ReasonLabs-EPP-setup[.]exe

resource
ReasonLabs-EPP-setup.exe
unpack001/$0/cs-CZ/RavStub.resources.dll
unpack001/$0/da-DK/RavStub.resources.dll
unpack001/$0/de-DE/RavStub.resources.dll
unpack001/$0/de/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/el-GR/RavStub.resources.dll
unpack001/$0/es-ES/RavStub.resources.dll
unpack001/$0/es/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/fi-FI/RavStub.resources.dll
unpack001/$0/fil-PH/RavStub.resources.dll
unpack001/$0/fr-FR/RavStub.resources.dll
unpack001/$0/fr/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/hi-IN/RavStub.resources.dll
unpack001/$0/hr-HR/RavStub.resources.dll
unpack001/$0/hu-HU/RavStub.resources.dll
unpack001/$0/id-ID/RavStub.resources.dll
unpack001/$0/it-IT/RavStub.resources.dll
unpack001/$0/it/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/ja-JP/RavStub.resources.dll
unpack001/$0/ko-KR/RavStub.resources.dll
unpack001/$0/nb-NO/RavStub.resources.dll
unpack001/$0/nl-NL/RavStub.resources.dll
unpack001/$0/pl-PL/RavStub.resources.dll
unpack001/$0/pl/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/pt-BR/RavStub.resources.dll
unpack001/$0/pt-PT/RavStub.resources.dll
unpack001/$0/pt/RavStub.resources.dll
unpack001/$0/ro-RO/RavStub.resources.dll
unpack001/$0/ru-RU/RavStub.resources.dll
unpack001/$0/ru/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/sk-SK/RavStub.resources.dll
unpack001/$0/sl-SI/RavStub.resources.dll
unpack001/$0/sl/RavStub.resources.dll
unpack001/$0/sv-SE/RavStub.resources.dll
unpack001/$0/th-TH/RavStub.resources.dll
unpack001/$0/tr-TR/RavStub.resources.dll
unpack001/$0/vi-VN/RavStub.resources.dll
unpack001/$0/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/zh-CN/RavStub.resources.dll
unpack001/$0/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll
unpack001/$0/zh-TW/RavStub.resources.dll
unpack001/$PLUGINSDIR/System.dll

ReasonLabs-EPP-setup.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 ad1a6967d927bf514233371b5ad7bf2b4beed79d517eccf43bab671b2390bafb
MD5 7e5c992dce119ed1ec5be91f40637cf3
SHA1 989e7f3b1e0b18e6a3e174dfa8a9a42974e6d0d4
SHA512 1f897a8a6f0f0303123b7e8e9e5f4c73ed0a4af268f525931ec8e7a7f34dd5c4b89c20cea80479706469b39d0ca0e3f9627ded73b0f5a2eadf98c238ec3382a7
SSDEEP 49152:1dlGbParmF6IuCiTBQe+MbjC5/7aee7OAru:1dlMpF+CMQeRC5/7+7Ol
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$0/ArchiveUtilityx64.dll

IMPHASH cb2522c235c4b2b8d93d6f45fce93571
SHA256 54329adbf13f43aa42fc0cee286058b1fb7e1bad5ab7f716bd1965af1f160ccc
MD5 b104f3c5615f0d77452de8c7d6714441
SHA1 63603797e75b9173ac3594c073045b5987ce2164
SHA512 bce8fd7885b2bb82bfd2a6bfbe78e6fb39e03c5a62ee22ab1baf0187a75a3e2d579bce99ecb6500380cafe24418683c04f1fe856c1eb554f03b61b7cf1ba17e7
SSDEEP 3072:TAZpz3eQkXBlJ6pM91zgrn4oul5ntwcKosOct7B1uP8ji:TAvzD6l0+1grn4itjuUji
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

36400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\rsStub\rsStub\x64\Release\ArchiveUtility.pdb

kernel32

CreateDirectoryW GetLastError WriteFile ReadFile SetFilePointer CloseHandle CreateFileW WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$0/Microsoft.Win32.TaskScheduler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c64b9752e159f0527fa288c55553f7d0dcc5ea0e9622c7b7f6f5b4caa1d8b121
MD5 0a02c8f405b1241cafaa9e4e868f3506
SHA1 33223b08bd45cb36103f959cce9c121aae376846
SHA512 1e0f811cf039a46bd108c2563832a178badc4a2b9b9e46b63b1b0e71d782f3724406376ca0e5cb77be4301807f39a72677f5748bae4e35cd6310dfe05220e936
SSDEEP 3072:n1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5Df5:n1sSmRIt/xhtsOju1DH5NXnIKAcLNU3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

339330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb

$0/RAVEndPointProtection-installer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b0edf2eb2128571d64c9f8106c275ae7dd99273229c268c75e5204acd549dd42
MD5 2d981249f032f3b4df178564c484edbd
SHA1 ca6bc68ed2013548576d84a759d58483b7291e04
SHA512 dc1e2a8d0d71d9d123c18fe6cb3785b4cae841c3fa014127125076ab8e74ff383f0201a40e484c00cdaac0081c651ad1afe95cdebdcd155629df9c6321942de9
SSDEEP 12288:5ZlEVgIQtZM1A0+Nwhq3drt0ZAP9yZzrOZW4blKxnFY4:5Ze661A0ue8lCZAPcZzrOZW4blqO4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

362978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\rsStub\rsStub\RavStub\obj\Release\RavStub.pdb

$0/System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 72f3b8ce2f6b9c8638cda791654cb814d117a346a490303e9451a59308982f5e
MD5 1d541d17703139bd2eb6145e7e15e499
SHA1 c5cbd2f667ec2a8ea6cb8abeb924cb92d1d63b4f
SHA512 e091123732b7b8b88629f296daf6fb39fbec8d10a56f0925fe22956bf6530fc530213dd8ca2b490ad41078c3359261899e56a96bef77b72670b5e87567b5558e
SSDEEP 6144:HruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmb:CNWx6xz+nRo2GGWHQZMaLyJSJFNFaFeQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

360554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb

$0/System.ValueTuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0346f8f8a64bb5a3bc74378352252e6c1787310ae31ff969e8a1c1af2bca98c9
MD5 e186977fdb4af4fc2c157cfa306389e8
SHA1 b5df38a70fafcdbbcecca6a553dc444bcb6b480c
SHA512 ebdf37d9a1c08de2b8e688cc9023399bcf81efdec18da5b66905a08628cc0b32fb05980570a7c977afa69ef582980fea6c0a56a4039c9fd9ef50a2bcee068234
SSDEEP 1536:v784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAt9bP8Fvx:v7NV8v36tI0XCKA/bP8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

68354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb

$0/cs-CZ/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 85001323a5c6bd7dfb4e1d1986c31d06ed5101059bde4d2064880a423485d1fb
MD5 bb8f9ea5efe569479e24b0eba3732a77
SHA1 71b869aa704693f8db1f8b178687ee4d483571ca
SHA512 234ec8da67ada2311cd6eb3d978b2e82159263477d4fb917e2ce7fd40ba2d366a98cfa9d0da6ac19db213d6f79f605a16f78a8a280607934946e1b9f089dbd94
SSDEEP 192:uIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YV1:u3pQ8vQToxMi5emzUA8rYgLIOrnz8uun
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/da-DK/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1141a4572ff7829f7c44c58e251741cf17f7e1380e88a5f2b30370126d302542
MD5 6a9efaa4a794867c94f3beb1953ec277
SHA1 12b8f92ab1416ceb3effdf499000a31a6b38582b
SHA512 90753f40cee60328b7acd5114874741e545bc25d94d55e1d3d01e716323bc369862a41d79b4ee23814f78436ef5592d11301b3f62e1e76522ced193675954061
SSDEEP 192:iIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHn:iXN3EsVfvVx8rUrb+M0lIVixNqiomyJz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/de-DE/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cf439402b877157bcdc709a634a02ab5285fbdb95a31824b52ae60fe21b1fbe
MD5 1115ded3b3a9cd2b7019ebc6903f3cad
SHA1 cedd9418a61e9a301154828a4578cb1890bc725f
SHA512 56537d7c7a9f28de752e39e3539210267cc73a463d5669a1e1b5711e5d7df531df19454c811435508f5cf9bedf9b2d1383d387f568552acfec8d49b0b970f35f
SSDEEP 384:L5rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndai3s8i:oPAKtnHOdvPhO2dmyndai3s8i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/de/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6909a1c134d0285fba2422a40ea0e65c1f0ca3c3ef2b94a1166015af2a87780f
MD5 f83d720b236576c7d1f9f55d3bb988f9
SHA1 105a4993e92646b5dbb50518187abe07ca473276
SHA512 fd8a464f2bc9d5b6c2efa80348c3a9362f7473d4d632b2addad8c272e8874e7e67c15b99b67e6515906b86d01d57cd42f9f0f1e9251c0af93a9391ccc30e3202
SSDEEP 192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/el-GR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5deaa13a6b0c52d7f7a468fe889b376bac8f68d62cfcb906a1dd58ab57d0816
MD5 80cdf809b95246efa9214d4b383afd8b
SHA1 a8bdfea9a8165a16dbca49d18f051aa6c4ca658a
SHA512 47c5f3ce5afbd1c3768b5b40669cb3cef243e4d29342963010d647b244d732981d823742d001804533fba355434a607f32fd60022a35ae1bebb436b6be251ba6
SSDEEP 384:9npUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozTpi3s8o:hJs5xEGzfOPMvMFi3s8o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/es-ES/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 60fa660c5771c4d40407becd299bf7de70728b5d42cc89a2fc81db1aabce0f10
MD5 ce06bf8e4547cdb105782119458b00ef
SHA1 780be2048b3aacbcb945282f1a33d756039c82c5
SHA512 e71a16d2e12e19f9c99184420d900e6122f2a2831fd4a318ffc6328419c1ce08195214376984c2ce0612c0f6e42db94f1161cbcdbf82b6d43d1e538782ad45d0
SSDEEP 192:JIYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7K:JuGe/V0ni6wxCjfpzocEs5dMvkcDqPD0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/es/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e893c6907da8d68c03b1a10e68b554ad5a8c0533f15912106f32e925f2beabf0
MD5 15db634b70d6d9d6cd41baae3f02eb14
SHA1 1456ffe09df896271a746f9cb40a230f188ad397
SHA512 1230e5368d4dab9776d57056993669327e95fe72e262efa541ed5d43abc1bcd3618db13b6bd6b3a27da053c103e3fb647eae759ccaeb443f7d9ffd1ecaa1122b
SSDEEP 192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fi-FI/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 05b72c9aa8652d52f2e7ac621e7e7b46cd0fd59c8e67fa2b328c80043cef6de1
MD5 9c1ff8aac0a4524af5c7db7a3632c574
SHA1 d3a9d1bd68dae7912b3f825e05fb18f6fc6a42b1
SHA512 76bb6f5fcec931b46df42ba72ab9869c580779b66a21ab1458deafb20b143e856c641a94460f401b743a98344a2aa1c1e1b6efb45153b1f3eaf3b5d12ab3eb34
SSDEEP 192:/xIYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUii:/xRkNcDtxJMxAM2+9Ul/laxRe8ZGGWgP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fil-PH/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4d0631fb0dbc2a7f2193913c29f94f3b00f91f642c9772979313950a672a8a15
MD5 37e2795d8c12bcfedacfe6f3a245f61c
SHA1 d96e684768f1eaaaa5504ee49d3f18f678d75950
SHA512 0bce277199350ab72c4bf0bb9bafd04b57fbdc1ebade8143a87597cea088b7ed168d4c97524e4afe2097eae332002c415fc40793dec407281e7340295d38a24a
SSDEEP 192:G0Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmy:G0Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fr-FR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b1bcca1a231c041d9718540f92937fee921b3f98a12e9d84eb849dd1e775ae66
MD5 c1a32e72e5555e7f5405498f2a2f559a
SHA1 a927d6774da87faaee74b7310f5e7b10e8e35e72
SHA512 50b6a9b1be63b4c97b2aaff785ce2c6ed9bdc07d99418994c9c7e08a2f865e67f1a0055d233ac916e28442b5441656a577b4850bedfe3c4fdf09b4c6eac3a6fa
SSDEEP 384:UY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXki3s8D:qBImyDM5DtyXwGY7uXki3s8D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/fr/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e3ee50e08124a7603be7d996dcf596eb0d3f9c603768e86e003f7b942d7097f3
MD5 3b4621370addcf4306669c9e7e45c865
SHA1 ea1ab3c499e946e152c1fc4a63fa99e1f9be94b4
SHA512 586755f32d16afd937bfc1fe3c52210ab815d5d4c904de101150fa052a94babfcbdc465669ff8c2537b782474658d7912037ddb76d8c9a8fd34715d1fe7b2857
SSDEEP 192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hi-IN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e2c653a16935da084aaf3be366deb79561b769cd734e4dd9218cfa0518be0bd
MD5 ab0cd79d6c7da739e5ed76479805cb4e
SHA1 92fc5167a1dd5da60da4b5df4440251d84853153
SHA512 b59113bd303ad2cf2e4feadc2603661adbce16bd6954c3670118b450ccb29cb84ec3779aaccb303627060018ea8b3fa167314d6c6d2d87d570040331c97dcf70
SSDEEP 384:tME5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac7diU:ZXJsO57hOt9AZnttxKq3i3s8Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hr-HR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 62444292be59be27c847286f80317580dbdb9d2a0c1a5287e96ba9c566765687
MD5 961a7f6409f8005baef5e92e69c87b8d
SHA1 117dbb53da54940ea4a8aae8e95e4ac23f5b2235
SHA512 c9a4939a22d7323629e7c44433dec0da92cfc70ae6491b7cd442ca9b354902ad5e910850f00ec912c14263d82bb8f52a637d1d52447bf4d3a4ae8d1743bd19b6
SSDEEP 192:aIYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWt:a1DpBwSkoZPxZlrPY92kGetEQII2oANo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/hu-HU/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cdc3d97de4b3cb11a2c1e5d4c298081a095187aaa3353a6f18729119eb5f7e93
MD5 a47296c69dec1801c2b0dd7f7f6d6a0a
SHA1 037db6df5e4cd9928d99a8b5078a1b753c97e93e
SHA512 30ea10fdfe57b198bac18474b1ff071aec1bafbb76755a07cdfeb0665ac05f6853d91945f3d900e76e88e55681d6605e767f78c513bd7acc60745743fe8c83a8
SSDEEP 384:OdpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfEi3s8Z:+4gNrBnOVlgcekILfpltci3s8Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/id-ID/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1093c8680641c7290fa38c9bb10bf9c41c1018364067da3ef4da6d93f7c8aafa
MD5 ddeab12eedf85525d741c406bcc2ba72
SHA1 7532bc024d6df15d0dc7326b49a5aaeada95f491
SHA512 e9c8a6310cb19e2d9d4f99c3211f5b120e44a4710a6815ef08b787f5b8490342c92b1674c854037ef1ee147b06ebcdafc8822878b9231af2a9d10aff6385b8e3
SSDEEP 192:nqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGCt:nqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2S/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/it-IT/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6af294b33c97a9c10fef07874b48d710d2d39373a916a475d523fc37797dbac3
MD5 96ee027378fa6cec267990dc21062232
SHA1 b355452e58af3b57f73a7383c3b470a56e2d4b5b
SHA512 5ee7bbefeeb96f714a75965cd2426e2d9b71f6c4783011eba7fd0e92a1ecda600a36b75025fc36e49a0bda7940df39bee5591e4faa65a3d6b3c157a9d4d52c81
SSDEEP 192:rIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIps:r3kupX/GSQxZdNYBRXvujVf9UOwGvwwr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/it/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d0493e38d8b3fcc7efa4916fea1eea69ee6449bf435e1869c1bc3f54d4090c5
MD5 1c331da4bce2809e16913c02e385576e
SHA1 cf8e71e030347749596a53d1b13b9e9583ec0527
SHA512 2871119690f3df0f244384a3f5f65ffe7cf17f1f00f6b530512aedeb8397c9e357079e8fba76d2a5bf6be4e2b18e4ac1ac104ea2d29f8f40cef6f30a905ecf83
SSDEEP 192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ja-JP/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 48792f12983b98ea0eec93b42f1a752e456cf3224828200a560efe2dc30ea6ac
MD5 ca3b74ffcde1fafb254bd92fa557b6fa
SHA1 34333989eaf15c63a286cf435c24993a51b87049
SHA512 ee49d4335a28d18a1025da07ef132a5da89f33011c5c860af5e00112192243fd4a4b7716b485aa77eb628234cbbb6b5ba5d916fa0ae7b00871ff4470091da90b
SSDEEP 384:3xwAHD6CkxQdCnvRl/oRHx8asale681v/Zi3s8V:OCkSdK0t81vxi3s8V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ko-KR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a289e70f3d63e8318906a1c819957b769a01d68ca33fc10a91068b5c3855ecfb
MD5 e7e5c80c2ea92c27e8e6fb99e643b661
SHA1 5502cc25aca8b4329a3701fd8af282a88eb36782
SHA512 2cdaf30b97ab5fb84f3eae34d9dab52e9c23a3ef728f5eefc5587c65faf4f99a4ac607e7084f43799378d3f84aa51faa2884fecc990d2c749c2656ca1f9d4490
SSDEEP 384:PFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDui3s8r:KdKv+WqV2ZLToU9wXi/uSi3s8r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/nb-NO/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 eea8a84874c12468b2e4cf6124987e39f097b3059d1635264b3cd2cff9abb828
MD5 2eb03c09c8c0e6417cf893748c4b0480
SHA1 ec7c44a746e82eec0fc177460de11ba8ccd98836
SHA512 0d6b2b6da0ffcba89edbb2d461948a62607faf0e5d3e089bcc5861248c6c571f70c9bd1b87a80c921a1eda0b5981a4910ba3f65c1e09f9cc0671a164d698aae0
SSDEEP 192:iIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEV:iZsK6epv3qxh7EFBYn1p4hVYTqhTAEGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/nl-NL/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4add8e125f8a73cbeaa74b8021d0de2dcdf033508b54980f8163894bb95c3b5a
MD5 5e6913c3d7cbdca201f1e9e12cadd693
SHA1 70b5b87c5842dd9ce3039a2f13c429bea16a5ffb
SHA512 295819f739f5440a74d9b912b4e77b48d5bbe6f2df08bc39e09e7bd93aead0925f7934637b5f60fac77dc271ce1add147c3ec3ca8a980b5f0db060354e0c1188
SSDEEP 192:atIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZF:mTN1X2HQTxklOVylzyOl/dEf80OCQPAg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pl-PL/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 202e9c763ed7d3067f60da141036e817f347df3e08858b5de29c3e63a64a36dd
MD5 116fe315f42d44df323698e7a3567aeb
SHA1 a68231f9c34232c741a7549ce71b0ee30ad5ad01
SHA512 e67755a0b494bf93a69d7d2e9811380a3047cdd48af6cb823e711b414354c5cd40a66084a83e43e156f5a2c33e4b1002179c9d59b34c5f46931f2f8995b84379
SSDEEP 192:OIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsg:OZp3Dcr2NAcLxE6oMy50rtbxn/Xi9Wds
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pl/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6e58d86c42b61226dd7af35d7c9432ce6f0982d1d0d5a2f4120e8abc5c787a02
MD5 b60817a69e314b22f746917c826da53e
SHA1 7d2785a6d1a53a0717c986b959af67de6f9300e4
SHA512 9a8f029329ce105b3f72fee623e3ab8c88e1af45f86fab61f81be418b2d70f83e4c0466010d312240a01e1ef8f9b9926ebf43e25bdc3c364c2d28ab9b0e5f6fc
SSDEEP 192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt-BR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6470212da284c3334d672b5e26b8f96d1074be1d4c4e47190e3aa0826ceef0a2
MD5 0ab334df39819004f18536a46c3981f6
SHA1 50127064b8be0a91e213b3f790a82636fac10a55
SHA512 4e832c881e9101177e2a64a56615cd9340fa0368bdd190a7442b485cab08c12412aa6a2701584b041faf7eeba7ee286c0748e9489402147f6a5d25172adbd15e
SSDEEP 192:qIY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afky:qrnlNK/xIDx+sQ0Y4EQujHOVZgdBtofY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt-PT/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 402ea4709cc1201d07c46b6700656e75521c116a9c6ed4c7e5eb8d0085e6c468
MD5 5937672ced4bf0ab68d59553623695e3
SHA1 62e73831946c9a12db915eca9a0e8a796de8225b
SHA512 8958f373f8e2bb76dea6d22fa0d3da24bb5892ab32053027fe7687136a54eac8630c56e1a78b986592ea3b66209433fe49c5e12dad63f89a4f37f98c8abdbbbc
SSDEEP 192:cIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4H:crnlNKNu7xKgUOVBQ6Bo19sPTLM80aoe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/pt/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e591acdf2890128e0288574452a7b477486ac34e580edcbb067748f2168d9ca5
MD5 0c09f8e9af263b54a7a3e61320ae99b0
SHA1 84eafe96644929e5430cda30e37ed377139c13cd
SHA512 3d3320f8896048c3935e835d38ed2b41da2a408ed7dec6ee11f83a7d829ce7db96dd2e9e514438ee040d82365223f4ece5005f00e9006409edfa90c567d63e20
SSDEEP 192:4IY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4t:4rnlNKNu7xKgUOVBQ6Bo19sPTLM80ao4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ro-RO/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dd8895afd40ee3d57d50e9d2cd092a487d403555486505775cd1ec727ef4a8ad
MD5 3f665dcebb1f994af9a3d0d1e79bf632
SHA1 75cd3e35670053fe195d2f306dfc7c7fcfa1b223
SHA512 939ddfa3881cff4cbe3b777d705b4c656b534f49ee626c11aa4421b617fa5caa010a33d7b2f999c45069076af7e769a28dc2b64d9d25d7278d1c1ea3f47635ef
SSDEEP 192:yxIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBb:EapuUhg7sJxWgAm/45t6lSertvHrDap8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/rsAtom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 644e94ae7c737f1c8b57812e98c6e65e549f41156ee38bb0c8f63b9615ff5cd1
MD5 d77c7b8568817142b699917d5f72030e
SHA1 257441949d058e2621af4a6ccf0eb79d32735265
SHA512 34419b4d9da12d2ce92d07b2547ff501411e666fc225ff92069b9d300710c337b14e64b73f3efb1e0794ea6f4da1ef8c864088c2e776814cfed37e9f4d3a65b7
SSDEEP 3072:j6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUTP8V:j6lrhISL9e1oWE56ndQ19aY9FjuUV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

151742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsAtom.pdb

$0/rsDatabase.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0787813a1d86f232da51cd9fa40a17a059e705c0bd8381d7555c2c25326c4d28
MD5 588cd3a08fea09219680fd57df0f7e31
SHA1 26a7b2609287f48097da35b326eadf52a5da16fa
SHA512 f05613fe9c2e45a0c8ff817c8f3a41d569b2c18c00cc177f66c96e2ec5713ed08c97300e0b97d42429104a38c807eeb74f13bb2267772b8c1c066c34b2f221f8
SSDEEP 3072:MR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555J:P1TcpihOk0KvvvvnPPH6Gi5tPArrYeiM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

161822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsDatabase.pdb

$0/rsJSON.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 64bab7cfa3356a2d312220b76323d1fb20139f7be7994e3a450872eb9890245a
MD5 ae304a14fc37c16db2acd42a8a214f77
SHA1 b10f11a59789c0ff11ea656bf71047ca69215120
SHA512 f1599aff57da0e001ca185da76b5d04bc1a88ed2de30ff43f6b961d6896b7960c5f54567091d446fa6f2e0b9ceeb8d823fae94a7d39ecf3eb60201061f8720e1
SSDEEP 6144:EqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dtYU9:EQYLlw2cB4x9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

214270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsJSON.pdb

$0/rsLogger.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d124ae3f63900d0802f69917d0f5bd7faabfecb2154c2e02226f0e5106cbbd1c
MD5 8ae8ddc3fd55e624659e1710dec8167a
SHA1 f692412b34574a702023deed3c0ab555332c992b
SHA512 10eb92d6fc7f66d3c94935de013b21740cdc02536aeabc62d2630abdc90ef2f7d2c205cbaa872641175b3244f1e837d9b362d2591cb3fa579ce1f34cc48a7500
SSDEEP 3072:D0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3iP8hoI:wRkD/0Q7IMCP3ePOUBRqKep5jSUhoI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

172702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsLogger.pdb

$0/rsStubLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f8972413f716ebd9695f7d5dad1cafe882d2f3c006844ef67ab25de55d4be21c
MD5 84a52f42935f346d7d1025795df1f643
SHA1 8642dbc0761ca2342eeead825d93b962b46c4e28
SHA512 2aace053d60c878554d29933568bb5b3c953671e64413f085bb836aeae2b5a0f659d30ee1ef2fadcda75e6267eab2b02310b6f37544adefe08407233f5bc0b7a
SSDEEP 6144:0kVPlpDkLrBdXEaqd9LsnlJEiYq46Ilf/zKMOnbkrgZBLwnkK0JCWKb74HyhVqiR:y4ogrgM02qi9lmwnliR/u
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

244226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb

$0/rsSyncSvc.exe

IMPHASH 0e997e653cae4b1b321d2d1e22c31054
SHA256 f908e104e1386bd4abbd45430cdc4a58bc437d33f60f09c7ccbbc2209f759f30
MD5 245d68860868023b81f3c8f373455d23
SHA1 087ceb29a384fd82cee39e015087cbc0937e0e82
SHA512 a6a6fefb30a48b2db0208da9a6eb31fa81e515482e52c367584befd8bce234da6d31f737c0b6016e0b31ead88c974c49e2aaf36c7cb87745c72b5e1d01fd7ca7
SSDEEP 12288:PkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1O7:NJll87GY2q61llaOZBjKt5qquO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

403608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

GetProcessHeap GetModuleHandleW WTSGetActiveConsoleSessionId GetProcAddress Process32FirstW Process32NextW ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess GetSystemPowerStatus GetLocaleInfoEx GetModuleFileNameA CloseHandle SetEvent CreateEventW WaitForSingleObject GetModuleFileNameW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP OutputDebugStringW LocalFree GetLastError LocalAlloc SetStdHandle HeapSize WriteConsoleW QueryPerformanceFrequency FlushFileBuffers GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetStdHandle FormatMessageA WideCharToMultiByte GetCurrentDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx MultiByteToWideChar QueryPerformanceCounter RtlUnwind GetStringTypeW GetCurrentThreadId Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess

advapi32

OpenServiceW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegQueryInfoKeyW RegCloseKey OpenProcessToken CreateProcessAsUserW DuplicateTokenEx RegisterServiceCtrlHandlerExW CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W DeleteService ControlService StartServiceW StartServiceCtrlDispatcherW RegCreateKeyExW

shell32

SHGetKnownFolderPath

ole32

CoInitializeEx CoCreateGuid CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

SysFreeString VariantClear SysAllocString

crypt32

CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

urlmon

URLDownloadToFileA

powrprof

GetPwrCapabilities

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpSendRequest WinHttpConnect

Name

.text

Size

599KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$0/rsTime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d886ee4eb27c47cca78db93c89d44d8ec9c26ee305b0ba0ea381e3018096ee2
MD5 87678c116dfcced2109724edafcc24b1
SHA1 92736d8ed0dc8f0476a0baee2d378e9e4c5ae0db
SHA512 72ae911fa3a206aff5cb9678811ce39f9b3252f2bd3b10e5b2e8032edcc4036cfd2eb131408f77f5d19d6533c16089902e5bb443df20f35eb2935de2562421b9
SSDEEP 3072:eWGjyLgosGplJLT7AwoTFGmrY6sW6P8KD:ewgBGplJX7AHGm8DUKD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,ST=New York,C=US

Serial Number

ba:cc:6b:c7:a7:07:b8:6f:34:56:7d:a1:2d:68:c3:0d

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2023 - Jan 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

124142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rsTime.pdb

$0/ru-RU/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2b51621e2b6c3bbd7e1cfcc4649f3f9c496ecb15f41d9d897ef9754c404c0fb4
MD5 5bebecad3114449be2c99b9df19f4874
SHA1 203c10b7ea64e34effbef37c89cbd3f50a2e2085
SHA512 f0ca2f78df7116cf37dd96e6d93ad2dd4ab35fbed7c9ccce361d6d18201bae759202416272541577258cbd66f7b227e063ba2f791e77dcfead2d043ca724896d
SSDEEP 384:jZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiii3s8E:VaL88/sd0QF7jiii3s8E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/ru/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a1d5fdac027144bcaa0e8110f4de717e80944420c59708b3dd8e2bd31bc7ed4
MD5 dade13e423762bdae745d57ca3dc86ef
SHA1 7b4122cbef771c5548a7cb5641b6db6743c8c3f6
SHA512 77f5050ba87e8abeb92298d16897d6cec087ffb7b4c38442c854a0993b398de529c15b5674adaacfb3e39ce05165f05a38337b2dbd41e8a7d806751542f6e8d3
SSDEEP 192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sk-SK/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f156187eabc3a1c6184a0882ad2a7f18bab670474265601ef58ca1619495d733
MD5 20e81e6aab9c9015e36d9e726a50c71e
SHA1 26798eea97b13a471b2ffbc0f9cc1ccf1fbe750d
SHA512 5a519a4eb8f5a7338dbded5e8665731c600c4bb7ca316c7af189a55e49091140c1477a57c1053afdd445e1487652be5a519f5e3decd7c1a894d4ff975a75d220
SSDEEP 192:vIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2:v41uOKl7hx9mX+41CLUMZc/ZOPVYJN68
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sl-SI/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 758070cb3dd1d0b4f09a312a6beae79a894c8c76c67dba6f49de015e9be07787
MD5 ec7553329d7da821faf6b955646dd0ce
SHA1 8ba8359617ff3421457e3f602f57f200509aaff7
SHA512 0d39820cfa924c4bc9640a09ed225515007b3d7f7d78b3b864a93a9084e1fa040ece3ab9b80e54b78f79c7fb02423fc097f8387e16bbc946e9390fac84149b57
SSDEEP 192:/IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZu:/TAGeXyuMxUY+iZWBei3gW0dFOaEe3Cf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sl/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b04b60a863f49d3ab4fa3ea40bdbee04b139664ae9c0119b8a6c1f7fe2021f5e
MD5 8bc7347792337c9faf5531fc95e743e1
SHA1 4d3ab59ebbbe4e0e22b00a4f25198e1eea097602
SHA512 853f450ae92d26e9450372f8123d72222e718580ef8c0ef22ca187c35db05bbc757bdb53e79dd77d40bb82cd1d0c7bad9830d166608e18e1a9601fbf5c54d3e9
SSDEEP 192:8IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZD:8TAGeXyuMxUY+iZWBei3gW0dFOaEe3Cy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/sv-SE/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f534a7c1303f8fdae656ee37915018f7cdd40a311301f5a6252f75d17f1b500d
MD5 013adfc05de5dd8b4e4e20a5d767a109
SHA1 d203f5f3cf7aeb5f30a8a98d3bdcadf257544115
SHA512 40a95e51dc9223158881197827d892d5fcce95e808d9260dcee8bc77670e84d4cabaf8bd1b06cf51b23098f6f231297db384bb9086ab4360cc38d9b0ae5d9e44
SSDEEP 192:NhIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvW:NhUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/th-TH/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dae63d6ed0ec6e4b026888256e201e800712836900ab45962fa9e4eec0773c23
MD5 836b78c8f86a9f5ababf78db011e591a
SHA1 d23e60a132e216e02c99b4f73bdd39c75a7297b8
SHA512 11d8ec43a93a013172ca59c9e9b06c626279767ec1a166f1c406137979356ae142ac1b6f8ae5880adc6396ca5aaa359a9661d374b9319e6ae24aa1a5b0766611
SSDEEP 384:tWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooZ:x7LHDFGh0EJviNhsFx55n5z5OPMuQ5mI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/tr-TR/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 291fc68c440b28c3c7b8d6702f13daaed8c9d6d4b12b4be02cee851bb6704f39
MD5 539504eab350d74efa0a5ab6b6b665d7
SHA1 48a68ff8d0be59be96ae4ff76d913042b0bf5486
SHA512 83ae12f33851d7d8f5e57899f18333068057c44cdac8da632c4832173c1b68cd2f6ad973b463f6fe8666258079077712387602b99aaf33b35f752727085c3654
SSDEEP 192:GIY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7ob:GKkciiwISxvnmkYsPV+tIqMvhBZYquLe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/uninstall-epp.ico

SHA256 0d3a05e1b06403f2130a6e827b1982d2af0495cdd42deb180ca0ce4f20db5058
MD5 af1c23b1e641e56b3de26f5f643eb7d9
SHA1 6c23deb9b7b0c930533fdbeea0863173d99cf323
SHA512 0c503ec7e83a5bfd59ec8ccc80f6c54412263afd24835b8b4272a79c440a0c106875b5c3b9a521a937f0615eb4f112d1d6826948ad5fb6fd173c5c51cb7168f4
SSDEEP 384:URqHi9xDnRbDPi6ag9rucqkerzUCgIMSfZHqdefc8+YZ9:SqmpD66h9lqkerzgIPfF+efc+
MD5 SHA1 SHA512 SSDEEP

$0/vi-VN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e274fe5f0634dd1f81755edd1cfe7a4f66c7923317b68c4975651c6692482f73
MD5 5b3e73d8474245a907d35cdfe346237f
SHA1 d80aedf5d8e01ba6802e5fc22fcf453951728293
SHA512 7389d1b029b1146959bebff4bb4a8074fcaa617e80cfebe09c8827287c5c04c6307f9696a9ed98bce47184c0f3f39efc1dc139ac892a487dd296cfec5c846907
SSDEEP 384:Mp4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2Msi3s8V:ZblbzC5jmtNeRN2pi3s8V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-CN/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aafbe48966dbc5372a308ab9501245ce261d2715f336ad1908c799d354c981a2
MD5 3cefec17baac089c54c8102a4cfd160c
SHA1 a54cd9bd4181a591937a99be88beb006279837de
SHA512 2d45193662c7ce2854ce2d3ee53ae199e094d09bc76d8d8a8e36b24ea60400a5f064ca16ce0078fe6cbdf4117c22565c04e47b99cd99868254c915db6d18700f
SSDEEP 192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-CN/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5167c04d900ee027ecb13ccb0907e39146a6d6dc961fc398b233aa3515a7dbed
MD5 fe6765984d7ddcc221a7a7dd88407a7f
SHA1 a336115dc261055aed3381dda3be086f3d49737a
SHA512 f5ee64d6e977276293fee6b3e160e8d8dc0da6ddc268c7346c1cd3eddfccf907ece7489e630d97bbab39c3fe4746b7a7d7f3423e524691a1b897aec3de20696a
SSDEEP 192:eIYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenTN:eRbXbaQixwYxzJSKqdy6eY5Rt/A7c+hi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-Hant/Microsoft.Win32.TaskScheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f8c769a357e6cd27452835e5288fe515fb50bfeec83ef3969975171174b467e5
MD5 833f269ba6f0c34f49273da7fbd7dce7
SHA1 d0253d322dcdf7f54e37c7e8911a8b77670d2967
SHA512 4fa315e23d985affb46f6536cdf2ddc1b882f47098ee2d5a4b954ddeeb8904d1c83182b1598e4948a59728339945307b699a147ecd813c0f91986d95bdc57184
SSDEEP 192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$0/zh-TW/RavStub.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 972d6bf83bbba3a6b7665d4b1b70907805dd27326a10664ac919d737f3d17b9b
MD5 de6f1963572cbabce32dd8ba3782c909
SHA1 d76e8821acdd7a4222a6315d9c371757ab7cf22f
SHA512 ba6865e668a1f5e4b071d99ae591ab923ad6180a7506d0273cd3a66054e7ceb2001b037635931a3157bfe10513965647d7fc6e653c9f61e249ad024b8028c5b9
SSDEEP 192:+IY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXB:+w6Y9TEVWxzJS9gSKiLwhcSSqgwmMGxZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer