General

Malware Config

Signatures

Files

• Visual-C-Runtimes-All-in-One-May-2024.zip

  .zip
• install_all.bat
• vcredist2005_x64.exe

  .exe windows:5 windows x86 arch:x86

  0ebb3c09b06b1666d307952e824c8697

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  72:eb:ec:84:ec:eb:2c:99:f6:93:1a:22:55:c2:43:bc:37:c7:56:59

  Signer

  Actual PE Digest

  72:eb:ec:84:ec:eb:2c:99:f6:93:1a:22:55:c2:43:bc:37:c7:56:59

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  wextract.pdb

  Imports

  advapi32

  FreeSid

  AllocateAndInitializeSid

  EqualSid

  GetTokenInformation

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  RegCloseKey

  RegDeleteValueA

  RegOpenKeyExA

  RegSetValueExA

  RegQueryValueExA

  RegCreateKeyExA

  RegQueryInfoKeyA

  kernel32

  LocalFree

  LocalAlloc

  GetLastError

  GetCurrentProcess

  lstrlenA

  GetModuleFileNameA

  GetSystemDirectoryA

  _lclose

  _llseek

  _lopen

  WritePrivateProfileStringA

  GetWindowsDirectoryA

  CreateDirectoryA

  GetFileAttributesA

  ExpandEnvironmentStringsA

  lstrcpyA

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  IsDBCSLeadByte

  GetShortPathNameA

  GetPrivateProfileStringA

  GetPrivateProfileIntA

  lstrcmpiA

  RemoveDirectoryA

  FindClose

  FindNextFileA

  DeleteFileA

  SetFileAttributesA

  lstrcmpA

  FindFirstFileA

  FreeResource

  GetProcAddress

  LoadResource

  SizeofResource

  FindResourceA

  lstrcatA

  CloseHandle

  WriteFile

  SetFilePointer

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  SetCurrentDirectoryA

  GetTempFileNameA

  ExitProcess

  CreateFileA

  LoadLibraryExA

  lstrcpynA

  GetVolumeInformationA

  FormatMessageA

  GetCurrentDirectoryA

  GetVersionExA

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessA

  GetTempPathA

  GetSystemInfo

  CreateMutexA

  SetEvent

  CreateEventA

  CreateThread

  ResetEvent

  TerminateThread

  GetDriveTypeA

  GetModuleHandleA

  GetStartupInfoA

  GetCommandLineA

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  ReadFile

  LoadLibraryA

  GetDiskFreeSpaceA

  MulDiv

  EnumResourceLanguagesA

  FreeLibrary

  LockResource

  gdi32

  GetDeviceCaps

  user32

  ExitWindowsEx

  wsprintfA

  CharNextA

  CharUpperA

  CharPrevA

  SetWindowLongA

  GetWindowLongA

  CallWindowProcA

  DispatchMessageA

  MsgWaitForMultipleObjects

  PeekMessageA

  SendMessageA

  SetWindowPos

  ReleaseDC

  GetDC

  GetWindowRect

  SendDlgItemMessageA

  GetDlgItem

  SetForegroundWindow

  SetWindowTextA

  MessageBoxA

  DialogBoxIndirectParamA

  ShowWindow

  EnableWindow

  GetDlgItemTextA

  EndDialog

  GetDesktopWindow

  MessageBeep

  SetDlgItemTextA

  LoadStringA

  GetSystemMetrics

  comctl32

  ord17

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  Sections

  .text

  Size: 38KB - Virtual size: 38KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2005_x86.exe

  .exe windows:5 windows x86 arch:x86

  0ebb3c09b06b1666d307952e824c8697

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  5d:9a:9e:30:e8:b4:79:bd:b9:25:8e:b1:69:72:67:0f:90:ec:0f:7f

  Signer

  Actual PE Digest

  5d:9a:9e:30:e8:b4:79:bd:b9:25:8e:b1:69:72:67:0f:90:ec:0f:7f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  wextract.pdb

  Imports

  advapi32

  FreeSid

  AllocateAndInitializeSid

  EqualSid

  GetTokenInformation

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  RegCloseKey

  RegDeleteValueA

  RegOpenKeyExA

  RegSetValueExA

  RegQueryValueExA

  RegCreateKeyExA

  RegQueryInfoKeyA

  kernel32

  LocalFree

  LocalAlloc

  GetLastError

  GetCurrentProcess

  lstrlenA

  GetModuleFileNameA

  GetSystemDirectoryA

  _lclose

  _llseek

  _lopen

  WritePrivateProfileStringA

  GetWindowsDirectoryA

  CreateDirectoryA

  GetFileAttributesA

  ExpandEnvironmentStringsA

  lstrcpyA

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  IsDBCSLeadByte

  GetShortPathNameA

  GetPrivateProfileStringA

  GetPrivateProfileIntA

  lstrcmpiA

  RemoveDirectoryA

  FindClose

  FindNextFileA

  DeleteFileA

  SetFileAttributesA

  lstrcmpA

  FindFirstFileA

  FreeResource

  GetProcAddress

  LoadResource

  SizeofResource

  FindResourceA

  lstrcatA

  CloseHandle

  WriteFile

  SetFilePointer

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  SetCurrentDirectoryA

  GetTempFileNameA

  ExitProcess

  CreateFileA

  LoadLibraryExA

  lstrcpynA

  GetVolumeInformationA

  FormatMessageA

  GetCurrentDirectoryA

  GetVersionExA

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessA

  GetTempPathA

  GetSystemInfo

  CreateMutexA

  SetEvent

  CreateEventA

  CreateThread

  ResetEvent

  TerminateThread

  GetDriveTypeA

  GetModuleHandleA

  GetStartupInfoA

  GetCommandLineA

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  ReadFile

  LoadLibraryA

  GetDiskFreeSpaceA

  MulDiv

  EnumResourceLanguagesA

  FreeLibrary

  LockResource

  gdi32

  GetDeviceCaps

  user32

  ExitWindowsEx

  wsprintfA

  CharNextA

  CharUpperA

  CharPrevA

  SetWindowLongA

  GetWindowLongA

  CallWindowProcA

  DispatchMessageA

  MsgWaitForMultipleObjects

  PeekMessageA

  SendMessageA

  SetWindowPos

  ReleaseDC

  GetDC

  GetWindowRect

  SendDlgItemMessageA

  GetDlgItem

  SetForegroundWindow

  SetWindowTextA

  MessageBoxA

  DialogBoxIndirectParamA

  ShowWindow

  EnableWindow

  GetDlgItemTextA

  EndDialog

  GetDesktopWindow

  MessageBeep

  SetDlgItemTextA

  LoadStringA

  GetSystemMetrics

  comctl32

  ord17

  version

  GetFileVersionInfoA

  VerQueryValueA

  GetFileVersionInfoSizeA

  Sections

  .text

  Size: 38KB - Virtual size: 38KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2008_x64.exe

  .exe windows:5 windows x86 arch:x86

  092eb6daba2f17cbda102fd1a32acd00

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  8f:01:df:78:ce:80:39:28:c8:49:b3:c7:c4:01:28:81:cc:40:e4:47

  Signer

  Actual PE Digest

  8f:01:df:78:ce:80:39:28:c8:49:b3:c7:c4:01:28:81:cc:40:e4:47

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  Imports

  kernel32

  GetDriveTypeA

  HeapFree

  FormatMessageA

  LeaveCriticalSection

  DeleteFileA

  EnterCriticalSection

  TerminateProcess

  WaitForMultipleObjects

  CreateEventW

  SetEvent

  Sleep

  SetEnvironmentVariableA

  GetEnvironmentVariableA

  WideCharToMultiByte

  HeapAlloc

  SetLastError

  WriteFile

  MoveFileA

  ExitProcess

  DeleteCriticalSection

  FlushFileBuffers

  GetVersionExA

  WaitForSingleObject

  OpenEventA

  GetCurrentProcess

  GetFileAttributesA

  GetCommandLineA

  GetModuleFileNameA

  CreateFileA

  FindNextFileA

  FindFirstFileA

  CopyFileA

  SetFileAttributesA

  SystemTimeToFileTime

  GetSystemTime

  GetDiskFreeSpaceA

  QueryDosDeviceA

  GetCurrentDirectoryA

  SetEndOfFile

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  GetExitCodeProcess

  CreateProcessA

  ExpandEnvironmentStringsA

  GetFileSize

  CreateThread

  CreateEventA

  GetProcessHeap

  InitializeCriticalSectionAndSpinCount

  GetModuleHandleA

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  SetUnhandledExceptionFilter

  CloseHandle

  DeviceIoControl

  GetSystemDirectoryA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  SetErrorMode

  GetTickCount

  CreateDirectoryA

  GetLastError

  RemoveDirectoryA

  MoveFileExA

  SetFilePointer

  FindClose

  ReadFile

  msvcrt

  strchr

  _strnicmp

  _stricmp

  strrchr

  _strlwr

  strncpy

  strstr

  _snprintf

  sprintf

  advapi32

  AllocateAndInitializeSid

  GetTokenInformation

  GetLengthSid

  InitiateSystemShutdownA

  CryptReleaseContext

  CryptGenRandom

  CryptAcquireContextA

  SetSecurityDescriptorDacl

  AddAccessAllowedAce

  InitializeAcl

  InitializeSecurityDescriptor

  OpenProcessToken

  user32

  ShowWindow

  SendDlgItemMessageA

  SendMessageA

  DialogBoxParamA

  LoadStringA

  EndDialog

  SetParent

  MessageBoxA

  ntdll

  NtShutdownSystem

  NtAdjustPrivilegesToken

  NtClose

  NtOpenProcessToken

  comctl32

  ord17

  shell32

  SHBrowseForFolderA

  SHGetPathFromIDListA

  Sections

  .text

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4.9MB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2008_x86.exe

  .exe windows:5 windows x86 arch:x86

  092eb6daba2f17cbda102fd1a32acd00

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:05:a2:30:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:01

  Not After

  25-07-2013 19:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a

  Signer

  Actual PE Digest

  d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  Imports

  kernel32

  GetDriveTypeA

  HeapFree

  FormatMessageA

  LeaveCriticalSection

  DeleteFileA

  EnterCriticalSection

  TerminateProcess

  WaitForMultipleObjects

  CreateEventW

  SetEvent

  Sleep

  SetEnvironmentVariableA

  GetEnvironmentVariableA

  WideCharToMultiByte

  HeapAlloc

  SetLastError

  WriteFile

  MoveFileA

  ExitProcess

  DeleteCriticalSection

  FlushFileBuffers

  GetVersionExA

  WaitForSingleObject

  OpenEventA

  GetCurrentProcess

  GetFileAttributesA

  GetCommandLineA

  GetModuleFileNameA

  CreateFileA

  FindNextFileA

  FindFirstFileA

  CopyFileA

  SetFileAttributesA

  SystemTimeToFileTime

  GetSystemTime

  GetDiskFreeSpaceA

  QueryDosDeviceA

  GetCurrentDirectoryA

  SetEndOfFile

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  GetExitCodeProcess

  CreateProcessA

  ExpandEnvironmentStringsA

  GetFileSize

  CreateThread

  CreateEventA

  GetProcessHeap

  InitializeCriticalSectionAndSpinCount

  GetModuleHandleA

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  SetUnhandledExceptionFilter

  CloseHandle

  DeviceIoControl

  GetSystemDirectoryA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  SetErrorMode

  GetTickCount

  CreateDirectoryA

  GetLastError

  RemoveDirectoryA

  MoveFileExA

  SetFilePointer

  FindClose

  ReadFile

  msvcrt

  strchr

  _strnicmp

  _stricmp

  strrchr

  _strlwr

  strncpy

  strstr

  _snprintf

  sprintf

  advapi32

  AllocateAndInitializeSid

  GetTokenInformation

  GetLengthSid

  InitiateSystemShutdownA

  CryptReleaseContext

  CryptGenRandom

  CryptAcquireContextA

  SetSecurityDescriptorDacl

  AddAccessAllowedAce

  InitializeAcl

  InitializeSecurityDescriptor

  OpenProcessToken

  user32

  ShowWindow

  SendDlgItemMessageA

  SendMessageA

  DialogBoxParamA

  LoadStringA

  EndDialog

  SetParent

  MessageBoxA

  ntdll

  NtShutdownSystem

  NtAdjustPrivilegesToken

  NtClose

  NtOpenProcessToken

  comctl32

  ord17

  shell32

  SHBrowseForFolderA

  SHGetPathFromIDListA

  Sections

  .text

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4.2MB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2010_x64.exe

  .exe windows:5 windows x86 arch:x86

  a1f6f100bff4507a3332f3f0cdfc24f5

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:06:94:2d:00:00:00:00:00:09

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:02

  Not After

  25-07-2013 19:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f

  Signer

  Actual PE Digest

  3e:29:68:50:9f:c0:15:85:b2:43:f6:40:df:72:7e:8c:87:c3:b3:4f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  sfxcab.pdb

  Imports

  msvcrt

  __setusermatherr

  _initterm

  __getmainargs

  __initenv

  exit

  _cexit

  _adjust_fdiv

  _exit

  _c_exit

  strncpy

  strstr

  _strlwr

  strrchr

  _stricmp

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler3

  _controlfp

  _XcptFilter

  _snprintf

  sprintf

  strchr

  _strnicmp

  _vsnprintf

  advapi32

  InitializeAcl

  AddAccessAllowedAce

  SetSecurityDescriptorDacl

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  AllocateAndInitializeSid

  OpenProcessToken

  GetTokenInformation

  GetLengthSid

  InitiateSystemShutdownA

  InitializeSecurityDescriptor

  kernel32

  CreateThread

  GetFileSize

  ExpandEnvironmentStringsA

  CreateProcessA

  GetExitCodeProcess

  InitializeCriticalSectionAndSpinCount

  LocalFileTimeToFileTime

  SetFileTime

  SetEndOfFile

  CreateEventA

  QueryDosDeviceA

  GetDiskFreeSpaceA

  GetSystemTime

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentDirectoryA

  GetProcessHeap

  CopyFileA

  SetFileAttributesA

  DosDateTimeToFileTime

  SetEvent

  GetVersionExA

  ReadFile

  SetFilePointer

  MoveFileExA

  RemoveDirectoryA

  GetLastError

  CreateDirectoryA

  GetTickCount

  SetErrorMode

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetSystemDirectoryA

  CloseHandle

  DeviceIoControl

  CreateFileA

  GetDriveTypeA

  HeapFree

  FormatMessageA

  LeaveCriticalSection

  DeleteFileA

  EnterCriticalSection

  TerminateProcess

  WaitForMultipleObjects

  CreateEventW

  FindFirstFileA

  Sleep

  SetEnvironmentVariableA

  GetEnvironmentVariableA

  WideCharToMultiByte

  HeapAlloc

  SetLastError

  WriteFile

  MoveFileA

  ExitProcess

  DeleteCriticalSection

  FlushFileBuffers

  WaitForSingleObject

  OpenEventA

  GetCurrentProcess

  GetFileAttributesA

  GetCommandLineA

  GetModuleFileNameA

  FindClose

  FindNextFileA

  SystemTimeToFileTime

  user32

  SendDlgItemMessageA

  SendMessageA

  DialogBoxParamA

  MessageBoxA

  SetParent

  EndDialog

  LoadStringA

  ShowWindow

  ntdll

  NtOpenProcessToken

  NtAdjustPrivilegesToken

  NtClose

  NtShutdownSystem

  comctl32

  ord17

  shell32

  SHBrowseForFolderA

  SHGetPathFromIDListA

  Sections

  .text

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9.8MB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2010_x86.exe

  .exe windows:5 windows x86 arch:x86

  a1f6f100bff4507a3332f3f0cdfc24f5

  
  

  Code Sign

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:01:b2:9b:00:00:00:00:00:15

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  21-02-2011 20:53

  Not After

  21-05-2012 20:53

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:05:a2:30:00:00:00:00:00:08

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  25-07-2008 19:01

  Not After

  25-07-2013 19:11

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  58:5d:c5:26:99:03:d9:98:d7:bd:f4:32:05:e3:4e:3b:e4:dd:15:47

  Signer

  Actual PE Digest

  58:5d:c5:26:99:03:d9:98:d7:bd:f4:32:05:e3:4e:3b:e4:dd:15:47

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  sfxcab.pdb

  Imports

  msvcrt

  __setusermatherr

  _initterm

  __getmainargs

  __initenv

  exit

  _cexit

  _adjust_fdiv

  _exit

  _c_exit

  strncpy

  strstr

  _strlwr

  strrchr

  _stricmp

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler3

  _controlfp

  _XcptFilter

  _snprintf

  sprintf

  strchr

  _strnicmp

  _vsnprintf

  advapi32

  InitializeAcl

  AddAccessAllowedAce

  SetSecurityDescriptorDacl

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  AllocateAndInitializeSid

  OpenProcessToken

  GetTokenInformation

  GetLengthSid

  InitiateSystemShutdownA

  InitializeSecurityDescriptor

  kernel32

  CreateThread

  GetFileSize

  ExpandEnvironmentStringsA

  CreateProcessA

  GetExitCodeProcess

  InitializeCriticalSectionAndSpinCount

  LocalFileTimeToFileTime

  SetFileTime

  SetEndOfFile

  CreateEventA

  QueryDosDeviceA

  GetDiskFreeSpaceA

  GetSystemTime

  QueryPerformanceCounter

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentDirectoryA

  GetProcessHeap

  CopyFileA

  SetFileAttributesA

  DosDateTimeToFileTime

  SetEvent

  GetVersionExA

  ReadFile

  SetFilePointer

  MoveFileExA

  RemoveDirectoryA

  GetLastError

  CreateDirectoryA

  GetTickCount

  SetErrorMode

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  GetSystemDirectoryA

  CloseHandle

  DeviceIoControl

  CreateFileA

  GetDriveTypeA

  HeapFree

  FormatMessageA

  LeaveCriticalSection

  DeleteFileA

  EnterCriticalSection

  TerminateProcess

  WaitForMultipleObjects

  CreateEventW

  FindFirstFileA

  Sleep

  SetEnvironmentVariableA

  GetEnvironmentVariableA

  WideCharToMultiByte

  HeapAlloc

  SetLastError

  WriteFile

  MoveFileA

  ExitProcess

  DeleteCriticalSection

  FlushFileBuffers

  WaitForSingleObject

  OpenEventA

  GetCurrentProcess

  GetFileAttributesA

  GetCommandLineA

  GetModuleFileNameA

  FindClose

  FindNextFileA

  SystemTimeToFileTime

  user32

  SendDlgItemMessageA

  SendMessageA

  DialogBoxParamA

  MessageBoxA

  SetParent

  EndDialog

  LoadStringA

  ShowWindow

  ntdll

  NtOpenProcessToken

  NtAdjustPrivilegesToken

  NtClose

  NtShutdownSystem

  comctl32

  ord17

  shell32

  SHBrowseForFolderA

  SHGetPathFromIDListA

  Sections

  .text

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8.5MB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• vcredist2012_x64.exe

  .exe windows:5 windows x86 arch:x86

  33c6db41ca15b47cfcec52de6c2ab2b7

  
  

  Code Sign

  33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  04-09-2012 21:12

  Not After

  04-12-2013 21:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  24-01-2013 22:33

  Not After

  24-04-2014 22:33

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  24-09-2013 17:41

  Not After

  24-12-2014 17:41

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  f9:21:a8:7f:5a:3b:9a:0a:03:ac:c7:ff:64:14:0d:fb:d7:83:d6:35:6f:b3:45:b4:6a:5d:07:98:a0:f2:ce:30

  Signer

  Actual PE Digest

  f9:21:a8:7f:5a:3b:9a:0a:03:ac:c7:ff:64:14:0d:fb:d7:83:d6:35:6f:b3:45:b4:6a:5d:07:98:a0:f2:ce:30

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  fa:4d:cd:f6:4c:96:60:0c:ed:96:a4:ab:84:4d:56:72:9b:e5:6f:2f

  Signer

  Actual PE Digest

  fa:4d:cd:f6:4c:96:60:0c:ed:96:a4:ab:84:4d:56:72:9b:e5:6f:2f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  E:\delivery\Dev\wix36_dev11\build\ship\x86\x86\burn.pdb

  Imports

  kernel32

  CopyFileExW

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  ResetEvent

  SetEndOfFile

  DeleteFileW

  GetThreadLocale

  UnmapViewOfFile

  GetFullPathNameW

  GetTempFileNameW

  CreateDirectoryW

  GetLocalTime

  SetFilePointer

  GetComputerNameW

  CreateFileA

  GetProcessHeap

  GetModuleHandleA

  CopyFileW

  MoveFileExW

  GlobalFree

  GlobalAlloc

  GetFileSizeEx

  GetCurrentDirectoryW

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  RaiseException

  GetConsoleCP

  GetConsoleMode

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  FormatMessageW

  HeapSetInformation

  GetStartupInfoW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  Sleep

  GetProcAddress

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  GetModuleFileNameW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  GetLastError

  InterlockedDecrement

  HeapCreate

  VirtualFree

  HeapFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  FreeLibrary

  InterlockedExchange

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapAlloc

  VirtualAlloc

  HeapReAlloc

  RtlUnwind

  HeapSize

  GetLocaleInfoA

  WideCharToMultiByte

  GetStringTypeA

  MultiByteToWideChar

  GetStringTypeW

  LCMapStringA

  LCMapStringW

  GetTimeZoneInformation

  CompareStringW

  InitializeCriticalSection

  CloseHandle

  LocalFree

  ReleaseMutex

  GetVersionExW

  GetProcessId

  ReadFile

  CreateNamedPipeW

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  WaitForSingleObject

  OpenProcess

  CreateFileW

  SetFilePointerEx

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  VerifyVersionInfoW

  VerSetConditionMask

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  GetWindowsDirectoryW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetDateFormatW

  GetSystemTime

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  SetFileAttributesW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  GetExitCodeProcess

  SetThreadExecutionState

  FlushFileBuffers

  msi

  ord171

  ord45

  ord137

  ord125

  ord17

  ord8

  ord141

  ord238

  ord190

  ord88

  ord90

  ord173

  ord111

  ord70

  ord169

  ord118

  ord115

  ord116

  ord205

  shell32

  SHGetFolderPathW

  ShellExecuteExW

  CommandLineToArgvW

  rpcrt4

  UuidCreate

  wininet

  HttpQueryInfoW

  InternetCrackUrlW

  InternetSetOptionW

  InternetConnectW

  InternetCloseHandle

  InternetOpenW

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  wintrust

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  CryptCATAdminCalcHashFromFileHandle

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  gdi32

  DeleteDC

  DeleteObject

  GetObjectW

  CreateCompatibleDC

  SelectObject

  StretchBlt

  cabinet

  ord23

  ord22

  ord20

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  SetNamedSecurityInfoW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  RegSetValueExW

  InitializeSecurityDescriptor

  SetEntriesInAclA

  SetSecurityDescriptorOwner

  SetSecurityDescriptorGroup

  SetSecurityDescriptorDacl

  RegOpenKeyExW

  GetTokenInformation

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  CloseServiceHandle

  ChangeServiceConfigW

  DecryptFileW

  SetEntriesInAclW

  InitializeAcl

  CreateWellKnownSid

  InitiateSystemShutdownExW

  GetUserNameW

  RegQueryValueExW

  RegDeleteValueW

  RegCloseKey

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  QueryServiceConfigW

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  ole32

  CLSIDFromProgID

  CoInitializeSecurity

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  CoInitializeEx

  CoUninitialize

  StringFromGUID2

  user32

  LoadBitmapW

  IsWindow

  PostMessageW

  PeekMessageW

  GetMessageW

  GetWindowLongW

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  CreateWindowExW

  RegisterClassW

  MsgWaitForMultipleObjects

  LoadCursorW

  PostQuitMessage

  GetCursorPos

  MonitorFromPoint

  GetMonitorInfoW

  PostThreadMessageW

  MessageBoxW

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  Sections

  .text

  Size: 312KB - Virtual size: 312KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcredist2012_x86.exe

  .exe windows:5 windows x86 arch:x86

  33c6db41ca15b47cfcec52de6c2ab2b7

  
  

  Code Sign

  33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  04-09-2012 21:12

  Not After

  04-12-2013 21:12

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  24-01-2013 22:33

  Not After

  24-04-2014 22:33

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  24-09-2013 17:41

  Not After

  24-12-2014 17:41

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  51:3c:0e:d0:e9:29:66:d4:05:e1:26:24:9d:da:d9:c0:63:79:c5:68:38:c7:69:c5:25:f3:62:ab:0e:b8:a4:f6

  Signer

  Actual PE Digest

  51:3c:0e:d0:e9:29:66:d4:05:e1:26:24:9d:da:d9:c0:63:79:c5:68:38:c7:69:c5:25:f3:62:ab:0e:b8:a4:f6

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  8c:12:40:11:a9:d9:22:02:f1:9b:18:34:2a:70:2d:89:dc:3c:69:a5

  Signer

  Actual PE Digest

  8c:12:40:11:a9:d9:22:02:f1:9b:18:34:2a:70:2d:89:dc:3c:69:a5

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  E:\delivery\Dev\wix36_dev11\build\ship\x86\x86\burn.pdb

  Imports

  kernel32

  CopyFileExW

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  ResetEvent

  SetEndOfFile

  DeleteFileW

  GetThreadLocale

  UnmapViewOfFile

  GetFullPathNameW

  GetTempFileNameW

  CreateDirectoryW

  GetLocalTime

  SetFilePointer

  GetComputerNameW

  CreateFileA

  GetProcessHeap

  GetModuleHandleA

  CopyFileW

  MoveFileExW

  GlobalFree

  GlobalAlloc

  GetFileSizeEx

  GetCurrentDirectoryW

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  RaiseException

  GetConsoleCP

  GetConsoleMode

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  FormatMessageW

  HeapSetInformation

  GetStartupInfoW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  Sleep

  GetProcAddress

  ExitProcess

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  GetModuleFileNameW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  DeleteCriticalSection

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  GetLastError

  InterlockedDecrement

  HeapCreate

  VirtualFree

  HeapFree

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  EnterCriticalSection

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  FreeLibrary

  InterlockedExchange

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  HeapAlloc

  VirtualAlloc

  HeapReAlloc

  RtlUnwind

  HeapSize

  GetLocaleInfoA

  WideCharToMultiByte

  GetStringTypeA

  MultiByteToWideChar

  GetStringTypeW

  LCMapStringA

  LCMapStringW

  GetTimeZoneInformation

  CompareStringW

  InitializeCriticalSection

  CloseHandle

  LocalFree

  ReleaseMutex

  GetVersionExW

  GetProcessId

  ReadFile

  CreateNamedPipeW

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  WaitForSingleObject

  OpenProcess

  CreateFileW

  SetFilePointerEx

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  VerifyVersionInfoW

  VerSetConditionMask

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  GetWindowsDirectoryW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetDateFormatW

  GetSystemTime

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  SetFileAttributesW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  GetExitCodeProcess

  SetThreadExecutionState

  FlushFileBuffers

  msi

  ord171

  ord45

  ord137

  ord125

  ord17

  ord8

  ord141

  ord238

  ord190

  ord88

  ord90

  ord173

  ord111

  ord70

  ord169

  ord118

  ord115

  ord116

  ord205

  shell32

  SHGetFolderPathW

  ShellExecuteExW

  CommandLineToArgvW

  rpcrt4

  UuidCreate

  wininet

  HttpQueryInfoW

  InternetCrackUrlW

  InternetSetOptionW

  InternetConnectW

  InternetCloseHandle

  InternetOpenW

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  wintrust

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  CryptCATAdminCalcHashFromFileHandle

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  gdi32

  DeleteDC

  DeleteObject

  GetObjectW

  CreateCompatibleDC

  SelectObject

  StretchBlt

  cabinet

  ord23

  ord22

  ord20

  advapi32

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  SetNamedSecurityInfoW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryInfoKeyW

  RegSetValueExW

  InitializeSecurityDescriptor

  SetEntriesInAclA

  SetSecurityDescriptorOwner

  SetSecurityDescriptorGroup

  SetSecurityDescriptorDacl

  RegOpenKeyExW

  GetTokenInformation

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  CloseServiceHandle

  ChangeServiceConfigW

  DecryptFileW

  SetEntriesInAclW

  InitializeAcl

  CreateWellKnownSid

  InitiateSystemShutdownExW

  GetUserNameW

  RegQueryValueExW

  RegDeleteValueW

  RegCloseKey

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  QueryServiceConfigW

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  ole32

  CLSIDFromProgID

  CoInitializeSecurity

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  CoInitializeEx

  CoUninitialize

  StringFromGUID2

  user32

  LoadBitmapW

  IsWindow

  PostMessageW

  PeekMessageW

  GetMessageW

  GetWindowLongW

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  CreateWindowExW

  RegisterClassW

  MsgWaitForMultipleObjects

  LoadCursorW

  PostQuitMessage

  GetCursorPos

  MonitorFromPoint

  GetMonitorInfoW

  PostThreadMessageW

  MessageBoxW

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  Sections

  .text

  Size: 312KB - Virtual size: 312KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcredist2013_x64.exe

  .exe windows:5 windows x86 arch:x86

  8e2588a9cf43886de3449dfff03137b6

  
  

  Code Sign

  33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  07-09-2016 17:58

  Not After

  07-09-2018 17:58

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  18-08-2016 20:17

  Not After

  02-11-2017 20:17

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  17-11-2016 22:09

  Not After

  17-02-2018 22:09

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  d2:15:be:d8:35:8b:b3:7c:e3:4d:4d:50:1d:e6:91:02:c5:a1:a4:0d:b3:8f:12:4d:59:61:61:e5:59:2d:0e:e7

  Signer

  Actual PE Digest

  d2:15:be:d8:35:8b:b3:7c:e3:4d:4d:50:1d:e6:91:02:c5:a1:a4:0d:b3:8f:12:4d:59:61:61:e5:59:2d:0e:e7

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  44:91:26:71:a4:e4:9a:f9:12:6b:88:da:fb:ae:ae:f6:69:04:19:21

  Signer

  Actual PE Digest

  44:91:26:71:a4:e4:9a:f9:12:6b:88:da:fb:ae:ae:f6:69:04:19:21

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

  Imports

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipDeleteGraphics

  GdipFree

  GdipCloneImage

  GdipDisposeImage

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateBitmapFromResource

  GdipCreateFromHDC

  GdipSetInterpolationMode

  GdipDrawImageRectI

  GdipAlloc

  advapi32

  QueryServiceConfigW

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteValueW

  RegQueryValueExW

  GetUserNameW

  InitiateSystemShutdownExW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  DecryptFileW

  ChangeServiceConfigW

  ControlService

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  RegQueryInfoKeyW

  RegSetValueExW

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  RegOpenKeyExW

  GetTokenInformation

  CheckTokenMembership

  AllocateAndInitializeSid

  FreeSid

  LookupAccountNameW

  SetNamedSecurityInfoW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  user32

  GetMessageW

  PeekMessageW

  PostMessageW

  IsWindow

  PostQuitMessage

  GetWindowLongW

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  MsgWaitForMultipleObjects

  WaitForInputIdle

  LoadCursorW

  BeginPaint

  EndPaint

  GetCursorPos

  MonitorFromPoint

  GetMonitorInfoW

  ReleaseDC

  MessageBoxW

  PostThreadMessageW

  RegisterClassW

  CreateWindowExW

  oleaut32

  VariantClear

  VariantInit

  SysAllocString

  SysFreeString

  gdi32

  GetDeviceCaps

  CreateDCW

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  CoUninitialize

  CoInitializeEx

  StringFromGUID2

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  GetCurrentProcess

  InitializeCriticalSection

  TlsFree

  DeleteCriticalSection

  CloseHandle

  TlsGetValue

  Sleep

  GetLastError

  ReleaseMutex

  TlsSetValue

  TlsAlloc

  GetCurrentThreadId

  GetVersionExW

  GetModuleHandleW

  ReadFile

  SetFilePointerEx

  CreateFileW

  GetCurrentProcessId

  GetProcessId

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  CompareStringW

  LocalFree

  CreateNamedPipeW

  WaitForSingleObject

  OpenProcess

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  LeaveCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetProcAddress

  VerifyVersionInfoW

  VerSetConditionMask

  GetComputerNameW

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  HeapAlloc

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetDateFormatW

  GetSystemTime

  InterlockedExchange

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  SetFileAttributesW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  HeapSetInformation

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetEndOfFile

  ResetEvent

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  DeleteFileW

  GetThreadLocale

  GetTimeZoneInformation

  TerminateProcess

  UnhandledExceptionFilter

  SystemTimeToTzSpecificLocalTime

  SystemTimeToFileTime

  GlobalAlloc

  IsProcessorFeaturePresent

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  EncodePointer

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  GlobalFree

  MoveFileExW

  CopyFileW

  GetFileSizeEx

  GetModuleHandleA

  RaiseException

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  RtlUnwind

  SetFilePointer

  WideCharToMultiByte

  GetConsoleCP

  GetConsoleMode

  HeapSize

  HeapReAlloc

  LCMapStringW

  MultiByteToWideChar

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  GetLocalTime

  UnmapViewOfFile

  IsDebuggerPresent

  DuplicateHandle

  HeapFree

  FormatMessageW

  GetTempFileNameW

  GetWindowsDirectoryW

  CompareStringA

  FreeEnvironmentStringsW

  GetModuleFileNameW

  GetStdHandle

  DecodePointer

  ExitProcess

  SetUnhandledExceptionFilter

  GetStartupInfoW

  GetCommandLineW

  GetFullPathNameW

  CreateDirectoryW

  GetProcessHeap

  cabinet

  ord22

  ord20

  ord23

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  msi

  ord88

  ord17

  ord125

  ord116

  ord115

  ord118

  ord8

  ord171

  ord205

  ord45

  ord137

  ord141

  ord238

  ord190

  ord169

  ord90

  ord173

  ord111

  ord70

  rpcrt4

  UuidCreate

  wininet

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  InternetSetOptionW

  InternetOpenW

  HttpQueryInfoW

  InternetCrackUrlW

  InternetConnectW

  wintrust

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  CryptCATAdminCalcHashFromFileHandle

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  Sections

  .text

  Size: 229KB - Virtual size: 228KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 104KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcredist2013_x86.exe

  .exe windows:5 windows x86 arch:x86

  8e2588a9cf43886de3449dfff03137b6

  
  

  Code Sign

  33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  07-09-2016 17:58

  Not After

  07-09-2018 17:58

  Subject

  CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  18-08-2016 20:17

  Not After

  02-11-2017 20:17

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:33:26:1a:00:00:00:00:00:31

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  31-08-2010 22:19

  Not After

  31-08-2020 22:29

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  17-11-2016 22:09

  Not After

  17-02-2018 22:09

  Subject

  CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  52:23:3d:61:a3:c7:a5:8d:8d:8c:82:da:a0:4b:34:8f:7b:f4:1d:29:40:64:85:23:a9:3c:34:b5:c4:85:42:3f

  Signer

  Actual PE Digest

  52:23:3d:61:a3:c7:a5:8d:8d:8c:82:da:a0:4b:34:8f:7b:f4:1d:29:40:64:85:23:a9:3c:34:b5:c4:85:42:3f

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  55:93:21:ff:30:02:58:ca:25:32:ed:9f:50:2b:ee:cc:82:3b:d9:62

  Signer

  Actual PE Digest

  55:93:21:ff:30:02:58:ca:25:32:ed:9f:50:2b:ee:cc:82:3b:d9:62

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

  Imports

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipDeleteGraphics

  GdipFree

  GdipCloneImage

  GdipDisposeImage

  GdipGetImageWidth

  GdipGetImageHeight

  GdipCreateBitmapFromResource

  GdipCreateFromHDC

  GdipSetInterpolationMode

  GdipDrawImageRectI

  GdipAlloc

  advapi32

  QueryServiceConfigW

  CryptAcquireContextW

  CryptCreateHash

  CryptHashData

  CryptGetHashParam

  CryptDestroyHash

  CryptReleaseContext

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegDeleteValueW

  RegQueryValueExW

  GetUserNameW

  InitiateSystemShutdownExW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  DecryptFileW

  ChangeServiceConfigW

  ControlService

  CloseServiceHandle

  QueryServiceStatus

  OpenServiceW

  OpenSCManagerW

  RegQueryInfoKeyW

  RegSetValueExW

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  RegOpenKeyExW

  GetTokenInformation

  CheckTokenMembership

  AllocateAndInitializeSid

  FreeSid

  LookupAccountNameW

  SetNamedSecurityInfoW

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  user32

  GetMessageW

  PeekMessageW

  PostMessageW

  IsWindow

  PostQuitMessage

  GetWindowLongW

  SetWindowLongW

  DefWindowProcW

  UnregisterClassW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  MsgWaitForMultipleObjects

  WaitForInputIdle

  LoadCursorW

  BeginPaint

  EndPaint

  GetCursorPos

  MonitorFromPoint

  GetMonitorInfoW

  ReleaseDC

  MessageBoxW

  PostThreadMessageW

  RegisterClassW

  CreateWindowExW

  oleaut32

  VariantClear

  VariantInit

  SysAllocString

  SysFreeString

  gdi32

  GetDeviceCaps

  CreateDCW

  shell32

  ShellExecuteExW

  SHGetFolderPathW

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoCreateInstance

  CoInitialize

  CoUninitialize

  CoInitializeEx

  StringFromGUID2

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  GetCurrentProcess

  InitializeCriticalSection

  TlsFree

  DeleteCriticalSection

  CloseHandle

  TlsGetValue

  Sleep

  GetLastError

  ReleaseMutex

  TlsSetValue

  TlsAlloc

  GetCurrentThreadId

  GetVersionExW

  GetModuleHandleW

  ReadFile

  SetFilePointerEx

  CreateFileW

  GetCurrentProcessId

  GetProcessId

  WriteFile

  ConnectNamedPipe

  SetNamedPipeHandleState

  lstrlenW

  CompareStringW

  LocalFree

  CreateNamedPipeW

  WaitForSingleObject

  OpenProcess

  lstrlenA

  RemoveDirectoryW

  GetFileAttributesW

  ExpandEnvironmentStringsW

  LeaveCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetProcAddress

  VerifyVersionInfoW

  VerSetConditionMask

  GetComputerNameW

  GetTempPathW

  GetSystemDirectoryW

  GetSystemWow64DirectoryW

  GetVolumePathNameW

  HeapAlloc

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetDateFormatW

  GetSystemTime

  InterlockedExchange

  LoadLibraryW

  InterlockedCompareExchange

  GetExitCodeThread

  CreateThread

  SetEvent

  WaitForMultipleObjects

  CreateEventW

  ProcessIdToSessionId

  InterlockedIncrement

  InterlockedDecrement

  GetStringTypeW

  SetFileAttributesW

  FindClose

  FindNextFileW

  FindFirstFileW

  CreateProcessW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  HeapSetInformation

  MapViewOfFile

  CreateFileMappingW

  CreateMutexW

  SetEndOfFile

  ResetEvent

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CreateFileA

  GetSystemTimeAsFileTime

  VirtualFree

  VirtualAlloc

  DeleteFileW

  GetThreadLocale

  GetTimeZoneInformation

  TerminateProcess

  UnhandledExceptionFilter

  SystemTimeToTzSpecificLocalTime

  SystemTimeToFileTime

  GlobalAlloc

  IsProcessorFeaturePresent

  GetTickCount

  QueryPerformanceCounter

  HeapCreate

  SetLastError

  EncodePointer

  GetFileType

  InitializeCriticalSectionAndSpinCount

  SetHandleCount

  GetEnvironmentStringsW

  GlobalFree

  MoveFileExW

  CopyFileW

  GetFileSizeEx

  GetModuleHandleA

  RaiseException

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  RtlUnwind

  SetFilePointer

  WideCharToMultiByte

  GetConsoleCP

  GetConsoleMode

  HeapSize

  HeapReAlloc

  LCMapStringW

  MultiByteToWideChar

  SetStdHandle

  WriteConsoleW

  FlushFileBuffers

  GetLocalTime

  UnmapViewOfFile

  IsDebuggerPresent

  DuplicateHandle

  HeapFree

  FormatMessageW

  GetTempFileNameW

  GetWindowsDirectoryW

  CompareStringA

  FreeEnvironmentStringsW

  GetModuleFileNameW

  GetStdHandle

  DecodePointer

  ExitProcess

  SetUnhandledExceptionFilter

  GetStartupInfoW

  GetCommandLineW

  GetFullPathNameW

  CreateDirectoryW

  GetProcessHeap

  cabinet

  ord22

  ord20

  ord23

  crypt32

  CertGetCertificateContextProperty

  CryptHashPublicKeyInfo

  msi

  ord88

  ord17

  ord125

  ord116

  ord115

  ord118

  ord8

  ord171

  ord205

  ord45

  ord137

  ord141

  ord238

  ord190

  ord169

  ord90

  ord173

  ord111

  ord70

  rpcrt4

  UuidCreate

  wininet

  InternetCloseHandle

  HttpAddRequestHeadersW

  HttpOpenRequestW

  InternetErrorDlg

  InternetReadFile

  HttpSendRequestW

  InternetSetOptionW

  InternetOpenW

  HttpQueryInfoW

  InternetCrackUrlW

  InternetConnectW

  wintrust

  WinVerifyTrust

  WTHelperGetProvSignerFromChain

  WTHelperProvDataFromStateData

  CryptCATAdminCalcHashFromFileHandle

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  Sections

  .text

  Size: 229KB - Virtual size: 228KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 104KB - Virtual size: 104KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcredist2015_2017_2019_2022_x64.exe

  .exe windows:5 windows x86 arch:x86

  1a5cdbf711fee14b077e599d13fddab2

  
  

  Code Sign

  33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2023 19:51

  Not After

  16-10-2024 19:51

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  48:e8:f4:91:26:a0:28:7f:3c:b2:27:8c:31:c5:37:ba:fe:08:0f:62:c8:41:e0:34:65:b4:31:42:a2:15:af:ad

  Signer

  Actual PE Digest

  48:e8:f4:91:26:a0:28:7f:3c:b2:27:8c:31:c5:37:ba:fe:08:0f:62:c8:41:e0:34:65:b4:31:42:a2:15:af:ad

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  C:\agent\_work\8\s\build\ship\x86\burn.pdb

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyExW

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  InitiateSystemShutdownExW

  GetUserNameW

  RegQueryValueExW

  RegDeleteValueW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  DecryptFileW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  ChangeServiceConfigW

  CloseServiceHandle

  ControlService

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  SetNamedSecurityInfoW

  CheckTokenMembership

  AllocateAndInitializeSid

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  SetSecurityDescriptorOwner

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumValueW

  RegEnumKeyExW

  RegDeleteKeyW

  RegCreateKeyExW

  GetTokenInformation

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextW

  QueryServiceConfigW

  user32

  GetMessageW

  PostMessageW

  IsWindow

  WaitForInputIdle

  PostQuitMessage

  PeekMessageW

  MsgWaitForMultipleObjects

  PostThreadMessageW

  GetMonitorInfoW

  MonitorFromPoint

  IsDialogMessageW

  LoadCursorW

  LoadBitmapW

  SetWindowLongW

  GetWindowLongW

  GetCursorPos

  MessageBoxW

  CreateWindowExW

  UnregisterClassW

  RegisterClassW

  DefWindowProcW

  DispatchMessageW

  TranslateMessage

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  gdi32

  CreateCompatibleDC

  DeleteObject

  SelectObject

  StretchBlt

  GetObjectW

  DeleteDC

  shell32

  SHGetFolderPathW

  CommandLineToArgvW

  ShellExecuteExW

  ole32

  CoUninitialize

  CoInitializeEx

  CoInitialize

  StringFromGUID2

  CoCreateInstance

  CoTaskMemFree

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  CloseHandle

  CreateFileW

  GetProcAddress

  LocalFree

  HeapSetInformation

  GetLastError

  GetModuleHandleW

  FormatMessageW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  LCMapStringW

  Sleep

  GetLocalTime

  GetModuleFileNameW

  ExpandEnvironmentStringsW

  GetTempPathW

  GetTempFileNameW

  CreateDirectoryW

  GetFullPathNameW

  CompareStringW

  GetCurrentProcessId

  WriteFile

  SetFilePointer

  LoadLibraryW

  GetSystemDirectoryW

  CreateFileA

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  FindClose

  GetCommandLineW

  GetCurrentDirectoryW

  RemoveDirectoryW

  SetFileAttributesW

  GetFileAttributesW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  MoveFileExW

  GetCurrentProcess

  GetCurrentThreadId

  InitializeCriticalSection

  DeleteCriticalSection

  ReleaseMutex

  GetEnvironmentStringsW

  TlsGetValue

  TlsSetValue

  TlsFree

  CreateProcessW

  GetVersionExW

  VerSetConditionMask

  FreeLibrary

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTime

  GetNativeSystemInfo

  GetModuleHandleExW

  GetWindowsDirectoryW

  GetSystemWow64DirectoryW

  GetComputerNameW

  VerifyVersionInfoW

  GetVolumePathNameW

  GetDateFormatW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetStringTypeW

  ReadFile

  SetFilePointerEx

  DuplicateHandle

  InterlockedExchange

  InterlockedCompareExchange

  CreateEventW

  ProcessIdToSessionId

  OpenProcess

  GetProcessId

  WaitForSingleObject

  ConnectNamedPipe

  SetNamedPipeHandleState

  CreateNamedPipeW

  CreateThread

  GetExitCodeThread

  SetEvent

  WaitForMultipleObjects

  InterlockedIncrement

  InterlockedDecrement

  ResetEvent

  SetEndOfFile

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CompareStringA

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  MapViewOfFile

  UnmapViewOfFile

  CreateMutexW

  CreateFileMappingW

  GetThreadLocale

  IsValidCodePage

  FreeEnvironmentStringsW

  TlsAlloc

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  DecodePointer

  WriteConsoleW

  GetModuleHandleA

  GlobalAlloc

  GlobalFree

  GetFileSizeEx

  CopyFileW

  VirtualAlloc

  VirtualFree

  SystemTimeToTzSpecificLocalTime

  GetTimeZoneInformation

  SystemTimeToFileTime

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  SetCurrentDirectoryW

  FindFirstFileExW

  GetFileType

  GetACP

  ExitProcess

  GetStdHandle

  LoadLibraryExW

  InitializeCriticalSectionAndSpinCount

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RaiseException

  RtlUnwind

  SetLastError

  LoadLibraryExA

  rpcrt4

  UuidCreate

  Sections

  .text

  Size: 294KB - Virtual size: 293KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 123KB - Virtual size: 122KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 224B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• vcredist2015_2017_2019_2022_x86.exe

  .exe windows:5 windows x86 arch:x86

  1a5cdbf711fee14b077e599d13fddab2

  
  

  Code Sign

  33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2023 19:51

  Not After

  16-10-2024 19:51

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e8:0a:d7:e5:13:99:94:d9:9a:4e:9c:aa:c2:b6:13:8e:29:c8:5f:99:05:8c:05:b6:0d:fa:b1:ad:95:1d:b0:3c

  Signer

  Actual PE Digest

  e8:0a:d7:e5:13:99:94:d9:9a:4e:9c:aa:c2:b6:13:8e:29:c8:5f:99:05:8c:05:b6:0d:fa:b1:ad:95:1d:b0:3c

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

  IMAGE_FILE_NET_RUN_FROM_SWAP

  PDB Paths

  C:\agent\_work\8\s\build\ship\x86\burn.pdb

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyExW

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  InitiateSystemShutdownExW

  GetUserNameW

  RegQueryValueExW

  RegDeleteValueW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  DecryptFileW

  CreateWellKnownSid

  InitializeAcl

  SetEntriesInAclW

  ChangeServiceConfigW

  CloseServiceHandle

  ControlService

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatus

  SetNamedSecurityInfoW

  CheckTokenMembership

  AllocateAndInitializeSid

  SetEntriesInAclA

  SetSecurityDescriptorGroup

  SetSecurityDescriptorOwner

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  RegSetValueExW

  RegQueryInfoKeyW

  RegEnumValueW

  RegEnumKeyExW

  RegDeleteKeyW

  RegCreateKeyExW

  GetTokenInformation

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextW

  QueryServiceConfigW

  user32

  GetMessageW

  PostMessageW

  IsWindow

  WaitForInputIdle

  PostQuitMessage

  PeekMessageW

  MsgWaitForMultipleObjects

  PostThreadMessageW

  GetMonitorInfoW

  MonitorFromPoint

  IsDialogMessageW

  LoadCursorW

  LoadBitmapW

  SetWindowLongW

  GetWindowLongW

  GetCursorPos

  MessageBoxW

  CreateWindowExW

  UnregisterClassW

  RegisterClassW

  DefWindowProcW

  DispatchMessageW

  TranslateMessage

  oleaut32

  SysFreeString

  SysAllocString

  VariantInit

  VariantClear

  gdi32

  CreateCompatibleDC

  DeleteObject

  SelectObject

  StretchBlt

  GetObjectW

  DeleteDC

  shell32

  SHGetFolderPathW

  CommandLineToArgvW

  ShellExecuteExW

  ole32

  CoUninitialize

  CoInitializeEx

  CoInitialize

  StringFromGUID2

  CoCreateInstance

  CoTaskMemFree

  CoInitializeSecurity

  CLSIDFromProgID

  kernel32

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  CloseHandle

  CreateFileW

  GetProcAddress

  LocalFree

  HeapSetInformation

  GetLastError

  GetModuleHandleW

  FormatMessageW

  lstrlenA

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  LCMapStringW

  Sleep

  GetLocalTime

  GetModuleFileNameW

  ExpandEnvironmentStringsW

  GetTempPathW

  GetTempFileNameW

  CreateDirectoryW

  GetFullPathNameW

  CompareStringW

  GetCurrentProcessId

  WriteFile

  SetFilePointer

  LoadLibraryW

  GetSystemDirectoryW

  CreateFileA

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  FindClose

  GetCommandLineW

  GetCurrentDirectoryW

  RemoveDirectoryW

  SetFileAttributesW

  GetFileAttributesW

  DeleteFileW

  FindFirstFileW

  FindNextFileW

  MoveFileExW

  GetCurrentProcess

  GetCurrentThreadId

  InitializeCriticalSection

  DeleteCriticalSection

  ReleaseMutex

  GetEnvironmentStringsW

  TlsGetValue

  TlsSetValue

  TlsFree

  CreateProcessW

  GetVersionExW

  VerSetConditionMask

  FreeLibrary

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemTime

  GetNativeSystemInfo

  GetModuleHandleExW

  GetWindowsDirectoryW

  GetSystemWow64DirectoryW

  GetComputerNameW

  VerifyVersionInfoW

  GetVolumePathNameW

  GetDateFormatW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  GetStringTypeW

  ReadFile

  SetFilePointerEx

  DuplicateHandle

  InterlockedExchange

  InterlockedCompareExchange

  CreateEventW

  ProcessIdToSessionId

  OpenProcess

  GetProcessId

  WaitForSingleObject

  ConnectNamedPipe

  SetNamedPipeHandleState

  CreateNamedPipeW

  CreateThread

  GetExitCodeThread

  SetEvent

  WaitForMultipleObjects

  InterlockedIncrement

  InterlockedDecrement

  ResetEvent

  SetEndOfFile

  SetFileTime

  LocalFileTimeToFileTime

  DosDateTimeToFileTime

  CompareStringA

  GetExitCodeProcess

  SetThreadExecutionState

  CopyFileExW

  MapViewOfFile

  UnmapViewOfFile

  CreateMutexW

  CreateFileMappingW

  GetThreadLocale

  IsValidCodePage

  FreeEnvironmentStringsW

  TlsAlloc

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  DecodePointer

  WriteConsoleW

  GetModuleHandleA

  GlobalAlloc

  GlobalFree

  GetFileSizeEx

  CopyFileW

  VirtualAlloc

  VirtualFree

  SystemTimeToTzSpecificLocalTime

  GetTimeZoneInformation

  SystemTimeToFileTime

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  SetCurrentDirectoryW

  FindFirstFileExW

  GetFileType

  GetACP

  ExitProcess

  GetStdHandle

  LoadLibraryExW

  InitializeCriticalSectionAndSpinCount

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RaiseException

  RtlUnwind

  SetLastError

  LoadLibraryExA

  rpcrt4

  UuidCreate

  Sections

  .text

  Size: 294KB - Virtual size: 293KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 123KB - Virtual size: 122KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .wixburn

  Size: 512B - Virtual size: 56B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 224B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ