING i2d_DISPLAYTEXT i2d_DIST_POINT i2d_DIST_POINT_NAME i2d_DSAPrivateKey i2d_DSAPrivateKey_bio i2d_DSAPrivateKey_fp i2d_DSAPublicKey i2d_DSA_PUBKEY i2d_DSA_PUBKEY_bio i2d_DSA_PUBKEY_fp i2d_DSA_SIG i2d_DSAparams i2d_ECDSA_SIG i2d_ECPKParameters i2d_ECParameters i2d_ECPrivateKey i2d_ECPrivateKey_bio i2d_ECPrivateKey_fp i2d_EC_PUBKEY i2d_EC_PUBKEY_bio i2d_EC_PUBKEY_fp i2d_EDIPARTYNAME i2d_ESS_CERT_ID i2d_ESS_CERT_ID_V2 i2d_ESS_ISSUER_SERIAL i2d_ESS_SIGNING_CERT i2d_ESS_SIGNING_CERT_V2 i2d_EXTENDED_KEY_USAGE i2d_GENERAL_NAME i2d_GENERAL_NAMES i2d_IPAddressChoice i2d_IPAddressFamily i2d_IPAddressOrRange i2d_IPAddressRange i2d_ISSUING_DIST_POINT i2d_NAMING_AUTHORITY i2d_NETSCAPE_CERT_SEQUENCE i2d_NETSCAPE_SPKAC i2d_NETSCAPE_SPKI i2d_NOTICEREF i2d_OCSP_BASICRESP i2d_OCSP_CERTID i2d_OCSP_CERTSTATUS i2d_OCSP_CRLID i2d_OCSP_ONEREQ i2d_OCSP_REQINFO i2d_OCSP_REQUEST i2d_OCSP_RESPBYTES i2d_OCSP_RESPDATA i2d_OCSP_RESPID i2d_OCSP_RESPONSE i2d_OCSP_REVOKEDINFO i2d_OCSP_SERVICELOC i2d_OCSP_SIGNATURE i2d_OCSP_SINGLERESP i2d_OTHERNAME i2d_PBE2PARAM i2d_PBEPARAM i2d_PBKDF2PARAM i2d_PKCS12 i2d_PKCS12_BAGS i2d_PKCS12_MAC_DATA i2d_PKCS12_SAFEBAG i2d_PKCS12_bio i2d_PKCS12_fp i2d_PKCS7 i2d_PKCS7_DIGEST i2d_PKCS7_ENCRYPT i2d_PKCS7_ENC_CONTENT i2d_PKCS7_ENVELOPE i2d_PKCS7_ISSUER_AND_SERIAL i2d_PKCS7_NDEF i2d_PKCS7_RECIP_INFO i2d_PKCS7_SIGNED i2d_PKCS7_SIGNER_INFO i2d_PKCS7_SIGN_ENVELOPE i2d_PKCS7_bio i2d_PKCS7_bio_stream i2d_PKCS7_fp i2d_PKCS8PrivateKeyInfo_bio i2d_PKCS8PrivateKeyInfo_fp i2d_PKCS8PrivateKey_bio i2d_PKCS8PrivateKey_fp i2d_PKCS8PrivateKey_nid_bio i2d_PKCS8PrivateKey_nid_fp i2d_PKCS8_PRIV_KEY_INFO i2d_PKCS8_PRIV_KEY_INFO_bio i2d_PKCS8_PRIV_KEY_INFO_fp i2d_PKCS8_bio i2d_PKCS8_fp i2d_PKEY_USAGE_PERIOD i2d_POLICYINFO i2d_POLICYQUALINFO i2d_PROFESSION_INFO i2d_PROXY_CERT_INFO_EXTENSION i2d_PROXY_POLICY i2d_PUBKEY i2d_PUBKEY_bio i2d_PUBKEY_fp i2d_PrivateKey i2d_PrivateKey_bio i2d_PrivateKey_fp i2d_PublicKey i2d_RSAPrivateKey i2d_RSAPrivateKey_bio i2d_RSAPrivateKey_fp i2d_RSAPublicKey i2d_RSAPublicKey_bio i2d_RSAPublicKey_fp i2d_RSA_OAEP_PARAMS i2d_RSA_PSS_PARAMS i2d_RSA_PUBKEY i2d_RSA_PUBKEY_bio i2d_RSA_PUBKEY_fp i2d_SCRYPT_PARAMS i2d_SCT_LIST i2d_SXNET i2d_SXNETID i2d_TS_ACCURACY i2d_TS_MSG_IMPRINT i2d_TS_MSG_IMPRINT_bio i2d_TS_MSG_IMPRINT_fp i2d_TS_REQ i2d_TS_REQ_bio i2d_TS_REQ_fp i2d_TS_RESP i2d_TS_RESP_bio i2d_TS_RESP_fp i2d_TS_STATUS_INFO i2d_TS_TST_INFO i2d_TS_TST_INFO_bio i2d_TS_TST_INFO_fp i2d_USERNOTICE i2d_X509 i2d_X509_ALGOR i2d_X509_ALGORS i2d_X509_ATTRIBUTE i2d_X509_AUX i2d_X509_CERT_AUX i2d_X509_CINF i2d_X509_CRL i2d_X509_CRL_INFO i2d_X509_CRL_bio i2d_X509_CRL_fp i2d_X509_EXTENSION i2d_X509_EXTENSIONS i2d_X509_NAME i2d_X509_NAME_ENTRY i2d_X509_PUBKEY i2d_X509_REQ i2d_X509_REQ_INFO i2d_X509_REQ_bio i2d_X509_REQ_fp i2d_X509_REVOKED i2d_X509_SIG i2d_X509_VAL i2d_X509_bio i2d_X509_fp i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_ECPublicKey i2o_SCT i2o_SCT_LIST i2s_ASN1_ENUMERATED i2s_ASN1_ENUMERATED_TABLE i2s_ASN1_IA5STRING i2s_ASN1_INTEGER i2s_ASN1_OCTET_STRING i2t_ASN1_OBJECT i2v_ASN1_BIT_STRING i2v_GENERAL_NAME i2v_GENERAL_NAMES o2i_ECPublicKey o2i_SCT o2i_SCT_LIST s2i_ASN1_IA5STRING s2i_ASN1_INTEGER s2i_ASN1_OCTET_STRING v2i_ASN1_BIT_STRING v2i_GENERAL_NAME v2i_GENERAL_NAMES v2i_GENERAL_NAME_ex

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libssl-1_1.dll

IMPHASH 0fbf72d833f142763a403114ef7eac10
SHA256 797ba3a838a6d0bc7b9b39efec86473ffe4255f782bb54066e81856eb0adf0a9
MD5 723c79630b1971f327fb7bff5ff38eda
SHA1 77844078bfea3b45e7fc4a42e5b7261fc5c6ad3a
SHA512 8329b8755104ad17889e1f4b1ead597a38bec8f07cebc246c5b0e8a0b88e1046d31cd3724e8fb8ed903e52e1e4808324e63ba4d4927a7fae3233ae37da8d31c2
SSDEEP 12288:4b4Y1HbWEsPTvVDAibOrwth/u2aom9qiDrMzNg+6U2lvz9s4:E4Y14JHkbxDrMRg+6U2lvzS4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

363535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libssl-1_1.pdb

libcrypto-1_1

COMP_CTX_new COMP_CTX_free BIO_s_mem EVP_CIPHER_key_length EVP_MD_CTX_ctrl EVP_MD_CTX_set_flags EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_md5 EVP_sha1 OPENSSL_sk_num OPENSSL_sk_value OPENSSL_sk_new_reserve OPENSSL_sk_pop_free CRYPTO_memdup CRYPTO_strdup EVP_sha256 EVP_PKEY_security_bits EVP_PKEY_set_type EVP_PKEY_set1_DH EVP_PKEY_new EVP_PKEY_up_ref EVP_PKEY_free EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_free EVP_PKEY_CTX_ctrl EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_derive EVP_PKEY_paramgen_init EVP_PKEY_paramgen EVP_PKEY_keygen_init EVP_PKEY_keygen EC_GROUP_get_curve_name EC_KEY_get0_group X509_NAME_free X509_free ASN1_OCTET_STRING_it INT32_it ZINT32_it UINT32_it ZUINT32_it ZINT64_it ZUINT64_it X509_it CRYPTO_strndup ASN1_item_free ASN1_item_d2i ASN1_item_i2d OPENSSL_DIR_read OPENSSL_DIR_end OPENSSL_sk_shift OPENSSL_sk_pop OPENSSL_sk_set_cmp_func CRYPTO_THREAD_lock_new CRYPTO_THREAD_lock_free CRYPTO_get_ex_new_index CRYPTO_THREAD_run_once BIO_s_file EVP_PKEY_id OPENSSL_LH_new OPENSSL_LH_free OPENSSL_LH_insert OPENSSL_LH_retrieve X509_STORE_new X509_STORE_free X509_STORE_up_ref X509_STORE_CTX_new X509_STORE_CTX_free X509_STORE_CTX_init X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_CTX_set_ex_data X509_STORE_CTX_get_error X509_STORE_CTX_get0_chain X509_STORE_CTX_get1_chain X509_STORE_CTX_set_flags X509_STORE_CTX_get0_param X509_STORE_CTX_set_default X509_STORE_CTX_set0_dane X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_move_peername X509_verify_cert_error_string X509_NAME_dup i2d_X509_NAME X509_get_subject_name X509_up_ref X509_chain_up_ref X509_cmp X509_NAME_hash X509_verify_cert PEM_read_bio_X509 X509_get_extension_flags OPENSSL_sk_new OPENSSL_sk_insert OPENSSL_sk_delete OPENSSL_sk_dup OPENSSL_sk_sort CRYPTO_mem_ctrl OBJ_nid2sn COMP_get_type COMP_get_name COMP_zlib EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0_info ENGINE_finish CONF_parse_list DH_free OBJ_sn2nid EC_curve_nist2nid EC_KEY_new_by_curve_name EC_KEY_free X509_STORE_load_locations PEM_read_bio_DHparams ERR_func_error_string ERR_load_strings_const OPENSSL_init_crypto OPENSSL_atexit err_free_strings_int OBJ_NAME_add EVP_md5_sha1 EVP_sha224 EVP_sha384 EVP_sha512 EVP_des_cbc EVP_des_ede3_cbc EVP_rc4 EVP_rc4_hmac_md5 EVP_idea_cbc EVP_rc2_cbc EVP_rc2_40_cbc EVP_aes_128_cbc EVP_aes_128_ccm EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_256_cbc EVP_aes_256_ccm EVP_aes_256_gcm EVP_aes_128_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_256_cbc_hmac_sha256 EVP_aria_128_gcm EVP_aria_256_gcm EVP_camellia_128_cbc EVP_camellia_256_cbc EVP_chacha20_poly1305 EVP_seed_cbc EVP_add_cipher EVP_add_digest CRYPTO_THREAD_read_lock CRYPTO_THREAD_write_lock CRYPTO_THREAD_unlock CRYPTO_new_ex_data CRYPTO_dup_ex_data CRYPTO_free_ex_data CRYPTO_set_ex_data CRYPTO_get_ex_data CRYPTO_realloc CRYPTO_secure_zalloc CRYPTO_secure_free BUF_MEM_free COMP_CTX_get_method BIO_int_ctrl BIO_pop BIO_free_all BIO_s_socket OPENSSL_LH_num_items ERR_peek_error OBJ_bsearch_ EVP_CIPHER_CTX_free X509_STORE_add_lookup OPENSSL_cleanse X509_LOOKUP_file X509_LOOKUP_ctrl X509_STORE_set_default_paths X509_VERIFY_PARAM_new X509_VERIFY_PARAM_free X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_depth d2i_PUBKEY X509_EXTENSION_free d2i_X509 X509_get0_pubkey X509_check_private_key X509_get_ext_d2i ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_start_job ASYNC_get_current_job CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time SCT_LIST_free SCT_set_source SCT_get_validation_status SCT_LIST_validate o2i_SCT_LIST CTLOG_STORE_new CTLOG_STORE_free CTLOG_STORE_load_file CTLOG_STORE_load_default_file X509_get_key_usage RAND_priv_bytes OCSP_response_get1_basic OCSP_resp_count OCSP_resp_get0 OCSP_SINGLERESP_get1_ext_d2i OCSP_BASICRESP_free OCSP_RESPID_free OCSP_RESPONSE_free d2i_OCSP_RESPONSE conf_ssl_get conf_ssl_name_find conf_ssl_get_cmd RSA_free RSA_up_ref RSA_flags d2i_RSAPrivateKey ERR_peek_last_error EVP_PKEY_assign EVP_PKEY_get0_RSA EVP_PKEY_get0_EC_KEY d2i_PrivateKey EVP_PKEY_copy_parameters EVP_PKEY_missing_parameters EVP_PKEY_cmp EC_KEY_can_sign d2i_X509_bio d2i_RSAPrivateKey_bio d2i_PrivateKey_bio X509_get_pubkey PEM_read_bio PEM_read_bio_X509_AUX PEM_read_bio_RSAPrivateKey PEM_read_bio_PrivateKey OPENSSL_LH_delete OPENSSL_LH_doall_arg OPENSSL_LH_get_down_load OPENSSL_LH_set_down_load PEM_ASN1_read_bio PEM_ASN1_write_bio PEM_ASN1_read PEM_ASN1_write ENGINE_get_ssl_client_cert_function ENGINE_init BIO_puts BIO_dump_indent BIO_printf EVP_DigestSignInit EVP_PKEY_new_raw_private_key EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_get1_tls_encodedpoint i2d_X509_EXTENSIONS i2d_OCSP_RESPID EVP_DigestSign d2i_X509_EXTENSIONS d2i_OCSP_RESPID BUF_MEM_new BUF_MEM_grow_clean BN_is_zero BN_num_bits BN_bin2bn BN_bn2bin BN_free RSA_pkey_ctx_ctrl DH_new DH_security_bits DH_check_params DH_set0_pqg DH_get0_key DH_set0_key EVP_Digest EVP_DigestInit EVP_DigestVerify EVP_DigestVerifyInit EVP_PKEY_size EVP_PKEY_get0_DH EVP_PKEY_encrypt_init EVP_PKEY_encrypt ENGINE_load_ssl_client_cert BUF_reverse EVP_DigestVerifyFinal d2i_X509_NAME i2d_X509 X509_NAME_cmp BN_ucmp RSA_size RSA_private_decrypt DH_get0_pqg EVP_EncryptInit_ex EVP_EncryptUpdate EVP_EncryptFinal EVP_PKEY_decrypt_init EVP_PKEY_decrypt HMAC_CTX_new HMAC_CTX_free HMAC_Init_ex HMAC_Update HMAC_Final EVP_PKEY_new_mac_key BN_new BN_set_word BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_8192 OBJ_ln2nid EVP_DecryptInit_ex EVP_DecryptUpdate EVP_DecryptFinal EVP_PKEY_get0 EVP_PKEY_get_default_digest_nid HMAC_size EC_GROUP_method_of EC_METHOD_get_field_type EC_KEY_get_conv_form DH_get_1024_160 DH_get_2048_224 X509_get_signature_info X509_get_signature_nid X509_get_issuer_name X509_chain_check_suiteb ERR_set_mark ERR_pop_to_mark BN_clear_free BN_copy BN_dup SRP_create_verifier_BN SRP_check_known_gN_param SRP_get_default_gN SRP_Calc_server_key SRP_Calc_B SRP_Verify_A_mod_N SRP_Calc_u SRP_Calc_x SRP_Calc_A SRP_Calc_client_key SRP_Verify_B_mod_N CRYPTO_clear_free MD5_Transform MD5_Init SHA512_Transform SHA512_Init SHA384_Init SHA256_Transform SHA256_Init SHA224_Init SHA1_Transform SHA1_Init EVP_DigestFinal EVP_DigestInit_ex EVP_MD_type EVP_CipherFinal_ex EVP_CipherUpdate EVP_CipherInit_ex RAND_bytes EVP_CIPHER_CTX_ctrl EVP_DigestSignFinal EVP_MD_CTX_copy EVP_DigestFinal_ex EVP_DigestUpdate EVP_MD_CTX_copy_ex EVP_MD_CTX_free EVP_MD_CTX_new EVP_Cipher EVP_CIPHER_CTX_block_size EVP_CIPHER_iv_length EVP_CIPHER_block_size COMP_expand_block COMP_compress_block CRYPTO_memcmp EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_cipher EVP_CIPHER_flags EVP_MD_CTX_md EVP_MD_size ERR_add_error_data BIO_snprintf CRYPTO_malloc BUF_MEM_grow OPENSSL_sk_push OPENSSL_sk_find OPENSSL_sk_free OPENSSL_sk_new_null ERR_clear_error BIO_ADDR_clear BIO_ADDR_free BIO_ADDR_new BIO_read BIO_test_flags ERR_put_error BIO_copy_next_retry BIO_f_buffer BIO_s_connect BIO_set_retry_reason BIO_get_retry_reason BIO_set_next BIO_next BIO_find_type BIO_push BIO_callback_ctrl BIO_ctrl BIO_write BIO_up_ref BIO_get_shutdown BIO_set_shutdown BIO_get_init BIO_set_init BIO_get_data BIO_set_data BIO_free BIO_new BIO_method_type BIO_clear_flags BIO_set_flags CRYPTO_free X509_LOOKUP_hash_dir CRYPTO_zalloc

kernel32

CreateFileW FlushFileBuffers HeapSize LoadLibraryW OutputDebugStringW WriteConsoleW SetStdHandle HeapReAlloc HeapAlloc RtlUnwind SetConsoleCtrlHandler LoadLibraryExW FreeLibrary InterlockedExchange GetModuleFileNameW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FatalAppExitA LeaveCriticalSection EnterCriticalSection Sleep WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter HeapFree GetModuleFileNameA DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap AreFileApisANSI GetModuleHandleExW ExitProcess MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage CreateSemaphoreW GetProcAddress GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThread InterlockedDecrement InterlockedIncrement DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime GetLastError SystemTimeToFileTime GetSystemTime SetLastError CloseHandle

BIO_f_ssl BIO_new_buffer_ssl_connect BIO_new_ssl BIO_new_ssl_connect BIO_ssl_copy_session_id BIO_ssl_shutdown DTLS_client_method DTLS_get_data_mtu DTLS_method DTLS_server_method DTLS_set_timer_cb DTLSv1_2_client_method DTLSv1_2_method DTLSv1_2_server_method DTLSv1_client_method DTLSv1_listen DTLSv1_method DTLSv1_server_method ERR_load_SSL_strings OPENSSL_cipher_name OPENSSL_init_ssl PEM_read_SSL_SESSION PEM_read_bio_SSL_SESSION PEM_write_SSL_SESSION PEM_write_bio_SSL_SESSION SRP_Calc_A_param SSL_CIPHER_description SSL_CIPHER_find SSL_CIPHER_get_auth_nid SSL_CIPHER_get_bits SSL_CIPHER_get_cipher_nid SSL_CIPHER_get_digest_nid SSL_CIPHER_get_handshake_digest SSL_CIPHER_get_id SSL_CIPHER_get_kx_nid SSL_CIPHER_get_name SSL_CIPHER_get_protocol_id SSL_CIPHER_get_version SSL_CIPHER_is_aead SSL_CIPHER_standard_name SSL_COMP_add_compression_method SSL_COMP_get0_name SSL_COMP_get_compression_methods SSL_COMP_get_id SSL_COMP_get_name SSL_COMP_set0_compression_methods SSL_CONF_CTX_clear_flags SSL_CONF_CTX_finish SSL_CONF_CTX_free SSL_CONF_CTX_new SSL_CONF_CTX_set1_prefix SSL_CONF_CTX_set_flags SSL_CONF_CTX_set_ssl SSL_CONF_CTX_set_ssl_ctx SSL_CONF_cmd SSL_CONF_cmd_argv SSL_CONF_cmd_value_type SSL_CTX_SRP_CTX_free SSL_CTX_SRP_CTX_init SSL_CTX_add1_to_CA_list SSL_CTX_add_client_CA SSL_CTX_add_client_custom_ext SSL_CTX_add_custom_ext SSL_CTX_add_server_custom_ext SSL_CTX_add_session SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_clear_options SSL_CTX_config SSL_CTX_ct_is_enabled SSL_CTX_ctrl SSL_CTX_dane_clear_flags SSL_CTX_dane_enable SSL_CTX_dane_mtype_set SSL_CTX_dane_set_flags SSL_CTX_enable_ct SSL_CTX_flush_sessions SSL_CTX_free SSL_CTX_get0_CA_list SSL_CTX_get0_certificate SSL_CTX_get0_ctlog_store SSL_CTX_get0_param SSL_CTX_get0_privatekey SSL_CTX_get0_security_ex_data SSL_CTX_get_cert_store SSL_CTX_get_ciphers SSL_CTX_get_client_CA_list SSL_CTX_get_client_cert_cb SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_ex_data SSL_CTX_get_info_callback SSL_CTX_get_keylog_callback SSL_CTX_get_max_early_data SSL_CTX_get_num_tickets SSL_CTX_get_options SSL_CTX_get_quiet_shutdown SSL_CTX_get_record_padding_callback_arg SSL_CTX_get_recv_max_early_data SSL_CTX_get_security_callback SSL_CTX_get_security_level SSL_CTX_get_ssl_method SSL_CTX_get_timeout SSL_CTX_get_verify_callback SSL_CTX_get_verify_depth SSL_CTX_get_verify_mode SSL_CTX_has_client_custom_ext SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_remove_session SSL_CTX_sess_get_get_cb SSL_CTX_sess_get_new_cb SSL_CTX_sess_get_remove_cb SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_sessions SSL_CTX_set0_CA_list SSL_CTX_set0_ctlog_store SSL_CTX_set0_security_ex_data SSL_CTX_set1_cert_store SSL_CTX_set1_param SSL_CTX_set_allow_early_data_cb SSL_CTX_set_alpn_protos SSL_CTX_set_alpn_select_cb SSL_CTX_set_block_padding SSL_CTX_set_cert_cb SSL_CTX_set_cert_store SSL_CTX_set_cert_verify_callback SSL_CTX_set_cipher_list SSL_CTX_set_ciphersuites SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_cb SSL_CTX_set_client_cert_engine SSL_CTX_set_client_hello_cb SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_ct_validation_callback SSL_CTX_set_ctlog_list_file SSL_CTX_set_default_ctlog_list_file SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_default_read_buffer_len SSL_CTX_set_default_verify_dir SSL_CTX_set_default_verify_file SSL_CTX_set_default_verify_paths SSL_CTX_set_ex_data SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_keylog_callback SSL_CTX_set_max_early_data SSL_CTX_set_msg_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_not_resumable_session_callback SSL_CTX_set_num_tickets SSL_CTX_set_options SSL_CTX_set_post_handshake_auth SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_find_session_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_psk_use_session_callback SSL_CTX_set_purpose SSL_CTX_set_quiet_shutdown SSL_CTX_set_record_padding_callback SSL_CTX_set_record_padding_callback_arg SSL_CTX_set_recv_max_early_data SSL_CTX_set_security_callback SSL_CTX_set_security_level SSL_CTX_set_session_id_context SSL_CTX_set_session_ticket_cb SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_password SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_ssl_version SSL_CTX_set_stateless_cookie_generate_cb SSL_CTX_set_stateless_cookie_verify_cb SSL_CTX_set_timeout SSL_CTX_set_tlsext_max_fragment_length SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_tmp_dh_callback SSL_CTX_set_trust SSL_CTX_set_verify SSL_CTX_set_verify_depth SSL_CTX_up_ref SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_ASN1 SSL_CTX_use_PrivateKey_file SSL_CTX_use_RSAPrivateKey SSL_CTX_use_RSAPrivateKey_ASN1 SSL_CTX_use_RSAPrivateKey_file SSL_CTX_use_cert_and_key SSL_CTX_use_certificate SSL_CTX_use_certificate_ASN1 SSL_CTX_use_certificate_chain_file SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_CTX_use_serverinfo SSL_CTX_use_serverinfo_ex SSL_CTX_use_serverinfo_file SSL_SESSION_dup SSL_SESSION_free SSL_SESSION_get0_alpn_selected SSL_SESSION_get0_cipher SSL_SESSION_get0_hostname SSL_SESSION_get0_id_context SSL_SESSION_get0_peer SSL_SESSION_get0_ticket SSL_SESSION_get0_ticket_appdata SSL_SESSION_get_compress_id SSL_SESSION_get_ex_data SSL_SESSION_get_id SSL_SESSION_get_master_key SSL_SESSION_get_max_early_data SSL_SESSION_get_max_fragment_length SSL_SESSION_get_protocol_version SSL_SESSION_get_ticket_lifetime_hint SSL_SESSION_get_time SSL_SESSION_get_timeout SSL_SESSION_has_ticket SSL_SESSION_is_resumable SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_fp SSL_SESSION_print_keylog SSL_SESSION_set1_alpn_selected SSL_SESSION_set1_hostname SSL_SESSION_set1_id SSL_SESSION_set1_id_context SSL_SESSION_set1_master_key SSL_SESSION_set1_ticket_appdata SSL_SESSION_set_cipher SSL_SESSION_set_ex_data SSL_SESSION_set_max_early_data SSL_SESSION_set_protocol_version SSL_SESSION_set_time SSL_SESSION_set_timeout SSL_SESSION_up_ref SSL_SRP_CTX_free SSL_SRP_CTX_init SSL_accept SSL_add1_host SSL_add1_to_CA_list SSL_add_client_CA SSL_add_dir_cert_subjects_to_stack SSL_add_file_cert_subjects_to_stack SSL_add_ssl_module SSL_alert_desc_string SSL_alert_desc_string_long SSL_alert_type_string SSL_alert_type_string_long SSL_alloc_buffers SSL_bytes_to_cipher_list SSL_callback_ctrl SSL_certs_clear SSL_check_chain SSL_check_private_key SSL_clear SSL_clear_options SSL_client_hello_get0_ciphers SSL_client_hello_get0_compression_methods SSL_client_hello_get0_ext SSL_client_hello_get0_legacy_version SSL_client_hello_get0_random SSL_client_hello_get0_session_id SSL_client_hello_get1_extensions_present SSL_client_hello_isv2 SSL_client_version SSL_config SSL_connect SSL_copy_session_id SSL_ct_is_enabled SSL_ctrl SSL_dane_clear_flags SSL_dane_enable SSL_dane_set_flags SSL_dane_tlsa_add SSL_do_handshake SSL_dup SSL_dup_CA_list SSL_enable_ct SSL_export_keying_material SSL_export_keying_material_early SSL_extension_supported SSL_free SSL_free_buffers SSL_get0_CA_list SSL_get0_alpn_selected SSL_get0_dane SSL_get0_dane_authority SSL_get0_dane_tlsa SSL_get0_next_proto_negotiated SSL_get0_param SSL_get0_peer_CA_list SSL_get0_peer_scts SSL_get0_peername SSL_get0_security_ex_data SSL_get0_verified_chain SSL_get1_session SSL_get1_supported_ciphers SSL_get_SSL_CTX SSL_get_all_async_fds SSL_get_certificate SSL_get_changed_async_fds SSL_get_cipher_list SSL_get_ciphers SSL_get_client_CA_list SSL_get_client_ciphers SSL_get_client_random SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_default_passwd_cb SSL_get_default_passwd_cb_userdata SSL_get_default_timeout SSL_get_early_data_status SSL_get_error SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_fd SSL_get_finished SSL_get_info_callback SSL_get_key_update_type SSL_get_max_early_data SSL_get_num_tickets SSL_get_options SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_peer_finished SSL_get_peer_signature_type_nid SSL_get_pending_cipher SSL_get_privatekey SSL_get_psk_identity SSL_get_psk_identity_hint SSL_get_quiet_shutdown SSL_get_rbio SSL_get_read_ahead SSL_get_record_padding_callback_arg SSL_get_recv_max_early_data SSL_get_rfd SSL_get_security_callback SSL_get_security_level SSL_get_selected_srtp_profile SSL_get_server_random SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shared_sigalgs SSL_get_shutdown SSL_get_sigalgs SSL_get_signature_type_nid SSL_get_srp_N SSL_get_srp_g SSL_get_srp_userinfo SSL_get_srp_username SSL_get_srtp_profiles SSL_get_ssl_method SSL_get_state SSL_get_verify_callback SSL_get_verify_depth SSL_get_verify_mode SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_get_wfd SSL_has_matching_session_id SSL_has_pending SSL_in_before SSL_in_init SSL_is_dtls SSL_is_init_finished SSL_is_server SSL_key_update SSL_load_client_CA_file SSL_new SSL_peek SSL_peek_ex SSL_pending SSL_read SSL_read_early_data SSL_read_ex SSL_renegotiate SSL_renegotiate_abbreviated SSL_renegotiate_pending SSL_rstate_string SSL_rstate_string_long SSL_select_next_proto SSL_session_reused SSL_set0_CA_list SSL_set0_rbio SSL_set0_security_ex_data SSL_set0_wbio SSL_set1_host SSL_set1_param SSL_set_SSL_CTX SSL_set_accept_state SSL_set_allow_early_data_cb SSL_set_alpn_protos SSL_set_bio SSL_set_block_padding SSL_set_cert_cb SSL_set_cipher_list SSL_set_ciphersuites SSL_set_client_CA_list SSL_set_connect_state SSL_set_ct_validation_callback SSL_set_debug SSL_set_default_passwd_cb SSL_set_default_passwd_cb_userdata SSL_set_default_read_buffer_len SSL_set_ex_data SSL_set_fd SSL_set_generate_session_id SSL_set_hostflags SSL_set_info_callback SSL_set_max_early_data SSL_set_msg_callback SSL_set_not_resumable_session_callback SSL_set_num_tickets SSL_set_options SSL_set_post_handshake_auth SSL_set_psk_client_callback SSL_set_psk_find_session_callback SSL_set_psk_server_callback SSL_set_psk_use_session_callback SSL_set_purpose SSL_set_quiet_shutdown SSL_set_read_ahead SSL_set_record_padding_callback SSL_set_record_padding_callback_arg SSL_set_recv_max_early_data SSL_set_rfd SSL_set_security_callback SSL_set_security_level SSL_set_session SSL_set_session_id_context SSL_set_session_secret_cb SSL_set_session_ticket_ext SSL_set_session_ticket_ext_cb SSL_set_shutdown SSL_set_srp_server_param SSL_set_srp_server_param_pw SSL_set_ssl_method SSL_set_tlsext_max_fragment_length SSL_set_tlsext_use_srtp SSL_set_tmp_dh_callback SSL_set_trust SSL_set_verify SSL_set_verify_depth SSL_set_verify_result SSL_set_wfd SSL_shutdown SSL_srp_server_param_with_username SSL_state_string SSL_state_string_long SSL_stateless SSL_up_ref SSL_use_PrivateKey SSL_use_PrivateKey_ASN1 SSL_use_PrivateKey_file SSL_use_RSAPrivateKey SSL_use_RSAPrivateKey_ASN1 SSL_use_RSAPrivateKey_file SSL_use_cert_and_key SSL_use_certificate SSL_use_certificate_ASN1 SSL_use_certificate_chain_file SSL_use_certificate_file SSL_use_psk_identity_hint SSL_verify_client_post_handshake SSL_version SSL_waiting_for_async SSL_want SSL_write SSL_write_early_data SSL_write_ex TLS_client_method TLS_method TLS_server_method TLSv1_1_client_method TLSv1_1_method TLSv1_1_server_method TLSv1_2_client_method TLSv1_2_method TLSv1_2_server_method TLSv1_client_method TLSv1_method TLSv1_server_method d2i_SSL_SESSION i2d_SSL_SESSION

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

locale/da_DK.mo

SHA256 cfa11e43e7a35d8e70748b9fed9799cd4c5bbc9fb3b984f4461f6d3c06519328
MD5 35b41bfed4624b2984df341cdabc0ddd
SHA1 4406c32944a572dcaa1c281899e3c48aea257443
SHA512 4fc208dd603dda33e374c8f0f4f64c193b4840a15fb149ba9ab891062a399e9154c94a80677ccdcf7db079a6f33c6c00524d334b5fa8840b4a5a8efb4c098a85
SSDEEP 6144:m0x0zfyGKUYSCFzLywSyJCs5gz0F2ndVCvTm:dx9tRLyjBz0F2nP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/de_DE.mo

SHA256 75918538429b33d4bc6495143f44586464eec66511547cf05075360361cc442a
MD5 346d6d204469741a6933d9d997283b0f
SHA1 8fa8520d7f6cf75282e99833f6b36be45e035861
SHA512 7e6b11778073528b87804d30585a669e356bd3c99518d5fe546fe667eee974626c84ae45dc8c1ad8be620149dae2fc9d8b87e36c9462f086e26110e256a0ae36
SSDEEP 6144:m0x0dlyKUYSCFzLywSyJCOLjvFsGQxq4V9F1YW6:d69tRLyjmLjvQxJ9F2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/es_ES.mo

SHA256 866d133376b188702c406779ffcede316d4577d2a029f78538a5d30faf71e47e
MD5 cf3800582e8dd0a7b346665a366b0369
SHA1 931d789e756fb4b6deb04c5f5bfe28305f22578c
SHA512 419660dc419a92a2771fc9568108f6f306db5b42bc2b8e58193aa03320bd4f2538f7f660ae01b810287231a99ee24168d8c56ddba84f33923db0bc13d2d67cbb
SSDEEP 3072:m0x0uslIRHwrousbvs+n1iu2UYSCCszdcMyXIfFN8yJCuDUhe3C6M+e1Co8AFM04:m0x0wwmKUYSCFzLywSyJCXYw+YFMv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/fr_FR.mo

SHA256 a78ffa801a90f998817cbe401c9186f5b2bff3f225c486d1dcafee9e089b7f3e
MD5 2d43a9c7652d14fb9869e484eb7d8022
SHA1 08d74e102dccfbd3b3bbb5ea6859f79312fa18d4
SHA512 2dcc15f87ae812702aef018868bfad33a14f77523ed4baca2866e1c277d6a2f696ae924d86581cd5955c34e0736c9ed838cf8bbf3e552e59f70f8d3db3937c34
SSDEEP 6144:m0x0huxTKUYSCFzLywSyJCLj3SLKma3/3ma5cGmWArUiCYRxp3/A7+:dnQ9tRLyjaLKma3/3ma5irRRxp37
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/it_IT.mo

SHA256 6e6e5ac92a3341cba3585430d460f74071dbff1bde2f79b8246810dc35983775
MD5 9e5efee9c003ff0f7c23786b049d1baf
SHA1 623e5c61dc11d1ca88ebb6722ead5287e543b12c
SHA512 22061fefc040800a40f487efb023807fb5dcffb68c2aaa04250fd4e0265b7de56f021da0adcd147dcbba1f60f78df998efb32c7996776abb0d051cbd496f5541
SSDEEP 6144:m0x0InKKUYSCFzLywSyJCoqRC0d3T9lVfm1dOIFjjmFQ2mYNowTp8Fmdk/C8UuTN:ddb9tRLyjq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/nl_NL.mo

SHA256 17dac2d8db8208e99c219e00db2fb7c192ae0d721c7953a38eafbfbb6910ba51
MD5 5c49172e8ead4717f508d2f858a91e6d
SHA1 4d85561468cd004f45bdc205d74f71713937733f
SHA512 5651abc36f158991dc48fb8e9df53c417b587689742decda8b751340b4e10db74979f1d5480112401b04cb9860b637a1faa25a4640c74afe9e1ea080e15bab96
SSDEEP 3072:m0x0uslI77EP3ousbvs+n1iu2UYSCCszdcMyXIfFN8yJCQsUJtpNMFtRkkO8RBWp:m0x0E7xKUYSCFzLywSyJCLJCSENLcgL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/nn_NO.mo

SHA256 bed4e35de6424cdb297d92a9e9eb3e00d73592beb828a7b764fe3a33f903198d
MD5 9a0c9fc80aee4b697e647c5361eb184e
SHA1 c7857e4daa4ab0206d9542d1367215783f6124a2
SHA512 2790b8597e49502ac12d73b0b581e3b0d2058867b2f19f207d67f6d8b191eccb07f906acb707078364e7ba63267200b371e20426c6fa8557646d82ad871dbe45
SSDEEP 6144:m0x0SAtakKUYSCFzLywSyJCBmmywW5zz95RKnDXlGAg:d+ah9tRLyj65tang
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/pl_PL.mo

SHA256 5687ab0bacf4ab323d0fff553c60b77e79bf64dd3fb89a4f21ac8c60b50fac3a
MD5 86b7193a0be54bfae03b31033f9bc224
SHA1 1ed49b98af5f2fe3b960b06fb537a8f6a68db1f0
SHA512 e2491cf0915b746b59b35e13e19ba400d1b5406e6d70f3835447574f992011f359a1055de42ef2c5839887f4252dc6d1a2987d802d0d0a3624812d092f9cd5f8
SSDEEP 6144:m0x0+CLgUKUYSCFzLywSyJCYufXKOWgK1zbFk+pbNafW4KjQF:ddd9tRLyjMO5KDk+pZafDY4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/pt_PT.mo

SHA256 5698eb42acfc94cd15acdc3d1eb8a650f2adeb935a8881fe6165abe39d9d61cb
MD5 1c8e2f0bef857a0f02696441f4a91564
SHA1 4bb0ecc08f0b6aec1f81d6b5c575402a1bf95294
SHA512 1cc3fd9960e3aafcd8f17063b6d07da91ea9796bd88fc5dacfe7642cfc237a8e1d18ec5f0adf047b7a94dbb4c913d07f8fa3af204b536f988a7a3cf4f8fd9e16
SSDEEP 3072:m0x0uslIJ+RfCousbvs+n1iu2UYSCCszdcMyXIfFN8yJClCuSfaKSTIX/EhQK3zm:m0x05fBKUYSCFzLywSyJCt3YdV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/sv_SE.mo

SHA256 1ee39ccda4805331e4899545fdf616d3b180347961e8bbf593540daeeb328494
MD5 625db4b4625d7f4025b6f3aad18c1056
SHA1 5e4e3e538f68011125e9c53a2fd5ec01d3ccafa9
SHA512 0230361e122c1c0ac178a24ad5c6df83976c279da8523fdf01f8511079aad1ae1d061acc395d30090aa6b05dee58fd56654447f7daeb2026ab2763179835d86c
SSDEEP 6144:m0x0u80DGp+KUYSCFzLywSyJCS6veBn2b3EkrZVymURfRdd393sH:dPb+9tRLyjKLBn2bv0w
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

locale/tr_TR.mo

SHA256 c8d764870132527a03ce4e6a90c237a4318f7663cefeb289eb3194dcfeec9e3f
MD5 3cc00d8143903aaf1601f93e8d5956cb
SHA1 a4121622dbe600302e327376e238901722f0bdf7
SHA512 25c42ffb446a639dc150f83844f45fd0760150911a9324b0553b2c9b558ec1c28c7d61259f4974c577140232b0358b5b20905bbb3b22421a6cdb0635a730f574
SSDEEP 3072:m0x0uslIk0wWousbvs+n1iu2UYSCCszdcMyXIfFN8yJCZuqYMAjAJoF+yRT48ggF:m0x0dZdKUYSCFzLywSyJCpAUTglokH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

mscordaccore.dll

IMPHASH b48f4be60ce658f8283045be599a540f
SHA256 5e63a9d0e5a7d10a738a7ce4633bff84e223183ef2155b7adf80c211a2b80a77
MD5 87a7aaf5ae5b7de4e15572166ca95d74
SHA1 76ec73926d22b708904e01623beb0138009dec5a
SHA512 5f0b2761c04c5565b5232446e3ca77a07f4a15567fd3a5de69661e705dd872a3e87358d79d6f02e807879eb1e15934fb09ad2e066a805c12c67c8d2c917e696f
SSDEEP 24576:TqNZkhwIJ9S6lumIuLLR4VCXsfPOdejmRmGSGKV5Fl5vWI:OMhwIHHumIuLLRAC8eejilgfl5vWI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d3:c1:d6:99:8f:18:9c:35:7c:72:82:60:60:41:be:6c:9c:15:e2:6b:7b:ba:d3:c8:37:ff:42:ed:62:c9:b7:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

636656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb

kernel32

GetCurrentProcess SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile FlushFileBuffers WriteFile ReadFile GetProcessHeap HeapAlloc HeapFree GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree TlsGetValue TlsAlloc TlsFree RaiseException TlsSetValue CreateEventW SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SetLastError GetCurrentThreadId GetSystemTimeAsFileTime DebugBreak GetProcessAffinityMask SwitchToThread GetEnvironmentVariableW GetFullPathNameW ReadProcessMemory LoadLibraryExW CreateFileW GetModuleFileNameW TerminateProcess OutputDebugStringW IsDebuggerPresent RaiseFailFastException CloseHandle FreeLibrary GetSystemInfo GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableA WideCharToMultiByte GetLastError MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree CoCreateGuid IIDFromString

oleaut32

SetErrorInfo CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscat_s strcmp strcpy_s strlen strncat_s wcsncat_s wcsncmp _wcslwr_s wcscpy_s strncmp strncpy_s strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo abort _cexit _errno _execute_onexit_table _initterm _initterm_e terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall __stdio_common_vsprintf_s __stdio_common_vsnwprintf_s _putws __stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-convert-l1-1-0

wcstoul

mscordaccore_x86_x86_4.700.22.55902.dll

IMPHASH b48f4be60ce658f8283045be599a540f
SHA256 5e63a9d0e5a7d10a738a7ce4633bff84e223183ef2155b7adf80c211a2b80a77
MD5 87a7aaf5ae5b7de4e15572166ca95d74
SHA1 76ec73926d22b708904e01623beb0138009dec5a
SHA512 5f0b2761c04c5565b5232446e3ca77a07f4a15567fd3a5de69661e705dd872a3e87358d79d6f02e807879eb1e15934fb09ad2e066a805c12c67c8d2c917e696f
SSDEEP 24576:TqNZkhwIJ9S6lumIuLLR4VCXsfPOdejmRmGSGKV5Fl5vWI:OMhwIHHumIuLLRAC8eejilgfl5vWI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d3:c1:d6:99:8f:18:9c:35:7c:72:82:60:60:41:be:6c:9c:15:e2:6b:7b:ba:d3:c8:37:ff:42:ed:62:c9:b7:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

636656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb

kernel32

GetCurrentProcess SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile FlushFileBuffers WriteFile ReadFile GetProcessHeap HeapAlloc HeapFree GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree TlsGetValue TlsAlloc TlsFree RaiseException TlsSetValue CreateEventW SetEvent ResetEvent WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate SetLastError GetCurrentThreadId GetSystemTimeAsFileTime DebugBreak GetProcessAffinityMask SwitchToThread GetEnvironmentVariableW GetFullPathNameW ReadProcessMemory LoadLibraryExW CreateFileW GetModuleFileNameW TerminateProcess OutputDebugStringW IsDebuggerPresent RaiseFailFastException CloseHandle FreeLibrary GetSystemInfo GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection GetEnvironmentVariableA WideCharToMultiByte GetLastError MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoTaskMemFree CoCreateGuid IIDFromString

oleaut32

SetErrorInfo CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

wcsncpy_s wcscat_s strcmp strcpy_s strlen strncat_s wcsncat_s wcsncmp _wcslwr_s wcscpy_s strncmp strncpy_s strnlen

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo abort _cexit _errno _execute_onexit_table _initterm _initterm_e terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_flushall __stdio_common_vsprintf_s __stdio_common_vsnwprintf_s _putws __stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-convert-l1-1-0

wcstoul

mscordbi.dll

IMPHASH 406ce9b644c8bf4e31063e1f8559d643
SHA256 776150b3c8008d9ef5d931ec871fc00638d81e3f5f37fe6cd4988353d6eaef25
MD5 0f5287ccf46af868d472a16dfada82f8
SHA1 96f9943dbdf240205de2a17c1c413ca3e0ac9b45
SHA512 d0e993348577b7fa526d046bb684e449d82a40c0a1964f1714474d9711660eb9f83ef34e01c5fcf1089ab7c8400afce6d0e7946b5f278a08226cb46ad0afd2fa
SSDEEP 24576:O1tPRQ/bWmM1hPu16JeC2KInVt3qwUk/:bamM1hPu1meClInVt6wUk/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

70:79:a7:cf:ef:a8:d5:e3:6d:fa:0a:bb:1c:89:3a:1e:f3:6d:14:d1:7e:fa:63:c5:23:a3:92:87:fb:d2:ae:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

671440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb

kernel32

OpenThread SuspendThread ResumeThread DuplicateHandle CreateThread TerminateProcess GetThreadContext SetThreadContext ContinueDebugEvent FreeLibrary VirtualQueryEx GetModuleHandleW GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile Sleep DebugActiveProcess DebugActiveProcessStop WaitForDebugEvent OpenProcess GetCurrentProcessId IsWow64Process ReadProcessMemory WriteProcessMemory SetLastError GetSystemTimeAsFileTime GetProcessHeap HeapAlloc HeapFree RaiseException GetSystemInfo IsDebuggerPresent DebugBreak LoadLibraryExW CreateFileW GetFileAttributesExW GetModuleFileNameW FlushInstructionCache GetEnvironmentVariableW GetFullPathNameW MultiByteToWideChar SwitchToThread GetCurrentThread GetACP LCMapStringEx IsDBCSLeadByte FormatMessageW LocalFree CreateProcessW TlsGetValue TlsAlloc TlsFree TlsSetValue WaitForSingleObjectEx CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex SleepEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate WriteFile SetFilePointer FlushFileBuffers ReadFile InitializeCriticalSectionAndSpinCount GetCurrentThreadId ResetEvent SetEvent CreateEventW WaitForMultipleObjectsEx GetProcAddress WaitForSingleObject LoadLibraryW WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection CloseHandle GetCurrentProcess GetLastError EnterCriticalSection LeaveCriticalSection EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

advapi32

GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation SetThreadToken RevertToSelf OpenThreadToken RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

ole32

IIDFromString CoTaskMemAlloc CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoTaskMemFree CoCreateGuid

oleaut32

SetErrorInfo VariantInit CreateErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

strncpy_s wcsncmp strncmp wcsncat_s wcscpy_s _wcsicmp wcscat_s wcsncpy_s strcpy_s wcsnlen

api-ms-win-crt-runtime-l1-1-0

_cexit _invalid_parameter_noinfo _errno abort _initterm _execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll terminate _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-heap-l1-1-0

malloc calloc free

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-math-l1-1-0

_except1

mscorlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e7f86acfe925900814e0f57828a9b437b108e50315a2d4e87654ac7dc39852f
MD5 c53ff6de7a243279034e8ddbab23325d
SHA1 f846e0a35c768188769e9fd08ed0b69ab7fffa73
SHA512 2baa9be32ab750e91ef174fc1d6db764bde37b9400040fa80b702b0989b5053afd9645a2242861548f092a6dee6c76d47f63ee5597cddc5035a07e14e5e9ca38
SSDEEP 384:fniCq6HTn8KR6WdUtox5q64O3HZhB52YtUBVT9yaDbcZN8dV0IaohKuirRkvx9AV:/n9RzF5J4yklDbcZV/Cq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mscorrc.debug.dll

SHA256 4681c02858164bb8cb210238fde27c7099dfd34d6150e9706da8845a3706b8e6
MD5 6552055346ddd6cfa8fb05bef8f26cfc
SHA1 4b6b93bdaa00fe2c3a8a8f313cac140ce04c785e
SHA512 fdcc771b0d7f43c8a808da1280890c721b47d6412a28c53acadd7bc3ddff9c4eae1d3a141f99f1b183bacbcc501fce795d9199581a597ff748792914872ec9f9
SSDEEP 1536:lJql0Zzb8IVAkR1RhQi/s1PzHvh7xYSmUlMbcCV9jfnw5RVvZ48MSZctpoEXtVH3:lJql0ZzgASHlMbrhnYDAS4SGB/VV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

02:b5:06:c1:46:46:47:88:60:be:62:9f:71:76:0f:9c:a3:d8:52:d3:b4:59:5a:32:c0:32:3e:0e:13:78:34:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\full\Release\mscorrc.debug.pdb

mscorrc.dll

SHA256 ac84b2497a3875aa104e2a18e0dd49a43ea38dc505c57d836f368d8443280e78
MD5 30041ff905e8057be55fff732f8de1bf
SHA1 b783bff2e6b2fc182d6a4345c6a33323b8eb7a53
SHA512 3daf4b0a481b93c3ad2d078cccd2e185506f3607309c1b11799b15e958137d51528638263281f7d0152751fd4ab301d0dce8705166f05820cd9eaab50beec829
SSDEEP 192:hcWPqdwGiWrdwFuzLeWvcuyjS7HnhWgN7aMWhfRETTbbrmjX01k9z3AzsCnNz:hcWPYXiWRiA7HRN7MRE3X+R9zusCd
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

44:36:9d:ab:55:da:f4:9f:62:5e:08:44:36:c4:b9:59:af:19:ea:e7:e7:79:36:2d:1b:ea:88:f7:42:54:12:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\small\Release\mscorrc.pdb

netstandard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d
MD5 671ed9d6e873ad29ccff10bcfaea6021
SHA1 49507f0040c27249e209be9ff92ea4c143575873
SHA512 15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e
SSDEEP 768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

79582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nfapi.dll

IMPHASH 144166113ab4a5e253b0d586d0c21c38
SHA256 eb59bd2322dbe8e289c35e304ebc4633d0298890fdbdeade2b35f32bed2e6b06
MD5 82cf3571fb6b98d3a7a7b5c7c34fdca3
SHA1 9df1dfe570518369d365d21495cf4c50591ff342
SHA512 5eebe58cd25bacc861e3ea5c89ec4c470cf6c41dc28f2597190166b3272db419c55ea989a60b2f6e822738e500846f5570d491082ee8dfc4e03924f200bb767d
SSDEEP 3072:/KpHwC6H+AYYYxYYYYYrs/NAWOZFvyfaP710WkYsf+6pu6v3tgHf+dNUxJcGtHF7:/KpHMg61ZFvyfKLkzfrnvGHfDcGtrF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

71:70:ec:22:a8:6f:75:dc:10:5e:c2:8e:0e:83:da:ae:8a:ad:9c:90:9a:0c:2b:10:91:b1:bc:78:48:55:39:81

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Oct 31, 2023

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 8, 2021 - Feb 28, 2024

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

92182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\projectsJ\nfsdk2_1.6\nfapi\build\release_c_api\win32\nfapi.pdb

kernel32

InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObject CreateEventA GetCurrentProcessId OpenProcess CancelIo GetTickCount GetModuleHandleA GetProcAddress WaitForMultipleObjects CreateFileA GetVersionExA DeviceIoControl GetOverlappedResult SetLastError GetLastError CloseHandle WriteFile ReadFile QueryDosDeviceW GetLogicalDriveStringsW GetDriveTypeW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemInfo InitializeCriticalSection FlushFileBuffers WriteConsoleW SetStdHandle HeapFree HeapAlloc EncodePointer DecodePointer CreateThread GetCurrentThreadId ExitThread LoadLibraryExW RaiseException RtlUnwind GetCommandLineA GetProcessHeap InterlockedDecrement ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapSize Sleep IsDebuggerPresent InterlockedIncrement GetCurrentThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW GetFileType GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW WideCharToMultiByte FatalAppExitA InterlockedExchange FreeLibrary SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo OutputDebugStringW LoadLibraryW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx GetStringTypeW CreateFileW

advapi32

QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService CreateServiceW CloseServiceHandle RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceA

psapi

GetModuleFileNameExA GetModuleFileNameExW

Name

.text

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nfregdrv.exe

IMPHASH 40b9d8afc649d5414a04999cb3a4d2f0
SHA256 aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
MD5 01b5780505301ada6dc102fb77b2298c
SHA1 328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
SHA512 bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
SSDEEP 768:2/1x+sxHjR9Q9V0nczMWkL/zDJ6kqsEtm:YjR8VfRkL0Jtm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

h:\projects\netfilter3\bin\Release_c_api\Win32\nfregdrv.pdb

ovpn/libcrypto-1_1.dll

IMPHASH a543d3b1f1e76db5f1ab4d97a41e7c66
SHA256 548c59044738554e6fd8aee9e1cd0e6cb13ee7b6f4f71532aff868e771eb8a7d
MD5 b9eb6a8ac15e8eee936d994bc87f9d5e
SHA1 b432473b753f371bb2415eb63d178e560455d4c8
SHA512 83688bdee057964072215de15039e27f0e3188fc32856183f9de3484f11d6cbd633f36c0f0abe7ec6f3eb17dd467c59e8cc8517a371091279270c6c2bb5c631c
SSDEEP 98304:+mjNt5deg7yCsF4Qd/CsIhu2w0ne8nB5U5jOmp9P1CPwDv3uFfJl2xEcFiuW9MZe:+mjVpGCsFldKsIhuSne8nBIjx9P1CPwE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Digest

de:14:9b:07:f2:f0:64:35:ee:b0:ba:bd:cc:e1:a2:91:25:81:f7:d5:f7:3d:01:0d:31:ad:02:7d:0a:ea:ad:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2021

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Serial Number

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Nov 4, 2022

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW

kernel32

CloseHandle ConvertFiberToThread ConvertThreadToFiber CreateFiber DeleteCriticalSection DeleteFiber EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileType GetLastError GetModuleHandleExW GetModuleHandleW GetProcAddress GetStdHandle GetSystemTime GetSystemTimeAsFileTime GetTickCount GetVersion InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar QueryPerformanceCounter ReadConsoleA ReadConsoleW SetConsoleMode SetLastError SetUnhandledExceptionFilter Sleep SwitchToFiber SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteFile

msvcrt

__dllonexit _amsg_exit _chmod _errno _exit _fileno _initterm _iob _lock _onexit _setmode _snwprintf _stat time gmtime _strdup _stricmp _strnicmp _unlock calloc clearerr fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getenv isspace malloc memchr memcmp memcpy memmove memset perror qsort raise realloc setbuf signal sprintf sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strspn strstr strtol strtoul _vsnprintf _vsnwprintf _wfopen abort vfprintf wcscpy wcsstr atoi _fstat _strdup

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSACleanup WSAGetLastError WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname getnameinfo getsockname getsockopt ioctlsocket listen ntohs recv recvfrom send sendto setsockopt shutdown socket

ACCESS_DESCRIPTION_free ACCESS_DESCRIPTION_it ACCESS_DESCRIPTION_new ADMISSIONS_free ADMISSIONS_get0_admissionAuthority ADMISSIONS_get0_namingAuthority ADMISSIONS_get0_professionInfos ADMISSIONS_it ADMISSIONS_new ADMISSIONS_set0_admissionAuthority ADMISSIONS_set0_namingAuthority ADMISSIONS_set0_professionInfos ADMISSION_SYNTAX_free ADMISSION_SYNTAX_get0_admissionAuthority ADMISSION_SYNTAX_get0_contentsOfAdmissions ADMISSION_SYNTAX_it ADMISSION_SYNTAX_new ADMISSION_SYNTAX_set0_admissionAuthority ADMISSION_SYNTAX_set0_contentsOfAdmissions AES_bi_ige_encrypt AES_cbc_encrypt AES_cfb128_encrypt AES_cfb1_encrypt AES_cfb8_encrypt AES_decrypt AES_ecb_encrypt AES_encrypt AES_ige_encrypt AES_ofb128_encrypt AES_options AES_set_decrypt_key AES_set_encrypt_key AES_unwrap_key AES_wrap_key ASIdOrRange_free ASIdOrRange_it ASIdOrRange_new ASIdentifierChoice_free ASIdentifierChoice_it ASIdentifierChoice_new ASIdentifiers_free ASIdentifiers_it ASIdentifiers_new ASN1_ANY_it ASN1_BIT_STRING_check ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_BIT_STRING_it ASN1_BIT_STRING_name_print ASN1_BIT_STRING_new ASN1_BIT_STRING_num_asc ASN1_BIT_STRING_set ASN1_BIT_STRING_set_asc ASN1_BIT_STRING_set_bit ASN1_BMPSTRING_free ASN1_BMPSTRING_it ASN1_BMPSTRING_new ASN1_BOOLEAN_it ASN1_ENUMERATED_free ASN1_ENUMERATED_get ASN1_ENUMERATED_get_int64 ASN1_ENUMERATED_it ASN1_ENUMERATED_new ASN1_ENUMERATED_set ASN1_ENUMERATED_set_int64 ASN1_ENUMERATED_to_BN ASN1_FBOOLEAN_it ASN1_GENERALIZEDTIME_adj ASN1_GENERALIZEDTIME_check ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_it ASN1_GENERALIZEDTIME_new ASN1_GENERALIZEDTIME_print ASN1_GENERALIZEDTIME_set ASN1_GENERALIZEDTIME_set_string ASN1_GENERALSTRING_free ASN1_GENERALSTRING_it ASN1_GENERALSTRING_new ASN1_IA5STRING_free ASN1_IA5STRING_it ASN1_IA5STRING_new ASN1_INTEGER_cmp ASN1_INTEGER_dup ASN1_INTEGER_free ASN1_INTEGER_get ASN1_INTEGER_get_int64 ASN1_INTEGER_get_uint64 ASN1_INTEGER_it ASN1_INTEGER_new ASN1_INTEGER_set ASN1_INTEGER_set_int64 ASN1_INTEGER_set_uint64 ASN1_INTEGER_to_BN ASN1_ITEM_get ASN1_ITEM_lookup ASN1_NULL_free ASN1_NULL_it ASN1_NULL_new ASN1_OBJECT_create ASN1_OBJECT_free ASN1_OBJECT_it ASN1_OBJECT_new ASN1_OCTET_STRING_NDEF_it ASN1_OCTET_STRING_cmp ASN1_OCTET_STRING_dup ASN1_OCTET_STRING_free ASN1_OCTET_STRING_it ASN1_OCTET_STRING_new ASN1_OCTET_STRING_set ASN1_PCTX_free ASN1_PCTX_get_cert_flags ASN1_PCTX_get_flags ASN1_PCTX_get_nm_flags ASN1_PCTX_get_oid_flags ASN1_PCTX_get_str_flags ASN1_PCTX_new ASN1_PCTX_set_cert_flags ASN1_PCTX_set_flags ASN1_PCTX_set_nm_flags ASN1_PCTX_set_oid_flags ASN1_PCTX_set_str_flags ASN1_PRINTABLESTRING_free ASN1_PRINTABLESTRING_it ASN1_PRINTABLESTRING_new ASN1_PRINTABLE_free ASN1_PRINTABLE_it ASN1_PRINTABLE_new ASN1_PRINTABLE_type ASN1_SCTX_free ASN1_SCTX_get_app_data ASN1_SCTX_get_flags ASN1_SCTX_get_item ASN1_SCTX_get_template ASN1_SCTX_new ASN1_SCTX_set_app_data ASN1_SEQUENCE_ANY_it ASN1_SEQUENCE_it ASN1_SET_ANY_it ASN1_STRING_TABLE_add ASN1_STRING_TABLE_cleanup ASN1_STRING_TABLE_get ASN1_STRING_clear_free ASN1_STRING_cmp ASN1_STRING_copy ASN1_STRING_data ASN1_STRING_dup ASN1_STRING_free ASN1_STRING_get0_data ASN1_STRING_get_default_mask ASN1_STRING_length ASN1_STRING_length_set ASN1_STRING_new ASN1_STRING_print ASN1_STRING_print_ex ASN1_STRING_print_ex_fp ASN1_STRING_set ASN1_STRING_set0 ASN1_STRING_set_by_NID ASN1_STRING_set_default_mask ASN1_STRING_set_default_mask_asc ASN1_STRING_to_UTF8 ASN1_STRING_type ASN1_STRING_type_new ASN1_T61STRING_free ASN1_T61STRING_it ASN1_T61STRING_new ASN1_TBOOLEAN_it ASN1_TIME_adj ASN1_TIME_check ASN1_TIME_cmp_time_t ASN1_TIME_compare ASN1_TIME_diff ASN1_TIME_free ASN1_TIME_it ASN1_TIME_new ASN1_TIME_normalize ASN1_TIME_print ASN1_TIME_set ASN1_TIME_set_string ASN1_TIME_set_string_X509 ASN1_TIME_to_generalizedtime ASN1_TIME_to_tm ASN1_TYPE_cmp ASN1_TYPE_free ASN1_TYPE_get ASN1_TYPE_get_int_octetstring ASN1_TYPE_get_octetstring ASN1_TYPE_new ASN1_TYPE_pack_sequence ASN1_TYPE_set ASN1_TYPE_set1 ASN1_TYPE_set_int_octetstring ASN1_TYPE_set_octetstring ASN1_TYPE_unpack_sequence ASN1_UNIVERSALSTRING_free ASN1_UNIVERSALSTRING_it ASN1_UNIVERSALSTRING_new ASN1_UNIVERSALSTRING_to_string ASN1_UTCTIME_adj ASN1_UTCTIME_check ASN1_UTCTIME_cmp_time_t ASN1_UTCTIME_free ASN1_UTCTIME_it ASN1_UTCTIME_new ASN1_UTCTIME_print ASN1_UTCTIME_set ASN1_UTCTIME_set_string ASN1_UTF8STRING_free ASN1_UTF8STRING_it ASN1_UTF8STRING_new ASN1_VISIBLESTRING_free ASN1_VISIBLESTRING_it ASN1_VISIBLESTRING_new ASN1_add_oid_module ASN1_add_stable_module ASN1_bn_print ASN1_buf_print ASN1_check_infinite_end ASN1_const_check_infinite_end ASN1_d2i_bio ASN1_d2i_fp ASN1_digest ASN1_dup ASN1_generate_nconf ASN1_generate_v3 ASN1_get_object ASN1_i2d_bio ASN1_i2d_fp ASN1_item_d2i ASN1_item_d2i_bio ASN1_item_d2i_fp ASN1_item_digest ASN1_item_dup ASN1_item_ex_d2i ASN1_item_ex_free ASN1_item_ex_i2d ASN1_item_ex_new ASN1_item_free ASN1_item_i2d ASN1_item_i2d_bio ASN1_item_i2d_fp ASN1_item_ndef_i2d ASN1_item_new ASN1_item_pack ASN1_item_print ASN1_item_sign ASN1_item_sign_ctx ASN1_item_unpack ASN1_item_verify ASN1_mbstring_copy ASN1_mbstring_ncopy ASN1_object_size ASN1_parse ASN1_parse_dump ASN1_put_eoc ASN1_put_object ASN1_sign ASN1_str2mask ASN1_tag2bit ASN1_tag2str ASN1_verify ASRange_free ASRange_it ASRange_new ASYNC_WAIT_CTX_clear_fd ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_get_fd ASYNC_WAIT_CTX_new ASYNC_WAIT_CTX_set_wait_fd ASYNC_block_pause ASYNC_cleanup_thread ASYNC_get_current_job ASYNC_get_wait_ctx ASYNC_init_thread ASYNC_is_capable ASYNC_pause_job ASYNC_start_job ASYNC_unblock_pause AUTHORITY_INFO_ACCESS_free AUTHORITY_INFO_ACCESS_it AUTHORITY_INFO_ACCESS_new AUTHORITY_KEYID_free AUTHORITY_KEYID_it AUTHORITY_KEYID_new BASIC_CONSTRAINTS_free BASIC_CONSTRAINTS_it BASIC_CONSTRAINTS_new BF_cbc_encrypt BF_cfb64_encrypt BF_decrypt BF_ecb_encrypt BF_encrypt BF_ofb64_encrypt BF_options BF_set_key BIGNUM_it BIO_ADDRINFO_address BIO_ADDRINFO_family BIO_ADDRINFO_free BIO_ADDRINFO_next BIO_ADDRINFO_protocol BIO_ADDRINFO_socktype BIO_ADDR_clear BIO_ADDR_family BIO_ADDR_free BIO_ADDR_hostname_string BIO_ADDR_new BIO_ADDR_path_string BIO_ADDR_rawaddress BIO_ADDR_rawmake BIO_ADDR_rawport BIO_ADDR_service_string BIO_accept BIO_accept_ex BIO_asn1_get_prefix BIO_asn1_get_suffix BIO_asn1_set_prefix BIO_asn1_set_suffix BIO_bind BIO_callback_ctrl BIO_clear_flags BIO_closesocket BIO_connect BIO_copy_next_retry BIO_ctrl BIO_ctrl_get_read_request BIO_ctrl_get_write_guarantee BIO_ctrl_pending BIO_ctrl_reset_read_request BIO_ctrl_wpending BIO_debug_callback BIO_dgram_non_fatal_error BIO_dump BIO_dump_cb BIO_dump_fp BIO_dump_indent BIO_dump_indent_cb BIO_dump_indent_fp BIO_dup_chain BIO_f_asn1 BIO_f_base64 BIO_f_buffer BIO_f_cipher BIO_f_linebuffer BIO_f_md BIO_f_nbio_test BIO_f_null BIO_f_reliable BIO_fd_non_fatal_error BIO_fd_should_retry BIO_find_type BIO_free BIO_free_all BIO_get_accept_socket BIO_get_callback BIO_get_callback_arg BIO_get_callback_ex BIO_get_data BIO_get_ex_data BIO_get_host_ip BIO_get_init BIO_get_new_index BIO_get_port BIO_get_retry_BIO BIO_get_retry_reason BIO_get_shutdown BIO_gethostbyname BIO_gets BIO_hex_string BIO_indent BIO_int_ctrl BIO_listen BIO_lookup BIO_lookup_ex BIO_meth_free BIO_meth_get_callback_ctrl BIO_meth_get_create BIO_meth_get_ctrl BIO_meth_get_destroy BIO_meth_get_gets BIO_meth_get_puts BIO_meth_get_read BIO_meth_get_read_ex BIO_meth_get_write BIO_meth_get_write_ex BIO_meth_new BIO_meth_set_callback_ctrl BIO_meth_set_create BIO_meth_set_ctrl BIO_meth_set_destroy BIO_meth_set_gets BIO_meth_set_puts BIO_meth_set_read BIO_meth_set_read_ex BIO_meth_set_write BIO_meth_set_write_ex BIO_method_name BIO_method_type BIO_new BIO_new_CMS BIO_new_NDEF BIO_new_PKCS7 BIO_new_accept BIO_new_bio_pair BIO_new_connect BIO_new_dgram BIO_new_fd BIO_new_file BIO_new_fp BIO_new_mem_buf BIO_new_socket BIO_next BIO_nread BIO_nread0 BIO_number_read BIO_number_written BIO_nwrite BIO_nwrite0 BIO_parse_hostserv BIO_pop BIO_printf BIO_ptr_ctrl BIO_push BIO_puts BIO_read BIO_read_ex BIO_s_accept BIO_s_bio BIO_s_connect BIO_s_datagram BIO_s_fd BIO_s_file BIO_s_log BIO_s_mem BIO_s_null BIO_s_secmem BIO_s_socket BIO_set_callback BIO_set_callback_arg BIO_set_callback_ex BIO_set_cipher BIO_set_data BIO_set_ex_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_set_tcp_ndelay BIO_snprintf BIO_sock_error BIO_sock_info BIO_sock_init BIO_sock_non_fatal_error BIO_sock_should_retry BIO_socket BIO_socket_ioctl BIO_socket_nbio BIO_test_flags BIO_up_ref BIO_vfree BIO_vprintf BIO_vsnprintf BIO_write BIO_write_ex BN_BLINDING_convert BN_BLINDING_convert_ex BN_BLINDING_create_param BN_BLINDING_free BN_BLINDING_get_flags BN_BLINDING_invert BN_BLINDING_invert_ex BN_BLINDING_is_current_thread BN_BLINDING_lock BN_BLINDING_new BN_BLINDING_set_current_thread BN_BLINDING_set_flags BN_BLINDING_unlock BN_BLINDING_update BN_CTX_end BN_CTX_free BN_CTX_get BN_CTX_new BN_CTX_secure_new BN_CTX_start BN_GENCB_call BN_GENCB_free BN_GENCB_get_arg BN_GENCB_new BN_GENCB_set BN_GENCB_set_old BN_GF2m_add BN_GF2m_arr2poly BN_GF2m_mod BN_GF2m_mod_arr BN_GF2m_mod_div BN_GF2m_mod_div_arr BN_GF2m_mod_exp BN_GF2m_mod_exp_arr BN_GF2m_mod_inv BN_GF2m_mod_inv_arr BN_GF2m_mod_mul BN_GF2m_mod_mul_arr BN_GF2m_mod_solve_quad BN_GF2m_mod_solve_quad_arr BN_GF2m_mod_sqr BN_GF2m_mod_sqr_arr BN_GF2m_mod_sqrt BN_GF2m_mod_sqrt_arr BN_GF2m_poly2arr BN_MONT_CTX_copy BN_MONT_CTX_free BN_MONT_CTX_new BN_MONT_CTX_set BN_MONT_CTX_set_locked BN_RECP_CTX_free BN_RECP_CTX_new BN_RECP_CTX_set BN_X931_derive_prime_ex BN_X931_generate_Xpq BN_X931_generate_prime_ex BN_abs_is_word BN_add BN_add_word BN_asc2bn BN_bin2bn BN_bn2bin BN_bn2binpad BN_bn2dec BN_bn2hex BN_bn2lebinpad BN_bn2mpi BN_bntest_rand BN_clear BN_clear_bit BN_clear_free BN_cmp BN_consttime_swap BN_copy BN_dec2bn BN_div BN_div_recp BN_div_word BN_dup BN_exp BN_free BN_from_montgomery BN_gcd BN_generate_dsa_nonce BN_generate_prime BN_generate_prime_ex BN_get0_nist_prime_192 BN_get0_nist_prime_224 BN_get0_nist_prime_256 BN_get0_nist_prime_384 BN_get0_nist_prime_521 BN_get_flags BN_get_params BN_get_rfc2409_prime_1024 BN_get_rfc2409_prime_768 BN_get_rfc3526_prime_1536 BN_get_rfc3526_prime_2048 BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_4096 BN_get_rfc3526_prime_6144 BN_get_rfc3526_prime_8192 BN_get_word BN_hex2bn BN_is_bit_set BN_is_negative BN_is_odd BN_is_one BN_is_prime BN_is_prime_ex BN_is_prime_fasttest BN_is_prime_fasttest_ex BN_is_word BN_is_zero BN_kronecker BN_lebin2bn BN_lshift BN_lshift1 BN_mask_bits BN_mod_add BN_mod_add_quick BN_mod_exp BN_mod_exp2_mont BN_mod_exp_mont BN_mod_exp_mont_consttime BN_mod_exp_mont_word BN_mod_exp_recp BN_mod_exp_simple BN_mod_inverse BN_mod_lshift BN_mod_lshift1 BN_mod_lshift1_quick BN_mod_lshift_quick BN_mod_mul BN_mod_mul_montgomery BN_mod_mul_reciprocal BN_mod_sqr BN_mod_sqrt BN_mod_sub BN_mod_sub_quick BN_mod_word BN_mpi2bn BN_mul BN_mul_word BN_new BN_nist_mod_192 BN_nist_mod_224 BN_nist_mod_256 BN_nist_mod_384 BN_nist_mod_521 BN_nist_mod_func BN_nnmod BN_num_bits BN_num_bits_word BN_options BN_print BN_print_fp BN_priv_rand BN_priv_rand_range BN_pseudo_rand BN_pseudo_rand_range BN_rand BN_rand_range BN_reciprocal BN_rshift BN_rshift1 BN_secure_new BN_security_bits BN_set_bit BN_set_flags BN_set_negative BN_set_params BN_set_word BN_sqr BN_sub BN_sub_word BN_swap BN_to_ASN1_ENUMERATED BN_to_ASN1_INTEGER BN_to_montgomery BN_uadd BN_ucmp BN_usub BN_value_one BN_with_flags BN_zero_ex BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_MEM_new_ex BUF_reverse CAST_cbc_encrypt CAST_cfb64_encrypt CAST_decrypt CAST_ecb_encrypt CAST_encrypt CAST_ofb64_encrypt CAST_set_key CBIGNUM_it CERTIFICATEPOLICIES_free CERTIFICATEPOLICIES_it CERTIFICATEPOLICIES_new CMAC_CTX_cleanup CMAC_CTX_copy CMAC_CTX_free CMAC_CTX_get0_cipher_ctx CMAC_CTX_new CMAC_Final CMAC_Init CMAC_Update CMAC_resume CMS_ContentInfo_free CMS_ContentInfo_it CMS_ContentInfo_new CMS_ContentInfo_print_ctx CMS_EncryptedData_decrypt CMS_EncryptedData_encrypt CMS_EncryptedData_set1_key CMS_EnvelopedData_create CMS_ReceiptRequest_create0 CMS_ReceiptRequest_free CMS_ReceiptRequest_get0_values CMS_ReceiptRequest_it CMS_ReceiptRequest_new CMS_RecipientEncryptedKey_cert_cmp CMS_RecipientEncryptedKey_get0_id CMS_RecipientInfo_decrypt CMS_RecipientInfo_encrypt CMS_RecipientInfo_get0_pkey_ctx CMS_RecipientInfo_kari_decrypt CMS_RecipientInfo_kari_get0_alg CMS_RecipientInfo_kari_get0_ctx CMS_RecipientInfo_kari_get0_orig_id CMS_RecipientInfo_kari_get0_reks CMS_RecipientInfo_kari_orig_id_cmp CMS_RecipientInfo_kari_set0_pkey CMS_RecipientInfo_kekri_get0_id CMS_RecipientInfo_kekri_id_cmp CMS_RecipientInfo_ktri_cert_cmp CMS_RecipientInfo_ktri_get0_algs CMS_RecipientInfo_ktri_get0_signer_id CMS_RecipientInfo_set0_key CMS_RecipientInfo_set0_password CMS_RecipientInfo_set0_pkey CMS_RecipientInfo_type CMS_SharedInfo_encode CMS_SignedData_init CMS_SignerInfo_cert_cmp CMS_SignerInfo_get0_algs CMS_SignerInfo_get0_md_ctx CMS_SignerInfo_get0_pkey_ctx CMS_SignerInfo_get0_signature CMS_SignerInfo_get0_signer_id CMS_SignerInfo_set1_signer_cert CMS_SignerInfo_sign CMS_SignerInfo_verify CMS_SignerInfo_verify_content CMS_add0_CertificateChoices CMS_add0_RevocationInfoChoice CMS_add0_cert CMS_add0_crl CMS_add0_recipient_key CMS_add0_recipient_password CMS_add1_ReceiptRequest CMS_add1_cert CMS_add1_crl CMS_add1_recipient_cert CMS_add1_signer CMS_add_simple_smimecap CMS_add_smimecap CMS_add_standard_smimecap CMS_compress CMS_data CMS_dataFinal CMS_dataInit CMS_data_create CMS_decrypt CMS_decrypt_set1_key CMS_decrypt_set1_password CMS_decrypt_set1_pkey CMS_digest_create CMS_digest_verify CMS_encrypt CMS_final CMS_get0_RecipientInfos CMS_get0_SignerInfos CMS_get0_content CMS_get0_eContentType CMS_get0_signers CMS_get0_type CMS_get1_ReceiptRequest CMS_get1_certs CMS_get1_crls CMS_is_detached CMS_set1_eContentType CMS_set1_signers_certs CMS_set_detached CMS_sign CMS_sign_receipt CMS_signed_add1_attr CMS_signed_add1_attr_by_NID CMS_signed_add1_attr_by_OBJ CMS_signed_add1_attr_by_txt CMS_signed_delete_attr CMS_signed_get0_data_by_OBJ CMS_signed_get_attr CMS_signed_get_attr_by_NID CMS_signed_get_attr_by_OBJ CMS_signed_get_attr_count CMS_stream CMS_uncompress CMS_unsigned_add1_attr CMS_unsigned_add1_attr_by_NID CMS_unsigned_add1_attr_by_OBJ CMS_unsigned_add1_attr_by_txt CMS_unsigned_delete_attr CMS_unsigned_get0_data_by_OBJ CMS_unsigned_get_attr CMS_unsigned_get_attr_by_NID CMS_unsigned_get_attr_by_OBJ CMS_unsigned_get_attr_count CMS_verify CMS_verify_receipt COMP_CTX_free COMP_CTX_get_method COMP_CTX_get_type COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_dump_bio CONF_dump_fp CONF_free CONF_get1_default_config_file CONF_get_number CONF_get_section CONF_get_string CONF_imodule_get_flags CONF_imodule_get_module CONF_imodule_get_name CONF_imodule_get_usr_data CONF_imodule_get_value CONF_imodule_set_flags CONF_imodule_set_usr_data CONF_load CONF_load_bio CONF_load_fp CONF_module_add CONF_module_get_usr_data CONF_module_set_usr_data CONF_modules_finish CONF_modules_load CONF_modules_load_file CONF_modules_unload CONF_parse_list CONF_set_default_method CONF_set_nconf CRL_DIST_POINTS_free CRL_DIST_POINTS_it CRL_DIST_POINTS_new CRYPTO_128_unwrap CRYPTO_128_unwrap_pad CRYPTO_128_wrap CRYPTO_128_wrap_pad CRYPTO_THREAD_cleanup_local CRYPTO_THREAD_compare_id CRYPTO_THREAD_get_current_id CRYPTO_THREAD_get_local CRYPTO_THREAD_init_local CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_set_local CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_atomic_add CRYPTO_cbc128_decrypt CRYPTO_cbc128_encrypt CRYPTO_ccm128_aad CRYPTO_ccm128_decrypt CRYPTO_ccm128_decrypt_ccm64 CRYPTO_ccm128_encrypt CRYPTO_ccm128_encrypt_ccm64 CRYPTO_ccm128_init CRYPTO_ccm128_setiv CRYPTO_ccm128_tag CRYPTO_cfb128_1_encrypt CRYPTO_cfb128_8_encrypt CRYPTO_cfb128_encrypt CRYPTO_clear_free CRYPTO_clear_realloc CRYPTO_ctr128_encrypt CRYPTO_ctr128_encrypt_ctr32 CRYPTO_cts128_decrypt CRYPTO_cts128_decrypt_block CRYPTO_cts128_encrypt CRYPTO_cts128_encrypt_block CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_free_ex_index CRYPTO_gcm128_aad CRYPTO_gcm128_decrypt CRYPTO_gcm128_decrypt_ctr32 CRYPTO_gcm128_encrypt CRYPTO_gcm128_encrypt_ctr32 CRYPTO_gcm128_finish CRYPTO_gcm128_init CRYPTO_gcm128_new CRYPTO_gcm128_release CRYPTO_gcm128_setiv CRYPTO_gcm128_tag CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_get_mem_functions CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_nistcts128_decrypt CRYPTO_nistcts128_decrypt_block CRYPTO_nistcts128_encrypt CRYPTO_nistcts128_encrypt_block CRYPTO_ocb128_aad CRYPTO_ocb128_cleanup CRYPTO_ocb128_copy_ctx CRYPTO_ocb128_decrypt CRYPTO_ocb128_encrypt CRYPTO_ocb128_finish CRYPTO_ocb128_init CRYPTO_ocb128_new CRYPTO_ocb128_setiv CRYPTO_ocb128_tag CRYPTO_ofb128_encrypt CRYPTO_realloc CRYPTO_secure_actual_size CRYPTO_secure_allocated CRYPTO_secure_clear_free CRYPTO_secure_free CRYPTO_secure_malloc CRYPTO_secure_malloc_done CRYPTO_secure_malloc_init CRYPTO_secure_malloc_initialized CRYPTO_secure_used CRYPTO_secure_zalloc CRYPTO_set_ex_data CRYPTO_set_mem_debug CRYPTO_set_mem_functions CRYPTO_strdup CRYPTO_strndup CRYPTO_xts128_encrypt CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_get0_log_by_id CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CTLOG_free CTLOG_get0_log_id CTLOG_get0_name CTLOG_get0_public_key CTLOG_new CTLOG_new_from_base64 CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_get0_cert CT_POLICY_EVAL_CTX_get0_issuer CT_POLICY_EVAL_CTX_get0_log_store CT_POLICY_EVAL_CTX_get_time CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time Camellia_cbc_encrypt Camellia_cfb128_encrypt Camellia_cfb1_encrypt Camellia_cfb8_encrypt Camellia_ctr128_encrypt Camellia_decrypt Camellia_ecb_encrypt Camellia_encrypt Camellia_ofb128_encrypt Camellia_set_key DES_cbc_cksum DES_cbc_encrypt DES_cfb64_encrypt DES_cfb_encrypt DES_check_key_parity DES_crypt DES_decrypt3 DES_ecb3_encrypt DES_ecb_encrypt DES_ede3_cbc_encrypt DES_ede3_cfb64_encrypt DES_ede3_cfb_encrypt DES_ede3_ofb64_encrypt DES_encrypt1 DES_encrypt2 DES_encrypt3 DES_fcrypt DES_is_weak_key DES_key_sched DES_ncbc_encrypt DES_ofb64_encrypt DES_ofb_encrypt DES_options DES_pcbc_encrypt DES_quad_cksum DES_random_key DES_set_key DES_set_key_checked DES_set_key_unchecked DES_set_odd_parity DES_string_to_2keys DES_string_to_key DES_xcbc_encrypt DH_KDF_X9_42 DH_OpenSSL DH_bits DH_check DH_check_ex DH_check_params DH_check_params_ex DH_check_pub_key DH_check_pub_key_ex DH_clear_flags DH_compute_key DH_compute_key_padded DH_free DH_generate_key DH_generate_parameters DH_generate_parameters_ex DH_get0_engine DH_get0_g DH_get0_key DH_get0_p DH_get0_pqg DH_get0_priv_key DH_get0_pub_key DH_get0_q DH_get_1024_160 DH_get_2048_224 DH_get_2048_256 DH_get_default_method DH_get_ex_data DH_get_length DH_get_nid DH_meth_dup DH_meth_free DH_meth_get0_app_data DH_meth_get0_name DH_meth_get_bn_mod_exp DH_meth_get_compute_key DH_meth_get_finish DH_meth_get_flags DH_meth_get_generate_key DH_meth_get_generate_params DH_meth_get_init DH_meth_new DH_meth_set0_app_data DH_meth_set1_name DH_meth_set_bn_mod_exp DH_meth_set_compute_key DH_meth_set_finish DH_meth_set_flags DH_meth_set_generate_key DH_meth_set_generate_params DH_meth_set_init DH_new DH_new_by_nid DH_new_method DH_security_bits DH_set0_key DH_set0_pqg DH_set_default_method DH_set_ex_data DH_set_flags DH_set_length DH_set_method DH_size DH_test_flags DH_up_ref DHparams_dup DHparams_it DHparams_print DHparams_print_fp DIRECTORYSTRING_free DIRECTORYSTRING_it DIRECTORYSTRING_new DISPLAYTEXT_free DISPLAYTEXT_it DISPLAYTEXT_new DIST_POINT_NAME_free DIST_POINT_NAME_it DIST_POINT_NAME_new DIST_POINT_free DIST_POINT_it DIST_POINT_new DIST_POINT_set_dpname DSA_OpenSSL DSA_SIG_free DSA_SIG_get0 DSA_SIG_new DSA_SIG_set0 DSA_bits DSA_clear_flags DSA_do_sign DSA_do_verify DSA_dup_DH DSA_free DSA_generate_key DSA_generate_parameters DSA_generate_parameters_ex DSA_get0_engine DSA_get0_g DSA_get0_key DSA_get0_p DSA_get0_pqg DSA_get0_priv_key DSA_get0_pub_key DSA_get0_q DSA_get_default_method DSA_get_ex_data DSA_get_method DSA_meth_dup DSA_meth_free DSA_meth_get0_app_data DSA_meth_get0_name DSA_meth_get_bn_mod_exp DSA_meth_get_finish DSA_meth_get_flags DSA_meth_get_init DSA_meth_get_keygen DSA_meth_get_mod_exp DSA_meth_get_paramgen DSA_meth_get_sign DSA_meth_get_sign_setup DSA_meth_get_verify DSA_meth_new DSA_meth_set0_app_data DSA_meth_set1_name DSA_meth_set_bn_mod_exp DSA_meth_set_finish DSA_meth_set_flags DSA_meth_set_init DSA_meth_set_keygen DSA_meth_set_mod_exp DSA_meth_set_paramgen DSA_meth_set_sign DSA_meth_set_sign_setup DSA_meth_set_verify DSA_new DSA_new_method DSA_print DSA_print_fp DSA_security_bits DSA_set0_key DSA_set0_pqg DSA_set_default_method DSA_set_ex_data DSA_set_flags DSA_set_method DSA_sign DSA_sign_setup DSA_size DSA_test_flags DSA_up_ref DSA_verify DSAparams_dup DSAparams_print DSAparams_print_fp DSO_METHOD_openssl DSO_bind_func DSO_convert_filename DSO_ctrl DSO_dsobyaddr DSO_flags DSO_free DSO_get_filename DSO_global_lookup DSO_load DSO_merge DSO_new DSO_pathbyaddr DSO_set_filename DSO_up_ref ECDH_KDF_X9_62 ECDH_compute_key ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_get0_r ECDSA_SIG_get0_s ECDSA_SIG_new ECDSA_SIG_set0 ECDSA_do_sign ECDSA_do_sign_ex ECDSA_do_verify ECDSA_sign ECDSA_sign_ex ECDSA_sign_setup ECDSA_size ECDSA_verify ECPARAMETERS_free ECPARAMETERS_it ECPARAMETERS_new ECPKPARAMETERS_free ECPKPARAMETERS_it ECPKPARAMETERS_new ECPKParameters_print ECPKParameters_print_fp ECParameters_print ECParameters_print_fp EC_GF2m_simple_method EC_GFp_mont_method EC_GFp_nist_method EC_GFp_simple_method EC_GROUP_check EC_GROUP_check_discriminant EC_GROUP_clear_free EC_GROUP_cmp EC_GROUP_copy EC_GROUP_dup EC_GROUP_free EC_GROUP_get0_cofactor EC_GROUP_get0_generator EC_GROUP_get0_order EC_GROUP_get0_seed EC_GROUP_get_asn1_flag EC_GROUP_get_basis_type EC_GROUP_get_cofactor EC_GROUP_get_curve EC_GROUP_get_curve_GF2m EC_GROUP_get_curve_GFp EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_get_ecparameters EC_GROUP_get_ecpkparameters EC_GROUP_get_mont_data EC_GROUP_get_order EC_GROUP_get_pentanomial_basis EC_GROUP_get_point_conversion_form EC_GROUP_get_seed_len EC_GROUP_get_trinomial_basis EC_GROUP_have_precompute_mult EC_GROUP_method_of EC_GROUP_new EC_GROUP_new_by_curve_name EC_GROUP_new_curve_GF2m EC_GROUP_new_curve_GFp EC_GROUP_new_from_ecparameters EC_GROUP_new_from_ecpkparameters EC_GROUP_order_bits EC_GROUP_precompute_mult EC_GROUP_set_asn1_flag EC_GROUP_set_curve EC_GROUP_set_curve_GF2m EC_GROUP_set_curve_GFp EC_GROUP_set_curve_name EC_GROUP_set_generator EC_GROUP_set_point_conversion_form EC_GROUP_set_seed EC_KEY_METHOD_free EC_KEY_METHOD_get_compute_key EC_KEY_METHOD_get_init EC_KEY_METHOD_get_keygen EC_KEY_METHOD_get_sign EC_KEY_METHOD_get_verify EC_KEY_METHOD_new EC_KEY_METHOD_set_compute_key EC_KEY_METHOD_set_init EC_KEY_METHOD_set_keygen EC_KEY_METHOD_set_sign EC_KEY_METHOD_set_verify EC_KEY_OpenSSL EC_KEY_can_sign EC_KEY_check_key EC_KEY_clear_flags EC_KEY_copy EC_KEY_decoded_from_explicit_params EC_KEY_dup EC_KEY_free EC_KEY_generate_key EC_KEY_get0_engine EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_get_conv_form EC_KEY_get_default_method EC_KEY_get_enc_flags EC_KEY_get_ex_data EC_KEY_get_flags EC_KEY_get_method EC_KEY_key2buf EC_KEY_new EC_KEY_new_by_curve_name EC_KEY_new_method EC_KEY_oct2key EC_KEY_oct2priv EC_KEY_precompute_mult EC_KEY_print EC_KEY_print_fp EC_KEY_priv2buf EC_KEY_priv2oct EC_KEY_set_asn1_flag EC_KEY_set_conv_form EC_KEY_set_default_method EC_KEY_set_enc_flags EC_KEY_set_ex_data EC_KEY_set_flags EC_KEY_set_group EC_KEY_set_method EC_KEY_set_private_key EC_KEY_set_public_key EC_KEY_set_public_key_affine_coordinates EC_KEY_up_ref EC_METHOD_get_field_type EC_POINT_add EC_POINT_bn2point EC_POINT_clear_free EC_POINT_cmp EC_POINT_copy EC_POINT_dbl EC_POINT_dup EC_POINT_free EC_POINT_get_Jprojective_coordinates_GFp EC_POINT_get_affine_coordinates EC_POINT_get_affine_coordinates_GF2m EC_POINT_get_affine_coordinates_GFp EC_POINT_hex2point EC_POINT_invert EC_POINT_is_at_infinity EC_POINT_is_on_curve EC_POINT_make_affine EC_POINT_method_of EC_POINT_mul EC_POINT_new EC_POINT_oct2point EC_POINT_point2bn EC_POINT_point2buf EC_POINT_point2hex EC_POINT_point2oct EC_POINT_set_Jprojective_coordinates_GFp EC_POINT_set_affine_coordinates EC_POINT_set_affine_coordinates_GF2m EC_POINT_set_affine_coordinates_GFp EC_POINT_set_compressed_coordinates EC_POINT_set_compressed_coordinates_GF2m EC_POINT_set_compressed_coordinates_GFp EC_POINT_set_to_infinity EC_POINTs_make_affine EC_POINTs_mul EC_curve_nid2nist EC_curve_nist2nid EC_get_builtin_curves EDIPARTYNAME_free EDIPARTYNAME_it EDIPARTYNAME_new ENGINE_add ENGINE_add_conf_module ENGINE_by_id ENGINE_cmd_is_executable ENGINE_ctrl ENGINE_ctrl_cmd ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_DH ENGINE_get_DSA ENGINE_get_EC ENGINE_get_RAND ENGINE_get_RSA ENGINE_get_cipher ENGINE_get_cipher_engine ENGINE_get_ciphers ENGINE_get_cmd_defns ENGINE_get_ctrl_function ENGINE_get_default_DH ENGINE_get_default_DSA ENGINE_get_default_EC ENGINE_get_default_RAND ENGINE_get_default_RSA ENGINE_get_destroy_function ENGINE_get_digest ENGINE_get_digest_engine ENGINE_get_digests ENGINE_get_ex_data ENGINE_get_finish_function ENGINE_get_first ENGINE_get_flags ENGINE_get_id ENGINE_get_init_function ENGINE_get_last ENGINE_get_load_privkey_function ENGINE_get_load_pubkey_function ENGINE_get_name ENGINE_get_next ENGINE_get_pkey_asn1_meth ENGINE_get_pkey_asn1_meth_engine ENGINE_get_pkey_asn1_meth_str ENGINE_get_pkey_asn1_meths ENGINE_get_pkey_meth ENGINE_get_pkey_meth_engine ENGINE_get_pkey_meths ENGINE_get_prev ENGINE_get_ssl_client_cert_function ENGINE_get_static_state ENGINE_get_table_flags ENGINE_init ENGINE_load_builtin_engines ENGINE_load_private_key ENGINE_load_public_key ENGINE_load_ssl_client_cert ENGINE_new ENGINE_pkey_asn1_find_str ENGINE_register_DH ENGINE_register_DSA ENGINE_register_EC ENGINE_register_RAND ENGINE_register_RSA ENGINE_register_all_DH ENGINE_register_all_DSA ENGINE_register_all_EC ENGINE_register_all_RAND ENGINE_register_all_RSA ENGINE_register_all_ciphers ENGINE_register_all_complete ENGINE_register_all_digests ENGINE_register_all_pkey_asn1_meths ENGINE_register_all_pkey_meths ENGINE_register_ciphers ENGINE_register_complete ENGINE_register_digests ENGINE_register_pkey_asn1_meths ENGINE_register_pkey_meths ENGINE_remove ENGINE_set_DH ENGINE_set_DSA ENGINE_set_EC ENGINE_set_RAND ENGINE_set_RSA ENGINE_set_ciphers ENGINE_set_cmd_defns ENGINE_set_ctrl_function ENGINE_set_default ENGINE_set_default_DH ENGINE_set_default_DSA ENGINE_set_default_EC ENGINE_set_default_RAND ENGINE_set_default_RSA ENGINE_set_default_ciphers ENGINE_set_default_digests ENGINE_set_default_pkey_asn1_meths ENGINE_set_default_pkey_meths ENGINE_set_default_string ENGINE_set_destroy_function ENGINE_set_digests ENGINE_set_ex_data ENGINE_set_finish_function ENGINE_set_flags ENGINE_set_id ENGINE_set_init_function ENGINE_set_load_privkey_function ENGINE_set_load_pubkey_function ENGINE_set_load_ssl_client_cert_function ENGINE_set_name ENGINE_set_pkey_asn1_meths ENGINE_set_pkey_meths ENGINE_set_table_flags ENGINE_unregister_DH ENGINE_unregister_DSA ENGINE_unregister_EC ENGINE_unregister_RAND ENGINE_unregister_RSA ENGINE_unregister_ciphers ENGINE_unregister_digests ENGINE_unregister_pkey_asn1_meths ENGINE_unregister_pkey_meths ENGINE_up_ref ERR_add_error_data ERR_add_error_vdata ERR_clear_error ERR_clear_last_mark ERR_error_string ERR_error_string_n ERR_func_error_string ERR_get_error ERR_get_error_line ERR_get_error_line_data ERR_get_next_error_library ERR_get_state ERR_lib_error_string ERR_load_ASN1_strings ERR_load_ASYNC_strings ERR_load_BIO_strings ERR_load_BN_strings ERR_load_BUF_strings ERR_load_CMS_strings ERR_load_COMP_strings ERR_load_CONF_strings ERR_load_CRYPTO_strings ERR_load_CT_strings ERR_load_DH_strings ERR_load_DSA_strings ERR_load_DSO_strings ERR_load_EC_strings ERR_load_ENGINE_strings ERR_load_ERR_strings ERR_load_EVP_strings ERR_load_KDF_strings ERR_load_OBJ_strings ERR_load_OCSP_strings ERR_load_OSSL_STORE_strings ERR_load_PEM_strings ERR_load_PKCS12_strings ERR_load_PKCS7_strings ERR_load_RAND_strings ERR_load_RSA_strings ERR_load_TS_strings ERR_load_UI_strings ERR_load_X509V3_strings ERR_load_X509_strings ERR_load_strings ERR_load_strings_const ERR_peek_error ERR_peek_error_line ERR_peek_error_line_data ERR_peek_last_error ERR_peek_last_error_line ERR_peek_last_error_line_data ERR_pop_to_mark ERR_print_errors ERR_print_errors_cb ERR_print_errors_fp ERR_put_error ERR_reason_error_string ERR_remove_state ERR_remove_thread_state ERR_set_error_data ERR_set_mark ERR_unload_strings ESS_CERT_ID_V2_dup ESS_CERT_ID_V2_free ESS_CERT_ID_V2_new ESS_CERT_ID_dup ESS_CERT_ID_free ESS_CERT_ID_new ESS_ISSUER_SERIAL_dup ESS_ISSUER_SERIAL_free ESS_ISSUER_SERIAL_new ESS_SIGNING_CERT_V2_dup ESS_SIGNING_CERT_V2_free ESS_SIGNING_CERT_V2_new ESS_SIGNING_CERT_dup ESS_SIGNING_CERT_free ESS_SIGNING_CERT_new EVP_BytesToKey EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_buf_noconst EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_clear_flags EVP_CIPHER_CTX_copy EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_encrypting EVP_CIPHER_CTX_free EVP_CIPHER_CTX_get_app_data EVP_CIPHER_CTX_get_cipher_data EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_nid EVP_CIPHER_CTX_num EVP_CIPHER_CTX_original_iv EVP_CIPHER_CTX_rand_key EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_set_cipher_data EVP_CIPHER_CTX_set_flags EVP_CIPHER_CTX_set_key_length EVP_CIPHER_CTX_set_num EVP_CIPHER_CTX_set_padding EVP_CIPHER_CTX_test_flags EVP_CIPHER_asn1_to_param EVP_CIPHER_block_size EVP_CIPHER_do_all EVP_CIPHER_do_all_sorted EVP_CIPHER_flags EVP_CIPHER_get_asn1_iv EVP_CIPHER_impl_ctx_size EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_meth_dup EVP_CIPHER_meth_free EVP_CIPHER_meth_get_cleanup EVP_CIPHER_meth_get_ctrl EVP_CIPHER_meth_get_do_cipher EVP_CIPHER_meth_get_get_asn1_params EVP_CIPHER_meth_get_init EVP_CIPHER_meth_get_set_asn1_params EVP_CIPHER_meth_new EVP_CIPHER_meth_set_cleanup EVP_CIPHER_meth_set_ctrl EVP_CIPHER_meth_set_do_cipher EVP_CIPHER_meth_set_flags EVP_CIPHER_meth_set_get_asn1_params EVP_CIPHER_meth_set_impl_ctx_size EVP_CIPHER_meth_set_init EVP_CIPHER_meth_set_iv_length EVP_CIPHER_meth_set_set_asn1_params EVP_CIPHER_nid EVP_CIPHER_param_to_asn1 EVP_CIPHER_set_asn1_iv EVP_CIPHER_type EVP_Cipher EVP_CipherFinal EVP_CipherFinal_ex EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_DecodeBlock EVP_DecodeFinal EVP_DecodeInit EVP_DecodeUpdate EVP_DecryptFinal EVP_DecryptFinal_ex EVP_DecryptInit EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinalXOF EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSign EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerify EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_ENCODE_CTX_copy EVP_ENCODE_CTX_free EVP_ENCODE_CTX_new EVP_ENCODE_CTX_num EVP_EncodeBlock EVP_EncodeFinal EVP_EncodeInit EVP_EncodeUpdate EVP_EncryptFinal EVP_EncryptFinal_ex EVP_EncryptInit EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_clear_flags EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_md_data EVP_MD_CTX_new EVP_MD_CTX_pkey_ctx EVP_MD_CTX_reset EVP_MD_CTX_set_flags EVP_MD_CTX_set_pkey_ctx EVP_MD_CTX_set_update_fn EVP_MD_CTX_test_flags EVP_MD_CTX_update_fn EVP_MD_block_size EVP_MD_do_all EVP_MD_do_all_sorted EVP_MD_flags EVP_MD_meth_dup EVP_MD_meth_free EVP_MD_meth_get_app_datasize EVP_MD_meth_get_cleanup EVP_MD_meth_get_copy EVP_MD_meth_get_ctrl EVP_MD_meth_get_final EVP_MD_meth_get_flags EVP_MD_meth_get_init EVP_MD_meth_get_input_blocksize EVP_MD_meth_get_result_size EVP_MD_meth_get_update EVP_MD_meth_new EVP_MD_meth_set_app_datasize EVP_MD_meth_set_cleanup EVP_MD_meth_set_copy EVP_MD_meth_set_ctrl EVP_MD_meth_set_final EVP_MD_meth_set_flags EVP_MD_meth_set_init EVP_MD_meth_set_input_blocksize EVP_MD_meth_set_result_size EVP_MD_meth_set_update EVP_MD_pkey_type EVP_MD_size EVP_MD_type EVP_OpenFinal EVP_OpenInit EVP_PBE_CipherInit EVP_PBE_alg_add EVP_PBE_alg_add_type EVP_PBE_cleanup EVP_PBE_find EVP_PBE_get EVP_PBE_scrypt EVP_PKCS82PKEY EVP_PKEY2PKCS8 EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_ctrl_uint64 EVP_PKEY_CTX_dup EVP_PKEY_CTX_free EVP_PKEY_CTX_get0_peerkey EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get_app_data EVP_PKEY_CTX_get_cb EVP_PKEY_CTX_get_data EVP_PKEY_CTX_get_keygen_info EVP_PKEY_CTX_get_operation EVP_PKEY_CTX_hex2ctrl EVP_PKEY_CTX_md EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set0_keygen_info EVP_PKEY_CTX_set_app_data EVP_PKEY_CTX_set_cb EVP_PKEY_CTX_set_data EVP_PKEY_CTX_str2ctrl EVP_PKEY_add1_attr EVP_PKEY_add1_attr_by_NID EVP_PKEY_add1_attr_by_OBJ EVP_PKEY_add1_attr_by_txt EVP_PKEY_asn1_add0 EVP_PKEY_asn1_add_alias EVP_PKEY_asn1_copy EVP_PKEY_asn1_find EVP_PKEY_asn1_find_str EVP_PKEY_asn1_free EVP_PKEY_asn1_get0 EVP_PKEY_asn1_get0_info EVP_PKEY_asn1_get_count EVP_PKEY_asn1_new EVP_PKEY_asn1_set_check EVP_PKEY_asn1_set_ctrl EVP_PKEY_asn1_set_free EVP_PKEY_asn1_set_get_priv_key EVP_PKEY_asn1_set_get_pub_key EVP_PKEY_asn1_set_item EVP_PKEY_asn1_set_param EVP_PKEY_asn1_set_param_check EVP_PKEY_asn1_set_private EVP_PKEY_asn1_set_public EVP_PKEY_asn1_set_public_check EVP_PKEY_asn1_set_security_bits EVP_PKEY_asn1_set_set_priv_key EVP_PKEY_asn1_set_set_pub_key EVP_PKEY_asn1_set_siginf EVP_PKEY_assign EVP_PKEY_base_id EVP_PKEY_bits EVP_PKEY_check EVP_PKEY_cmp EVP_PKEY_cmp_parameters EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_decrypt_old EVP_PKEY_delete_attr EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_encrypt_old EVP_PKEY_free EVP_PKEY_get0 EVP_PKEY_get0_DH EVP_PKEY_get0_DSA EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get0_asn1 EVP_PKEY_get0_engine EVP_PKEY_get0_hmac EVP_PKEY_get0_poly1305 EVP_PKEY_get0_siphash EVP_PKEY_get1_DH EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_get_attr EVP_PKEY_get_attr_by_NID EVP_PKEY_get_attr_by_OBJ EVP_PKEY_get_attr_count EVP_PKEY_get_default_digest_nid EVP_PKEY_get_raw_private_key EVP_PKEY_get_raw_public_key EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_meth_add0 EVP_PKEY_meth_copy EVP_PKEY_meth_find EVP_PKEY_meth_free EVP_PKEY_meth_get0 EVP_PKEY_meth_get0_info EVP_PKEY_meth_get_check EVP_PKEY_meth_get_cleanup EVP_PKEY_meth_get_copy EVP_PKEY_meth_get_count EVP_PKEY_meth_get_ctrl EVP_PKEY_meth_get_decrypt EVP_PKEY_meth_get_derive EVP_PKEY_meth_get_digest_custom EVP_PKEY_meth_get_digestsign EVP_PKEY_meth_get_digestverify EVP_PKEY_meth_get_encrypt EVP_PKEY_meth_get_init EVP_PKEY_meth_get_keygen EVP_PKEY_meth_get_param_check EVP_PKEY_meth_get_paramgen EVP_PKEY_meth_get_public_check EVP_PKEY_meth_get_sign EVP_PKEY_meth_get_signctx EVP_PKEY_meth_get_verify EVP_PKEY_meth_get_verify_recover EVP_PKEY_meth_get_verifyctx EVP_PKEY_meth_new EVP_PKEY_meth_remove EVP_PKEY_meth_set_check EVP_PKEY_meth_set_cleanup EVP_PKEY_meth_set_copy EVP_PKEY_meth_set_ctrl EVP_PKEY_meth_set_decrypt EVP_PKEY_meth_set_derive EVP_PKEY_meth_set_digest_custom EVP_PKEY_meth_set_digestsign EVP_PKEY_meth_set_digestverify EVP_PKEY_meth_set_encrypt EVP_PKEY_meth_set_init EVP_PKEY_meth_set_keygen EVP_PKEY_meth_set_param_check EVP_PKEY_meth_set_paramgen EVP_PKEY_meth_set_public_check EVP_PKEY_meth_set_sign EVP_PKEY_meth_set_signctx EVP_PKEY_meth_set_verify EVP_PKEY_meth_set_verify_recover EVP_PKEY_meth_set_verifyctx EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_CMAC_key EVP_PKEY_new_mac_key EVP_PKEY_new_raw_private_key EVP_PKEY_new_raw_public_key EVP_PKEY_param_check EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_print_params EVP_PKEY_print_private EVP_PKEY_print_public EVP_PKEY_public_check EVP_PKEY_save_parameters EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_DSA EVP_PKEY_set1_EC_KEY EVP_PKEY_set1_RSA EVP_PKEY_set1_engine EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_alias_type EVP_PKEY_set_type EVP_PKEY_set_type_str EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_type EVP_PKEY_up_ref EVP_PKEY_verify EVP_PKEY_verify_init EVP_PKEY_verify_recover EVP_PKEY_verify_recover_init EVP_SealFinal EVP_SealInit EVP_SignFinal EVP_VerifyFinal EVP_add_alg_module EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_cfb1 EVP_aes_128_cfb128 EVP_aes_128_cfb8 EVP_aes_128_ctr EVP_aes_128_ecb EVP_aes_128_gcm EVP_aes_128_ocb EVP_aes_128_ofb EVP_aes_128_wrap EVP_aes_128_wrap_pad EVP_aes_128_xts EVP_aes_192_cbc EVP_aes_192_ccm EVP_aes_192_cfb1 EVP_aes_192_cfb128 EVP_aes_192_cfb8 EVP_aes_192_ctr EVP_aes_192_ecb EVP_aes_192_gcm EVP_aes_192_ocb EVP_aes_192_ofb EVP_aes_192_wrap EVP_aes_192_wrap_pad EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_cfb1 EVP_aes_256_cfb128 EVP_aes_256_cfb8 EVP_aes_256_ctr EVP_aes_256_ecb EVP_aes_256_gcm EVP_aes_256_ocb EVP_aes_256_ofb EVP_aes_256_wrap EVP_aes_256_wrap_pad EVP_aes_256_xts EVP_aria_128_cbc EVP_aria_128_ccm EVP_aria_128_cfb1 EVP_aria_128_cfb128 EVP_aria_128_cfb8 EVP_aria_128_ctr EVP_aria_128_ecb EVP_aria_128_gcm EVP_aria_128_ofb EVP_aria_192_cbc EVP_aria_192_ccm EVP_aria_192_cfb1 EVP_aria_192_cfb128 EVP_aria_192_cfb8 EVP_aria_192_ctr EVP_aria_192_ecb EVP_aria_192_gcm EVP_aria_192_ofb EVP_aria_256_cbc EVP_aria_256_ccm EVP_aria_256_cfb1 EVP_aria_256_cfb128 EVP_aria_256_cfb8 EVP_aria_256_ctr EVP_aria_256_ecb EVP_aria_256_gcm EVP_aria_256_ofb EVP_bf_cbc EVP_bf_cfb64 EVP_bf_ecb EVP_bf_ofb EVP_blake2b512 EVP_blake2s256 EVP_camellia_128_cbc EVP_camellia_128_cfb1 EVP_camellia_128_cfb128 EVP_camellia_128_cfb8 EVP_camellia_128_ctr EVP_camellia_128_ecb EVP_camellia_128_ofb EVP_camellia_192_cbc EVP_camellia_192_cfb1 EVP_camellia_192_cfb128 EVP_camellia_192_cfb8 EVP_camellia_192_ctr EVP_camellia_192_ecb EVP_camellia_192_ofb EVP_camellia_256_cbc EVP_camellia_256_cfb1 EVP_camellia_256_cfb128 EVP_camellia_256_cfb8 EVP_camellia_256_ctr EVP_camellia_256_ecb EVP_camellia_256_ofb EVP_cast5_cbc EVP_cast5_cfb64 EVP_cast5_ecb EVP_cast5_ofb EVP_chacha20 EVP_chacha20_poly1305 EVP_des_cbc EVP_des_cfb1 EVP_des_cfb64 EVP_des_cfb8 EVP_des_ecb EVP_des_ede EVP_des_ede3 EVP_des_ede3_cbc EVP_des_ede3_cfb1 EVP_des_ede3_cfb64 EVP_des_ede3_cfb8 EVP_des_ede3_ecb EVP_des_ede3_ofb EVP_des_ede3_wrap EVP_des_ede_cbc EVP_des_ede_cfb64 EVP_des_ede_ecb EVP_des_ede_ofb EVP_des_ofb EVP_desx_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_get_pw_prompt EVP_idea_cbc EVP_idea_cfb64 EVP_idea_ecb EVP_idea_ofb EVP_md4 EVP_md5 EVP_md5_sha1 EVP_md_null EVP_mdc2 EVP_rc2_40_cbc EVP_rc2_64_cbc EVP_rc2_cbc EVP_rc2_cfb64 EVP_rc2_ecb EVP_rc2_ofb EVP_rc4 EVP_rc4_40 EVP_rc4_hmac_md5 EVP_read_pw_string EVP_read_pw_string_min EVP_ripemd160 EVP_seed_cbc EVP_seed_cfb128 EVP_seed_ecb EVP_seed_ofb EVP_set_pw_prompt EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha3_224 EVP_sha3_256 EVP_sha3_384 EVP_sha3_512 EVP_sha512 EVP_sha512_224 EVP_sha512_256 EVP_shake128 EVP_shake256 EVP_sm3 EVP_sm4_cbc EVP_sm4_cfb128 EVP_sm4_ctr EVP_sm4_ecb EVP_sm4_ofb EVP_whirlpool EXTENDED_KEY_USAGE_free EXTENDED_KEY_USAGE_it EXTENDED_KEY_USAGE_new FIPS_mode FIPS_mode_set GENERAL_NAMES_free GENERAL_NAMES_it GENERAL_NAMES_new GENERAL_NAME_cmp GENERAL_NAME_dup GENERAL_NAME_free GENERAL_NAME_get0_otherName GENERAL_NAME_get0_value GENERAL_NAME_it GENERAL_NAME_new GENERAL_NAME_print GENERAL_NAME_set0_othername GENERAL_NAME_set0_value GENERAL_SUBTREE_free GENERAL_SUBTREE_it GENERAL_SUBTREE_new HMAC HMAC_CTX_copy HMAC_CTX_free HMAC_CTX_get_md HMAC_CTX_new HMAC_CTX_reset HMAC_CTX_set_flags HMAC_Final HMAC_Init HMAC_Init_ex HMAC_Update HMAC_size IDEA_cbc_encrypt IDEA_cfb64_encrypt IDEA_ecb_encrypt IDEA_encrypt IDEA_ofb64_encrypt IDEA_options IDEA_set_decrypt_key IDEA_set_encrypt_key INT32_it INT64_it IPAddressChoice_free IPAddressChoice_it IPAddressChoice_new IPAddressFamily_free IPAddressFamily_it IPAddressFamily_new IPAddressOrRange_free IPAddressOrRange_it IPAddressOrRange_new IPAddressRange_free IPAddressRange_it IPAddressRange_new ISSUING_DIST_POINT_free ISSUING_DIST_POINT_it ISSUING_DIST_POINT_new LONG_it MD4 MD4_Final MD4_Init MD4_Transform MD4_Update MD5 MD5_Final MD5_Init MD5_Transform MD5_Update MDC2 MDC2_Final MDC2_Init MDC2_Update NAME_CONSTRAINTS_check NAME_CONSTRAINTS_check_CN NAME_CONSTRAINTS_free NAME_CONSTRAINTS_it NAME_CONSTRAINTS_new NAMING_AUTHORITY_free NAMING_AUTHORITY_get0_authorityId NAMING_AUTHORITY_get0_authorityText NAMING_AUTHORITY_get0_authorityURL NAMING_AUTHORITY_it NAMING_AUTHORITY_new NAMING_AUTHORITY_set0_authorityId NAMING_AUTHORITY_set0_authorityText NAMING_AUTHORITY_set0_authorityURL NCONF_WIN32 NCONF_default NCONF_dump_bio NCONF_dump_fp NCONF_free NCONF_free_data NCONF_get_number_e NCONF_get_section NCONF_get_string NCONF_load NCONF_load_bio NCONF_load_fp NCONF_new NETSCAPE_CERT_SEQUENCE_free NETSCAPE_CERT_SEQUENCE_it NETSCAPE_CERT_SEQUENCE_new NETSCAPE_SPKAC_free NETSCAPE_SPKAC_it NETSCAPE_SPKAC_new NETSCAPE_SPKI_b64_decode NETSCAPE_SPKI_b64_encode NETSCAPE_SPKI_free NETSCAPE_SPKI_get_pubkey NETSCAPE_SPKI_it NETSCAPE_SPKI_new NETSCAPE_SPKI_print NETSCAPE_SPKI_set_pubkey NETSCAPE_SPKI_sign NETSCAPE_SPKI_verify NOTICEREF_free NOTICEREF_it NOTICEREF_new OBJ_NAME_add OBJ_NAME_cleanup OBJ_NAME_do_all OBJ_NAME_do_all_sorted OBJ_NAME_get OBJ_NAME_init OBJ_NAME_new_index OBJ_NAME_remove OBJ_add_object OBJ_add_sigid OBJ_bsearch_ OBJ_bsearch_ex_ OBJ_cmp OBJ_create OBJ_create_objects OBJ_dup OBJ_find_sigid_algs OBJ_find_sigid_by_algs OBJ_get0_data OBJ_length OBJ_ln2nid OBJ_new_nid OBJ_nid2ln OBJ_nid2obj OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sigid_free OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OCSP_BASICRESP_add1_ext_i2d OCSP_BASICRESP_add_ext OCSP_BASICRESP_delete_ext OCSP_BASICRESP_free OCSP_BASICRESP_get1_ext_d2i OCSP_BASICRESP_get_ext OCSP_BASICRESP_get_ext_by_NID OCSP_BASICRESP_get_ext_by_OBJ OCSP_BASICRESP_get_ext_by_critical OCSP_BASICRESP_get_ext_count OCSP_BASICRESP_it OCSP_BASICRESP_new OCSP_CERTID_dup OCSP_CERTID_free OCSP_CERTID_it OCSP_CERTID_new OCSP_CERTSTATUS_free OCSP_CERTSTATUS_it OCSP_CERTSTATUS_new OCSP_CRLID_free OCSP_CRLID_it OCSP_CRLID_new OCSP_ONEREQ_add1_ext_i2d OCSP_ONEREQ_add_ext OCSP_ONEREQ_delete_ext OCSP_ONEREQ_free OCSP_ONEREQ_get1_ext_d2i OCSP_ONEREQ_get_ext OCSP_ONEREQ_get_ext_by_NID OCSP_ONEREQ_get_ext_by_OBJ OCSP_ONEREQ_get_ext_by_critical OCSP_ONEREQ_get_ext_count OCSP_ONEREQ_it OCSP_ONEREQ_new OCSP_REQINFO_free OCSP_REQINFO_it OCSP_REQINFO_new OCSP_REQUEST_add1_ext_i2d OCSP_REQUEST_add_ext OCSP_REQUEST_delete_ext OCSP_REQUEST_free OCSP_REQUEST_get1_ext_d2i OCSP_REQUEST_get_ext OCSP_REQUEST_get_ext_by_NID OCSP_REQUEST_get_ext_by_OBJ OCSP_REQUEST_get_ext_by_critical OCSP_REQUEST_get_ext_count OCSP_REQUEST_it OCSP_REQUEST_new OCSP_REQUEST_print OCSP_REQ_CTX_add1_header OCSP_REQ_CTX_free OCSP_REQ_CTX_get0_mem_bio OCSP_REQ_CTX_http OCSP_REQ_CTX_i2d OCSP_REQ_CTX_nbio OCSP_REQ_CTX_nbio_d2i OCSP_REQ_CTX_new OCSP_REQ_CTX_set1_req OCSP_RESPBYTES_free OCSP_RESPBYTES_it OCSP_RESPBYTES_new OCSP_RESPDATA_free OCSP_RESPDATA_it OCSP_RESPDATA_new OCSP_RESPID_free OCSP_RESPID_it OCSP_RESPID_match OCSP_RESPID_new OCSP_RESPID_set_by_key OCSP_RESPID_set_by_name OCSP_RESPONSE_free OCSP_RESPONSE_it OCSP_RESPONSE_new OCSP_RESPONSE_print OCSP_REVOKEDINFO_free OCSP_REVOKEDINFO_it OCSP_REVOKEDINFO_new OCSP_SERVICELOC_free OCSP_SERVICELOC_it OCSP_SERVICELOC_new OCSP_SIGNATURE_free OCSP_SIGNATURE_it OCSP_SIGNATURE_new OCSP_SINGLERESP_add1_ext_i2d OCSP_SINGLERESP_add_ext OCSP_SINGLERESP_delete_ext OCSP_SINGLERESP_free OCSP_SINGLERESP_get0_id OCSP_SINGLERESP_get1_ext_d2i OCSP_SINGLERESP_get_ext OCSP_SINGLERESP_get_ext_by_NID OCSP_SINGLERESP_get_ext_by_OBJ OCSP_SINGLERESP_get_ext_by_critical OCSP_SINGLERESP_get_ext_count OCSP_SINGLERESP_it OCSP_SINGLERESP_new OCSP_accept_responses_new OCSP_archive_cutoff_new OCSP_basic_add1_cert OCSP_basic_add1_nonce OCSP_basic_add1_status OCSP_basic_sign OCSP_basic_sign_ctx OCSP_basic_verify OCSP_cert_id_new OCSP_cert_status_str OCSP_cert_to_id OCSP_check_nonce OCSP_check_validity OCSP_copy_nonce OCSP_crlID_new OCSP_crl_reason_str OCSP_id_cmp OCSP_id_get0_info OCSP_id_issuer_cmp OCSP_onereq_get0_id OCSP_parse_url OCSP_request_add0_id OCSP_request_add1_cert OCSP_request_add1_nonce OCSP_request_is_signed OCSP_request_onereq_count OCSP_request_onereq_get0 OCSP_request_set1_name OCSP_request_sign OCSP_request_verify OCSP_resp_count OCSP_resp_find OCSP_resp_find_status OCSP_resp_get0 OCSP_resp_get0_certs OCSP_resp_get0_id OCSP_resp_get0_produced_at OCSP_resp_get0_respdata OCSP_resp_get0_signature OCSP_resp_get0_signer OCSP_resp_get0_tbs_sigalg OCSP_resp_get1_id OCSP_response_create OCSP_response_get1_basic OCSP_response_status OCSP_response_status_str OCSP_sendreq_bio OCSP_sendreq_nbio OCSP_sendreq_new OCSP_set_max_response_length OCSP_single_get0_status OCSP_url_svcloc_new OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_INIT_free OPENSSL_INIT_new OPENSSL_INIT_set_config_appname OPENSSL_INIT_set_config_file_flags OPENSSL_INIT_set_config_filename OPENSSL_LH_delete OPENSSL_LH_doall OPENSSL_LH_doall_arg OPENSSL_LH_error OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_node_stats OPENSSL_LH_node_stats_bio OPENSSL_LH_node_usage_stats OPENSSL_LH_node_usage_stats_bio OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_LH_stats OPENSSL_LH_stats_bio OPENSSL_LH_strhash OPENSSL_asc2uni OPENSSL_atexit OPENSSL_buf2hexstr OPENSSL_cleanse OPENSSL_cleanup OPENSSL_config OPENSSL_die OPENSSL_gmtime OPENSSL_gmtime_adj OPENSSL_gmtime_diff OPENSSL_hexchar2int OPENSSL_hexstr2buf OPENSSL_init OPENSSL_init_crypto OPENSSL_isservice OPENSSL_issetugid OPENSSL_load_builtin_modules OPENSSL_memcmp OPENSSL_sk_deep_copy OPENSSL_sk_delete OPENSSL_sk_delete_ptr OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_find_ex OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_is_sorted OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_new_reserve OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_reserve OPENSSL_sk_set OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_unshift OPENSSL_sk_value OPENSSL_sk_zero OPENSSL_strlcat OPENSSL_strlcpy OPENSSL_strnlen OPENSSL_thread_stop OPENSSL_uni2asc OPENSSL_uni2utf8 OPENSSL_utf82uni OSSL_STORE_INFO_free OSSL_STORE_INFO_get0_CERT OSSL_STORE_INFO_get0_CRL OSSL_STORE_INFO_get0_NAME OSSL_STORE_INFO_get0_NAME_description OSSL_STORE_INFO_get0_PARAMS OSSL_STORE_INFO_get0_PKEY OSSL_STORE_INFO_get1_CERT OSSL_STORE_INFO_get1_CRL OSSL_STORE_INFO_get1_NAME OSSL_STORE_INFO_get1_NAME_description OSSL_STORE_INFO_get1_PARAMS OSSL_STORE_INFO_get1_PKEY OSSL_STORE_INFO_get_type OSSL_STORE_INFO_new_CERT OSSL_STORE_INFO_new_CRL OSSL_STORE_INFO_new_NAME OSSL_STORE_INFO_new_PARAMS OSSL_STORE_INFO_new_PKEY OSSL_STORE_INFO_set0_NAME_description OSSL_STORE_INFO_type_string OSSL_STORE_LOADER_free OSSL_STORE_LOADER_get0_engine OSSL_STORE_LOADER_get0_scheme OSSL_STORE_LOADER_new OSSL_STORE_LOADER_set_close OSSL_STORE_LOADER_set_ctrl OSSL_STORE_LOADER_set_eof OSSL_STORE_LOADER_set_error OSSL_STORE_LOADER_set_expect OSSL_STORE_LOADER_set_find OSSL_STORE_LOADER_set_load OSSL_STORE_LOADER_set_open OSSL_STORE_SEARCH_by_alias OSSL_STORE_SEARCH_by_issuer_serial OSSL_STORE_SEARCH_by_key_fingerprint OSSL_STORE_SEARCH_by_name OSSL_STORE_SEARCH_free OSSL_STORE_SEARCH_get0_bytes OSSL_STORE_SEARCH_get0_digest OSSL_STORE_SEARCH_get0_name OSSL_STORE_SEARCH_get0_serial OSSL_STORE_SEARCH_get0_string OSSL_STORE_SEARCH_get_type OSSL_STORE_close OSSL_STORE_ctrl OSSL_STORE_do_all_loaders OSSL_STORE_eof OSSL_STORE_error OSSL_STORE_expect OSSL_STORE_find OSSL_STORE_load OSSL_STORE_open OSSL_STORE_register_loader OSSL_STORE_supports_search OSSL_STORE_unregister_loader OSSL_STORE_vctrl OTHERNAME_cmp OTHERNAME_free OTHERNAME_it OTHERNAME_new OpenSSL_version OpenSSL_version_num PBE2PARAM_free PBE2PARAM_it PBE2PARAM_new PBEPARAM_free PBEPARAM_it PBEPARAM_new PBKDF2PARAM_free PBKDF2PARAM_it PBKDF2PARAM_new PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_SignFinal PEM_SignInit PEM_SignUpdate PEM_X509_INFO_read PEM_X509_INFO_read_bio PEM_X509_INFO_write_bio PEM_bytes_read_bio PEM_bytes_read_bio_secmem PEM_def_callback PEM_dek_info PEM_do_header PEM_get_EVP_CIPHER_INFO PEM_proc_type PEM_read PEM_read_CMS PEM_read_DHparams PEM_read_DSAPrivateKey PEM_read_DSA_PUBKEY PEM_read_DSAparams PEM_read_ECPKParameters PEM_read_ECPrivateKey PEM_read_EC_PUBKEY PEM_read_NETSCAPE_CERT_SEQUENCE PEM_read_PKCS7 PEM_read_PKCS8 PEM_read_PKCS8_PRIV_KEY_INFO PEM_read_PUBKEY PEM_read_PrivateKey PEM_read_RSAPrivateKey PEM_read_RSAPublicKey PEM_read_RSA_PUBKEY PEM_read_X509 PEM_read_X509_AUX PEM_read_X509_CRL PEM_read_X509_REQ PEM_read_bio PEM_read_bio_CMS PEM_read_bio_DHparams PEM_read_bio_DSAPrivateKey PEM_read_bio_DSA_PUBKEY PEM_read_bio_DSAparams PEM_read_bio_ECPKParameters PEM_read_bio_ECPrivateKey PEM_read_bio_EC_PUBKEY PEM_read_bio_NETSCAPE_CERT_SEQUENCE PEM_read_bio_PKCS7 PEM_read_bio_PKCS8 PEM_read_bio_PKCS8_PRIV_KEY_INFO PEM_read_bio_PUBKEY PEM_read_bio_Parameters PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_RSAPublicKey PEM_read_bio_RSA_PUBKEY PEM_read_bio_X509 PEM_read_bio_X509_AUX PEM_read_bio_X509_CRL PEM_read_bio_X509_REQ PEM_read_bio_ex PEM_write PEM_write_CMS PEM_write_DHparams PEM_write_DHxparams PEM_write_DSAPrivateKey PEM_write_DSA_PUBKEY PEM_write_DSAparams PEM_write_ECPKParameters PEM_write_ECPrivateKey PEM_write_EC_PUBKEY PEM_write_NETSCAPE_CERT_SEQUENCE PEM_write_PKCS7 PEM_write_PKCS8 PEM_write_PKCS8PrivateKey PEM_write_PKCS8PrivateKey_nid PEM_write_PKCS8_PRIV_KEY_INFO PEM_write_PUBKEY PEM_write_PrivateKey PEM_write_RSAPrivateKey PEM_write_RSAPublicKey PEM_write_RSA_PUBKEY PEM_write_X509 PEM_write_X509_AUX PEM_write_X509_CRL PEM_write_X509_REQ PEM_write_X509_REQ_NEW PEM_write_bio PEM_write_bio_ASN1_stream PEM_write_bio_CMS PEM_write_bio_CMS_stream PEM_write_bio_DHparams PEM_write_bio_DHxparams PEM_write_bio_DSAPrivateKey PEM_write_bio_DSA_PUBKEY PEM_write_bio_DSAparams PEM_write_bio_ECPKParameters PEM_write_bio_ECPrivateKey PEM_write_bio_EC_PUBKEY PEM_write_bio_NETSCAPE_CERT_SEQUENCE PEM_write_bio_PKCS7 PEM_write_bio_PKCS7_stream PEM_write_bio_PKCS8 PEM_write_bio_PKCS8PrivateKey PEM_write_bio_PKCS8PrivateKey_nid PEM_write_bio_PKCS8_PRIV_KEY_INFO PEM_write_bio_PUBKEY PEM_write_bio_Parameters PEM_write_bio_PrivateKey PEM_write_bio_PrivateKey_traditional PEM_write_bio_RSAPrivateKey PEM_write_bio_RSAPublicKey PEM_write_bio_RSA_PUBKEY PEM_write_bio_X509 PEM_write_bio_X509_AUX PEM_write_bio_X509_CRL PEM_write_bio_X509_REQ PEM_write_bio_X509_REQ_NEW PKCS12_AUTHSAFES_it PKCS12_BAGS_free PKCS12_BAGS_it PKCS12_BAGS_new PKCS12_MAC_DATA_free PKCS12_MAC_DATA_it PKCS12_MAC_DATA_new PKCS12_PBE_add PKCS12_PBE_keyivgen PKCS12_SAFEBAGS_it PKCS12_SAFEBAG_create0_p8inf PKCS12_SAFEBAG_create0_pkcs8 PKCS12_SAFEBAG_create_cert PKCS12_SAFEBAG_create_crl PKCS12_SAFEBAG_create_pkcs8_encrypt PKCS12_SAFEBAG_free PKCS12_SAFEBAG_get0_attr PKCS12_SAFEBAG_get0_attrs PKCS12_SAFEBAG_get0_p8inf PKCS12_SAFEBAG_get0_pkcs8 PKCS12_SAFEBAG_get0_safes PKCS12_SAFEBAG_get0_type PKCS12_SAFEBAG_get1_cert PKCS12_SAFEBAG_get1_crl PKCS12_SAFEBAG_get_bag_nid PKCS12_SAFEBAG_get_nid PKCS12_SAFEBAG_it PKCS12_SAFEBAG_new PKCS12_add_CSPName_asc PKCS12_add_cert PKCS12_add_friendlyname_asc PKCS12_add_friendlyname_uni PKCS12_add_friendlyname_utf8 PKCS12_add_key PKCS12_add_localkeyid PKCS12_add_safe PKCS12_add_safes PKCS12_create PKCS12_decrypt_skey PKCS12_free PKCS12_gen_mac PKCS12_get0_mac PKCS12_get_attr PKCS12_get_attr_gen PKCS12_get_friendlyname PKCS12_init PKCS12_it PKCS12_item_decrypt_d2i PKCS12_item_i2d_encrypt PKCS12_item_pack_safebag PKCS12_key_gen_asc PKCS12_key_gen_uni PKCS12_key_gen_utf8 PKCS12_mac_present PKCS12_new PKCS12_newpass PKCS12_pack_authsafes PKCS12_pack_p7data PKCS12_pack_p7encdata PKCS12_parse PKCS12_pbe_crypt PKCS12_set_mac PKCS12_setup_mac PKCS12_unpack_authsafes PKCS12_unpack_p7data PKCS12_unpack_p7encdata PKCS12_verify_mac PKCS1_MGF1 PKCS5_PBE_add PKCS5_PBE_keyivgen PKCS5_PBKDF2_HMAC PKCS5_PBKDF2_HMAC_SHA1 PKCS5_pbe2_set PKCS5_pbe2_set_iv PKCS5_pbe2_set_scrypt PKCS5_pbe_set PKCS5_pbe_set0_algor PKCS5_pbkdf2_set PKCS5_v2_PBE_keyivgen PKCS5_v2_scrypt_keyivgen PKCS7_ATTR_SIGN_it PKCS7_ATTR_VERIFY_it PKCS7_DIGEST_free PKCS7_DIGEST_it PKCS7_DIGEST_new PKCS7_ENCRYPT_free PKCS7_ENCRYPT_it PKCS7_ENCRYPT_new PKCS7_ENC_CONTENT_free PKCS7_ENC_CONTENT_it PKCS7_ENC_CONTENT_new PKCS7_ENVELOPE_free PKCS7_ENVELOPE_it PKCS7_ENVELOPE_new PKCS7_ISSUER_AND_SERIAL_digest PKCS7_ISSUER_AND_SERIAL_free PKCS7_ISSUER_AND_SERIAL_it PKCS7_ISSUER_AND_SERIAL_new PKCS7_RECIP_INFO_free PKCS7_RECIP_INFO_get0_alg PKCS7_RECIP_INFO_it PKCS7_RECIP_INFO_new PKCS7_RECIP_INFO_set PKCS7_SIGNED_free PKCS7_SIGNED_it PKCS7_SIGNED_new PKCS7_SIGNER_INFO_free PKCS7_SIGNER_INFO_get0_algs PKCS7_SIGNER_INFO_it PKCS7_SIGNER_INFO_new PKCS7_SIGNER_INFO_set PKCS7_SIGNER_INFO_sign PKCS7_SIGN_ENVELOPE_free PKCS7_SIGN_ENVELOPE_it PKCS7_SIGN_ENVELOPE_new PKCS7_add0_attrib_signing_time PKCS7_add1_attrib_digest PKCS7_add_attrib_content_type PKCS7_add_attrib_smimecap PKCS7_add_attribute PKCS7_add_certificate PKCS7_add_crl PKCS7_add_recipient PKCS7_add_recipient_info PKCS7_add_signature PKCS7_add_signed_attribute PKCS7_add_signer PKCS7_cert_from_signer_info PKCS7_content_new PKCS7_ctrl PKCS7_dataDecode PKCS7_dataFinal PKCS7_dataInit PKCS7_dataVerify PKCS7_decrypt PKCS7_digest_from_attributes PKCS7_dup PKCS7_encrypt PKCS7_final PKCS7_free PKCS7_get0_signers PKCS7_get_attribute PKCS7_get_issuer_and_serial PKCS7_get_signed_attribute PKCS7_get_signer_info PKCS7_get_smimecap PKCS7_it PKCS7_new PKCS7_print_ctx PKCS7_set0_type_other PKCS7_set_attributes PKCS7_set_cipher PKCS7_set_content PKCS7_set_digest PKCS7_set_signed_attributes PKCS7_set_type PKCS7_sign PKCS7_sign_add_signer PKCS7_signatureVerify PKCS7_simple_smimecap PKCS7_stream PKCS7_to_TS_TST_INFO PKCS7_verify PKCS8_PRIV_KEY_INFO_free PKCS8_PRIV_KEY_INFO_it PKCS8_PRIV_KEY_INFO_new PKCS8_add_keyusage PKCS8_decrypt PKCS8_encrypt PKCS8_get_attr PKCS8_pkey_add1_attr_by_NID PKCS8_pkey_get0 PKCS8_pkey_get0_attrs PKCS8_pkey_set0 PKCS8_set0_pbe PKEY_USAGE_PERIOD_free PKEY_USAGE_PERIOD_it PKEY_USAGE_PERIOD_new POLICYINFO_free POLICYINFO_it POLICYINFO_new POLICYQUALINFO_free POLICYQUALINFO_it POLICYQUALINFO_new POLICY_CONSTRAINTS_free POLICY_CONSTRAINTS_it POLICY_CONSTRAINTS_new POLICY_MAPPINGS_it POLICY_MAPPING_free POLICY_MAPPING_it POLICY_MAPPING_new PROFESSION_INFO_free PROFESSION_INFO_get0_addProfessionInfo PROFESSION_INFO_get0_namingAuthority PROFESSION_INFO_get0_professionItems PROFESSION_INFO_get0_professionOIDs PROFESSION_INFO_get0_registrationNumber PROFESSION_INFO_it PROFESSION_INFO_new PROFESSION_INFO_set0_addProfessionInfo PROFESSION_INFO_set0_namingAuthority PROFESSION_INFO_set0_professionItems PROFESSION_INFO_set0_professionOIDs PROFESSION_INFO_set0_registrationNumber PROXY_CERT_INFO_EXTENSION_free PROXY_CERT_INFO_EXTENSION_it PROXY_CERT_INFO_EXTENSION_new PROXY_POLICY_free PROXY_POLICY_it PROXY_POLICY_new RAND_DRBG_bytes RAND_DRBG_free RAND_DRBG_generate RAND_DRBG_get0_master RAND_DRBG_get0_private RAND_DRBG_get0_public RAND_DRBG_get_ex_data RAND_DRBG_instantiate RAND_DRBG_new RAND_DRBG_reseed RAND_DRBG_secure_new RAND_DRBG_set RAND_DRBG_set_callbacks RAND_DRBG_set_defaults RAND_DRBG_set_ex_data RAND_DRBG_set_reseed_defaults RAND_DRBG_set_reseed_interval RAND_DRBG_set_reseed_time_interval RAND_DRBG_uninstantiate RAND_OpenSSL RAND_add RAND_bytes RAND_event RAND_file_name RAND_get_rand_method RAND_keep_random_devices_open RAND_load_file RAND_poll RAND_priv_bytes RAND_pseudo_bytes RAND_screen RAND_seed RAND_set_rand_engine RAND_set_rand_method RAND_status RAND_write_file RC2_cbc_encrypt RC2_cfb64_encrypt RC2_decrypt RC2_ecb_encrypt RC2_encrypt RC2_ofb64_encrypt RC2_set_key RC4 RC4_options RC4_set_key RIPEMD160 RIPEMD160_Final RIPEMD160_Init RIPEMD160_Transform RIPEMD160_Update RSAPrivateKey_dup RSAPrivateKey_it RSAPublicKey_dup RSAPublicKey_it RSA_OAEP_PARAMS_free RSA_OAEP_PARAMS_it RSA_OAEP_PARAMS_new RSA_PKCS1_OpenSSL RSA_PSS_PARAMS_free RSA_PSS_PARAMS_it RSA_PSS_PARAMS_new RSA_X931_derive_ex RSA_X931_generate_key_ex RSA_X931_hash_id RSA_bits RSA_blinding_off RSA_blinding_on RSA_check_key RSA_check_key_ex RSA_clear_flags RSA_flags RSA_free RSA_generate_key RSA_generate_key_ex RSA_generate_multi_prime_key RSA_get0_crt_params RSA_get0_d RSA_get0_dmp1 RSA_get0_dmq1 RSA_get0_e RSA_get0_engine RSA_get0_factors RSA_get0_iqmp RSA_get0_key RSA_get0_multi_prime_crt_params RSA_get0_multi_prime_factors RSA_get0_n RSA_get0_p RSA_get0_pss_params RSA_get0_q RSA_get_default_method RSA_get_ex_data RSA_get_method RSA_get_multi_prime_extra_count RSA_get_version RSA_meth_dup RSA_meth_free RSA_meth_get0_app_data RSA_meth_get0_name RSA_meth_get_bn_mod_exp RSA_meth_get_finish RSA_meth_get_flags RSA_meth_get_init RSA_meth_get_keygen RSA_meth_get_mod_exp RSA_meth_get_multi_prime_keygen RSA_meth_get_priv_dec RSA_meth_get_priv_enc RSA_meth_get_pub_dec RSA_meth_get_pub_enc RSA_meth_get_sign RSA_meth_get_verify RSA_meth_new RSA_meth_set0_app_data RSA_meth_set1_name RSA_meth_set_bn_mod_exp RSA_meth_set_finish RSA_meth_set_flags RSA_meth_set_init RSA_meth_set_keygen RSA_meth_set_mod_exp RSA_meth_set_multi_prime_keygen RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_meth_set_sign RSA_meth_set_verify RSA_new RSA_new_method RSA_null_method RSA_padding_add_PKCS1_OAEP RSA_padding_add_PKCS1_OAEP_mgf1 RSA_padding_add_PKCS1_PSS RSA_padding_add_PKCS1_PSS_mgf1 RSA_padding_add_PKCS1_type_1 RSA_padding_add_PKCS1_type_2 RSA_padding_add_SSLv23 RSA_padding_add_X931 RSA_padding_add_none RSA_padding_check_PKCS1_OAEP RSA_padding_check_PKCS1_OAEP_mgf1 RSA_padding_check_PKCS1_type_1 RSA_padding_check_PKCS1_type_2 RSA_padding_check_SSLv23 RSA_padding_check_X931 RSA_padding_check_none RSA_pkey_ctx_ctrl RSA_print RSA_print_fp RSA_private_decrypt RSA_private_encrypt RSA_public_decrypt RSA_public_encrypt RSA_security_bits RSA_set0_crt_params RSA_set0_factors RSA_set0_key RSA_set0_multi_prime_params RSA_set_default_method RSA_set_ex_data RSA_set_flags RSA_set_method RSA_setup_blinding RSA_sign RSA_sign_ASN1_OCTET_STRING RSA_size RSA_test_flags RSA_up_ref RSA_verify RSA_verify_ASN1_OCTET_STRING RSA_verify_PKCS1_PSS RSA_verify_PKCS1_PSS_mgf1 SCRYPT_PARAMS_free SCRYPT_PARAMS_it SCRYPT_PARAMS_new SCT_LIST_free SCT_LIST_print SCT_LIST_validate SCT_free SCT_get0_extensions SCT_get0_log_id SCT_get0_signature SCT_get_log_entry_type SCT_get_signature_nid SCT_get_source SCT_get_timestamp SCT_get_validation_status SCT_get_version SCT_new SCT_new_from_base64 SCT_print SCT_set0_extensions SCT_set0_log_id SCT_set0_signature SCT_set1_extensions SCT_set1_log_id SCT_set1_signature SCT_set_log_entry_type SCT_set_signature_nid SCT_set_source SCT_set_timestamp SCT_set_version SCT_validate SCT_validation_status_string SEED_cbc_encrypt SEED_cfb128_encrypt SEED_decrypt SEED_ecb_encrypt SEED_encrypt SEED_ofb128_encrypt SEED_set_key SHA1 SHA1_Final SHA1_Init SHA1_Transform SHA1_Update SHA224 SHA224_Final SHA224_Init SHA224_Update SHA256 SHA256_Final SHA256_Init SHA256_Transform SHA256_Update SHA384 SHA384_Final SHA384_Init SHA384_Update SHA512 SHA512_Final SHA512_Init SHA512_Transform SHA512_Update SMIME_crlf_copy SMIME_read_ASN1 SMIME_read_CMS SMIME_read_PKCS7 SMIME_text SMIME_write_ASN1 SMIME_write_CMS SMIME_write_PKCS7 SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_VBASE_free SRP_VBASE_get1_by_user SRP_VBASE_get_by_user SRP_VBASE_init SRP_VBASE_new SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier SRP_create_verifier_BN SRP_get_default_gN SRP_user_pwd_free SXNETID_free SXNETID_it SXNETID_new SXNET_add_id_INTEGER SXNET_add_id_asc SXNET_add_id_ulong SXNET_free SXNET_get_id_INTEGER SXNET_get_id_asc SXNET_get_id_ulong SXNET_it SXNET_new TLS_FEATURE_free TLS_FEATURE_new TS_ACCURACY_dup TS_ACCURACY_free TS_ACCURACY_get_micros TS_ACCURACY_get_millis TS_ACCURACY_get_seconds TS_ACCURACY_new TS_ACCURACY_set_micros TS_ACCURACY_set_millis TS_ACCURACY_set_seconds TS_ASN1_INTEGER_print_bio TS_CONF_get_tsa_section TS_CONF_load_cert TS_CONF_load_certs TS_CONF_load_key TS_CONF_set_accuracy TS_CONF_set_certs TS_CONF_set_clock_precision_digits TS_CONF_set_crypto_device TS_CONF_set_def_policy TS_CONF_set_default_engine TS_CONF_set_digests TS_CONF_set_ess_cert_id_chain TS_CONF_set_ess_cert_id_digest TS_CONF_set_ordering TS_CONF_set_policies TS_CONF_set_serial TS_CONF_set_signer_cert TS_CONF_set_signer_digest TS_CONF_set_signer_key TS_CONF_set_tsa_name TS_MSG_IMPRINT_dup TS_MSG_IMPRINT_free TS_MSG_IMPRINT_get_algo TS_MSG_IMPRINT_get_msg TS_MSG_IMPRINT_new TS_MSG_IMPRINT_print_bio TS_MSG_IMPRINT_set_algo TS_MSG_IMPRINT_set_msg TS_OBJ_print_bio TS_REQ_add_ext TS_REQ_delete_ext TS_REQ_dup TS_REQ_ext_free TS_REQ_free TS_REQ_get_cert_req TS_REQ_get_ext TS_REQ_get_ext_by_NID TS_REQ_get_ext_by_OBJ TS_REQ_get_ext_by_critical TS_REQ_get_ext_count TS_REQ_get_ext_d2i TS_REQ_get_exts TS_REQ_get_msg_imprint TS_REQ_get_nonce TS_REQ_get_policy_id TS_REQ_get_version TS_REQ_new TS_REQ_print_bio TS_REQ_set_cert_req TS_REQ_set_msg_imprint TS_REQ_set_nonce TS_REQ_set_policy_id TS_REQ_set_version TS_REQ_to_TS_VERIFY_CTX TS_RESP_CTX_add_failure_info TS_RESP_CTX_add_flags TS_RESP_CTX_add_md TS_RESP_CTX_add_policy TS_RESP_CTX_free TS_RESP_CTX_get_request TS_RESP_CTX_get_tst_info TS_RESP_CTX_new TS_RESP_CTX_set_accuracy TS_RESP_CTX_set_certs TS_RESP_CTX_set_clock_precision_digits TS_RESP_CTX_set_def_policy TS_RESP_CTX_set_ess_cert_id_digest TS_RESP_CTX_set_extension_cb TS_RESP_CTX_set_serial_cb TS_RESP_CTX_set_signer_cert TS_RESP_CTX_set_signer_digest TS_RESP_CTX_set_signer_key TS_RESP_CTX_set_status_info TS_RESP_CTX_set_status_info_cond TS_RESP_CTX_set_time_cb TS_RESP_create_response TS_RESP_dup TS_RESP_free TS_RESP_get_status_info TS_RESP_get_token TS_RESP_get_tst_info TS_RESP_new TS_RESP_print_bio TS_RESP_set_status_info TS_RESP_set_tst_info TS_RESP_verify_response TS_RESP_verify_signature TS_RESP_verify_token TS_STATUS_INFO_dup TS_STATUS_INFO_free TS_STATUS_INFO_get0_failure_info TS_STATUS_INFO_get0_status TS_STATUS_INFO_get0_text TS_STATUS_INFO_new TS_STATUS_INFO_print_bio TS_STATUS_INFO_set_status TS_TST_INFO_add_ext TS_TST_INFO_delete_ext TS_TST_INFO_dup TS_TST_INFO_ext_free TS_TST_INFO_free TS_TST_INFO_get_accuracy TS_TST_INFO_get_ext TS_TST_INFO_get_ext_by_NID TS_TST_INFO_get_ext_by_OBJ TS_TST_INFO_get_ext_by_critical TS_TST_INFO_get_ext_count TS_TST_INFO_get_ext_d2i TS_TST_INFO_get_exts TS_TST_INFO_get_msg_imprint TS_TST_INFO_get_nonce TS_TST_INFO_get_ordering TS_TST_INFO_get_policy_id TS_TST_INFO_get_serial TS_TST_INFO_get_time TS_TST_INFO_get_tsa TS_TST_INFO_get_version TS_TST_INFO_new TS_TST_INFO_print_bio TS_TST_INFO_set_accuracy TS_TST_INFO_set_msg_imprint TS_TST_INFO_set_nonce TS_TST_INFO_set_ordering TS_TST_INFO_set_policy_id TS_TST_INFO_set_serial TS_TST_INFO_set_time TS_TST_INFO_set_tsa TS_TST_INFO_set_version TS_VERIFY_CTS_set_certs TS_VERIFY_CTX_add_flags TS_VERIFY_CTX_cleanup TS_VERIFY_CTX_free TS_VERIFY_CTX_init TS_VERIFY_CTX_new TS_VERIFY_CTX_set_data TS_VERIFY_CTX_set_flags TS_VERIFY_CTX_set_imprint TS_VERIFY_CTX_set_store TS_X509_ALGOR_print_bio TS_ext_print_bio TXT_DB_create_index TXT_DB_free TXT_DB_get_by_index TXT_DB_insert TXT_DB_read TXT_DB_write UINT32_it UINT64_it UI_OpenSSL UI_UTIL_read_pw UI_UTIL_read_pw_string UI_UTIL_wrap_read_pem_callback UI_add_error_string UI_add_info_string UI_add_input_boolean UI_add_input_string UI_add_user_data UI_add_verify_string UI_construct_prompt UI_create_method UI_ctrl UI_destroy_method UI_dup_error_string UI_dup_info_string UI_dup_input_boolean UI_dup_input_string UI_dup_user_data UI_dup_verify_string UI_free UI_get0_action_string UI_get0_output_string UI_get0_result UI_get0_result_string UI_get0_test_string UI_get0_user_data UI_get_default_method UI_get_ex_data UI_get_input_flags UI_get_method UI_get_result_length UI_get_result_maxsize UI_get_result_minsize UI_get_result_string_length UI_get_string_type UI_method_get_closer UI_method_get_data_destructor UI_method_get_data_duplicator UI_method_get_ex_data UI_method_get_flusher UI_method_get_opener UI_method_get_prompt_constructor UI_method_get_reader UI_method_get_writer UI_method_set_closer UI_method_set_data_duplicator UI_method_set_ex_data UI_method_set_flusher UI_method_set_opener UI_method_set_prompt_constructor UI_method_set_reader UI_method_set_writer UI_new UI_new_method UI_null UI_process UI_set_default_method UI_set_ex_data UI_set_method UI_set_result UI_set_result_ex USERNOTICE_free USERNOTICE_it USERNOTICE_new UTF8_getc UTF8_putc WHIRLPOOL WHIRLPOOL_BitUpdate WHIRLPOOL_Final WHIRLPOOL_Init WHIRLPOOL_Update X509V3_EXT_CRL_add_conf X509V3_EXT_CRL_add_nconf X509V3_EXT_REQ_add_conf X509V3_EXT_REQ_add_nconf X509V3_EXT_add X509V3_EXT_add_alias X509V3_EXT_add_conf X509V3_EXT_add_list X509V3_EXT_add_nconf X509V3_EXT_add_nconf_sk X509V3_EXT_cleanup X509V3_EXT_conf X509V3_EXT_conf_nid X509V3_EXT_d2i X509V3_EXT_get X509V3_EXT_get_nid X509V3_EXT_i2d X509V3_EXT_nconf X509V3_EXT_nconf_nid X509V3_EXT_print X509V3_EXT_print_fp X509V3_EXT_val_prn X509V3_NAME_from_section X509V3_add1_i2d X509V3_add_standard_extensions X509V3_add_value X509V3_add_value_bool X509V3_add_value_bool_nf X509V3_add_value_int X509V3_add_value_uchar X509V3_conf_free X509V3_extensions_print X509V3_get_d2i X509V3_get_section X509V3_get_string X509V3_get_value_bool X509V3_get_value_int X509V3_parse_list X509V3_section_free X509V3_set_conf_lhash X509V3_set_ctx X509V3_set_nconf X509V3_string_free X509_ALGORS_it X509_ALGOR_cmp X509_ALGOR_copy X509_ALGOR_dup X509_ALGOR_free X509_ALGOR_get0 X509_ALGOR_it X509_ALGOR_new X509_ALGOR_set0 X509_ALGOR_set_md X509_ATTRIBUTE_count X509_ATTRIBUTE_create X509_ATTRIBUTE_create_by_NID X509_ATTRIBUTE_create_by_OBJ X509_ATTRIBUTE_create_by_txt X509_ATTRIBUTE_dup X509_ATTRIBUTE_free X509_ATTRIBUTE_get0_data X509_ATTRIBUTE_get0_object X509_ATTRIBUTE_get0_type X509_ATTRIBUTE_it X509_ATTRIBUTE_new X509_ATTRIBUTE_set1_data X509_ATTRIBUTE_set1_object X509_CERT_AUX_free X509_CERT_AUX_it X509_CERT_AUX_new X509_CINF_free X509_CINF_it X509_CINF_new X509_CRL_INFO_free X509_CRL_INFO_it X509_CRL_INFO_new X509_CRL_METHOD_free X509_CRL_METHOD_new X509_CRL_add0_revoked X509_CRL_add1_ext_i2d X509_CRL_add_ext X509_CRL_check_suiteb X509_CRL_cmp X509_CRL_delete_ext X509_CRL_diff X509_CRL_digest X509_CRL_dup X509_CRL_free X509_CRL_get0_by_cert X509_CRL_get0_by_serial X509_CRL_get0_extensions X509_CRL_get0_lastUpdate X509_CRL_get0_nextUpdate X509_CRL_get0_signature X509_CRL_get_REVOKED X509_CRL_get_ext X509_CRL_get_ext_by_NID X509_CRL_get_ext_by_OBJ X509_CRL_get_ext_by_critical X509_CRL_get_ext_count X509_CRL_get_ext_d2i X509_CRL_get_issuer X509_CRL_get_lastUpdate X509_CRL_get_meth_data X509_CRL_get_nextUpdate X509_CRL_get_signature_nid X509_CRL_get_version X509_CRL_http_nbio X509_CRL_it X509_CRL_match X509_CRL_new X509_CRL_print X509_CRL_print_ex X509_CRL_print_fp X509_CRL_set1_lastUpdate X509_CRL_set1_nextUpdate X509_CRL_set_default_method X509_CRL_set_issuer_name X509_CRL_set_meth_data X509_CRL_set_version X509_CRL_sign X509_CRL_sign_ctx X509_CRL_sort X509_CRL_up_ref X509_CRL_verify X509_EXTENSIONS_it X509_EXTENSION_create_by_NID X509_EXTENSION_create_by_OBJ X509_EXTENSION_dup X509_EXTENSION_free X509_EXTENSION_get_critical X509_EXTENSION_get_data X509_EXTENSION_get_object X509_EXTENSION_it X509_EXTENSION_new X509_EXTENSION_set_critical X509_EXTENSION_set_data X509_EXTENSION_set_object X509_INFO_free X509_INFO_new X509_LOOKUP_by_alias X509_LOOKUP_by_fingerprint X509_LOOKUP_by_issuer_serial X509_LOOKUP_by_subject X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_free X509_LOOKUP_get_method_data X509_LOOKUP_get_store X509_LOOKUP_hash_dir X509_LOOKUP_init X509_LOOKUP_meth_free X509_LOOKUP_meth_get_ctrl X509_LOOKUP_meth_get_free X509_LOOKUP_meth_get_get_by_alias X509_LOOKUP_meth_get_get_by_fingerprint X509_LOOKUP_meth_get_get_by_issuer_serial X509_LOOKUP_meth_get_get_by_subject X509_LOOKUP_meth_get_init X509_LOOKUP_meth_get_new_item X509_LOOKUP_meth_get_shutdown X509_LOOKUP_meth_new X509_LOOKUP_meth_set_ctrl X509_LOOKUP_meth_set_free X509_LOOKUP_meth_set_get_by_alias X509_LOOKUP_meth_set_get_by_fingerprint X509_LOOKUP_meth_set_get_by_issuer_serial X509_LOOKUP_meth_set_get_by_subject X509_LOOKUP_meth_set_init X509_LOOKUP_meth_set_new_item X509_LOOKUP_meth_set_shutdown X509_LOOKUP_new X509_LOOKUP_set_method_data X509_LOOKUP_shutdown X509_NAME_ENTRY_create_by_NID X509_NAME_ENTRY_create_by_OBJ X509_NAME_ENTRY_create_by_txt X509_NAME_ENTRY_dup X509_NAME_ENTRY_free X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_ENTRY_it X509_NAME_ENTRY_new X509_NAME_ENTRY_set X509_NAME_ENTRY_set_data X509_NAME_ENTRY_set_object X509_NAME_add_entry X509_NAME_add_entry_by_NID X509_NAME_add_entry_by_OBJ X509_NAME_add_entry_by_txt X509_NAME_cmp X509_NAME_delete_entry X509_NAME_digest X509_NAME_dup X509_NAME_entry_count X509_NAME_free X509_NAME_get0_der X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_get_text_by_NID X509_NAME_get_text_by_OBJ X509_NAME_hash X509_NAME_hash_old X509_NAME_it X509_NAME_new X509_NAME_oneline X509_NAME_print X509_NAME_print_ex X509_NAME_print_ex_fp X509_NAME_set X509_OBJECT_free X509_OBJECT_get0_X509 X509_OBJECT_get0_X509_CRL X509_OBJECT_get_type X509_OBJECT_idx_by_subject X509_OBJECT_new X509_OBJECT_retrieve_by_subject X509_OBJECT_retrieve_match X509_OBJECT_set1_X509 X509_OBJECT_set1_X509_CRL X509_OBJECT_up_ref_count X509_PKEY_free X509_PKEY_new X509_POLICY_NODE_print X509_PUBKEY_free X509_PUBKEY_get X509_PUBKEY_get0 X509_PUBKEY_get0_param X509_PUBKEY_it X509_PUBKEY_new X509_PUBKEY_set X509_PUBKEY_set0_param X509_PURPOSE_add X509_PURPOSE_cleanup X509_PURPOSE_get0 X509_PURPOSE_get0_name X509_PURPOSE_get0_sname X509_PURPOSE_get_by_id X509_PURPOSE_get_by_sname X509_PURPOSE_get_count X509_PURPOSE_get_id X509_PURPOSE_get_trust X509_PURPOSE_set X509_REQ_INFO_free X509_REQ_INFO_it X509_REQ_INFO_new X509_REQ_add1_attr X509_REQ_add1_attr_by_NID X509_REQ_add1_attr_by_OBJ X509_REQ_add1_attr_by_txt X509_REQ_add_extensions X509_REQ_add_extensions_nid X509_REQ_check_private_key X509_REQ_delete_attr X509_REQ_digest X509_REQ_dup X509_REQ_extension_nid X509_REQ_free X509_REQ_get0_pubkey X509_REQ_get0_signature X509_REQ_get1_email X509_REQ_get_X509_PUBKEY X509_REQ_get_attr X509_REQ_get_attr_by_NID X509_REQ_get_attr_by_OBJ X509_REQ_get_attr_count X509_REQ_get_extension_nids X509_REQ_get_extensions X509_REQ_get_pubkey X509_REQ_get_signature_nid X509_REQ_get_subject_name X509_REQ_get_version X509_REQ_it X509_REQ_new X509_REQ_print X509_REQ_print_ex X509_REQ_print_fp X509_REQ_set0_signature X509_REQ_set1_signature_algo X509_REQ_set_extension_nids X509_REQ_set_pubkey X509_REQ_set_subject_name X509_REQ_set_version X509_REQ_sign X509_REQ_sign_ctx X509_REQ_to_X509 X509_REQ_verify X509_REVOKED_add1_ext_i2d X509_REVOKED_add_ext X509_REVOKED_delete_ext X509_REVOKED_dup X509_REVOKED_free X509_REVOKED_get0_extensions X509_REVOKED_get0_revocationDate X509_REVOKED_get0_serialNumber X509_REVOKED_get_ext X509_REVOKED_get_ext_by_NID X509_REVOKED_get_ext_by_OBJ X509_REVOKED_get_ext_by_critical X509_REVOKED_get_ext_count X509_REVOKED_get_ext_d2i X509_REVOKED_it X509_REVOKED_new X509_REVOKED_set_revocationDate X509_REVOKED_set_serialNumber X509_SIG_INFO_get X509_SIG_INFO_set X509_SIG_free X509_SIG_get0 X509_SIG_getm X509_SIG_it X509_SIG_new X509_STORE_CTX_cleanup X509_STORE_CTX_free X509_STORE_CTX_get0_cert X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_current_crl X509_STORE_CTX_get0_current_issuer X509_STORE_CTX_get0_param X509_STORE_CTX_get0_parent_ctx X509_STORE_CTX_get0_policy_tree X509_STORE_CTX_get0_store X509_STORE_CTX_get0_untrusted X509_STORE_CTX_get1_certs X509_STORE_CTX_get1_chain X509_STORE_CTX_get1_crls X509_STORE_CTX_get1_issuer X509_STORE_CTX_get_by_subject X509_STORE_CTX_get_cert_crl X509_STORE_CTX_get_check_crl X509_STORE_CTX_get_check_issued X509_STORE_CTX_get_check_policy X509_STORE_CTX_get_check_revocation X509_STORE_CTX_get_cleanup X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_CTX_get_explicit_policy X509_STORE_CTX_get_get_crl X509_STORE_CTX_get_get_issuer X509_STORE_CTX_get_lookup_certs X509_STORE_CTX_get_lookup_crls X509_STORE_CTX_get_num_untrusted X509_STORE_CTX_get_obj_by_subject X509_STORE_CTX_get_verify X509_STORE_CTX_get_verify_cb X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_purpose_inherit X509_STORE_CTX_set0_crls X509_STORE_CTX_set0_dane X509_STORE_CTX_set0_param X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set0_verified_chain X509_STORE_CTX_set_cert X509_STORE_CTX_set_current_cert X509_STORE_CTX_set_default X509_STORE_CTX_set_depth X509_STORE_CTX_set_error X509_STORE_CTX_set_error_depth X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_purpose X509_STORE_CTX_set_time X509_STORE_CTX_set_trust X509_STORE_CTX_set_verify X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_free X509_STORE_get0_objects X509_STORE_get0_param X509_STORE_get_cert_crl X509_STORE_get_check_crl X509_STORE_get_check_issued X509_STORE_get_check_policy X509_STORE_get_check_revocation X509_STORE_get_cleanup X509_STORE_get_ex_data X509_STORE_get_get_crl X509_STORE_get_get_issuer X509_STORE_get_lookup_certs X509_STORE_get_lookup_crls X509_STORE_get_verify X509_STORE_get_verify_cb X509_STORE_load_locations X509_STORE_lock X509_STORE_new X509_STORE_set1_param X509_STORE_set_cert_crl X509_STORE_set_check_crl X509_STORE_set_check_issued X509_STORE_set_check_policy X509_STORE_set_check_revocation X509_STORE_set_cleanup X509_STORE_set_default_paths X509_STORE_set_depth X509_STORE_set_ex_data X509_STORE_set_flags X509_STORE_set_get_crl X509_STORE_set_get_issuer X509_STORE_set_lookup_certs X509_STORE_set_lookup_crls X509_STORE_set_purpose X509_STORE_set_trust X509_STORE_set_verify X509_STORE_set_verify_cb X509_STORE_unlock X509_STORE_up_ref X509_TRUST_add X509_TRUST_cleanup X509_TRUST_get0 X509_TRUST_get0_name X509_TRUST_get_by_id X509_TRUST_get_count X509_TRUST_get_flags X509_TRUST_get_trust X509_TRUST_set X509_TRUST_set_default X509_VAL_free X509_VAL_it X509_VAL_new X509_VERIFY_PARAM_add0_policy X509_VERIFY_PARAM_add0_table X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_clear_flags X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0 X509_VERIFY_PARAM_get0_name X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_auth_level X509_VERIFY_PARAM_get_count X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_get_flags X509_VERIFY_PARAM_get_hostflags X509_VERIFY_PARAM_get_inh_flags X509_VERIFY_PARAM_get_time X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_lookup X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_email X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set1_ip X509_VERIFY_PARAM_set1_ip_asc X509_VERIFY_PARAM_set1_name X509_VERIFY_PARAM_set1_policies X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_flags X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_inh_flags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_time X509_VERIFY_PARAM_set_trust X509_VERIFY_PARAM_table_cleanup X509_add1_ext_i2d X509_add1_reject_object X509_add1_trust_object X509_add_ext X509_alias_get0 X509_alias_set1 X509_aux_print X509_certificate_type X509_chain_check_suiteb X509_chain_up_ref X509_check_akid X509_check_ca X509_check_email X509_check_host X509_check_ip X509_check_ip_asc X509_check_issued X509_check_private_key X509_check_purpose X509_check_trust X509_cmp X509_cmp_current_time X509_cmp_time X509_delete_ext X509_digest X509_dup X509_email_free X509_find_by_issuer_and_serial X509_find_by_subject X509_free X509_get0_authority_issuer X509_get0_authority_key_id X509_get0_authority_serial X509_get0_extensions X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get0_pubkey_bitstr X509_get0_reject_objects X509_get0_serialNumber X509_get0_signature X509_get0_subject_key_id X509_get0_tbs_sigalg X509_get0_trust_objects X509_get0_uids X509_get1_email X509_get1_ocsp X509_get_X509_PUBKEY X509_get_default_cert_area X509_get_default_cert_dir X509_get_default_cert_dir_env X509_get_default_cert_file X509_get_default_cert_file_env X509_get_default_private_dir X509_get_ex_data X509_get_ext X509_get_ext_by_NID X509_get_ext_by_OBJ X509_get_ext_by_critical X509_get_ext_count X509_get_ext_d2i X509_get_extended_key_usage X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_pathlen X509_get_proxy_pathlen X509_get_pubkey X509_get_pubkey_parameters X509_get_serialNumber X509_get_signature_info X509_get_signature_nid X509_get_signature_type X509_get_subject_name X509_get_version X509_getm_notAfter X509_getm_notBefore X509_gmtime_adj X509_http_nbio X509_issuer_and_serial_cmp X509_issuer_and_serial_hash X509_issuer_name_cmp X509_issuer_name_hash X509_issuer_name_hash_old X509_it X509_keyid_get0 X509_keyid_set1 X509_load_cert_crl_file X509_load_cert_file X509_load_crl_file X509_new X509_ocspid_print X509_policy_check X509_policy_level_get0_node X509_policy_level_node_count X509_policy_node_get0_parent X509_policy_node_get0_policy X509_policy_node_get0_qualifiers X509_policy_tree_free X509_policy_tree_get0_level X509_policy_tree_get0_policies X509_policy_tree_get0_user_policies X509_policy_tree_level_count X509_print X509_print_ex X509_print_ex_fp X509_print_fp X509_pubkey_digest X509_reject_clear X509_set1_notAfter X509_set1_notBefore X509_set_ex_data X509_set_issuer_name X509_set_proxy_flag X509_set_proxy_pathlen X509_set_pubkey X509_set_serialNumber X509_set_subject_name X509_set_version X509_sign X509_sign_ctx X509_signature_dump X509_signature_print X509_subject_name_cmp X509_subject_name_hash X509_subject_name_hash_old X509_supported_extension X509_time_adj X509_time_adj_ex X509_to_X509_REQ X509_trust_clear X509_trusted X509_up_ref X509_verify X509_verify_cert X509_verify_cert_error_string X509at_add1_attr X509at_add1_attr_by_NID X509at_add1_attr_by_OBJ X509at_add1_attr_by_txt X509at_delete_attr X509at_get0_data_by_OBJ X509at_get_attr X509at_get_attr_by_NID X509at_get_attr_by_OBJ X509at_get_attr_count X509v3_add_ext X509v3_addr_add_inherit X509v3_addr_add_prefix X509v3_addr_add_range X509v3_addr_canonize X509v3_addr_get_afi X509v3_addr_get_range X509v3_addr_inherits X509v3_addr_is_canonical X509v3_addr_subset X509v3_addr_validate_path X509v3_addr_validate_resource_set X509v3_asid_add_id_or_range X509v3_asid_add_inherit X509v3_asid_canonize X509v3_asid_inherits X509v3_asid_is_canonical X509v3_asid_subset X509v3_asid_validate_path X509v3_asid_validate_resource_set X509v3_delete_ext X509v3_get_ext X509v3_get_ext_by_NID X509v3_get_ext_by_OBJ X509v3_get_ext_by_critical X509v3_get_ext_count ZINT32_it ZINT64_it ZLONG_it ZUINT32_it ZUINT64_it _shadow_DES_check_key a2d_ASN1_OBJECT a2i_ASN1_ENUMERATED a2i_ASN1_INTEGER a2i_ASN1_STRING a2i_GENERAL_NAME a2i_IPADDRESS a2i_IPADDRESS_NC b2i_PVK_bio b2i_PrivateKey b2i_PrivateKey_bio b2i_PublicKey b2i_PublicKey_bio conf_ssl_get conf_ssl_get_cmd conf_ssl_name_find d2i_ACCESS_DESCRIPTION d2i_ADMISSIONS d2i_ADMISSION_SYNTAX d2i_ASIdOrRange d2i_ASIdentifierChoice d2i_ASIdentifiers d2i_ASN1_BIT_STRING d2i_ASN1_BMPSTRING d2i_ASN1_ENUMERATED d2i_ASN1_GENERALIZEDTIME d2i_ASN1_GENERALSTRING d2i_ASN1_IA5STRING d2i_ASN1_INTEGER d2i_ASN1_NULL d2i_ASN1_OBJECT d2i_ASN1_OCTET_STRING d2i_ASN1_PRINTABLE d2i_ASN1_PRINTABLESTRING d2i_ASN1_SEQUENCE_ANY d2i_ASN1_SET_ANY d2i_ASN1_T61STRING d2i_ASN1_TIME d2i_ASN1_TYPE d2i_ASN1_UINTEGER d2i_ASN1_UNIVERSALSTRING d2i_ASN1_UTCTIME d2i_ASN1_UTF8STRING d2i_ASN1_VISIBLESTRING d2i_ASRange d2i_AUTHORITY_INFO_ACCESS d2i_AUTHORITY_KEYID d2i_AutoPrivateKey d2i_BASIC_CONSTRAINTS d2i_CERTIFICATEPOLICIES d2i_CMS_ContentInfo d2i_CMS_ReceiptRequest d2i_CMS_bio d2i_CRL_DIST_POINTS d2i_DHparams d2i_DHxparams d2i_DIRECTORYSTRING d2i_DISPLAYTEXT d2i_DIST_POINT d2i_DIST_POINT_NAME d2i_DSAPrivateKey d2i_DSAPrivateKey_bio d2i_DSAPrivateKey_fp d2i_DSAPublicKey d2i_DSA_PUBKEY d2i_DSA_PUBKEY_bio d2i_DSA_PUBKEY_fp d2i_DSA_SIG d2i_DSAparams d2i_ECDSA_SIG d2i_ECPKParameters d2i_ECParameters d2i_ECPrivateKey d2i_ECPrivateKey_bio d2i_ECPrivateKey_fp d2i_EC_PUBKEY d2i_EC_PUBKEY_bio d2i_EC_PUBKEY_fp d2i_EDIPARTYNAME d2i_ESS_CERT_ID d2i_ESS_CERT_ID_V2 d2i_ESS_ISSUER_SERIAL d2i_ESS_SIGNING_CERT d2i_ESS_SIGNING_CERT_V2 d2i_EXTENDED_KEY_USAGE d2i_GENERAL_NAME d2i_GENERAL_NAMES d2i_IPAddressChoice d2i_IPAddressFamily d2i_IPAddressOrRange d2i_IPAddressRange d2i_ISSUING_DIST_POINT d2i_NAMING_AUTHORITY d2i_NETSCAPE_CERT_SEQUENCE d2i_NETSCAPE_SPKAC d2i_NETSCAPE_SPKI d2i_NOTICEREF d2i_OCSP_BASICRESP d2i_OCSP_CERTID d2i_OCSP_CERTSTATUS d2i_OCSP_CRLID d2i_OCSP_ONEREQ d2i_OCSP_REQINFO d2i_OCSP_REQUEST d2i_OCSP_RESPBYTES d2i_OCSP_RESPDATA d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_OCSP_REVOKEDINFO d2i_OCSP_SERVICELOC d2i_OCSP_SIGNATURE d2i_OCSP_SINGLERESP d2i_OTHERNAME d2i_PBE2PARAM d2i_PBEPARAM d2i_PBKDF2PARAM d2i_PKCS12 d2i_PKCS12_BAGS d2i_PKCS12_MAC_DATA d2i_PKCS12_SAFEBAG d2i_PKCS12_bio d2i_PKCS12_fp d2i_PKCS7 d2i_PKCS7_DIGEST d2i_PKCS7_ENCRYPT d2i_PKCS7_ENC_CONTENT d2i_PKCS7_ENVELOPE d2i_PKCS7_ISSUER_AND_SERIAL d2i_PKCS7_RECIP_INFO d2i_PKCS7_SIGNED d2i_PKCS7_SIGNER_INFO d2i_PKCS7_SIGN_ENVELOPE d2i_PKCS7_bio d2i_PKCS7_fp d2i_PKCS8PrivateKey_bio d2i_PKCS8PrivateKey_fp d2i_PKCS8_PRIV_KEY_INFO d2i_PKCS8_PRIV_KEY_INFO_bio d2i_PKCS8_PRIV_KEY_INFO_fp d2i_PKCS8_bio d2i_PKCS8_fp d2i_PKEY_USAGE_PERIOD d2i_POLICYINFO d2i_POLICYQUALINFO d2i_PROFESSION_INFO d2i_PROXY_CERT_INFO_EXTENSION d2i_PROXY_POLICY d2i_PUBKEY d2i_PUBKEY_bio d2i_PUBKEY_fp d2i_PrivateKey d2i_PrivateKey_bio d2i_PrivateKey_fp d2i_PublicKey d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_RSAPrivateKey_fp d2i_RSAPublicKey d2i_RSAPublicKey_bio d2i_RSAPublicKey_fp d2i_RSA_OAEP_PARAMS d2i_RSA_PSS_PARAMS d2i_RSA_PUBKEY d2i_RSA_PUBKEY_bio d2i_RSA_PUBKEY_fp d2i_SCRYPT_PARAMS d2i_SCT_LIST d2i_SXNET d2i_SXNETID d2i_TS_ACCURACY d2i_TS_MSG_IMPRINT d2i_TS_MSG_IMPRINT_bio d2i_TS_MSG_IMPRINT_fp d2i_TS_REQ d2i_TS_REQ_bio d2i_TS_REQ_fp d2i_TS_RESP d2i_TS_RESP_bio d2i_TS_RESP_fp d2i_TS_STATUS_INFO d2i_TS_TST_INFO d2i_TS_TST_INFO_bio d2i_TS_TST_INFO_fp d2i_USERNOTICE d2i_X509 d2i_X509_ALGOR d2i_X509_ALGORS d2i_X509_ATTRIBUTE d2i_X509_AUX d2i_X509_CERT_AUX d2i_X509_CINF d2i_X509_CRL d2i_X509_CRL_INFO d2i_X509_CRL_bio d2i_X509_CRL_fp d2i_X509_EXTENSION d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_NAME_ENTRY d2i_X509_PUBKEY d2i_X509_REQ d2i_X509_REQ_INFO d2i_X509_REQ_bio d2i_X509_REQ_fp d2i_X509_REVOKED d2i_X509_SIG d2i_X509_VAL d2i_X509_bio d2i_X509_fp err_free_strings_int i2a_ACCESS_DESCRIPTION i2a_ASN1_ENUMERATED i2a_ASN1_INTEGER i2a_ASN1_OBJECT i2a_ASN1_STRING i2b_PVK_bio i2b_PrivateKey_bio i2b_PublicKey_bio i2d_ACCESS_DESCRIPTION i2d_ADMISSIONS i2d_ADMISSION_SYNTAX i2d_ASIdOrRange i2d_ASIdentifierChoice i2d_ASIdentifiers i2d_ASN1_BIT_STRING i2d_ASN1_BMPSTRING i2d_ASN1_ENUMERATED i2d_ASN1_GENERALIZEDTIME i2d_ASN1_GENERALSTRING i2d_ASN1_IA5STRING i2d_ASN1_INTEGER i2d_ASN1_NULL i2d_ASN1_OBJECT i2d_ASN1_OCTET_STRING i2d_ASN1_PRINTABLE i2d_ASN1_PRINTABLESTRING i2d_ASN1_SEQUENCE_ANY i2d_ASN1_SET_ANY i2d_ASN1_T61STRING i2d_ASN1_TIME i2d_ASN1_TYPE i2d_ASN1_UNIVERSALSTRING i2d_ASN1_UTCTIME i2d_ASN1_UTF8STRING i2d_ASN1_VISIBLESTRING i2d_ASN1_bio_stream i2d_ASRange i2d_AUTHORITY_INFO_ACCESS i2d_AUTHORITY_KEYID i2d_BASIC_CONSTRAINTS i2d_CERTIFICATEPOLICIES i2d_CMS_ContentInfo i2d_CMS_ReceiptRequest i2d_CMS_bio i2d_CMS_bio_stream i2d_CRL_DIST_POINTS i2d_DHparams i2d_DHxparams i2d_DIRECTORYSTRING i2d_DISPLAYTEXT i2d_DIST_POINT i2d_DIST_POINT_NAME i2d_DSAPrivateKey i2d_DSAPrivateKey_bio i2d_DSAPrivateKey_fp i2d_DSAPublicKey i2d_DSA_PUBKEY i2d_DSA_PUBKEY_bio i2d_DSA_PUBKEY_fp i2d_DSA_SIG i2d_DSAparams i2d_ECDSA_SIG i2d_ECPKParameters i2d_ECParameters i2d_ECPrivateKey i2d_ECPrivateKey_bio i2d_ECPrivateKey_fp i2d_EC_PUBKEY i2d_EC_PUBKEY_bio i2d_EC_PUBKEY_fp i2d_EDIPARTYNAME i2d_ESS_CERT_ID i2d_ESS_CERT_ID_V2 i2d_ESS_ISSUER_SERIAL i2d_ESS_SIGNING_CERT i2d_ESS_SIGNING_CERT_V2 i2d_EXTENDED_KEY_USAGE i2d_GENERAL_NAME i2d_GENERAL_NAMES i2d_IPAddressChoice i2d_IPAddressFamily i2d_IPAddressOrRange i2d_IPAddressRange i2d_ISSUING_DIST_POINT i2d_NAMING_AUTHORITY i2d_NETSCAPE_CERT_SEQUENCE i2d_NETSCAPE_SPKAC i2d_NETSCAPE_SPKI i2d_NOTICEREF i2d_OCSP_BASICRESP i2d_OCSP_CERTID i2d_OCSP_CERTSTATUS i2d_OCSP_CRLID i2d_OCSP_ONEREQ i2d_OCSP_REQINFO i2d_OCSP_REQUEST i2d_OCSP_RESPBYTES i2d_OCSP_RESPDATA i2d_OCSP_RESPID i2d_OCSP_RESPONSE i2d_OCSP_REVOKEDINFO i2d_OCSP_SERVICELOC i2d_OCSP_SIGNATURE i2d_OCSP_SINGLERESP i2d_OTHERNAME i2d_PBE2PARAM i2d_PBEPARAM i2d_PBKDF2PARAM i2d_PKCS12 i2d_PKCS12_BAGS i2d_PKCS12_MAC_DATA i2d_PKCS12_SAFEBAG i2d_PKCS12_bio i2d_PKCS12_fp i2d_PKCS7 i2d_PKCS7_DIGEST i2d_PKCS7_ENCRYPT i2d_PKCS7_ENC_CONTENT i2d_PKCS7_ENVELOPE i2d_PKCS7_ISSUER_AND_SERIAL i2d_PKCS7_NDEF i2d_PKCS7_RECIP_INFO i2d_PKCS7_SIGNED i2d_PKCS7_SIGNER_INFO i2d_PKCS7_SIGN_ENVELOPE i2d_PKCS7_bio i2d_PKCS7_bio_stream i2d_PKCS7_fp i2d_PKCS8PrivateKeyInfo_bio i2d_PKCS8PrivateKeyInfo_fp i2d_PKCS8PrivateKey_bio i2d_PKCS8PrivateKey_fp i2d_PKCS8PrivateKey_nid_bio i2d_PKCS8PrivateKey_nid_fp i2d_PKCS8_PRIV_KEY_INFO i2d_PKCS8_PRIV_KEY_INFO_bio i2d_PKCS8_PRIV_KEY_INFO_fp i2d_PKCS8_bio i2d_PKCS8_fp i2d_PKEY_USAGE_PERIOD i2d_POLICYINFO i2d_POLICYQUALINFO i2d_PROFESSION_INFO i2d_PROXY_CERT_INFO_EXTENSION i2d_PROXY_POLICY i2d_PUBKEY i2d_PUBKEY_bio i2d_PUBKEY_fp i2d_PrivateKey i2d_PrivateKey_bio i2d_PrivateKey_fp i2d_PublicKey i2d_RSAPrivateKey i2d_RSAPrivateKey_bio i2d_RSAPrivateKey_fp i2d_RSAPublicKey i2d_RSAPublicKey_bio i2d_RSAPublicKey_fp i2d_RSA_OAEP_PARAMS i2d_RSA_PSS_PARAMS i2d_RSA_PUBKEY i2d_RSA_PUBKEY_bio i2d_RSA_PUBKEY_fp i2d_SCRYPT_PARAMS i2d_SCT_LIST i2d_SXNET i2d_SXNETID i2d_TS_ACCURACY i2d_TS_MSG_IMPRINT i2d_TS_MSG_IMPRINT_bio i2d_TS_MSG_IMPRINT_fp i2d_TS_REQ i2d_TS_REQ_bio i2d_TS_REQ_fp i2d_TS_RESP i2d_TS_RESP_bio i2d_TS_RESP_fp i2d_TS_STATUS_INFO i2d_TS_TST_INFO i2d_TS_TST_INFO_bio i2d_TS_TST_INFO_fp i2d_USERNOTICE i2d_X509 i2d_X509_ALGOR i2d_X509_ALGORS i2d_X509_ATTRIBUTE i2d_X509_AUX i2d_X509_CERT_AUX i2d_X509_CINF i2d_X509_CRL i2d_X509_CRL_INFO i2d_X509_CRL_bio i2d_X509_CRL_fp i2d_X509_EXTENSION i2d_X509_EXTENSIONS i2d_X509_NAME i2d_X509_NAME_ENTRY i2d_X509_PUBKEY i2d_X509_REQ i2d_X509_REQ_INFO i2d_X509_REQ_bio i2d_X509_REQ_fp i2d_X509_REVOKED i2d_X509_SIG i2d_X509_VAL i2d_X509_bio i2d_X509_fp i2d_re_X509_CRL_tbs i2d_re_X509_REQ_tbs i2d_re_X509_tbs i2o_ECPublicKey i2o_SCT i2o_SCT_LIST i2s_ASN1_ENUMERATED i2s_ASN1_ENUMERATED_TABLE i2s_ASN1_IA5STRING i2s_ASN1_INTEGER i2s_ASN1_OCTET_STRING i2t_ASN1_OBJECT i2v_ASN1_BIT_STRING i2v_GENERAL_NAME i2v_GENERAL_NAMES o2i_ECPublicKey o2i_SCT o2i_SCT_LIST s2i_ASN1_IA5STRING s2i_ASN1_INTEGER s2i_ASN1_OCTET_STRING v2i_ASN1_BIT_STRING v2i_GENERAL_NAME v2i_GENERAL_NAMES v2i_GENERAL_NAME_ex

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

387KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/4

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/liblzo2-2.dll

IMPHASH a11e7dc095461a50ba9511e2c1a77e7a
SHA256 22c1a7a44308ff6aafd80caa6fd53c93df7696c99feadf9ae700f26365c0986f
MD5 bd9eab80f953d1674d71c315e050292b
SHA1 7f0d391e1d7b4dd455359ca1381bc5b90a23c84d
SHA512 baedfe72d58711ce95ad5ab2010f99d1f42825b825eae48c72add6c2cb8c8f756eb8d1f8c13b78d4cd6cc2a3cfeb920f4188ca47dc6f59aa1c66b0d83b0ebf4e
SSDEEP 3072:xyJHcFYd6nLF3XRAXqXKGfyI4yaIw4QBkUgPQtRfG/:oeF3XWXq6GK14CVgIvO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

90:97:00:cc:1b:02:de:be:b8:9c:fb:e9:90:43:e4:0b:c3:5b:96:f2:95:8f:ae:96:4e:43:78:ee:5d:8f:4d:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2021

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Serial Number

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Nov 4, 2022

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

@feat.00 __lzo_align_gap __lzo_init_v2 __lzo_ptr_linear _lzo1b_1_compress_func _lzo1b_2_compress_func _lzo1b_3_compress_func _lzo1b_4_compress_func _lzo1b_5_compress_func _lzo1b_6_compress_func _lzo1b_7_compress_func _lzo1b_8_compress_func _lzo1b_99_compress_func _lzo1b_9_compress_func _lzo1b_do_compress _lzo1b_store_run _lzo1c_1_compress_func _lzo1c_2_compress_func _lzo1c_3_compress_func _lzo1c_4_compress_func _lzo1c_5_compress_func _lzo1c_6_compress_func _lzo1c_7_compress_func _lzo1c_8_compress_func _lzo1c_99_compress_func _lzo1c_9_compress_func _lzo1c_do_compress _lzo1c_store_run _lzo_config_check _lzo_version_date _lzo_version_string lzo1_99_compress lzo1_compress lzo1_decompress lzo1_info lzo1a_99_compress lzo1a_compress lzo1a_decompress lzo1a_info lzo1b_1_compress lzo1b_2_compress lzo1b_3_compress lzo1b_4_compress lzo1b_5_compress lzo1b_6_compress lzo1b_7_compress lzo1b_8_compress lzo1b_999_compress lzo1b_999_compress_callback lzo1b_99_compress lzo1b_9_compress lzo1b_compress lzo1b_decompress lzo1b_decompress_safe lzo1c_1_compress lzo1c_2_compress lzo1c_3_compress lzo1c_4_compress lzo1c_5_compress lzo1c_6_compress lzo1c_7_compress lzo1c_8_compress lzo1c_999_compress lzo1c_999_compress_callback lzo1c_99_compress lzo1c_9_compress lzo1c_compress lzo1c_decompress lzo1c_decompress_asm lzo1c_decompress_asm_safe lzo1c_decompress_safe lzo1f_1_compress lzo1f_999_compress lzo1f_999_compress_callback lzo1f_decompress lzo1f_decompress_asm_fast lzo1f_decompress_asm_fast_safe lzo1f_decompress_safe lzo1x_1_11_compress lzo1x_1_12_compress lzo1x_1_15_compress lzo1x_1_compress lzo1x_999_compress lzo1x_999_compress_dict lzo1x_999_compress_internal lzo1x_999_compress_level lzo1x_decompress lzo1x_decompress_asm lzo1x_decompress_asm_fast lzo1x_decompress_asm_fast_safe lzo1x_decompress_asm_safe lzo1x_decompress_dict_safe lzo1x_decompress_safe lzo1x_optimize lzo1y_1_compress lzo1y_999_compress lzo1y_999_compress_dict lzo1y_999_compress_internal lzo1y_999_compress_level lzo1y_decompress lzo1y_decompress_asm lzo1y_decompress_asm_fast lzo1y_decompress_asm_fast_safe lzo1y_decompress_asm_safe lzo1y_decompress_dict_safe lzo1y_decompress_safe lzo1y_optimize lzo1z_999_compress lzo1z_999_compress_dict lzo1z_999_compress_internal lzo1z_999_compress_level lzo1z_decompress lzo1z_decompress_dict_safe lzo1z_decompress_safe lzo2a_999_compress lzo2a_999_compress_callback lzo2a_decompress lzo2a_decompress_safe lzo_adler32 lzo_copyright lzo_crc32 lzo_get_crc32_table lzo_memcmp lzo_memcpy lzo_memmove lzo_memset lzo_version lzo_version_date lzo_version_string

Name

.text

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

948B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/libpkcs11-helper-1.dll

IMPHASH a1faeb7748678e2828e3209f0aff2acc
SHA256 6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead
MD5 5e12d4d264ba957604e80ebbb436c61b
SHA1 50ad9a622518989a80355d226b77c5c57aecba64
SHA512 e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002
SSDEEP 3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

3b:06:63:e0:26:be:05:0f:ab:d2:07:5b:4a:72:41:66:b2:fa:7e:dd:f5:cd:03:f4:e3:38:c3:8d:86:d2:57:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2021

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Serial Number

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Nov 4, 2022

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

libcrypto-1_1

BN_bin2bn BN_clear_free BN_free CRYPTO_get_ex_new_index DSA_SIG_free DSA_SIG_new DSA_SIG_set0 DSA_free DSA_get_default_method DSA_get_ex_data DSA_meth_dup DSA_meth_free DSA_meth_set1_name DSA_meth_set_sign DSA_set_ex_data DSA_set_method ECDSA_SIG_free ECDSA_SIG_new ECDSA_SIG_set0 EC_KEY_METHOD_free EC_KEY_METHOD_get_sign EC_KEY_METHOD_new EC_KEY_METHOD_set_sign EC_KEY_free EC_KEY_get_default_method EC_KEY_get_ex_data EC_KEY_set_ex_data EC_KEY_set_method EVP_PKEY_free EVP_PKEY_get1_DSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_id RSA_free RSA_get_default_method RSA_get_ex_data RSA_meth_dup RSA_meth_free RSA_meth_set1_name RSA_meth_set_flags RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_set_ex_data RSA_set_method RSA_size X509_NAME_cmp X509_NAME_oneline X509_cmp_current_time X509_dup X509_free X509_get0_notAfter X509_get0_notBefore X509_get_issuer_name X509_get_pubkey X509_get_subject_name X509_new X509_verify d2i_X509

kernel32

CloseHandle CreateEventA CreateMutexA DeleteCriticalSection EnterCriticalSection FileTimeToSystemTime FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameW GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA QueryPerformanceCounter ReleaseMutex SetEvent SetUnhandledExceptionFilter Sleep SystemTimeToTzSpecificLocalTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

__dllonexit _amsg_exit _beginthreadex _exit _initterm _iob _lock _onexit _snwprintf time mktime localtime gmtime _unlock calloc free fwprintf fwrite getenv isgraph isxdigit malloc memmove memset raise sprintf sscanf strchr strcmp strlen strncat strncmp strncpy strrchr abort asctime vfprintf wcscpy

user32

MessageBoxW

pkcs11h_addProvider pkcs11h_certificate_create pkcs11h_certificate_decrypt pkcs11h_certificate_decryptAny pkcs11h_certificate_deserializeCertificateId pkcs11h_certificate_duplicateCertificateId pkcs11h_certificate_ensureCertificateAccess pkcs11h_certificate_ensureKeyAccess pkcs11h_certificate_enumCertificateIds pkcs11h_certificate_enumTokenCertificateIds pkcs11h_certificate_freeCertificate pkcs11h_certificate_freeCertificateId pkcs11h_certificate_freeCertificateIdList pkcs11h_certificate_getCertificateBlob pkcs11h_certificate_getCertificateId pkcs11h_certificate_getPromptMask pkcs11h_certificate_getUserData pkcs11h_certificate_lockSession pkcs11h_certificate_releaseSession pkcs11h_certificate_serializeCertificateId pkcs11h_certificate_setCertificateIdCertificateBlob pkcs11h_certificate_setPromptMask pkcs11h_certificate_setUserData pkcs11h_certificate_sign pkcs11h_certificate_signAny pkcs11h_certificate_signRecover pkcs11h_certificate_unwrap pkcs11h_data_del pkcs11h_data_enumDataObjects pkcs11h_data_freeDataIdList pkcs11h_data_get pkcs11h_data_put pkcs11h_engine_setCrypto pkcs11h_engine_setSystem pkcs11h_forkFixup pkcs11h_getFeatures pkcs11h_getLogLevel pkcs11h_getMessage pkcs11h_getVersion pkcs11h_initialize pkcs11h_logout pkcs11h_openssl_createSession pkcs11h_openssl_freeSession pkcs11h_openssl_getCleanupHook pkcs11h_openssl_getX509 pkcs11h_openssl_session_getEVP pkcs11h_openssl_session_getRSA pkcs11h_openssl_session_getX509 pkcs11h_openssl_setCleanupHook pkcs11h_plugAndPlay pkcs11h_removeProvider pkcs11h_setForkMode pkcs11h_setLogHook pkcs11h_setLogLevel pkcs11h_setMaxLoginRetries pkcs11h_setPINCachePeriod pkcs11h_setPINPromptHook pkcs11h_setProtectedAuthentication pkcs11h_setSlotEventHook pkcs11h_setTokenPromptHook pkcs11h_terminate pkcs11h_token_deserializeTokenId pkcs11h_token_duplicateTokenId pkcs11h_token_ensureAccess pkcs11h_token_enumTokenIds pkcs11h_token_freeTokenId pkcs11h_token_freeTokenIdList pkcs11h_token_login pkcs11h_token_logout pkcs11h_token_sameTokenId pkcs11h_token_serializeTokenId

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1012B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/libssl-1_1.dll

IMPHASH c380e5cdb447699b978cfcecd75b85b1
SHA256 89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd
MD5 d6d65e0a4a7706a90e328578251f43ae
SHA1 5a34a15fd21f345b3f6c1876df3503e0050e7428
SHA512 2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273
SSDEEP 24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Digest

b3:ee:47:ad:a1:53:e3:9a:2e:d2:12:ca:09:75:90:73:c1:b0:33:60:2a:1e:5c:5e:46:c2:68:43:3e:c7:44:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2021

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Serial Number

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Nov 4, 2022

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Minor OS version

0

Major OS version

4

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libcrypto-1_1

ASN1_ANY_it ASN1_OCTET_STRING_it ASN1_TYPE_get ASN1_item_d2i ASN1_item_free ASN1_item_i2d ASN1_item_new ASYNC_WAIT_CTX_free ASYNC_WAIT_CTX_get_all_fds ASYNC_WAIT_CTX_get_changed_fds ASYNC_WAIT_CTX_new ASYNC_get_current_job ASYNC_start_job BIO_ADDR_clear BIO_ADDR_free BIO_ADDR_new BIO_callback_ctrl BIO_clear_flags BIO_copy_next_retry BIO_ctrl BIO_dump_indent BIO_f_buffer BIO_find_type BIO_free BIO_free_all BIO_get_data BIO_get_init BIO_get_retry_reason BIO_get_shutdown BIO_int_ctrl BIO_method_type BIO_new BIO_next BIO_pop BIO_printf BIO_push BIO_puts BIO_read BIO_s_connect BIO_s_file BIO_s_mem BIO_s_socket BIO_set_data BIO_set_flags BIO_set_init BIO_set_next BIO_set_retry_reason BIO_set_shutdown BIO_snprintf BIO_test_flags BIO_up_ref BIO_write BN_bin2bn BN_bn2bin BN_clear_free BN_copy BN_dup BN_free BN_get_rfc2409_prime_1024 BN_get_rfc3526_prime_2048 BN_get_rfc3526_prime_3072 BN_get_rfc3526_prime_4096 BN_get_rfc3526_prime_8192 BN_is_zero BN_new BN_num_bits BN_set_word BN_ucmp BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_reverse COMP_CTX_free COMP_CTX_get_method COMP_CTX_new COMP_compress_block COMP_expand_block COMP_get_name COMP_get_type COMP_zlib CONF_parse_list CRYPTO_THREAD_lock_free CRYPTO_THREAD_lock_new CRYPTO_THREAD_read_lock CRYPTO_THREAD_run_once CRYPTO_THREAD_unlock CRYPTO_THREAD_write_lock CRYPTO_clear_free CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_memdup CRYPTO_new_ex_data CRYPTO_realloc CRYPTO_secure_free CRYPTO_secure_zalloc CRYPTO_set_ex_data CRYPTO_strdup CRYPTO_strndup CRYPTO_zalloc CTLOG_STORE_free CTLOG_STORE_load_default_file CTLOG_STORE_load_file CTLOG_STORE_new CT_POLICY_EVAL_CTX_free CT_POLICY_EVAL_CTX_new CT_POLICY_EVAL_CTX_set1_cert CT_POLICY_EVAL_CTX_set1_issuer CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE CT_POLICY_EVAL_CTX_set_time DH_check_params DH_free DH_get0_key DH_get0_pqg DH_new DH_set0_key DH_set0_pqg EC_GROUP_get_curve_name EC_GROUP_method_of EC_KEY_can_sign EC_KEY_free EC_KEY_get0_group EC_KEY_get_conv_form EC_KEY_new_by_curve_name EC_METHOD_get_field_type EC_curve_nist2nid ENGINE_finish ENGINE_get_ssl_client_cert_function ENGINE_init ENGINE_load_ssl_client_cert ERR_add_error_data ERR_clear_error ERR_func_error_string ERR_load_strings_const ERR_peek_error ERR_peek_last_error ERR_pop_to_mark ERR_put_error ERR_set_mark EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_CIPHER_block_size EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_Cipher EVP_CipherFinal_ex EVP_CipherInit_ex EVP_CipherUpdate EVP_DecryptFinal EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSign EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerify EVP_DigestVerifyFinal EVP_DigestVerifyInit EVP_EncryptFinal EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_ctrl EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_new EVP_MD_CTX_set_flags EVP_MD_size EVP_MD_type EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_free EVP_PKEY_CTX_new EVP_PKEY_CTX_new_id EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0_info EVP_PKEY_assign EVP_PKEY_cmp EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_derive EVP_PKEY_derive_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_free EVP_PKEY_get0 EVP_PKEY_get0_DH EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get1_tls_encodedpoint EVP_PKEY_get_default_digest_nid EVP_PKEY_id EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_mac_key EVP_PKEY_new_raw_private_key EVP_PKEY_paramgen EVP_PKEY_paramgen_init EVP_PKEY_security_bits EVP_PKEY_set1_DH EVP_PKEY_set1_tls_encodedpoint EVP_PKEY_set_type EVP_PKEY_size EVP_PKEY_up_ref EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_cbc_hmac_sha256 EVP_aes_128_ccm EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_cbc_hmac_sha256 EVP_aes_256_ccm EVP_aes_256_gcm EVP_aria_128_gcm EVP_aria_256_gcm EVP_camellia_128_cbc EVP_camellia_256_cbc EVP_chacha20_poly1305 EVP_des_cbc EVP_des_ede3_cbc EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_idea_cbc EVP_md5 EVP_md5_sha1 EVP_rc2_40_cbc EVP_rc2_cbc EVP_rc4 EVP_rc4_hmac_md5 EVP_seed_cbc EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 HMAC_CTX_free HMAC_CTX_new HMAC_Final HMAC_Init_ex HMAC_Update HMAC_size INT32_it MD5_Init MD5_Transform OBJ_NAME_add OBJ_bsearch_ OBJ_ln2nid OBJ_nid2sn OBJ_sn2nid OCSP_BASICRESP_free OCSP_RESPID_free OCSP_RESPONSE_free OCSP_SINGLERESP_get1_ext_d2i OCSP_resp_count OCSP_resp_get0 OCSP_response_get1_basic OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_LH_delete OPENSSL_LH_doall_arg OPENSSL_LH_free OPENSSL_LH_get_down_load OPENSSL_LH_insert OPENSSL_LH_new OPENSSL_LH_num_items OPENSSL_LH_retrieve OPENSSL_LH_set_down_load OPENSSL_atexit OPENSSL_cleanse OPENSSL_init_crypto OPENSSL_sk_delete OPENSSL_sk_dup OPENSSL_sk_find OPENSSL_sk_free OPENSSL_sk_insert OPENSSL_sk_new OPENSSL_sk_new_null OPENSSL_sk_new_reserve OPENSSL_sk_num OPENSSL_sk_pop OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_set_cmp_func OPENSSL_sk_shift OPENSSL_sk_sort OPENSSL_sk_value PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_read_bio PEM_read_bio_DHparams PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_X509 PEM_read_bio_X509_AUX RAND_bytes RAND_priv_bytes RSA_free RSA_pkey_ctx_ctrl RSA_private_decrypt RSA_size RSA_up_ref SCT_LIST_free SCT_LIST_validate SCT_get_validation_status SCT_set_source SHA1_Init SHA1_Transform SHA224_Init SHA256_Init SHA256_Transform SHA384_Init SHA512_Init SHA512_Transform SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier_BN SRP_get_default_gN UINT32_it X509_EXTENSION_free X509_LOOKUP_ctrl X509_LOOKUP_file X509_LOOKUP_hash_dir X509_NAME_cmp X509_NAME_dup X509_NAME_free X509_NAME_hash X509_STORE_CTX_free X509_STORE_CTX_get0_chain X509_STORE_CTX_get0_param X509_STORE_CTX_get1_chain X509_STORE_CTX_get_error X509_STORE_CTX_init X509_STORE_CTX_new X509_STORE_CTX_set0_dane X509_STORE_CTX_set_default X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_flags X509_STORE_CTX_set_verify_cb X509_STORE_add_cert X509_STORE_add_lookup X509_STORE_free X509_STORE_load_locations X509_STORE_new X509_STORE_set_default_paths X509_STORE_up_ref X509_VERIFY_PARAM_add1_host X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get0_peername X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_move_peername X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set1_host X509_VERIFY_PARAM_set_auth_level X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_hostflags X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_trust X509_chain_check_suiteb X509_chain_up_ref X509_check_private_key X509_cmp X509_free X509_get0_pubkey X509_get_ext_d2i X509_get_extension_flags X509_get_issuer_name X509_get_key_usage X509_get_pubkey X509_get_signature_info X509_get_signature_nid X509_get_subject_name X509_it X509_up_ref X509_verify_cert X509_verify_cert_error_string ZINT32_it ZINT64_it ZUINT32_it ZUINT64_it conf_ssl_get conf_ssl_get_cmd conf_ssl_name_find d2i_OCSP_RESPID d2i_OCSP_RESPONSE d2i_PUBKEY d2i_PrivateKey d2i_PrivateKey_bio d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_X509 d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_bio err_free_strings_int i2d_OCSP_RESPID i2d_X509 i2d_X509_EXTENSIONS i2d_X509_NAME o2i_SCT_LIST

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetSystemTime GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _errno _initterm _iob _lock _onexit time _stricmp _strnicmp _unlock calloc free fwrite malloc memchr memcmp memcpy memmove memset qsort sprintf strchr strcmp strcpy strlen strncmp abort vfprintf atoi

BIO_f_ssl BIO_new_buffer_ssl_connect BIO_new_ssl BIO_new_ssl_connect BIO_ssl_copy_session_id BIO_ssl_shutdown DTLS_client_method DTLS_get_data_mtu DTLS_method DTLS_server_method DTLS_set_timer_cb DTLSv1_2_client_method DTLSv1_2_method DTLSv1_2_server_method DTLSv1_client_method DTLSv1_listen DTLSv1_method DTLSv1_server_method ERR_load_SSL_strings OPENSSL_cipher_name OPENSSL_init_ssl PEM_read_SSL_SESSION PEM_read_bio_SSL_SESSION PEM_write_SSL_SESSION PEM_write_bio_SSL_SESSION SRP_Calc_A_param SSL_CIPHER_description SSL_CIPHER_find SSL_CIPHER_get_auth_nid SSL_CIPHER_get_bits SSL_CIPHER_get_cipher_nid SSL_CIPHER_get_digest_nid SSL_CIPHER_get_handshake_digest SSL_CIPHER_get_id SSL_CIPHER_get_kx_nid SSL_CIPHER_get_name SSL_CIPHER_get_protocol_id SSL_CIPHER_get_version SSL_CIPHER_is_aead SSL_CIPHER_standard_name SSL_COMP_add_compression_method SSL_COMP_get0_name SSL_COMP_get_compression_methods SSL_COMP_get_id SSL_COMP_get_name SSL_COMP_set0_compression_methods SSL_CONF_CTX_clear_flags SSL_CONF_CTX_finish SSL_CONF_CTX_free SSL_CONF_CTX_new SSL_CONF_CTX_set1_prefix SSL_CONF_CTX_set_flags SSL_CONF_CTX_set_ssl SSL_CONF_CTX_set_ssl_ctx SSL_CONF_cmd SSL_CONF_cmd_argv SSL_CONF_cmd_value_type SSL_CTX_SRP_CTX_free SSL_CTX_SRP_CTX_init SSL_CTX_add1_to_CA_list SSL_CTX_add_client_CA SSL_CTX_add_client_custom_ext SSL_CTX_add_custom_ext SSL_CTX_add_server_custom_ext SSL_CTX_add_session SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_clear_options SSL_CTX_config SSL_CTX_ct_is_enabled SSL_CTX_ctrl SSL_CTX_dane_clear_flags SSL_CTX_dane_enable SSL_CTX_dane_mtype_set SSL_CTX_dane_set_flags SSL_CTX_enable_ct SSL_CTX_flush_sessions SSL_CTX_free SSL_CTX_get0_CA_list SSL_CTX_get0_certificate SSL_CTX_get0_ctlog_store SSL_CTX_get0_param SSL_CTX_get0_privatekey SSL_CTX_get0_security_ex_data SSL_CTX_get_cert_store SSL_CTX_get_ciphers SSL_CTX_get_client_CA_list SSL_CTX_get_client_cert_cb SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_get_ex_data SSL_CTX_get_info_callback SSL_CTX_get_keylog_callback SSL_CTX_get_max_early_data SSL_CTX_get_num_tickets SSL_CTX_get_options SSL_CTX_get_quiet_shutdown SSL_CTX_get_record_padding_callback_arg SSL_CTX_get_recv_max_early_data SSL_CTX_get_security_callback SSL_CTX_get_security_level SSL_CTX_get_ssl_method SSL_CTX_get_timeout SSL_CTX_get_verify_callback SSL_CTX_get_verify_depth SSL_CTX_get_verify_mode SSL_CTX_has_client_custom_ext SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_remove_session SSL_CTX_sess_get_get_cb SSL_CTX_sess_get_new_cb SSL_CTX_sess_get_remove_cb SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_sessions SSL_CTX_set0_CA_list SSL_CTX_set0_ctlog_store SSL_CTX_set0_security_ex_data SSL_CTX_set1_cert_store SSL_CTX_set1_param SSL_CTX_set_allow_early_data_cb SSL_CTX_set_alpn_protos SSL_CTX_set_alpn_select_cb SSL_CTX_set_block_padding SSL_CTX_set_cert_cb SSL_CTX_set_cert_store SSL_CTX_set_cert_verify_callback SSL_CTX_set_cipher_list SSL_CTX_set_ciphersuites SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_cb SSL_CTX_set_client_cert_engine SSL_CTX_set_client_hello_cb SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_ct_validation_callback SSL_CTX_set_ctlog_list_file SSL_CTX_set_default_ctlog_list_file SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_default_read_buffer_len SSL_CTX_set_default_verify_dir SSL_CTX_set_default_verify_file SSL_CTX_set_default_verify_paths SSL_CTX_set_ex_data SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_keylog_callback SSL_CTX_set_max_early_data SSL_CTX_set_msg_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_not_resumable_session_callback SSL_CTX_set_num_tickets SSL_CTX_set_options SSL_CTX_set_post_handshake_auth SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_find_session_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_psk_use_session_callback SSL_CTX_set_purpose SSL_CTX_set_quiet_shutdown SSL_CTX_set_record_padding_callback SSL_CTX_set_record_padding_callback_arg SSL_CTX_set_recv_max_early_data SSL_CTX_set_security_callback SSL_CTX_set_security_level SSL_CTX_set_session_id_context SSL_CTX_set_session_ticket_cb SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_password SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_ssl_version SSL_CTX_set_stateless_cookie_generate_cb SSL_CTX_set_stateless_cookie_verify_cb SSL_CTX_set_timeout SSL_CTX_set_tlsext_max_fragment_length SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_tmp_dh_callback SSL_CTX_set_trust SSL_CTX_set_verify SSL_CTX_set_verify_depth SSL_CTX_up_ref SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_ASN1 SSL_CTX_use_PrivateKey_file SSL_CTX_use_RSAPrivateKey SSL_CTX_use_RSAPrivateKey_ASN1 SSL_CTX_use_RSAPrivateKey_file SSL_CTX_use_cert_and_key SSL_CTX_use_certificate SSL_CTX_use_certificate_ASN1 SSL_CTX_use_certificate_chain_file SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_CTX_use_serverinfo SSL_CTX_use_serverinfo_ex SSL_CTX_use_serverinfo_file SSL_SESSION_dup SSL_SESSION_free SSL_SESSION_get0_alpn_selected SSL_SESSION_get0_cipher SSL_SESSION_get0_hostname SSL_SESSION_get0_id_context SSL_SESSION_get0_peer SSL_SESSION_get0_ticket SSL_SESSION_get0_ticket_appdata SSL_SESSION_get_compress_id SSL_SESSION_get_ex_data SSL_SESSION_get_id SSL_SESSION_get_master_key SSL_SESSION_get_max_early_data SSL_SESSION_get_max_fragment_length SSL_SESSION_get_protocol_version SSL_SESSION_get_ticket_lifetime_hint SSL_SESSION_get_time SSL_SESSION_get_timeout SSL_SESSION_has_ticket SSL_SESSION_is_resumable SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_fp SSL_SESSION_print_keylog SSL_SESSION_set1_alpn_selected SSL_SESSION_set1_hostname SSL_SESSION_set1_id SSL_SESSION_set1_id_context SSL_SESSION_set1_master_key SSL_SESSION_set1_ticket_appdata SSL_SESSION_set_cipher SSL_SESSION_set_ex_data SSL_SESSION_set_max_early_data SSL_SESSION_set_protocol_version SSL_SESSION_set_time SSL_SESSION_set_timeout SSL_SESSION_up_ref SSL_SRP_CTX_free SSL_SRP_CTX_init SSL_accept SSL_add1_host SSL_add1_to_CA_list SSL_add_client_CA SSL_add_dir_cert_subjects_to_stack SSL_add_file_cert_subjects_to_stack SSL_add_ssl_module SSL_alert_desc_string SSL_alert_desc_string_long SSL_alert_type_string SSL_alert_type_string_long SSL_alloc_buffers SSL_bytes_to_cipher_list SSL_callback_ctrl SSL_certs_clear SSL_check_chain SSL_check_private_key SSL_clear SSL_clear_options SSL_client_hello_get0_ciphers SSL_client_hello_get0_compression_methods SSL_client_hello_get0_ext SSL_client_hello_get0_legacy_version SSL_client_hello_get0_random SSL_client_hello_get0_session_id SSL_client_hello_get1_extensions_present SSL_client_hello_isv2 SSL_client_version SSL_config SSL_connect SSL_copy_session_id SSL_ct_is_enabled SSL_ctrl SSL_dane_clear_flags SSL_dane_enable SSL_dane_set_flags SSL_dane_tlsa_add SSL_do_handshake SSL_dup SSL_dup_CA_list SSL_enable_ct SSL_export_keying_material SSL_export_keying_material_early SSL_extension_supported SSL_free SSL_free_buffers SSL_get0_CA_list SSL_get0_alpn_selected SSL_get0_dane SSL_get0_dane_authority SSL_get0_dane_tlsa SSL_get0_next_proto_negotiated SSL_get0_param SSL_get0_peer_CA_list SSL_get0_peer_scts SSL_get0_peername SSL_get0_security_ex_data SSL_get0_verified_chain SSL_get1_session SSL_get1_supported_ciphers SSL_get_SSL_CTX SSL_get_all_async_fds SSL_get_certificate SSL_get_changed_async_fds SSL_get_cipher_list SSL_get_ciphers SSL_get_client_CA_list SSL_get_client_ciphers SSL_get_client_random SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_default_passwd_cb SSL_get_default_passwd_cb_userdata SSL_get_default_timeout SSL_get_early_data_status SSL_get_error SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_fd SSL_get_finished SSL_get_info_callback SSL_get_key_update_type SSL_get_max_early_data SSL_get_num_tickets SSL_get_options SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_peer_finished SSL_get_peer_signature_type_nid SSL_get_pending_cipher SSL_get_privatekey SSL_get_psk_identity SSL_get_psk_identity_hint SSL_get_quiet_shutdown SSL_get_rbio SSL_get_read_ahead SSL_get_record_padding_callback_arg SSL_get_recv_max_early_data SSL_get_rfd SSL_get_security_callback SSL_get_security_level SSL_get_selected_srtp_profile SSL_get_server_random SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shared_sigalgs SSL_get_shutdown SSL_get_sigalgs SSL_get_signature_type_nid SSL_get_srp_N SSL_get_srp_g SSL_get_srp_userinfo SSL_get_srp_username SSL_get_srtp_profiles SSL_get_ssl_method SSL_get_state SSL_get_verify_callback SSL_get_verify_depth SSL_get_verify_mode SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_get_wfd SSL_has_matching_session_id SSL_has_pending SSL_in_before SSL_in_init SSL_is_dtls SSL_is_init_finished SSL_is_server SSL_key_update SSL_load_client_CA_file SSL_new SSL_peek SSL_peek_ex SSL_pending SSL_read SSL_read_early_data SSL_read_ex SSL_renegotiate SSL_renegotiate_abbreviated SSL_renegotiate_pending SSL_rstate_string SSL_rstate_string_long SSL_select_next_proto SSL_session_reused SSL_set0_CA_list SSL_set0_rbio SSL_set0_security_ex_data SSL_set0_wbio SSL_set1_host SSL_set1_param SSL_set_SSL_CTX SSL_set_accept_state SSL_set_allow_early_data_cb SSL_set_alpn_protos SSL_set_bio SSL_set_block_padding SSL_set_cert_cb SSL_set_cipher_list SSL_set_ciphersuites SSL_set_client_CA_list SSL_set_connect_state SSL_set_ct_validation_callback SSL_set_debug SSL_set_default_passwd_cb SSL_set_default_passwd_cb_userdata SSL_set_default_read_buffer_len SSL_set_ex_data SSL_set_fd SSL_set_generate_session_id SSL_set_hostflags SSL_set_info_callback SSL_set_max_early_data SSL_set_msg_callback SSL_set_not_resumable_session_callback SSL_set_num_tickets SSL_set_options SSL_set_post_handshake_auth SSL_set_psk_client_callback SSL_set_psk_find_session_callback SSL_set_psk_server_callback SSL_set_psk_use_session_callback SSL_set_purpose SSL_set_quiet_shutdown SSL_set_read_ahead SSL_set_record_padding_callback SSL_set_record_padding_callback_arg SSL_set_recv_max_early_data SSL_set_rfd SSL_set_security_callback SSL_set_security_level SSL_set_session SSL_set_session_id_context SSL_set_session_secret_cb SSL_set_session_ticket_ext SSL_set_session_ticket_ext_cb SSL_set_shutdown SSL_set_srp_server_param SSL_set_srp_server_param_pw SSL_set_ssl_method SSL_set_tlsext_max_fragment_length SSL_set_tlsext_use_srtp SSL_set_tmp_dh_callback SSL_set_trust SSL_set_verify SSL_set_verify_depth SSL_set_verify_result SSL_set_wfd SSL_shutdown SSL_srp_server_param_with_username SSL_state_string SSL_state_string_long SSL_stateless SSL_up_ref SSL_use_PrivateKey SSL_use_PrivateKey_ASN1 SSL_use_PrivateKey_file SSL_use_RSAPrivateKey SSL_use_RSAPrivateKey_ASN1 SSL_use_RSAPrivateKey_file SSL_use_cert_and_key SSL_use_certificate SSL_use_certificate_ASN1 SSL_use_certificate_chain_file SSL_use_certificate_file SSL_use_psk_identity_hint SSL_verify_client_post_handshake SSL_version SSL_waiting_for_async SSL_want SSL_write SSL_write_early_data SSL_write_ex TLS_client_method TLS_method TLS_server_method TLSv1_1_client_method TLSv1_1_method TLSv1_1_server_method TLSv1_2_client_method TLSv1_2_method TLSv1_2_server_method TLSv1_client_method TLSv1_method TLSv1_server_method d2i_SSL_SESSION i2d_SSL_SESSION

Name

.text

Size

385KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/4

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

216KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ovpn/openssl-license .txt

SHA256 b9f6a4d26b1c7118c3b0ac41f0777a2b82de0ea25f48a9ca6a0e5550dba2382a
MD5 4c359b890e7eeb474a96075f6df68597
SHA1 eb7d89454cd1f62d8ad37d61fe52117be5b38a12
SHA512 d3578180c52d0daebd7b1792a261140bb49a11ff592efcb0c9d520a06ff6dc11ec3b1fcede1c95594deeffbd46d8703d1c5aabcd1677ab685774dadebb1af9bf
SSDEEP 192:uf9fG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhR:Q1u9b01DY/rGBt+dc+acR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ovpn/openvpn-license.txt

SHA256 a45afcd949cb0e29a3ca81801c7b72666e585ac039a0e1eac63546bcb7273d4c
MD5 a5aa9694cc581daf09c7f75d1bc64c30
SHA1 484b11367024a690fbd459fb4f45fd044f42d63a
SHA512 5dd967d247732aa4d718e25347224ea93a15c597c47507deeea30be84c87283e984daf39798492167a422acdc5af174eebd7f7220162f0907ad89d3730c7b306
SSDEEP 384:H4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPoqHZ:H46uh1iYWrTXoPoqHZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ovpn/openvpn.exe

IMPHASH 20cbd3fa02694a58ad084032cf6a8ecf
SHA256 1c704ce36e37384692d4e9d111be69665fb2bfd3edc614ed6117ed6b934b736e
MD5 d62e7bd8fcfc550f4c664eb7f6933186
SHA1 0c1434e0afc5abb50e4fc266a83b7d412a23c280
SHA512 36f8d5c714108140134d0e1d6852e2ef78da186d75fe6d6134ae7cbe43b79e451762f9e070004b13c0ccbb60e2c5ac12d34664381b7ed2187be57228861c815c
SSDEEP 24576:AHLo6iymW1bTJJf+mae38OB8s1k0yu3z3di6YT5WPYsrUFuyeAToym:YojeP+8828YYqp68
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

5e:54:0c:2c:78:cc:ec:e0:3e:1e:3c:91:db:a2:29:0f:f8:e0:b4:a5:33:e3:e4:eb:46:01:a2:cf:6f:c2:77:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2021

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Serial Number

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2019 - Nov 4, 2022

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Minor OS version

0

Major OS version

4

Entry point

5360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libcrypto-1_1

ASN1_BIT_STRING_free ASN1_BIT_STRING_get_bit ASN1_INTEGER_to_BN ASN1_OBJECT_free ASN1_STRING_to_UTF8 BIO_ctrl BIO_f_base64 BIO_free BIO_free_all BIO_new BIO_new_file BIO_new_mem_buf BIO_push BIO_read BIO_s_mem BIO_test_flags BIO_write BN_bin2bn BN_bn2dec BN_dup BN_free CRYPTO_free CRYPTO_get_ex_new_index CRYPTO_memcmp DES_check_key_parity DES_ecb_encrypt DES_is_weak_key DES_set_key_unchecked DES_set_odd_parity DH_free DH_size ECDSA_SIG_free ECDSA_SIG_new ECDSA_SIG_set0 ECDSA_size EC_GROUP_get_curve_name EC_KEY_METHOD_free EC_KEY_METHOD_new EC_KEY_METHOD_set_init EC_KEY_METHOD_set_sign EC_KEY_OpenSSL EC_KEY_dup EC_KEY_free EC_KEY_get0_group EC_KEY_get_ex_data EC_KEY_get_method EC_KEY_new_by_curve_name EC_KEY_set_ex_data EC_KEY_set_method EC_get_builtin_curves ENGINE_by_id ENGINE_ctrl_cmd_string ENGINE_finish ENGINE_free ENGINE_get_first ENGINE_get_id ENGINE_get_name ENGINE_get_next ENGINE_init ENGINE_load_builtin_engines ENGINE_load_private_key ENGINE_register_all_complete ENGINE_set_default ERR_clear_error ERR_error_string ERR_get_error ERR_load_strings ERR_peek_error ERR_put_error EVP_CIPHER_CTX_block_size EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_set_key_length EVP_CIPHER_block_size EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_CIPHER_nid EVP_CipherFinal EVP_CipherInit EVP_CipherInit_ex EVP_CipherUpdate EVP_Digest EVP_DigestFinal EVP_DigestInit EVP_DigestUpdate EVP_MD_CTX_free EVP_MD_CTX_md EVP_MD_CTX_new EVP_MD_CTX_reset EVP_MD_size EVP_MD_type EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_get0_pkey EVP_PKEY_assign EVP_PKEY_bits EVP_PKEY_free EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_id EVP_PKEY_meth_add0 EVP_PKEY_meth_copy EVP_PKEY_meth_find EVP_PKEY_meth_get_sign EVP_PKEY_meth_new EVP_PKEY_meth_set_sign EVP_PKEY_new EVP_get_cipherbyname EVP_get_digestbyname EVP_sha1 EVP_sha256 HMAC_CTX_free HMAC_CTX_new HMAC_CTX_reset HMAC_Final HMAC_Init_ex HMAC_Update HMAC_size OBJ_nid2sn OBJ_obj2nid OBJ_obj2txt OBJ_sn2nid OBJ_txt2nid OBJ_txt2obj OPENSSL_init_crypto OPENSSL_sk_delete OPENSSL_sk_find OPENSSL_sk_free OPENSSL_sk_new OPENSSL_sk_num OPENSSL_sk_pop_free OPENSSL_sk_push OPENSSL_sk_value OpenSSL_version PEM_X509_INFO_read_bio PEM_read_bio PEM_read_bio_DHparams PEM_read_bio_PrivateKey PEM_read_bio_X509 PEM_read_bio_X509_CRL PEM_write_X509 PEM_write_bio PKCS12_free PKCS12_parse RAND_bytes RSA_bits RSA_flags RSA_free RSA_get0_key RSA_get_method RSA_meth_free RSA_meth_get0_app_data RSA_meth_new RSA_meth_set0_app_data RSA_meth_set_finish RSA_meth_set_init RSA_meth_set_priv_dec RSA_meth_set_priv_enc RSA_meth_set_pub_dec RSA_meth_set_pub_enc RSA_new RSA_pkey_ctx_ctrl RSA_set0_key RSA_set_flags RSA_set_method RSA_size UI_create_method UI_destroy_method UI_get0_user_data UI_get_string_type UI_method_set_reader UI_set_result X509V3_EXT_print X509_CRL_free X509_INFO_free X509_LOOKUP_ctrl X509_LOOKUP_hash_dir X509_NAME_ENTRY_get_data X509_NAME_ENTRY_get_object X509_NAME_cmp X509_NAME_dup X509_NAME_entry_count X509_NAME_get_entry X509_NAME_get_index_by_NID X509_NAME_get_index_by_OBJ X509_NAME_print_ex X509_OBJECT_free X509_OBJECT_get_type X509_STORE_CTX_get_current_cert X509_STORE_CTX_get_error X509_STORE_CTX_get_error_depth X509_STORE_CTX_get_ex_data X509_STORE_add_cert X509_STORE_add_crl X509_STORE_add_lookup X509_STORE_get0_objects X509_STORE_set_flags X509_check_purpose X509_cmp_time X509_digest X509_free X509_get0_notAfter X509_get0_notBefore X509_get0_pubkey X509_get_ext X509_get_ext_by_NID X509_get_ext_d2i X509_get_pubkey X509_get_serialNumber X509_get_signature_nid X509_get_subject_name X509_verify_cert_error_string d2i_ECDSA_SIG d2i_PKCS12_bio d2i_PKCS12_fp d2i_X509 i2a_ASN1_INTEGER i2d_ECDSA_SIG

liblzo2-2

__lzo_init_v2 lzo1x_1_15_compress lzo1x_decompress_safe lzo_version_string

libpkcs11-helper-1

pkcs11h_addProvider pkcs11h_certificate_create pkcs11h_certificate_deserializeCertificateId pkcs11h_certificate_enumCertificateIds pkcs11h_certificate_freeCertificate pkcs11h_certificate_freeCertificateId pkcs11h_certificate_freeCertificateIdList pkcs11h_certificate_getCertificateBlob pkcs11h_certificate_serializeCertificateId pkcs11h_engine_setSystem pkcs11h_getMessage pkcs11h_initialize pkcs11h_logout pkcs11h_openssl_createSession pkcs11h_openssl_freeSession pkcs11h_openssl_getX509 pkcs11h_openssl_session_getEVP pkcs11h_openssl_session_getX509 pkcs11h_setForkMode pkcs11h_setLogHook pkcs11h_setLogLevel pkcs11h_setPINCachePeriod pkcs11h_setPINPromptHook pkcs11h_setProtectedAuthentication pkcs11h_setTokenPromptHook pkcs11h_terminate

libssl-1_1

BIO_f_ssl SSL_CIPHER_get_name SSL_CIPHER_get_version SSL_CTX_add_client_CA SSL_CTX_check_private_key SSL_CTX_ctrl SSL_CTX_free SSL_CTX_get0_certificate SSL_CTX_get_cert_store SSL_CTX_get_default_passwd_cb SSL_CTX_get_default_passwd_cb_userdata SSL_CTX_new SSL_CTX_set_cipher_list SSL_CTX_set_ciphersuites SSL_CTX_set_client_CA_list SSL_CTX_set_default_passwd_cb SSL_CTX_set_info_callback SSL_CTX_set_options SSL_CTX_set_security_level SSL_CTX_set_verify SSL_CTX_use_PrivateKey SSL_CTX_use_RSAPrivateKey SSL_CTX_use_certificate SSL_alert_desc_string_long SSL_alert_type_string_long SSL_export_keying_material SSL_free SSL_get1_supported_ciphers SSL_get_cipher_list SSL_get_current_cipher SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_peer_certificate SSL_get_version SSL_new SSL_set_accept_state SSL_set_bio SSL_set_connect_state SSL_set_ex_data SSL_state_string_long TLS_client_method TLS_method TLS_server_method

advapi32

CryptCreateHash CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptSetHashParam CryptSignHashA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW SetKernelObjectSecurity SetSecurityDescriptorDacl

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenStore CertVerifyTimeValidity CryptAcquireCertificatePrivateKey

fwpuclnt

FwpmEngineClose0 FwpmEngineOpen0 FwpmFilterAdd0 FwpmFreeMemory0 FwpmGetAppIdFromFileName0 FwpmSubLayerAdd0 FwpmSubLayerGetByKey0

iphlpapi

AddIPAddress ConvertInterfaceIndexToLuid CreateIpForwardEntry DeleteIPAddress DeleteIpForwardEntry FlushIpNetTable GetAdapterIndex GetAdaptersInfo GetBestInterfaceEx GetBestRoute2 GetInterfaceInfo GetIpForwardTable GetIpInterfaceEntry GetPerAdapterInfo InitializeIpInterfaceEntry IpReleaseAddress IpRenewAddress SetIpInterfaceEntry

kernel32

CancelIo CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateProcessA CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FormatMessageA FormatMessageW FreeLibrary GetConsoleMode GetConsoleTitleA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileType GetLastError GetModuleFileNameA GetModuleFileNameW GetNumberOfConsoleInputEvents GetOverlappedResult GetProcAddress GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeZoneInformation InitializeCriticalSection IsWow64Process LeaveCriticalSection LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar QueryPerformanceCounter ReadConsoleInputA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetConsoleTitleA SetEvent SetFilePointer SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleInputA WriteFile

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _atoi64 _cexit _chsize _dup2 _errno _exit _fdopen _fmode _initterm _iob _lock _onexit _open_osfhandle _snwprintf time localtime _stricmp _strnicmp _unlock calloc exit fclose feof fflush fgetc fgets fopen fprintf fputc fread free fwprintf fwrite isalnum isalpha iscntrl isprint ispunct isspace isxdigit malloc mbstowcs memcmp memcpy memmove memset printf putchar puts qsort raise rand realloc setlocale signal srand sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strstr strtok strtoul _vsnprintf _vsnwprintf _waccess _wchdir _wcmdln _wfopen _wopen abort tolower toupper vfprintf wcscmp wcscpy wcstombs atoi _wstat _write _strdup _read _open _lseek _dup2 _dup _close

ncrypt

NCryptFreeObject NCryptSignHash

setupapi

CM_Get_Device_Interface_ListA CM_Get_Device_Interface_List_SizeA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsExA SetupDiGetDeviceInstanceIdA SetupDiOpenDevRegKey

user32

MessageBoxW

ws2_32

WSACleanup WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSAStartup WSAWaitForMultipleEvents accept bind closesocket connect freeaddrinfo getaddrinfo getnameinfo getservbyname getsockname getsockopt htonl htons inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv select send setsockopt socket

Name

.text

Size

791KB

Virtual Size

791KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

ovpn/openvpn_down.bat

SHA256 6cab17fee12d3a2c43eb4d7c3a790cdbd7fc9afc6b0c6d60dbbb61594f6cec74
MD5 08bae2de82fa4fb579f707376d440056
SHA1 33eaaac6f01f017affb58b68636cffa6ce30b157
SHA512 67bfb8a995eb12b5f995860472a0817279ff2acdbdc19e7ee38a0a91eaec67a870dfc56ce39cf4bb5d29c227809cb35b16635d1fe1c0bbc64429079e5aada6f0
MD5 SHA1 SHA512

NSIS installer

installer

ovpn/openvpn_up.bat

SHA256 6ed4c6d1ba69e5aad84434e40f97c39432be10b903652860f8f16d7861ea79d6
MD5 cd4d223acddbd08101a159b17022324b
SHA1 510979a24584898281d7190c9981a1f7aa5b09ca
SHA512 8516ff62ecf818db7f794d66a2c479ea549444ed718f519b297a0723d78e191466d8f889f4f544a3e3324d6ce9002ceaa3d119b2a5fb63dcb8a2fd324110e1c7
MD5 SHA1 SHA512

NSIS installer

installer

protected_elam/amd64/protected_elam.sys

IMPHASH 293190b331b17091579cb7083407b852
SHA256 119bb976356fac1cc0b81e2cdc8d1135c1f57c1d06b631a1814796e1601c2bbc
MD5 e9806e894443f95671064755f9663a18
SHA1 ee77dcdeda8f1c8f81dee89ae3924c1ef5d6c69b
SHA512 7a52c467cbcf80ec10e8e4656bf57198a9ee4b28971120ac4d47de3f3b20a5acd4199366d7ebe6920c9b4232768c000a9bae66905313016037f46a64f62f0cbb
SSDEEP 192:DGCPcD0vWi7GszmVY84WVDi5f/VWQ4WWtd7JAh+Il+jX01k9z3Aalf3N:DGUcDfLVYIs/aN8EjR9zl53N
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

74:f7:c4:71:c8:92:7d:e6:bd:26:cb:cf:84:08:8e:28:e3:4b:db:b9:00:a0:19:de:45:d2:13:8c:b2:52:3b:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

10

Entry point

4272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\protected_elam\protected_elam\x64\Release\protected_elam.pdb

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

654B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

protected_elam/x86/protected_elam.sys

IMPHASH 293190b331b17091579cb7083407b852
SHA256 0b0d0898257846c320f7ddf30771126bbdf9edc7f9afbe1fb3d4f0925680215b
MD5 cf833a28b40ab93655f342a9d760d224
SHA1 d03ec91202f85970e4a24124bca36d7b4e262a16
SHA512 3332f2eb60a422124628c749ba43a140ae6bc8c753019ba78edbbf0a390efcccefa15f3eaa192e7bb5b2d3195cf58def64bae42a844f5fbbde741d3c465a5e3a
SSDEEP 384:fV/MVnhyp3DiyZbV0VYjt4s/GpQtR9zusP3:fVbVbGeRMQP9zuG
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c2:f5:4e:ab:a7:b4:7b:9e:e5:08:30:7d:1c:8b:69:fc:6c:06:59:c1:76:bb:13:90:25:18:4b:d2:29:d4:f9:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

10

Entry point

4256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\protected_elam\protected_elam\Release\protected_elam.pdb

Name

.text

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

908B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1024B

Virtual Size

526B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pwm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 58ea66beb9fd07738a6a05622e04cc14bdea6e2d7628c3ef52e9960ff254ceba
MD5 885a2706ad5cd98c637a9d02a6712d56
SHA1 7bbe52a527efc084516c512372c8102749bd3746
SHA512 f966d711ffca055354ee68116032d818ce857237c7c27d92ddbb5f5a6a4b8dc3d17637e22532e524dcc72a428aeb60ca534150f41648e59c842a804b89790d63
SSDEEP 768:0ymFTYwH+5FUraxpcn0CLRGgFxZZjQZ9XIjFDqrdtUn5k:mH+5FUrfbAojQZ9XIjRqrjWe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

37166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

securityservice.cat

SHA256 17da88c29be86ba54c810ec0afdcfe9584a648e24745fdd3c049791959c47cdd
MD5 f7d1d228beafd2473fe5d039b0b5a8c2
SHA1 e9855109124b96c781c68e4fadfc4a658db7c305
SHA512 2a7c81444c9a80670674a8d22e8aca5e516241168fde9653977f3d9dbbda48c3cb4165b94cbccdf6012c9c28d00abb47d523b785fee35b9f98fbbf4fe18aba29
SSDEEP 24576:uoV5o//555/dbwUQaAsoAMC4Yt1t6n+CSbDO8xF8IUs4D+Q8CRFc25MusMT:bzu5wNCJ100BxO8CRFcQL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

sni.dll

IMPHASH 00f5001ebf137746556043a7c9155eca
SHA256 1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c
MD5 c62a83f20bc23aeface70ec13003c4c5
SHA1 35553cfcdcbeccdc49710e68aec495c16880f0bd
SHA512 4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37
SSDEEP 3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

be:e0:1f:b9:15:bc:e5:77:a2:a0:e3:dd:41:4e:59:93:c8:28:3b:1c:91:bd:9d:1c:42:fa:96:2c:4e:9a:f0:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

a4:da:98:d6:cc:38:31:14:3a:60:44:18:10:f5:a7:26:00:cf:81:f1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 12, 2017

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2016 - Feb 17, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

6

Entry point

70512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\A\_work\410\s\bin\obj\Windows_NT.x86.Release\Native\sni\Release\sni.pdb

kernel32

SetEvent CreateSemaphoreA SetLastError GetQueuedCompletionStatus Sleep FileTimeToSystemTime GetSystemDirectoryA CreateThread SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime InitializeSListHead CreateIoCompletionPort GetComputerNameA TlsSetValue FormatMessageW TlsAlloc WaitForMultipleObjects TlsFree SetHandleInformation LoadLibraryExW InitializeCriticalSectionAndSpinCount ReleaseSemaphore MultiByteToWideChar GetComputerNameExA WideCharToMultiByte CompareStringA LCMapStringA SetFileCompletionNotificationModes GetTickCount GetOverlappedResult CreateFileA DisconnectNamedPipe WaitForSingleObject PeekNamedPipe WriteFile GetCurrentProcess WaitNamedPipeA SetNamedPipeHandleState ReadFile QueryDepthSList InterlockedPopEntrySList CreateEventA InterlockedPushEntrySList RtlUnwind RaiseException IsDebuggerPresent GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter EncodePointer IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeLibrary DeleteCriticalSection GetProcAddress CloseHandle LoadLibraryA InterlockedFlushSList GetLastError PostQueuedCompletionStatus InitializeCriticalSection LeaveCriticalSection TlsGetValue EnterCriticalSection

user32

CharNextExA

advapi32

RegCloseKey ImpersonateNamedPipeClient CryptDestroyKey CryptReleaseContext IsTokenRestricted RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumKeyExA RevertToSelf

rpcrt4

UuidCreate

ws2_32

WSAIoctl WSASend getpeername getsockname ntohs shutdown bind WSARecv WSAPoll getnameinfo WSACleanup __WSAFDIsSet closesocket select WSAEnumProtocolsW connect WSAGetLastError setsockopt sendto freeaddrinfo htons htonl socket WSAStartup getaddrinfo WSAStringToAddressW recv

api-ms-win-crt-string-l1-1-0

_wcsnicmp _stricmp strcpy_s strncmp _stricmp_l wcsncpy_s _strnicmp_l

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

_atoi_l atoi

api-ms-win-crt-multibyte-l1-1-0

_mbsnbicmp_l _mbschr _mbsspn

api-ms-win-crt-runtime-l1-1-0

_cexit abort _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment terminate _invalid_parameter_noinfo _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _errno

api-ms-win-crt-heap-l1-1-0

_calloc_base _callnewh free malloc _free_base

ucrtbase.dll

IMPHASH e97d8949b62ac66aa0d4cfccf17c8a2e
SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
MD5 6343ff7874ba03f78bb0dfe20b45f817
SHA1 82221a9ac1c1b8006f3f5e8539e74e3308f10bcb
SHA512 63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994
SSDEEP 24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

30:aa:01:6d:b0:35:c9:61:c8:d9:c3:fe:74:38:8e:42:06:ff:c6:fb:86:9d:17:2d:bb:49:99:de:0f:db:71:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

PE Signature issue

Digest

7e:11:3c:29:b8:de:a4:9c:00:ae:7e:79:e2:be:8d:21:f4:00:84:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 20, 2018

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2017 - Sep 12, 2018

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Minor OS version

0

Major OS version

10

Entry point

196768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ucrtbase.pdb

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter SetErrorMode RaiseException GetLastError SetLastError

api-ms-win-core-heap-l1-1-0

HeapSize HeapAlloc HeapCompact HeapValidate HeapReAlloc HeapQueryInformation GetProcessHeap HeapWalk HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread GetCurrentProcess TlsAlloc TerminateProcess TlsSetValue GetCurrentThreadId TlsGetValue ExitProcess TlsFree GetCurrentProcessId GetExitCodeProcess ResumeThread ExitThread CreateThread CreateProcessW GetStartupInfoW

api-ms-win-core-file-l1-1-0

WriteFile GetDiskFreeSpaceW GetLogicalDrives SetFileTime SetFilePointerEx LockFileEx UnlockFileEx FlushFileBuffers SetEndOfFile DeleteFileW RemoveDirectoryW CreateDirectoryW SetFileAttributesW GetFileAttributesExW GetDriveTypeW GetFileInformationByHandle GetFullPathNameW FindFirstFileExW CreateFileW FindNextFileW ReadFile GetFileType FindClose

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW FreeLibrary GetModuleHandleExW GetModuleFileNameW GetProcAddress LoadLibraryExW FreeLibraryAndExitThread

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionAndSpinCount

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW GetStdHandle GetCommandLineA FreeEnvironmentStringsW SetCurrentDirectoryW SetEnvironmentVariableW GetCommandLineW GetCurrentDirectoryW SetStdHandle

api-ms-win-core-string-l1-1-0

MultiByteToWideChar GetStringTypeW CompareStringW WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID GetCPInfo GetACP IsValidCodePage GetLocaleInfoW LCMapStringW EnumSystemLocalesW IsValidLocale GetOEMCP

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetLocalTime SetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

ReadConsoleInputW SetConsoleCtrlHandler WriteConsoleW GetConsoleCP SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleW PeekConsoleInputA GetConsoleMode

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation FileTimeToSystemTime TzSpecificLocalTimeToSystemTime

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualQuery VirtualProtect

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer Beep

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList InterlockedPushEntrySList

_CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _Cbuild _Cmulcc _Cmulcr _CreateFrameInfo _CxxThrowException _EH_prolog _Exit _FCbuild _FCmulcc _FCmulcr _FindAndUnlinkFrame _Getdays _Getmonths _Gettnames _IsExceptionObjectToBeDestroyed _LCbuild _LCmulcc _LCmulcr _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback _Strftime _W_Getdays _W_Getmonths _W_Gettnames _Wcsftime __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func ___mb_cur_max_func ___mb_cur_max_l_func __acrt_iob_func __conio_common_vcprintf __conio_common_vcprintf_p __conio_common_vcprintf_s __conio_common_vcscanf __conio_common_vcwprintf __conio_common_vcwprintf_p __conio_common_vcwprintf_s __conio_common_vcwscanf __control87_2 __current_exception __current_exception_context __daylight __dcrt_get_wide_environment_from_os __dcrt_initial_narrow_environment __doserrno __dstbias __fpe_flt_rounds __fpecode __initialize_lconv_for_unsigned_char __intrinsic_abnormal_termination __intrinsic_setjmp __isascii __iscsym __iscsymf __iswcsym __iswcsymf __libm_sse2_acos __libm_sse2_acosf __libm_sse2_asin __libm_sse2_asinf __libm_sse2_atan __libm_sse2_atan2 __libm_sse2_atanf __libm_sse2_cos __libm_sse2_cosf __libm_sse2_exp __libm_sse2_expf __libm_sse2_log __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_logf __libm_sse2_pow __libm_sse2_powf __libm_sse2_sin __libm_sse2_sinf __libm_sse2_tan __libm_sse2_tanf __p___argc __p___argv __p___wargv __p__acmdln __p__commode __p__environ __p__fmode __p__mbcasemap __p__mbctype __p__pgmptr __p__wcmdln __p__wenviron __p__wpgmptr __pctype_func __processing_throw __pwctype_func __pxcptinfoptrs __report_gsfailure __setusermatherr __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __stdio_common_vfprintf __stdio_common_vfprintf_p __stdio_common_vfprintf_s __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vfwprintf_p __stdio_common_vfwprintf_s __stdio_common_vfwscanf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_p __stdio_common_vswprintf_s __stdio_common_vswscanf __strncnt __sys_errlist __sys_nerr __threadhandle __threadid __timezone __toascii __tzname __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __wcserror __wcserror_s __wcsncnt _abs64 _access _access_s _aligned_free _aligned_malloc _aligned_msize _aligned_offset_malloc _aligned_offset_realloc _aligned_offset_recalloc _aligned_realloc _aligned_recalloc _assert _atodbl _atodbl_l _atof_l _atoflt _atoflt_l _atoi64 _atoi64_l _atoi_l _atol_l _atoldbl _atoldbl_l _atoll_l _beep _beginthread _beginthreadex _byteswap_uint64 _byteswap_ulong _byteswap_ushort _c_exit _cabs _callnewh _calloc_base _cexit _cgets _cgets_s _cgetws _cgetws_s _chdir _chdrive _chgsign _chgsignf _chkesp _chmod _chsize _chsize_s _clearfp _close _commit _configthreadlocale _configure_narrow_argv _configure_wide_argv _control87 _controlfp _controlfp_s _copysign _copysignf _cputs _cputws _creat _create_locale _crt_at_quick_exit _crt_atexit _crt_debugger_hook _ctime32 _ctime32_s _ctime64 _ctime64_s _cwait _d_int _dclass _dexp _difftime32 _difftime64 _dlog _dnorm _dpcomp _dpoly _dscale _dsign _dsin _dtest _dunscale _dup _dup2 _dupenv_s _ecvt _ecvt_s _endthread _endthreadex _eof _errno _except1 _except_handler2 _except_handler3 _except_handler4_common _execl _execle _execlp _execlpe _execute_onexit_table _execv _execve _execvp _execvpe _exit _expand _fclose_nolock _fcloseall _fcvt _fcvt_s _fd_int _fdclass _fdexp _fdlog _fdnorm _fdopen _fdpcomp _fdpoly _fdscale _fdsign _fdsin _fdtest _fdunscale _fflush_nolock _fgetc_nolock _fgetchar _fgetwc_nolock _fgetwchar _filelength _filelengthi64 _fileno _findclose _findfirst32 _findfirst32i64 _findfirst64 _findfirst64i32 _findnext32 _findnext32i64 _findnext64 _findnext64i32 _finite _flushall _fpclass _fpieee_flt _fpreset _fputc_nolock _fputchar _fputwc_nolock _fputwchar _fread_nolock _fread_nolock_s _free_base _free_locale _fseek_nolock _fseeki64 _fseeki64_nolock _fsopen _fstat32 _fstat32i64 _fstat64 _fstat64i32 _ftell_nolock _ftelli64 _ftelli64_nolock _ftime32 _ftime32_s _ftime64 _ftime64_s _ftol _fullpath _futime32 _futime64 _fwrite_nolock _gcvt _gcvt_s _get_current_locale _get_daylight _get_doserrno _get_dstbias _get_errno _get_fmode _get_heap_handle _get_initial_narrow_environment _get_initial_wide_environment _get_invalid_parameter_handler _get_narrow_winmain_command_line _get_osfhandle _get_pgmptr _get_printf_count_output _get_purecall_handler _get_stream_buffer_pointers _get_terminate _get_thread_local_invalid_parameter_handler _get_timezone _get_tzname _get_unexpected _get_wide_winmain_command_line _get_wpgmptr _getc_nolock _getch _getch_nolock _getche _getche_nolock _getcwd _getdcwd _getdiskfree _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwc_nolock _getwch _getwch_nolock _getwche _getwche_nolock _getws _getws_s _global_unwind2 _gmtime32 _gmtime32_s _gmtime64 _gmtime64_s _heapchk _heapmin _heapwalk _hypot _hypotf _i64toa _i64toa_s _i64tow _i64tow_s _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _invoke_watson _is_exception_typeof _isalnum_l _isalpha_l _isatty _isblank_l _iscntrl_l _isctype _isctype_l _isdigit_l _isgraph_l _isleadbyte_l _islower_l _ismbbalnum _ismbbalnum_l _ismbbalpha _ismbbalpha_l _ismbbblank _ismbbblank_l _ismbbgraph _ismbbgraph_l _ismbbkalnum _ismbbkalnum_l _ismbbkana _ismbbkana_l _ismbbkprint _ismbbkprint_l _ismbbkpunct _ismbbkpunct_l _ismbblead _ismbblead_l _ismbbprint _ismbbprint_l _ismbbpunct _ismbbpunct_l _ismbbtrail _ismbbtrail_l _ismbcalnum _ismbcalnum_l _ismbcalpha _ismbcalpha_l _ismbcblank _ismbcblank_l _ismbcdigit _ismbcdigit_l _ismbcgraph _ismbcgraph_l _ismbchira _ismbchira_l _ismbckata _ismbckata_l _ismbcl0 _ismbcl0_l _ismbcl1 _ismbcl1_l _ismbcl2 _ismbcl2_l _ismbclegal _ismbclegal_l _ismbclower _ismbclower_l _ismbcprint _ismbcprint_l _ismbcpunct _ismbcpunct_l _ismbcspace _ismbcspace_l _ismbcsymbol _ismbcsymbol_l _ismbcupper _ismbcupper_l _ismbslead _ismbslead_l _ismbstrail _ismbstrail_l _isnan _isprint_l _ispunct_l _isspace_l _isupper_l _iswalnum_l _iswalpha_l _iswblank_l _iswcntrl_l _iswcsym_l _iswcsymf_l _iswctype_l _iswdigit_l _iswgraph_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _isxdigit_l _itoa _itoa_s _itow _itow_s _j0 _j1 _jn _kbhit _ld_int _ldclass _ldexp _ldlog _ldpcomp _ldpoly _ldscale _ldsign _ldsin _ldtest _ldunscale _lfind _lfind_s _libm_sse2_acos_precise _libm_sse2_asin_precise _libm_sse2_atan_precise _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_log10_precise _libm_sse2_log_precise _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise _libm_sse2_tan_precise _loaddll _local_unwind2 _local_unwind4 _localtime32 _localtime32_s _localtime64 _localtime64_s _lock_file _lock_locales _locking _logb _longjmpex _lrotl _lrotr _lsearch _lsearch_s _lseek _lseeki64 _ltoa _ltoa_s _ltow _ltow_s _makepath _makepath_s _malloc_base _mbbtombc _mbbtombc_l _mbbtype _mbbtype_l _mbcasemap _mbccpy _mbccpy_l _mbccpy_s _mbccpy_s_l _mbcjistojms _mbcjistojms_l _mbcjmstojis _mbcjmstojis_l _mbclen _mbclen_l _mbctohira _mbctohira_l _mbctokata _mbctokata_l _mbctolower _mbctolower_l _mbctombb _mbctombb_l _mbctoupper _mbctoupper_l _mblen_l _mbsbtype _mbsbtype_l _mbscat_s _mbscat_s_l _mbschr _mbschr_l _mbscmp _mbscmp_l _mbscoll _mbscoll_l _mbscpy_s _mbscpy_s_l _mbscspn _mbscspn_l _mbsdec _mbsdec_l _mbsdup _mbsicmp _mbsicmp_l _mbsicoll _mbsicoll_l _mbsinc _mbsinc_l _mbslen _mbslen_l _mbslwr _mbslwr_l _mbslwr_s _mbslwr_s_l _mbsnbcat _mbsnbcat_l _mbsnbcat_s _mbsnbcat_s_l _mbsnbcmp _mbsnbcmp_l _mbsnbcnt _mbsnbcnt_l _mbsnbcoll _mbsnbcoll_l _mbsnbcpy _mbsnbcpy_l _mbsnbcpy_s _mbsnbcpy_s_l _mbsnbicmp _mbsnbicmp_l _mbsnbicoll _mbsnbicoll_l _mbsnbset _mbsnbset_l _mbsnbset_s _mbsnbset_s_l _mbsncat _mbsncat_l _mbsncat_s _mbsncat_s_l _mbsnccnt _mbsnccnt_l _mbsncmp _mbsncmp_l _mbsncoll _mbsncoll_l _mbsncpy _mbsncpy_l _mbsncpy_s _mbsncpy_s_l _mbsnextc _mbsnextc_l _mbsnicmp _mbsnicmp_l _mbsnicoll _mbsnicoll_l _mbsninc _mbsninc_l _mbsnlen _mbsnlen_l _mbsnset _mbsnset_l _mbsnset_s _mbsnset_s_l _mbspbrk _mbspbrk_l _mbsrchr _mbsrchr_l _mbsrev _mbsrev_l _mbsset _mbsset_l _mbsset_s _mbsset_s_l _mbsspn _mbsspn_l _mbsspnp _mbsspnp_l _mbsstr _mbsstr_l _mbstok _mbstok_l _mbstok_s _mbstok_s_l _mbstowcs_l _mbstowcs_s_l _mbstrlen _mbstrlen_l _mbstrnlen _mbstrnlen_l _mbsupr _mbsupr_l _mbsupr_s _mbsupr_s_l _mbtowc_l _memccpy _memicmp _memicmp_l _mkdir _mkgmtime32 _mkgmtime64 _mktemp _mktemp_s _mktime32 _mktime64 _msize _nextafter _o__CIacos _o__CIasin _o__CIatan _o__CIatan2 _o__CIcos _o__CIcosh _o__CIexp _o__CIfmod _o__CIlog _o__CIlog10 _o__CIpow _o__CIsin _o__CIsinh _o__CIsqrt _o__CItan _o__CItanh _o__Getdays _o__Getmonths _o__Gettnames _o__Strftime _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__Wcsftime _o____lc_codepage_func _o____lc_collate_cp_func _o____lc_locale_name_func _o____mb_cur_max_func _o___acrt_iob_func _o___conio_common_vcprintf _o___conio_common_vcprintf_p _o___conio_common_vcprintf_s _o___conio_common_vcscanf _o___conio_common_vcwprintf _o___conio_common_vcwprintf_p _o___conio_common_vcwprintf_s _o___conio_common_vcwscanf _o___daylight _o___dstbias _o___fpe_flt_rounds _o___libm_sse2_acos _o___libm_sse2_acosf _o___libm_sse2_asin _o___libm_sse2_asinf _o___libm_sse2_atan _o___libm_sse2_atan2 _o___libm_sse2_atanf _o___libm_sse2_cos _o___libm_sse2_cosf _o___libm_sse2_exp _o___libm_sse2_expf _o___libm_sse2_log _o___libm_sse2_log10 _o___libm_sse2_log10f _o___libm_sse2_logf _o___libm_sse2_pow _o___libm_sse2_powf _o___libm_sse2_sin _o___libm_sse2_sinf _o___libm_sse2_tan _o___libm_sse2_tanf _o___p___argc _o___p___argv _o___p___wargv _o___p__acmdln _o___p__commode _o___p__environ _o___p__fmode _o___p__mbcasemap _o___p__mbctype _o___p__pgmptr _o___p__wcmdln _o___p__wenviron _o___p__wpgmptr _o___pctype_func _o___pwctype_func _o___std_exception_copy _o___std_exception_destroy _o___std_type_info_destroy_list _o___std_type_info_name _o___stdio_common_vfprintf _o___stdio_common_vfprintf_p _o___stdio_common_vfprintf_s _o___stdio_common_vfscanf _o___stdio_common_vfwprintf _o___stdio_common_vfwprintf_p _o___stdio_common_vfwprintf_s _o___stdio_common_vfwscanf _o___stdio_common_vsnprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsprintf _o___stdio_common_vsprintf_p _o___stdio_common_vsprintf_s _o___stdio_common_vsscanf _o___stdio_common_vswprintf _o___stdio_common_vswprintf_p _o___stdio_common_vswprintf_s _o___stdio_common_vswscanf _o___timezone _o___tzname _o___wcserror _o__access _o__access_s _o__aligned_free _o__aligned_malloc _o__aligned_msize _o__aligned_offset_malloc _o__aligned_offset_realloc _o__aligned_offset_recalloc _o__aligned_realloc _o__aligned_recalloc _o__atodbl _o__atodbl_l _o__atof_l _o__atoflt _o__atoflt_l _o__atoi64 _o__atoi64_l _o__atoi_l _o__atol_l _o__atoldbl _o__atoldbl_l _o__atoll_l _o__beep _o__beginthread _o__beginthreadex _o__cabs _o__callnewh _o__calloc_base _o__cexit _o__cgets _o__cgets_s _o__cgetws _o__cgetws_s _o__chdir _o__chdrive _o__chmod _o__chsize _o__chsize_s _o__close _o__commit _o__configthreadlocale _o__configure_narrow_argv _o__configure_wide_argv _o__controlfp_s _o__cputs _o__cputws _o__creat _o__create_locale _o__crt_atexit _o__ctime32_s _o__ctime64_s _o__cwait _o__d_int _o__dclass _o__difftime32 _o__difftime64 _o__dlog _o__dnorm _o__dpcomp _o__dpoly _o__dscale _o__dsign _o__dsin _o__dtest _o__dunscale _o__dup _o__dup2 _o__dupenv_s _o__ecvt _o__ecvt_s _o__endthread _o__endthreadex _o__eof _o__errno _o__except1 _o__execute_onexit_table _o__execv _o__execve _o__execvp _o__execvpe _o__exit _o__expand _o__fclose_nolock _o__fcloseall _o__fcvt _o__fcvt_s _o__fd_int _o__fdclass _o__fdexp _o__fdlog _o__fdopen _o__fdpcomp _o__fdpoly _o__fdscale _o__fdsign _o__fdsin _o__fflush_nolock _o__fgetc_nolock _o__fgetchar _o__fgetwc_nolock _o__fgetwchar _o__filelength _o__filelengthi64 _o__fileno _o__findclose _o__findfirst32 _o__findfirst32i64 _o__findfirst64 _o__findfirst64i32 _o__findnext32 _o__findnext32i64 _o__findnext64 _o__findnext64i32 _o__flushall _o__fpclass _o__fputc_nolock _o__fputchar _o__fputwc_nolock _o__fputwchar _o__fread_nolock _o__fread_nolock_s _o__free_base _o__free_locale _o__fseek_nolock _o__fseeki64 _o__fseeki64_nolock _o__fsopen _o__fstat32 _o__fstat32i64 _o__fstat64 _o__fstat64i32 _o__ftell_nolock _o__ftelli64 _o__ftelli64_nolock _o__ftime32 _o__ftime32_s _o__ftime64 _o__ftime64_s _o__fullpath _o__futime32 _o__futime64 _o__fwrite_nolock _o__gcvt _o__gcvt_s _o__get_daylight _o__get_doserrno _o__get_dstbias _o__get_errno _o__get_fmode _o__get_heap_handle _o__get_initial_narrow_environment _o__get_initial_wide_environment _o__get_invalid_parameter_handler _o__get_narrow_winmain_command_line _o__get_osfhandle _o__get_pgmptr _o__get_stream_buffer_pointers _o__get_terminate _o__get_thread_local_invalid_parameter_handler _o__get_timezone _o__get_tzname _o__get_wide_winmain_command_line _o__get_wpgmptr _o__getc_nolock _o__getch _o__getch_nolock _o__getche _o__getche_nolock _o__getcwd _o__getdcwd _o__getdiskfree _o__getdllprocaddr _o__getdrive _o__getdrives _o__getmbcp _o__getsystime _o__getw _o__getwc_nolock _o__getwch _o__getwch_nolock _o__getwche _o__getwche_nolock _o__getws _o__getws_s _o__gmtime32 _o__gmtime32_s _o__gmtime64 _o__gmtime64_s _o__heapchk _o__heapmin _o__hypot _o__hypotf _o__i64toa _o__i64toa_s _o__i64tow _o__i64tow_s _o__initialize_narrow_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__isatty _o__isctype _o__isctype_l _o__isleadbyte_l _o__ismbbalnum _o__ismbbalnum_l _o__ismbbalpha _o__ismbbalpha_l _o__ismbbblank _o__ismbbblank_l _o__ismbbgraph _o__ismbbgraph_l _o__ismbbkalnum _o__ismbbkalnum_l _o__ismbbkana _o__ismbbkana_l _o__ismbbkprint _o__ismbbkprint_l _o__ismbbkpunct _o__ismbbkpunct_l _o__ismbblead _o__ismbblead_l _o__ismbbprint _o__ismbbprint_l _o__ismbbpunct _o__ismbbpunct_l _o__ismbbtrail _o__ismbbtrail_l _o__ismbcalnum _o__ismbcalnum_l _o__ismbcalpha _o__ismbcalpha_l _o__ismbcblank _o__ismbcblank_l _o__ismbcdigit _o__ismbcdigit_l _o__ismbcgraph _o__ismbcgraph_l _o__ismbchira _o__ismbchira_l _o__ismbckata _o__ismbckata_l _o__ismbcl0 _o__ismbcl0_l _o__ismbcl1 _o__ismbcl1_l _o__ismbcl2 _o__ismbcl2_l _o__ismbclegal _o__ismbclegal_l _o__ismbclower _o__ismbclower_l _o__ismbcprint _o__ismbcprint_l _o__ismbcpunct _o__ismbcpunct_l _o__ismbcspace _o__ismbcspace_l _o__ismbcsymbol _o__ismbcsymbol_l _o__ismbcupper _o__ismbcupper_l _o__ismbslead _o__ismbslead_l _o__ismbstrail _o__ismbstrail_l _o__iswctype_l _o__itoa _o__itoa_s _o__itow _o__itow_s _o__j0 _o__j1 _o__jn _o__kbhit _o__ld_int _o__ldclass _o__ldexp _o__ldlog _o__ldpcomp _o__ldpoly _o__ldscale _o__ldsign _o__ldsin _o__ldtest _o__ldunscale _o__lfind _o__lfind_s _o__libm_sse2_acos_precise _o__libm_sse2_asin_precise _o__libm_sse2_atan_precise _o__libm_sse2_cos_precise _o__libm_sse2_exp_precise _o__libm_sse2_log10_precise _o__libm_sse2_log_precise _o__libm_sse2_pow_precise _o__libm_sse2_sin_precise _o__libm_sse2_sqrt_precise _o__libm_sse2_tan_precise _o__loaddll _o__localtime32 _o__localtime32_s _o__localtime64 _o__localtime64_s _o__lock_file _o__locking _o__logb _o__lsearch _o__lsearch_s _o__lseek _o__lseeki64 _o__ltoa _o__ltoa_s _o__ltow _o__ltow_s _o__makepath _o__makepath_s _o__malloc_base _o__mbbtombc _o__mbbtombc_l _o__mbbtype _o__mbbtype_l _o__mbccpy _o__mbccpy_l _o__mbccpy_s _o__mbccpy_s_l _o__mbcjistojms _o__mbcjistojms_l _o__mbcjmstojis _o__mbcjmstojis_l _o__mbclen _o__mbclen_l _o__mbctohira _o__mbctohira_l _o__mbctokata _o__mbctokata_l _o__mbctolower _o__mbctolower_l _o__mbctombb _o__mbctombb_l _o__mbctoupper _o__mbctoupper_l _o__mblen_l _o__mbsbtype _o__mbsbtype_l _o__mbscat_s _o__mbscat_s_l _o__mbschr _o__mbschr_l _o__mbscmp _o__mbscmp_l _o__mbscoll _o__mbscoll_l _o__mbscpy_s _o__mbscpy_s_l _o__mbscspn _o__mbscspn_l _o__mbsdec _o__mbsdec_l _o__mbsicmp _o__mbsicmp_l _o__mbsicoll _o__mbsicoll_l _o__mbsinc _o__mbsinc_l _o__mbslen _o__mbslen_l _o__mbslwr _o__mbslwr_l _o__mbslwr_s _o__mbslwr_s_l _o__mbsnbcat _o__mbsnbcat_l _o__mbsnbcat_s _o__mbsnbcat_s_l _o__mbsnbcmp _o__mbsnbcmp_l _o__mbsnbcnt _o__mbsnbcnt_l _o__mbsnbcoll _o__mbsnbcoll_l _o__mbsnbcpy _o__mbsnbcpy_l _o__mbsnbcpy_s _o__mbsnbcpy_s_l _o__mbsnbicmp _o__mbsnbicmp_l _o__mbsnbicoll _o__mbsnbicoll_l _o__mbsnbset _o__mbsnbset_l _o__mbsnbset_s _o__mbsnbset_s_l _o__mbsncat _o__mbsncat_l _o__mbsncat_s _o__mbsncat_s_l _o__mbsnccnt _o__mbsnccnt_l _o__mbsncmp _o__mbsncmp_l _o__mbsncoll _o__mbsncoll_l _o__mbsncpy _o__mbsncpy_l _o__mbsncpy_s _o__mbsncpy_s_l _o__mbsnextc _o__mbsnextc_l _o__mbsnicmp _o__mbsnicmp_l _o__mbsnicoll _o__mbsnicoll_l _o__mbsninc _o__mbsninc_l _o__mbsnlen _o__mbsnlen_l _o__mbsnset _o__mbsnset_l _o__mbsnset_s _o__mbsnset_s_l _o__mbspbrk _o__mbspbrk_l _o__mbsrchr _o__mbsrchr_l _o__mbsrev _o__mbsrev_l _o__mbsset _o__mbsset_l _o__mbsset_s _o__mbsset_s_l _o__mbsspn _o__mbsspn_l _o__mbsspnp _o__mbsspnp_l _o__mbsstr _o__mbsstr_l _o__mbstok _o__mbstok_l _o__mbstok_s _o__mbstok_s_l _o__mbstowcs_l _o__mbstowcs_s_l _o__mbstrlen _o__mbstrlen_l _o__mbstrnlen _o__mbstrnlen_l _o__mbsupr _o__mbsupr_l _o__mbsupr_s _o__mbsupr_s_l _o__mbtowc_l _o__memicmp _o__memicmp_l _o__mkdir _o__mkgmtime32 _o__mkgmtime64 _o__mktemp _o__mktemp_s _o__mktime32 _o__mktime64 _o__msize _o__nextafter _o__open_osfhandle _o__pclose _o__pipe _o__popen _o__purecall _o__putc_nolock _o__putch _o__putch_nolock _o__putenv _o__putenv_s _o__putw _o__putwc_nolock _o__putwch _o__putwch_nolock _o__putws _o__read _o__realloc_base _o__recalloc _o__register_onexit_function _o__resetstkoflw _o__rmdir _o__rmtmp _o__scalb _o__searchenv _o__searchenv_s _o__seh_filter_dll _o__seh_filter_exe _o__set_abort_behavior _o__set_app_type _o__set_doserrno _o__set_errno _o__set_fmode _o__set_invalid_parameter_handler _o__set_new_handler _o__set_new_mode _o__set_thread_local_invalid_parameter_handler _o__seterrormode _o__setmbcp _o__setmode _o__setsystime _o__sleep _o__sopen _o__sopen_dispatch _o__sopen_s _o__spawnv _o__spawnve _o__spawnvp _o__spawnvpe _o__splitpath _o__splitpath_s _o__stat32 _o__stat32i64 _o__stat64 _o__stat64i32 _o__strcoll_l _o__strdate _o__strdate_s _o__strdup _o__strerror _o__strerror_s _o__strftime_l _o__stricmp _o__stricmp_l _o__stricoll _o__stricoll_l _o__strlwr _o__strlwr_l _o__strlwr_s _o__strlwr_s_l _o__strncoll _o__strncoll_l _o__strnicmp _o__strnicmp_l _o__strnicoll _o__strnicoll_l _o__strnset_s _o__strset_s _o__strtime _o__strtime_s _o__strtod_l _o__strtof_l _o__strtoi64 _o__strtoi64_l _o__strtol_l _o__strtold_l _o__strtoll_l _o__strtoui64 _o__strtoui64_l _o__strtoul_l _o__strtoull_l _o__strupr _o__strupr_l _o__strupr_s _o__strupr_s_l _o__strxfrm_l _o__swab _o__tell _o__telli64 _o__timespec32_get _o__timespec64_get _o__tolower _o__tolower_l _o__toupper _o__toupper_l _o__towlower_l _o__towupper_l _o__tzset _o__ui64toa _o__ui64toa_s _o__ui64tow _o__ui64tow_s _o__ultoa _o__ultoa_s _o__ultow _o__ultow_s _o__umask _o__umask_s _o__ungetc_nolock _o__ungetch _o__ungetch_nolock _o__ungetwc_nolock _o__ungetwch _o__ungetwch_nolock _o__unlink _o__unloaddll _o__unlock_file _o__utime32 _o__utime64 _o__waccess _o__waccess_s _o__wasctime _o__wasctime_s _o__wchdir _o__wchmod _o__wcreat _o__wcreate_locale _o__wcscoll_l _o__wcsdup _o__wcserror _o__wcserror_s _o__wcsftime_l _o__wcsicmp _o__wcsicmp_l _o__wcsicoll _o__wcsicoll_l _o__wcslwr _o__wcslwr_l _o__wcslwr_s _o__wcslwr_s_l _o__wcsncoll _o__wcsncoll_l _o__wcsnicmp _o__wcsnicmp_l _o__wcsnicoll _o__wcsnicoll_l _o__wcsnset _o__wcsnset_s _o__wcsset _o__wcsset_s _o__wcstod_l _o__wcstof_l _o__wcstoi64 _o__wcstoi64_l _o__wcstol_l _o__wcstold_l _o__wcstoll_l _o__wcstombs_l _o__wcstombs_s_l _o__wcstoui64 _o__wcstoui64_l _o__wcstoul_l _o__wcstoull_l _o__wcsupr _o__wcsupr_l _o__wcsupr_s _o__wcsupr_s_l _o__wcsxfrm_l _o__wctime32 _o__wctime32_s _o__wctime64 _o__wctime64_s _o__wctomb_l _o__wctomb_s_l _o__wdupenv_s _o__wexecv _o__wexecve _o__wexecvp _o__wexecvpe _o__wfdopen _o__wfindfirst32 _o__wfindfirst32i64 _o__wfindfirst64 _o__wfindfirst64i32 _o__wfindnext32 _o__wfindnext32i64 _o__wfindnext64 _o__wfindnext64i32 _o__wfopen _o__wfopen_s _o__wfreopen _o__wfreopen_s _o__wfsopen _o__wfullpath _o__wgetcwd _o__wgetdcwd _o__wgetenv _o__wgetenv_s _o__wmakepath _o__wmakepath_s _o__wmkdir _o__wmktemp _o__wmktemp_s _o__wperror _o__wpopen _o__wputenv _o__wputenv_s _o__wremove _o__wrename _o__write _o__wrmdir _o__wsearchenv _o__wsearchenv_s _o__wsetlocale _o__wsopen_dispatch _o__wsopen_s _o__wspawnv _o__wspawnve _o__wspawnvp _o__wspawnvpe _o__wsplitpath _o__wsplitpath_s _o__wstat32 _o__wstat32i64 _o__wstat64 _o__wstat64i32 _o__wstrdate _o__wstrdate_s _o__wstrtime _o__wstrtime_s _o__wsystem _o__wtmpnam_s _o__wtof _o__wtof_l _o__wtoi _o__wtoi64 _o__wtoi64_l _o__wtoi_l _o__wtol _o__wtol_l _o__wtoll _o__wtoll_l _o__wunlink _o__wutime32 _o__wutime64 _o__y0 _o__y1 _o__yn _o_abort _o_acos _o_acosh _o_acoshf _o_acoshl _o_asctime _o_asctime_s _o_asin _o_asinh _o_asinhf _o_asinhl _o_atan _o_atan2 _o_atanh _o_atanhf _o_atanhl _o_atof _o_atoi _o_atol _o_atoll _o_bsearch _o_bsearch_s _o_btowc _o_calloc _o_cbrt _o_cbrtf _o_ceil _o_clearerr _o_clearerr_s _o_cos _o_cosh _o_erf _o_erfc _o_erfcf _o_erfcl _o_erff _o_erfl _o_exit _o_exp _o_exp2 _o_exp2f _o_exp2l _o_fabs _o_fclose _o_feof _o_ferror _o_fflush _o_fgetc _o_fgetpos _o_fgets _o_fgetwc _o_fgetws _o_floor _o_fma _o_fmaf _o_fmal _o_fmod _o_fopen _o_fopen_s _o_fputc _o_fputs _o_fputwc _o_fputws _o_fread _o_fread_s _o_free _o_freopen _o_freopen_s _o_frexp _o_fseek _o_fsetpos _o_ftell _o_fwrite _o_getc _o_getchar _o_getenv _o_getenv_s _o_gets _o_gets_s _o_getwc _o_getwchar _o_hypot _o_is_wctype _o_isalnum _o_isalpha _o_isblank _o_iscntrl _o_isdigit _o_isgraph _o_isleadbyte _o_islower _o_isprint _o_ispunct _o_isspace _o_isupper _o_iswalnum _o_iswalpha _o_iswascii _o_iswblank _o_iswcntrl _o_iswctype _o_iswdigit _o_iswgraph _o_iswlower _o_iswprint _o_iswpunct _o_iswspace _o_iswupper _o_iswxdigit _o_isxdigit _o_ldexp _o_lgamma _o_lgammaf _o_lgammal _o_llrint _o_llrintf _o_llrintl _o_llround _o_llroundf _o_llroundl _o_localeconv _o_log _o_log10 _o_log1p _o_log1pf _o_log1pl _o_log2 _o_log2f _o_log2l _o_logb _o_logbf _o_logbl _o_lrint _o_lrintf _o_lrintl _o_lround _o_lroundf _o_lroundl _o_malloc _o_mblen _o_mbrlen _o_mbrtoc16 _o_mbrtoc32 _o_mbrtowc _o_mbsrtowcs _o_mbsrtowcs_s _o_mbstowcs _o_mbstowcs_s _o_mbtowc _o_memcpy_s _o_memset _o_modf _o_nan _o_nanf _o_nanl _o_nearbyint _o_nearbyintf _o_nearbyintl _o_nextafter _o_nextafterf _o_nextafterl _o_nexttoward _o_nexttowardf _o_nexttowardl _o_pow _o_powf _o_putc _o_putchar _o_puts _o_putwc _o_putwchar _o_qsort _o_qsort_s _o_raise _o_rand _o_rand_s _o_realloc _o_remainder _o_remainderf _o_remainderl _o_remove _o_remquo _o_remquof _o_remquol _o_rename _o_rewind _o_rint _o_rintf _o_rintl _o_round _o_roundf _o_roundl _o_scalbln _o_scalblnf _o_scalblnl _o_scalbn _o_scalbnf _o_scalbnl _o_set_terminate _o_setbuf _o_setlocale _o_setvbuf _o_sin _o_sinh _o_sqrt _o_srand _o_strcat_s _o_strcoll _o_strcpy_s _o_strerror _o_strerror_s _o_strftime _o_strncat_s _o_strncpy_s _o_strtod _o_strtof _o_strtok _o_strtok_s _o_strtol _o_strtold _o_strtoll _o_strtoul _o_strtoull _o_system _o_tan _o_tanh _o_terminate _o_tgamma _o_tgammaf _o_tgammal _o_tmpfile_s _o_tmpnam_s _o_tolower _o_toupper _o_towlower _o_towupper _o_ungetc _o_ungetwc _o_wcrtomb _o_wcrtomb_s _o_wcscat_s _o_wcscoll _o_wcscpy _o_wcscpy_s _o_wcsftime _o_wcsncat_s _o_wcsncpy_s _o_wcsrtombs _o_wcsrtombs_s _o_wcstod _o_wcstof _o_wcstok _o_wcstok_s _o_wcstol _o_wcstold _o_wcstoll _o_wcstombs _o_wcstombs_s _o_wcstoul _o_wcstoull _o_wctob _o_wctomb _o_wctomb_s _o_wmemcpy_s _o_wmemmove_s _open _open_osfhandle _pclose _pipe _popen _purecall _putc_nolock _putch _putch_nolock _putenv _putenv_s _putw _putwc_nolock _putwch _putwch_nolock _putws _query_app_type _query_new_handler _query_new_mode _read _realloc_base _recalloc _register_onexit_function _register_thread_local_exe_atexit_callback _resetstkoflw _rmdir _rmtmp _rotl _rotl64 _rotr _rotr64 _scalb _searchenv _searchenv_s _seh_filter_dll _seh_filter_exe _seh_longjmp_unwind _seh_longjmp_unwind4 _set_SSE2_enable _set_abort_behavior _set_app_type _set_controlfp _set_doserrno _set_errno _set_error_mode _set_fmode _set_invalid_parameter_handler _set_new_handler _set_new_mode _set_printf_count_output _set_purecall_handler _set_se_translator _set_thread_local_invalid_parameter_handler _seterrormode _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _sopen _sopen_dispatch _sopen_s _spawnl _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _splitpath_s _stat32 _stat32i64 _stat64 _stat64i32 _statusfp _statusfp2 _strcoll_l _strdate _strdate_s _strdup _strerror _strerror_s _strftime_l _stricmp _stricmp_l _stricoll _stricoll_l _strlwr _strlwr_l _strlwr_s _strlwr_s_l _strncoll _strncoll_l _strnicmp _strnicmp_l _strnicoll _strnicoll_l _strnset _strnset_s _strrev _strset _strset_s _strtime _strtime_s _strtod_l _strtof_l _strtoi64 _strtoi64_l _strtoimax_l _strtol_l _strtold_l _strtoll_l _strtoui64 _strtoui64_l _strtoul_l _strtoull_l _strtoumax_l _strupr _strupr_l _strupr_s _strupr_s_l _strxfrm_l _swab _tell _telli64 _tempnam _time32 _time64 _timespec32_get _timespec64_get _tolower _tolower_l _toupper _toupper_l _towlower_l _towupper_l _tzset _ui64toa _ui64toa_s _ui64tow _ui64tow_s _ultoa _ultoa_s _ultow _ultow_s _umask _umask_s _ungetc_nolock _ungetch _ungetch_nolock _ungetwc_nolock _ungetwch _ungetwch_nolock _unlink _unloaddll _unlock_file _unlock_locales _utime32 _utime64 _waccess _waccess_s _wasctime _wasctime_s _wassert _wchdir _wchmod _wcreat _wcreate_locale _wcscoll_l _wcsdup _wcserror _wcserror_s _wcsftime_l _wcsicmp _wcsicmp_l _wcsicoll _wcsicoll_l _wcslwr _wcslwr_l _wcslwr_s _wcslwr_s_l _wcsncoll _wcsncoll_l _wcsnicmp _wcsnicmp_l _wcsnicoll _wcsnicoll_l _wcsnset _wcsnset_s _wcsrev _wcsset _wcsset_s _wcstod_l _wcstof_l _wcstoi64 _wcstoi64_l _wcstoimax_l _wcstol_l _wcstold_l _wcstoll_l _wcstombs_l _wcstombs_s_l _wcstoui64 _wcstoui64_l _wcstoul_l _wcstoull_l _wcstoumax_l _wcsupr _wcsupr_l _wcsupr_s _wcsupr_s_l _wcsxfrm_l _wctime32 _wctime32_s _wctime64 _wctime64_s _wctomb_l _wctomb_s_l _wctype _wdupenv_s _wexecl _wexecle _wexeclp _wexeclpe _wexecv _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst32 _wfindfirst32i64 _wfindfirst64 _wfindfirst64i32 _wfindnext32 _wfindnext32i64 _wfindnext64 _wfindnext64i32 _wfopen _wfopen_s _wfreopen _wfreopen_s _wfsopen _wfullpath _wgetcwd _wgetdcwd _wgetenv _wgetenv_s _wmakepath _wmakepath_s _wmkdir _wmktemp _wmktemp_s _wopen _wperror _wpopen _wputenv _wputenv_s _wremove _wrename _write _wrmdir _wsearchenv _wsearchenv_s _wsetlocale _wsopen _wsopen_dispatch _wsopen_s _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wsplitpath_s _wstat32 _wstat32i64 _wstat64 _wstat64i32 _wstrdate _wstrdate_s _wstrtime _wstrtime_s _wsystem _wtempnam _wtmpnam _wtmpnam_s _wtof _wtof_l _wtoi _wtoi64 _wtoi64_l _wtoi_l _wtol _wtol_l _wtoll _wtoll_l _wunlink _wutime32 _wutime64 _y0 _y1 _yn abort abs acos acosh acoshf acoshl asctime asctime_s asin asinh asinhf asinhl atan atan2 atanh atanhf atanhl atof atoi atol atoll bsearch bsearch_s btowc c16rtomb c32rtomb cabs cabsf cabsl cacos cacosf cacosh cacoshf cacoshl cacosl calloc carg cargf cargl casin casinf casinh casinhf casinhl casinl catan catanf catanh catanhf catanhl catanl cbrt cbrtf cbrtl ccos ccosf ccosh ccoshf ccoshl ccosl ceil cexp cexpf cexpl cimag cimagf cimagl clearerr clearerr_s clock clog clog10 clog10f clog10l clogf clogl conj conjf conjl copysign copysignf copysignl cos cosh cpow cpowf cpowl cproj cprojf cprojl creal crealf creall csin csinf csinh csinhf csinhl csinl csqrt csqrtf csqrtl ctan ctanf ctanh ctanhf ctanhl ctanl div erf erfc erfcf erfcl erff erfl exit exp exp2 exp2f exp2l expm1 expm1f expm1l fabs fclose fdim fdimf fdiml feclearexcept fegetenv fegetexceptflag fegetround feholdexcept feof ferror fesetenv fesetexceptflag fesetround fetestexcept fflush fgetc fgetpos fgets fgetwc fgetws floor fma fmaf fmal fmax fmaxf fmaxl fmin fminf fminl fmod fopen fopen_s fputc fputs fputwc fputws fread fread_s free freopen freopen_s frexp fseek fsetpos ftell fwrite getc getchar getenv getenv_s gets gets_s getwc getwchar hypot ilogb ilogbf ilogbl imaxabs imaxdiv is_wctype isalnum isalpha isblank iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswblank iswcntrl iswctype iswdigit iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv lgamma lgammaf lgammal llabs lldiv llrint llrintf llrintl llround llroundf llroundl localeconv log log10 log1p log1pf log1pl log2 log2f log2l logb logbf logbl longjmp lrint lrintf lrintl lround lroundf lroundl malloc mblen mbrlen mbrtoc16 mbrtoc32 mbrtowc mbsrtowcs mbsrtowcs_s mbstowcs mbstowcs_s mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset modf nan nanf nanl nearbyint nearbyintf nearbyintl nextafter nextafterf nextafterl nexttoward nexttowardf nexttowardl norm normf norml perror pow powf putc putchar puts putwc putwchar qsort qsort_s quick_exit raise rand rand_s realloc remainder remainderf remainderl remove remquo remquof remquol rename rewind rint rintf rintl round roundf roundl scalbln scalblnf scalblnl scalbn scalbnf scalbnl set_terminate set_unexpected setbuf setlocale setvbuf signal sin sinh sqrt srand strcat strcat_s strchr strcmp strcoll strcpy strcpy_s strcspn strerror strerror_s strftime strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strrchr strspn strstr strtod strtof strtoimax strtok strtok_s strtol strtold strtoll strtoul strtoull strtoumax strxfrm system tan tanh terminate tgamma tgammaf tgammal tmpfile tmpfile_s tmpnam tmpnam_s tolower toupper towctrans towlower towupper trunc truncf truncl unexpected ungetc ungetwc wcrtomb wcrtomb_s wcscat wcscat_s wcschr wcscmp wcscoll wcscpy wcscpy_s wcscspn wcsftime wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcspbrk wcsrchr wcsrtombs wcsrtombs_s wcsspn wcsstr wcstod wcstof wcstoimax wcstok wcstok_s wcstol wcstold wcstoll wcstombs wcstombs_s wcstoul wcstoull wcstoumax wcsxfrm wctob wctomb wctomb_s wctrans wctype wmemcpy_s wmemmove_s

uninst.exe.nsis

SHA256 caea81c8c438c84703a67881a248ebcd1b47b1b554392de18b6cfa60078df8ce
MD5 ff6de82e82a9cef815631a4d041f7e42
SHA1 49ee8aa57cd06fe5a69c9574ce7971b9b46851cc
SHA512 147f49eb8c8b759a82b012829ad3f9fcdd7f9ab63de95099f52628a5fe6304e74075b59fc32b661f10d2c162aba28e5fca4819ee7fe8de294d3a5d28d3bd3ff8
SSDEEP 1536:ZcXScmVKZ9bp1hTTx6zLMQywJuEuY3oun2EseUxXp:ZoZ9bpXV8MQ74tYYm2DxXp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

urldrv/tdi/amd64/webshieldfilter.sys

IMPHASH b5514f7ee33e61e55bebf7ca20955200
SHA256 b5ff1ea46318772e179c56e8e386f9b6c5831a304ebc4783501304aa2a9f8d33
MD5 21a332af5c8e929415dbde71db19b8ca
SHA1 dd908daf05b0fa89de836110e68f97cc54859d21
SHA512 c0dad463aa71c1cfe2cf7de1b605be36f57fc49028a68b37e823ab5449f985b07d4c7b66e828aecbb2fffd240bab3f51d75a2d4ba43fb14674c0af50684d40be
SSDEEP 1536:9iwOws+rmFBi9rsWsZBey3EV+tj6scdDUfI:9VOwso9QHBeyEV+tj6scr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

a3:d1:d0:a0:2d:5b:f1:3b:73:56:b3:32:a7:24:94:d6:14:46:5f:0c:ba:f8:4f:3e:df:a9:f5:c2:00:d9:7b:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

47:58:2d:1d:c2:72:92:8b:e3:82:5a:4e:d7:83:a0:c8:e7:34:a4:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

69732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\netfilter2\driver_tdi\std\objfre_wnet_amd64\amd64\webshieldfilter.pdb

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/tdi/i386/webshieldfilter.sys

IMPHASH f5c3ef1e88aabef8ecd0616cd29873f3
SHA256 3282e62445815de2e45092d9476f6ba5625dc50c96077845c2e32afbf8c9d2bd
MD5 2aa6d30e357b9a3e63d178f244482150
SHA1 44577e1a2fbc916fc8acca1ae5c7958ff64f8da4
SHA512 57964eb6f0e36a4eaf41e7586d1fb37e36896fa26687767012443898c1b59f8bd4900da1f639251ae726e60be8df97812a9b700d5064fcccc0343e59bbb2e0fe
SSDEEP 1536:8+wIzEJyjGTyUvtarIHl6v4Pm37sc6BUvCnUf:HwIzYyjA10IHl6gO37f6B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

84:9b:2e:fc:e7:33:ff:46:4d:07:47:50:ba:f2:ad:cc:86:cc:70:ce:b6:62:04:9b:72:34:f2:f8:59:e2:31:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

88:49:c6:b2:d2:7b:17:8a:9b:af:73:38:43:61:42:23:86:c3:db:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

47038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\netfilter2\driver_tdi\std\objfre_wxp_x86\i386\webshieldfilter.pdb

Name

.text

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win10/amd64/webshieldfilter.sys

IMPHASH c089b867a4b799a2ece4dca0900e084b
SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
MD5 b797771c87184870eb95d2e50e17a9e7
SHA1 b303acad4220542c3150bb979aa966c2640434af
SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

2

Major OS version

6

Entry point

67504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb

fwpkclnt.sys

FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmTransactionBegin0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsRedirectHandleCreate0 FwpsFreeNetBufferList0 FwpsFreeCloneNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0 FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisFreeNetBufferListPool NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExAllocatePoolWithTag ExUuidCreate swprintf_s RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject __C_specific_handler SeExports RtlGetVersion RtlCompareMemory RtlValidSid

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win10/i386/webshieldfilter.sys

IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
MD5 709ae7d4bb1817abf5b22bd5eb6d1943
SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

2

Major OS version

6

Entry point

62392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb

fwpkclnt.sys

FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpmTransactionBegin0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0 FwpsRedirectHandleCreate0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsFlowAssociateContext0 FwpsAcquireClassifyHandle0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsFreeCloneNetBufferList0

ndis.sys

NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

ntoskrnl.exe

memset RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject SeExports RtlGetVersion KeQuerySystemTime _allmul _aulldiv _aullrem RtlCompareMemory RtlValidSid RtlUnwind memcpy ExUuidCreate ExAllocatePoolWithTag swprintf_s

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win7/amd64/webshieldfilter.sys

IMPHASH 22602cf9c9696e7b40d9844e9d493520
SHA256 16399d8faf4a30ed463b8db7900fe0e67aa981a519d324f32349ba2abd779647
MD5 36a5f7f6601d2427426588ffd415ea89
SHA1 e69a5cfde38c82a6b0081e476fd83f1e3211337c
SHA512 3379adcfbcb23cbdfc62390a0ebedde75810b1f90c19bb66ce142594994a11545090583cc9d71e4e28fb2bf875fd5798f9adb9e339ba9a146513734fb74693dd
SSDEEP 1536:sGKnLHVUPDbU08dqnBtZ1ZPM1QubbE3CIXkuTtWuUf:mLHqDQZiaQA7IX5tW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

38:31:bf:f5:3a:ed:5f:8d:53:f1:74:d6:9b:a0:53:81:c4:68:d4:38:ee:9f:14:b2:ca:df:24:6e:6c:99:9e:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

77:8a:12:df:b3:22:57:23:07:ce:80:80:10:99:23:b0:8b:02:25:ca

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

77924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\repos\netfilter2\driver_wfp\std\objfre_win7_amd64\amd64\webshieldfilter.pdb

ntoskrnl.exe

KeBugCheckEx ExUuidCreate swprintf_s RtlCreateSecurityDescriptor RtlLengthSid IoAllocateMdl ObOpenObjectByPointer IoReleaseCancelSpinLock IoCreateDevice MmFreePagesFromMdl ObfDereferenceObject PsGetCurrentProcessId IoCreateSymbolicLink SeExports ZwSetSecurityObject KeWaitForSingleObject ObReferenceObjectByHandle ZwSetInformationThread IofCompleteRequest PsTerminateSystemThread ZwQueryValueKey MmMapLockedPagesSpecifyCache PsCreateSystemThread RtlAddAccessAllowedAce MmBuildMdlForNonPagedPool MmAllocatePagesForMdl KeInitializeEvent RtlAppendUnicodeToString MmGetSystemRoutineAddress KeSetEvent IoDeleteDevice RtlSetDaclSecurityDescriptor PsLookupProcessByProcessId RtlCreateAcl IoDeleteSymbolicLink MmUnmapLockedPages RtlCompareMemory RtlValidSid ExDeleteNPagedLookasideList ExQueryDepthSList IoFreeMdl ExpInterlockedPopEntrySList KeAcquireInStackQueuedSpinLock ExpInterlockedPushEntrySList KeReleaseInStackQueuedSpinLock ExInitializeNPagedLookasideList ExFreePoolWithTag ExAllocatePoolWithTag ZwOpenKey ZwClose RtlInitUnicodeString __C_specific_handler

fwpkclnt.sys

FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpmSubLayerAdd0 FwpsQueryPacketInjectionState0 FwpmSubLayerDeleteByKey0 FwpmSubLayerEnum0 FwpmTransactionCommit0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerDestroyEnumHandle0 FwpmProviderContextDeleteByKey0 FwpmCalloutAdd0 FwpmProviderAdd0 FwpmTransactionAbort0 FwpmEngineOpen0 FwpsAcquireClassifyHandle0 FwpmFilterAdd0 FwpsPendClassify0 FwpsCalloutRegister1 FwpmTransactionBegin0 FwpmEngineClose0 FwpmFreeMemory0 FwpsAcquireWritableLayerDataPointer0 FwpsApplyModifiedLayerData0 FwpsInjectNetworkReceiveAsync0 FwpsFreeCloneNetBufferList0 FwpsInjectionHandleDestroy0 FwpsConstructIpHeaderForTransportPacket0 FwpsAllocateNetBufferAndNetBufferList0 FwpsInjectionHandleCreate0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkSendAsync0 FwpsCopyStreamDataToBuffer0 FwpsInjectTransportSendAsync0 FwpsFlowRemoveContext0 FwpsCloneStreamData0 FwpsCompleteClassify0 FwpsStreamInjectAsync0 FwpsReleaseClassifyHandle0 FwpsDiscardClonedStreamData0 FwpsFreeNetBufferList0 FwpmBfeStateUnsubscribeChanges0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0

ndis.sys

NdisAllocateGenericObject NdisWaitEvent NdisAllocateNetBufferListPool NdisInitializeEvent NdisFreeGenericObject NdisFreeNetBufferListPool NdisGetDataBuffer NdisRetreatNetBufferDataStart NdisAdvanceNetBufferDataStart

Name

.text

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

494B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win7/i386/webshieldfilter.sys

IMPHASH 57038502f0601ba9f99e8f3d4355bb56
SHA256 3512260c75fe5ab584e7c072c38a9b17f4603c7b735d9e9e1e0b2f0ff901abbd
MD5 9508031dacfbbaf2595fdc9dacdb3b2a
SHA1 7b85a2830535a53068a8167093de36a3d3176e26
SHA512 a27287409313bd084510f92677111b92424c6a39eaf20e53519f563fe5a8d3a339b5e5d7399713164b41e1e22fc6ad87f6161f602ebdc74f9785f87e0bafc01e
SSDEEP 1536:heDMC9wA1lHT6pmrnPWxtbHoncn3Ii62NOtwFqGuPUfM:AqOMpmrPWxFonXi628OAhP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

16:fe:47:46:39:5e:71:c2:f3:bf:e4:c5:ca:06:fa:a2:f5:12:2a:e5:9b:d2:87:9d:62:99:a4:3a:81:64:5d:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

ed:ad:4d:c2:1f:66:63:34:6c:b5:1e:71:99:fc:ef:2d:bb:53:41:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

May 28, 2020

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 6, 2020 - Feb 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2018 - Feb 10, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

6

Entry point

61502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\netfilter2\driver_wfp\std\objfre_win7_x86\i386\webshieldfilter.pdb

ntoskrnl.exe

memcpy RtlValidSid IoFreeMdl RtlUnwind KeBugCheckEx RtlCompareMemory KeTickCount _allmul _aulldiv KeQuerySystemTime ExUuidCreate swprintf_s KeInitializeEvent PsCreateSystemThread ZwSetInformationThread ObReferenceObjectByHandle RtlAppendUnicodeToString IoCreateDevice IoCreateSymbolicLink PsTerminateSystemThread MmGetSystemRoutineAddress PsLookupProcessByProcessId IoAllocateMdl MmBuildMdlForNonPagedPool IoReleaseCancelSpinLock PsGetCurrentProcessId IofCompleteRequest IoDeleteSymbolicLink IoDeleteDevice KeWaitForSingleObject ObfDereferenceObject MmAllocatePagesForMdl MmMapLockedPagesSpecifyCache MmFreePagesFromMdl MmUnmapLockedPages KeSetEvent ObOpenObjectByPointer RtlLengthSid SeExports RtlCreateAcl RtlAddAccessAllowedAce RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor ZwSetSecurityObject ZwQueryValueKey ExDeleteNPagedLookasideList ExInitializeNPagedLookasideList InterlockedPushEntrySList InterlockedPopEntrySList _aullrem ExFreePoolWithTag memset ExAllocatePoolWithTag RtlInitUnicodeString ZwOpenKey ZwClose

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

fwpkclnt.sys

FwpsStreamInjectAsync0 FwpmEngineOpen0 FwpmProviderAdd0 FwpmSubLayerDeleteByKey0 FwpmProviderContextDeleteByKey0 FwpsAcquireClassifyHandle0 FwpsQueryPacketInjectionState0 FwpsFlowAssociateContext0 FwpmSubLayerAdd0 FwpmSubLayerCreateEnumHandle0 FwpmFreeMemory0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpmTransactionBegin0 FwpmEngineClose0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpsCalloutRegister1 FwpsCalloutUnregisterByKey0 FwpsPendClassify0 FwpsInjectionHandleCreate0 FwpsCopyStreamDataToBuffer0 FwpsInjectNetworkReceiveAsync0 FwpsAcquireWritableLayerDataPointer0 FwpsApplyModifiedLayerData0 FwpsAllocateNetBufferAndNetBufferList0 FwpsInjectTransportSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectNetworkSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsFreeCloneNetBufferList0 FwpsInjectionHandleDestroy0 FwpsFlowRemoveContext0 FwpsCloneStreamData0 FwpsCompleteClassify0 FwpsReleaseClassifyHandle0 FwpsDiscardClonedStreamData0 FwpsFreeNetBufferList0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0

ndis.sys

NdisFreeGenericObject NdisInitializeEvent NdisFreeNetBufferListPool NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisAllocateNetBufferListPool NdisAllocateGenericObject NdisWaitEvent

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win8/amd64/webshieldfilter.sys

IMPHASH c089b867a4b799a2ece4dca0900e084b
SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
MD5 b797771c87184870eb95d2e50e17a9e7
SHA1 b303acad4220542c3150bb979aa966c2640434af
SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

2

Major OS version

6

Entry point

67504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb

fwpkclnt.sys

FwpmFreeMemory0 FwpmEngineOpen0 FwpmEngineClose0 FwpmTransactionBegin0 FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsRedirectHandleCreate0 FwpsFreeNetBufferList0 FwpsFreeCloneNetBufferList0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsAcquireClassifyHandle0 FwpsFlowAssociateContext0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsAllocateNetBufferAndNetBufferList0

ndis.sys

NdisFreeNetBufferListPool NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart

ntoskrnl.exe

KeAcquireInStackQueuedSpinLock KeReleaseInStackQueuedSpinLock ExAllocatePoolWithTag ExUuidCreate swprintf_s RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag ExQueryDepthSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject __C_specific_handler SeExports RtlGetVersion RtlCompareMemory RtlValidSid

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

urldrv/wfp/win8/i386/webshieldfilter.sys

IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
MD5 709ae7d4bb1817abf5b22bd5eb6d1943
SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

2

Major OS version

6

Entry point

62392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb

fwpkclnt.sys

FwpmTransactionCommit0 FwpmTransactionAbort0 FwpmProviderAdd0 FwpmProviderContextDeleteByKey0 FwpmSubLayerAdd0 FwpmSubLayerDeleteByKey0 FwpmSubLayerCreateEnumHandle0 FwpmSubLayerEnum0 FwpmSubLayerDestroyEnumHandle0 FwpmCalloutAdd0 FwpmFilterAdd0 FwpsFlowAbort0 FwpsInjectionHandleCreate0 FwpsInjectionHandleDestroy0 FwpsAllocateNetBufferAndNetBufferList0 FwpsFreeNetBufferList0 FwpmTransactionBegin0 FwpsInjectNetworkSendAsync0 FwpsConstructIpHeaderForTransportPacket0 FwpsInjectTransportSendAsync0 FwpsInjectTransportReceiveAsync0 FwpsInjectNetworkReceiveAsync0 FwpsStreamInjectAsync0 FwpsCopyStreamDataToBuffer0 FwpmBfeStateGet0 FwpmBfeStateSubscribeChanges0 FwpmBfeStateUnsubscribeChanges0 FwpsFlowRemoveContext0 FwpsCompleteClassify0 FwpsRedirectHandleDestroy0 FwpsCloneStreamData0 FwpsDiscardClonedStreamData0 FwpmEngineClose0 FwpmEngineOpen0 FwpmFreeMemory0 FwpsRedirectHandleCreate0 FwpsQueryPacketInjectionState0 FwpsApplyModifiedLayerData0 FwpsAcquireWritableLayerDataPointer0 FwpsReleaseClassifyHandle0 FwpsFlowAssociateContext0 FwpsAcquireClassifyHandle0 FwpsCalloutUnregisterByKey0 FwpsCalloutRegister1 FwpsPendClassify0 FwpsFreeCloneNetBufferList0

ndis.sys

NdisAllocateNetBufferListPool NdisWaitEvent NdisInitializeEvent NdisFreeGenericObject NdisAllocateGenericObject NdisGetDataBuffer NdisAdvanceNetBufferDataStart NdisRetreatNetBufferDataStart NdisFreeNetBufferListPool

ntoskrnl.exe

memset RtlInitUnicodeString MmGetSystemRoutineAddress RtlAppendUnicodeToString RtlCreateSecurityDescriptor RtlSetDaclSecurityDescriptor KeInitializeEvent KeSetEvent KeWaitForSingleObject KeInitializeSpinLock ExFreePoolWithTag InterlockedPopEntrySList InterlockedPushEntrySList ExInitializeNPagedLookasideList ExDeleteNPagedLookasideList MmBuildMdlForNonPagedPool MmMapLockedPagesSpecifyCache MmUnmapLockedPages MmAllocatePagesForMdl MmFreePagesFromMdl PsCreateSystemThread PsTerminateSystemThread IoAllocateMdl IofCompleteRequest IoCreateDevice IoCreateSymbolicLink IoDeleteDevice IoDeleteSymbolicLink IoFreeMdl IoReleaseCancelSpinLock ObReferenceObjectByHandle ObfDereferenceObject ZwClose ZwOpenKey ZwQueryValueKey PsGetCurrentProcessId ZwSetInformationThread RtlLengthSid RtlCreateAcl RtlAddAccessAllowedAce PsLookupProcessByProcessId ObOpenObjectByPointer ZwSetSecurityObject SeExports RtlGetVersion KeQuerySystemTime _allmul _aulldiv _aullrem RtlCompareMemory RtlValidSid RtlUnwind memcpy ExUuidCreate ExAllocatePoolWithTag swprintf_s

hal

KeReleaseInStackQueuedSpinLock KeGetCurrentIrql KeAcquireInStackQueuedSpinLock

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vcruntime140_cor3.dll

IMPHASH b06d4116da69a513992d529f84731e6f
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a6:9d:85:b1:34:64:a0:a9:69:70:90:5b:bb:98:00:b8:16:3e:b7:c6:a4:68:de:cd:a5:02:95:79:5e:4b:ae:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

58816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb

_CreateFrameInfo _CxxThrowException _EH_prolog _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _NLG_Dispatch2 _NLG_Return _NLG_Return2 _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxLongjmpUnwind __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _chkesp _except_handler2 _except_handler3 _except_handler4_common _get_purecall_handler _get_unexpected _global_unwind2 _is_exception_typeof _local_unwind2 _local_unwind4 _longjmpex _purecall _seh_longjmp_unwind _seh_longjmp_unwind4 _set_purecall_handler _set_se_translator _setjmp3 longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

wpfgfx_cor3.dll

IMPHASH 5514d2d9b95c73162286e973c6f47da0
SHA256 69c03db89ad14cdf2c05db284d1452a517d7127bafd871334685d715f662d203
MD5 52d8f7f0ab9d679209b707c7ebc8377e
SHA1 7042a8788ea40f29b2fab2ec249dfd9e8c6ed7e6
SHA512 8617663d2292ca05d1873cbf9cf2397a0e56214c5bf5d66d5b1c8e95658a5604e1d27656ce853d1306c4a21575e3fe45934a0b8e5bb256644cd064b8d8269c87
SSDEEP 24576:jA4+95hzAxEvPcYCUhGU6YVjfB458Yqj0ggwBklV3SFyyTNjnm81d1:k4+fxAxEvPXG+Ig0GFycND9d1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

04:21:d5:d2:3e:09:dc:80:72:2c:dc:1d:7d:45:c3:c8:5d:10:f1:50:f6:e7:ec:e0:45:ff:af:01:22:d0:6f:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 26, 2024

Minor OS version

0

Major OS version

6

Entry point

335440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\bin\WpfGfx\Win32\Release\wpfgfx_cor3.pdb

kernel32

GetCurrentThreadId ResetEvent TryEnterCriticalSection MulDiv QueryPerformanceCounter Sleep FindResourceW LoadResource LockResource GlobalUnlock QueryPerformanceFrequency InitializeSListHead InterlockedPushEntrySList QueryDepthSList InterlockedFlushSList SleepEx RtlCaptureStackBackTrace IsDebuggerPresent ExitProcess GetProcessHeap HeapAlloc HeapFree HeapReAlloc TerminateThread GetCurrentThread GetCurrentProcessId SetThreadPriority CreateEventW InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock LocalFree FormatMessageA GetSystemTimeAsFileTime WaitForSingleObjectEx RaiseException CloseHandle WaitForSingleObject SetEvent LoadLibraryExW FindClose FindFirstFileW GetSystemDirectoryW SystemTimeToFileTime LoadLibraryA LoadLibraryExA GetVersionExW DebugBreak GetModuleFileNameW CreateThread FreeLibrary OutputDebugStringW LoadLibraryW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount GetLastError DisableThreadLibraryCalls IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer UnhandledExceptionFilter GetModuleHandleW GetProcAddress GetSystemInfo VirtualProtect WaitForMultipleObjects GetTickCount SizeofResource UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualFree VirtualAlloc VerSetConditionMask VirtualQuery

advapi32

UnregisterTraceGuids RegQueryValueExW RegCloseKey AllocateLocallyUniqueId RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage TraceEvent RegOpenKeyExW

user32

ClientToScreen EnumDisplayMonitors GetMonitorInfoW SystemParametersInfoW EnumDisplayDevicesW MonitorFromWindow SetLayeredWindowAttributes WindowFromDC GetWindowRect EnumDisplaySettingsW GetClientRect InvalidateRect ReleaseDC GetDC OffsetRect GetWindowLongW GetGuiResources EqualRect IntersectRect SetRect IsRectEmpty PostMessageW RegisterWindowMessageW GetDesktopWindow MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW IsWindow UpdateLayeredWindow ScreenToClient GetParent GetWindowDC

gdi32

CreateCompatibleBitmap CreatePalette OffsetRgn RealizePalette GetSystemPaletteEntries GetDIBits GetRandomRgn CreateCompatibleDC SelectPalette CreateRectRgn GetRgnBox SetRectRgn GetRegionData RectInRegion CombineRgn CreateRectRgnIndirect SelectObject CreateDIBSection DeleteObject CreateICW GetDeviceCaps DeleteDC BitBlt SetLayout

ole32

CoUninitialize PropVariantClear PropVariantCopy CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

d3dcompiler_47_cor3

D3DCompile

api-ms-win-crt-runtime-l1-1-0

abort _initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _invalid_parameter_noinfo_noreturn terminate

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

floor _libm_sse2_tan_precise _libm_sse2_sqrt_precise _libm_sse2_sin_precise _libm_sse2_pow_precise _libm_sse2_log_precise _libm_sse2_exp_precise _libm_sse2_cos_precise _CIfmod _CIatan2 nextafterf modf _finite _isnan _copysign

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

calloc malloc free

api-ms-win-crt-string-l1-1-0

strcpy_s memset wcsncmp

ntdll

DbgPrintEx RtlInitializeBitMap RtlFindClearBitsAndSet DbgPrompt RtlClearBits NtQuerySystemInformation RtlUnwind RtlInterlockedFlushSList DbgBreakPoint RtlSetBits

api-ms-win-crt-utility-l1-1-0

qsort

GetNextPerfElementId IWICColorContext_GetExifColorSpace_Proxy IWICColorContext_GetProfileBytes_Proxy IWICColorContext_GetType_Proxy InteropDeviceBitmap_AddDirtyRect InteropDeviceBitmap_Create InteropDeviceBitmap_Detach InteropDeviceBitmap_GetAsSoftwareBitmap MIL3DCalcProjected2DBounds MILAddRef MILCreateEventProxy MILCreateFactory MILCreateStreamFromStreamDescriptor MILFactoryCreateBitmapRenderTarget MILFactoryCreateMediaPlayer MILFactoryCreateSWRenderTargetForBitmap MILIStreamWrite MILLoadResource MILMediaCanPause MILMediaClose MILMediaGetBufferingProgress MILMediaGetDownloadProgress MILMediaGetMediaLength MILMediaGetNaturalHeight MILMediaGetNaturalWidth MILMediaGetPosition MILMediaHasAudio MILMediaHasVideo MILMediaIsBuffering MILMediaNeedUIFrameUpdate MILMediaOpen MILMediaProcessExitHandler MILMediaSetBalance MILMediaSetIsScrubbingEnabled MILMediaSetPosition MILMediaSetRate MILMediaSetVolume MILMediaShutdown MILMediaStop MILQueryInterface MILRelease MILRenderTargetBitmapClear MILRenderTargetBitmapGetBitmap MILSwDoubleBufferedBitmapAddDirtyRect MILSwDoubleBufferedBitmapCreate MILSwDoubleBufferedBitmapGetBackBuffer MILSwDoubleBufferedBitmapProtectBackBuffer MILUpdateSystemParametersInfo MilChannel_AppendCommandData MilChannel_BeginCommand MilChannel_CloseBatch MilChannel_CommitChannel MilChannel_EndCommand MilChannel_GetMarshalType MilChannel_SetNotificationWindow MilChannel_SetReceiveBroadcastMessages MilCompositionEngine_DeinitializePartitionManager MilCompositionEngine_EnterCompositionEngineLock MilCompositionEngine_ExitCompositionEngineLock MilCompositionEngine_GetComposedEventId MilCompositionEngine_InitializePartitionManager MilCompositionEngine_UpdateSchedulerSettings MilComposition_PeekNextMessage MilComposition_SyncFlush MilComposition_WaitForNextMessage MilConnection_CreateChannel MilConnection_DestroyChannel MilContent_AttachToHwnd MilContent_DetachFromHwnd MilGlyphRun_GetGlyphOutline MilGlyphRun_ReleasePathGeometryData MilPlayer_Create MilPlayer_Process MilResource_CreateCWICWrapperBitmap MilResource_CreateOrAddRefOnChannel MilResource_DuplicateHandle MilResource_GetRefCountOnChannel MilResource_ReleaseOnChannel MilResource_SendCommand MilResource_SendCommandBitmapSource MilResource_SendCommandMedia MilUtility_ArcToBezier MilUtility_CopyPixelBuffer MilUtility_GeometryGetArea MilUtility_GetPointAtLengthFraction MilUtility_GetTileBrushMapping MilUtility_PathGeometryBounds MilUtility_PathGeometryCombine MilUtility_PathGeometryFlatten MilUtility_PathGeometryHitTest MilUtility_PathGeometryHitTestPathGeometry MilUtility_PathGeometryOutline MilUtility_PathGeometryWiden MilUtility_PolygonBounds MilUtility_PolygonHitTest MilVersionCheck MilVisualTarget_AttachToHwnd MilVisualTarget_DetachFromHwnd RenderOptions_ForceSoftwareRenderingModeForProcess RenderOptions_IsSoftwareRenderingForcedForProcess SetMilPerfInstrumentationFlags WgxConnection_Create WgxConnection_Disconnect WgxConnection_SameThreadPresent WgxConnection_ShouldForceSoftwareForGraphicsStreamClient

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

wscf.exe

IMPHASH e756a2c7ee0dd3d54f8bcc5d0d1200ac
SHA256 266d4d9769b1498992fc953f2c82b9b6853b311f06adca63825a07c4dce72da0
MD5 25330672ddf4763c86f65438ea2561d6
SHA1 94a602fffe514fdc9d3824263f6491f1342a9cf2
SHA512 0cb2aea5155843e9ba4a5657acb8451665a722720f0e1d4a66935752aaaabcb56b032f31a5dbf4e5f4f310f28ca0d9e597c2f3f12a9a162e56063338db018630
SSDEEP 6144:TFb5y9XQG2/4xIdIevQiwhnFPEuEORXaRsRZKoAOWL8DYrS:TZ5GQG2/4xIxBhuEORXaRsRZKoAYYW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

45501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\repos\protected_elam\protected_elam\Release\wscf.pdb

shell32

ShellExecuteW

kernel32

GetCPInfo WriteConsoleW MultiByteToWideChar LocalFree FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI CloseHandle GetLastError SetLastError GetModuleHandleW GetProcAddress WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW ReadConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree GetFileSizeEx GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize

x86/update.dll

IMPHASH b35ddd7b181110cc0604ac6c7b6d05ea
SHA256 fc85d8cc5fe0327be1253c1f69ca48eaa30d9aa583becb6f1e678e7960e33022
MD5 8fcfabdf2458336b061a06d7362f1c37
SHA1 ed669e2c73292d3a6510ed9d670bdf56cb7ca92d
SHA512 056eb2071e33efaa7ac52002a906008baf0f8c59f8fcc99c500510c327a6b2917922706c9ec05e12f716573d6d9321e28190f1a911f765d596fd4c0d4c882dec
SSDEEP 49152:Clg4XDo+apyPH5kscRzpBvMXBoHI1LFQQ2W9gtxWhToexMX+tPTqH8dO0t3z6XJh:Clg8oskscR/MRoHI1L0tiTVhqHuO0a
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

26:df:a1:0b:ac:00:44:53:53:db:db:cd:fb:40:3e:78:99:fb:3e:6e:5f:20:be:90:a1:65:8b:4a:d7:0c:49:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Chains

Jul 26, 2024

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:0f:14:d2:35:88:fc:d5:b3:27:d8:00:00:00:00:0f:14

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2023 - Jun 7, 2023

Subject

CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE

Serial Number

33:00:00:0f:14:d2:35:88:fc:d5:b3:27:d8:00:00:00:00:0f:14

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2023 - Jun 7, 2023

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Minor OS version

0

Major OS version

6

Entry point

2236960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\bamboo-build\WPPSDK-UPD-WINDX86\build-windows\src\update.pdb

crypt32

CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateContextProperty CertOpenStore

ws2_32

getsockopt send gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet inet_pton socket htons WSAIoctl setsockopt WSACleanup WSAStartup inet_ntop WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent

kernel32

GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetConsoleOutputCP GetModuleFileNameW CreateProcessW DuplicateHandle SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread Sleep CreateFileW CloseHandle GetLastError MoveFileExW GetShortPathNameW FlushFileBuffers ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetUserDefaultLCID GetSystemDirectoryW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId SleepEx VerSetConditionMask GetModuleHandleA VerifyVersionInfoW GetFileSizeEx InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW WriteFile DeleteFiber GetSystemTimeAsFileTime ConvertFiberToThread LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSection GetModuleFileNameA LoadLibraryExA FormatMessageA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW LoadLibraryExW InterlockedFlushSList EnumSystemLocalesW HeapReAlloc SetStdHandle WaitForSingleObject GetExitCodeProcess CreatePipe GetTimeZoneInformation DeleteFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize WriteConsoleW IsValidLocale QueryPerformanceFrequency RtlUnwind LocalFree GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetEndOfFile SetFileInformationByHandle SetFilePointerEx GetTempPathW AreFileApisANSI CopyFileW GetFileInformationByHandleEx GetStringTypeW EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

advapi32

CryptEnumProvidersW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW SystemFunction036 CryptAcquireContextW

bcrypt

BCryptGenRandom

Sharing

Errors

General

Malware Config

Signatures

File Explorer

PCProtect_Setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aebb.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aecore.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aecrypto.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aedroid.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aedroid_gwf.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeemu.dll

PE Signature issue

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeexp.dll

PE Signature issue

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeexp_gwf.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aegen.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aehelp.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_agen.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_gwf.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeheur_mv.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelibinf.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelibinf_db.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aelidb.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeml.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aemobile.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice.dll

PE Signature issue

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice_gwf.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aeoffice_mv.dat

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aepack.dll

PE Signature issue

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aerdl.dll

PE Signature issue

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aesbx.dll

kernel32

generic

$APPDATA/PCProtect/updates/SAVAPI 11.0.1/aescn.dll

kernel32

generic