antivirueses.zip
- SHA256 0f4d4462a002437dd96462df09c8ab92931b87accafeec923072591eff55fbb5
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
Errors
Reason
config extraction: CfgExtr crashed: 'BlackGuard' runtime error: slice bounds out of range [:5] with capacity 3
General
- Target antivirueses.zip
- Size 72.5MB
- Sample240824-mkap1swbjc
- SHA256 0f4d4462a002437dd96462df09c8ab92931b87accafeec923072591eff55fbb5
- MD5 b32657119f47584e0690fe963dc19066
- SHA1 e51370924321fb57fd5ac6b17ad5a08f23d94cc7
- SHA512 afe9799772a0b85be5d9a20f9bfc68f0abda21bdbf54765403e4e022560982c94c9aa6686cfa67ae935c5d63e942f049ab704c3e7ef5f8e80b88e4a202decd9a
- SSDEEP 1572864:zdBLDvMitoJCBWSDDY2EelMFEwSwT2CPB3uTnLz8hRrl:xBLD7sCsr2zkEwLD3uTnLCRrl
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Blackguard family
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/$PLUGINSDIR/nsRandom.dll acprotect -
resource yara_rule static1/unpack002/$PLUGINSDIR/nsRandom.dll upx - Unsigned PE 198 IoCs
Checks for missing Authenticode signature.
resource unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.sys unpack002/$APPDATA/TotalAV/updates/SAVAPI 11.0.1/plg_fops_dummy.dll unpack002/$PLUGINSDIR/AccessControl.dll unpack002/$PLUGINSDIR/INetC.dll unpack002/$PLUGINSDIR/SysRestore.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/$PLUGINSDIR/nsExec.dll unpack002/$PLUGINSDIR/nsRandom.dll unpack003/out.upx unpack002/Accessibility.dll unpack002/BouncyCastle.Crypto.dll unpack002/DotNetZip.dll unpack002/EntityFramework.SqlServer.dll unpack002/EntityFramework.dll unpack002/HtmlAgilityPack.dll unpack002/Microsoft.AppCenter.Analytics.dll unpack002/Microsoft.AppCenter.Crashes.dll unpack002/Microsoft.AppCenter.dll unpack002/Microsoft.CSharp.dll unpack002/Microsoft.Extensions.Configuration.Abstractions.dll unpack002/Microsoft.Extensions.Configuration.Binder.dll unpack002/Microsoft.Extensions.Configuration.dll unpack002/Microsoft.Extensions.DependencyInjection.Abstractions.dll unpack002/Microsoft.Extensions.DependencyInjection.dll unpack002/Microsoft.Extensions.Logging.Abstractions.dll unpack002/Microsoft.Extensions.Logging.dll unpack002/Microsoft.Extensions.Options.dll unpack002/Microsoft.Win32.Primitives.dll unpack002/Microsoft.Win32.Registry.AccessControl.dll unpack002/Microsoft.Win32.Registry.dll unpack002/Microsoft.Win32.SystemEvents.dll unpack002/Mindscape.Raygun4Net.NetCore.Common.dll unpack002/Mindscape.Raygun4Net.NetCore.dll unpack002/NamedPipeServerStream.NetFrameworkVersion.dll unpack002/Netlib.dll unpack002/Newtonsoft.Json.dll unpack002/Nito.AsyncEx.Context.dll unpack002/Nito.AsyncEx.Coordination.dll unpack002/Nito.AsyncEx.Interop.WaitHandles.dll unpack002/Nito.AsyncEx.Oop.dll unpack002/Nito.AsyncEx.Tasks.dll unpack002/Nito.Cancellation.dll unpack002/Nito.Collections.Deque.dll unpack002/Nito.Disposables.dll unpack002/PresentationCore.dll unpack002/PresentationFramework-SystemCore.dll unpack002/PresentationFramework-SystemData.dll unpack002/PresentationFramework-SystemDrawing.dll unpack002/PresentationFramework-SystemXml.dll unpack002/PresentationFramework-SystemXmlLinq.dll unpack002/PresentationFramework.Aero.dll unpack002/PresentationFramework.Aero2.dll unpack002/PresentationFramework.AeroLite.dll unpack002/PresentationFramework.Classic.dll unpack002/PresentationFramework.Luna.dll unpack002/PresentationFramework.Royale.dll unpack002/PresentationFramework.dll unpack002/PresentationUI.dll unpack002/PropertyChanged.dll unpack002/ProtectedAPC.dll unpack002/ReachFramework.dll unpack002/SAVAPI/on_access/win32/win8/avgntflt.sys unpack002/SAVAPI/on_access/win32/win8/avipbb.sys unpack002/SAVAPI/on_access/win32/win8/avkmgr.sys unpack002/SAVAPI/on_access/win64/win8/avgntflt.sys unpack002/SAVAPI/on_access/win64/win8/avipbb.sys unpack002/SAVAPI/on_access/win64/win8/avkmgr.sys unpack002/SAVAPI/plg_fops_dummy.dll unpack002/SQLite.Interop.dll unpack002/SQLitePCLRaw.batteries_v2.dll unpack002/SQLitePCLRaw.nativelibrary.dll unpack002/SQLitePCLRaw.provider.dynamic_cdecl.dll unpack002/System.CodeDom.dll unpack002/System.Collections.Immutable.dll unpack002/System.Collections.NonGeneric.dll unpack002/System.Collections.Specialized.dll unpack002/System.ComponentModel.Annotations.dll unpack002/System.ComponentModel.Composition.Registration.dll unpack002/System.ComponentModel.Composition.dll unpack002/System.ComponentModel.EventBasedAsync.dll unpack002/System.ComponentModel.Primitives.dll unpack002/System.ComponentModel.TypeConverter.dll unpack002/System.ComponentModel.dll unpack002/System.Configuration.ConfigurationManager.dll unpack002/System.Data.Common.dll unpack002/System.Data.Odbc.dll unpack002/System.Data.OleDb.dll unpack002/System.Data.SQLite.EF6.dll unpack002/System.Data.SQLite.dll unpack002/System.Data.SqlClient.dll unpack002/System.Design.dll unpack002/System.Diagnostics.DiagnosticSource.dll unpack002/System.Diagnostics.EventLog.dll unpack002/System.Diagnostics.FileVersionInfo.dll unpack002/System.Diagnostics.PerformanceCounter.dll unpack002/System.DirectoryServices.AccountManagement.dll unpack002/System.DirectoryServices.Protocols.dll unpack002/System.DirectoryServices.dll unpack002/System.Drawing.Design.dll unpack002/System.Drawing.Primitives.dll unpack002/System.Drawing.dll unpack002/System.IO.Compression.Brotli.dll unpack002/System.IO.Compression.dll unpack002/System.IO.FileSystem.DriveInfo.dll unpack002/System.IO.FileSystem.Watcher.dll unpack002/System.IO.IsolatedStorage.dll unpack002/System.IO.MemoryMappedFiles.dll unpack002/System.IO.Packaging.dll unpack002/System.IO.Ports.dll unpack002/System.Linq.Expressions.dll unpack002/System.Linq.Parallel.dll unpack002/System.Linq.Queryable.dll unpack002/System.Linq.dll unpack002/System.Management.dll unpack002/System.Net.Http.dll unpack002/System.Net.NameResolution.dll unpack002/System.Net.Requests.dll unpack002/System.Net.ServicePoint.dll unpack002/System.Net.WebClient.dll unpack002/System.Net.WebHeaderCollection.dll unpack002/System.Net.WebProxy.dll unpack002/System.Net.WebSockets.Client.dll unpack002/System.Net.WebSockets.dll unpack002/System.ObjectModel.dll unpack002/System.Private.DataContractSerialization.dll unpack002/System.Private.ServiceModel.dll unpack002/System.Private.Xml.Linq.dll unpack002/System.Reflection.Context.dll unpack002/System.Reflection.DispatchProxy.dll unpack002/System.Reflection.Metadata.dll unpack002/System.Resources.Extensions.dll unpack002/System.Resources.Writer.dll unpack002/System.Runtime.Caching.dll unpack002/System.Runtime.CompilerServices.Unsafe.dll unpack002/System.Runtime.CompilerServices.VisualC.dll unpack002/System.Runtime.InteropServices.RuntimeInformation.dll unpack002/System.Runtime.Serialization.Primitives.dll unpack002/System.Security.AccessControl.dll unpack002/System.Security.Claims.dll unpack002/System.Security.Cryptography.Cng.dll unpack002/System.Security.Cryptography.Csp.dll unpack002/System.Security.Cryptography.Encoding.dll unpack002/System.Security.Cryptography.Pkcs.dll unpack002/System.Security.Cryptography.ProtectedData.dll unpack002/System.Security.Cryptography.X509Certificates.dll unpack002/System.Security.Cryptography.Xml.dll unpack002/System.Security.Permissions.dll unpack002/System.Security.Principal.Windows.dll unpack002/System.ServiceModel.Duplex.dll unpack002/System.ServiceModel.Http.dll unpack002/System.ServiceModel.NetTcp.dll unpack002/System.ServiceModel.Primitives.dll unpack002/System.ServiceModel.Security.dll unpack002/System.ServiceModel.Syndication.dll unpack002/System.ServiceModel.dll unpack002/System.Text.Encoding.CodePages.dll unpack002/System.Text.Json.dll unpack002/System.Threading.AccessControl.dll unpack002/System.Transactions.Local.dll unpack002/System.Web.HttpUtility.dll unpack002/System.Windows.Controls.Ribbon.dll unpack002/System.Windows.Extensions.dll unpack002/System.Windows.Forms.Design.Editors.dll unpack002/System.Windows.Forms.Design.dll unpack002/System.Windows.Input.Manipulations.dll unpack002/System.Windows.Presentation.dll unpack002/System.Xaml.dll unpack002/System.Xml.XPath.XmlDocument.dll unpack002/Trinet.Core.IO.Ntfs.dll unpack002/UIAutomationClient.dll unpack002/UIAutomationClientSideProviders.dll unpack002/UIAutomationProvider.dll unpack002/UIAutomationTypes.dll unpack002/Utilizr.NotifyIcon.dll unpack002/Utilizr.OpenVPN.dll unpack002/Utilizr.VPN.RasSharp.NetCore.dll unpack002/Utilzr.WPF.dll unpack002/Webshield.Client.dll unpack002/WindowsBase.dll unpack002/WindowsFormsIntegration.dll unpack002/avira.managed.remediation.dll unpack002/avira.managed.sdk.dll unpack002/avira.managed.update.dll unpack002/cachey-bashi.netcore.dll unpack002/e_sqlite3.dll unpack002/libcrypto-1_1.dll unpack002/libssl-1_1.dll unpack002/mscorlib.dll unpack002/netstandard.dll unpack002/nfregdrv.exe unpack002/pwm.dll unpack002/wscf.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/TotalAV_Setup.exe nsis_installer_1 static1/unpack001/TotalAV_Setup.exe nsis_installer_2
File Explorer
-
antivirueses.zip.zip 72.5MB
-
MBSetup.exe.exe 2.5MB
-
TotalAV_Setup.exe.exe 54.8MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aebb.dll.dll 93KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecore.dll.dll 310KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecrypto.dll.dll 163KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aedroid.dll.dll 2.7MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aedroid_gwf.dat4.2MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeemu.dll.dll 407KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeexp.dll.dll 386KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeexp_gwf.dat59KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aegen.dll.dll 742KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aehelp.dll.dll 323KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur.dll.dll 10.9MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_agen.dat2.1MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_gwf.dat912B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_mv.dat3.4MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelibinf.dll.dll 105KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelibinf_db.dat86KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelidb.dat86KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeml.dll.dll 340KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aemobile.dll.dll 369KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice.dll.dll 1.1MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice_gwf.dat30KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice_mv.dat2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aepack.dll.dll 863KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aerdl.dll.dll 1.1MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aesbx.dll.dll 1.6MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aescn.dll.dll 174KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aescript.dll.dll 1.3MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeset.dat3KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aevdf.dat5KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aevdf.dll.dll 188KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/ams_setup.exe.exe 171KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apc_random_id_generator.exe.exe 267KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apcfile.dll.dll 2.8MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apchash.dll.dll 144KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-apchash-product.conf266B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-on-access-savapilib-product.conf324B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapi-engine.conf304B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapi-product.conf265B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapilib-engine.conf315B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapilib-product.conf253B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-xvdfmerge-product.conf270B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate.exe.exe 2.8MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate_msg.avr6KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/cacert.crt5KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/README516B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll.dll 153KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.cat651B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.inf2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys.sys 152KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.cat647B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys.sys 169KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.cat647B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys.sys 35KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll.dll 153KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.inf2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys.sys 172KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys.sys 196KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys.sys 53KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll.dll 153KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.inf2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys.sys 216KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys.sys 172KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.cat7KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys.sys 35KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll.dll 153KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.inf2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys.sys 204KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.sys.sys 194KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.cat9KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.inf1KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.sys.sys 45KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/plg_fops_dummy.dll.dll 105KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/productname.dat16B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.conf32KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.dll.dll 2.8MB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.exe.exe 634KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_post.bat.bat .vbs 2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_pre.bat509B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_pretest.bat.bat .vbs 2KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_restart.exe.exe 126KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_stub.exe.exe 302KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapiclient.dll.dll 368KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/scew.dll.dll 338KB
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/update.bat702B
-
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/xvdfmerge.dll.dll 329KB
-
$PLUGINSDIR/AccessControl.dll.dll 13KB
-
$PLUGINSDIR/INetC.dll.dll 21KB
-
$PLUGINSDIR/SysRestore.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/modern-header.bmp86KB
-
$PLUGINSDIR/modern-wizard.bmp150KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/nsExec.dll.dll 6KB
-
$PLUGINSDIR/nsRandom.dll.dll 21KB
-
out.upx.dll 39KB
-
API-MS-Win-core-xstate-l2-1-0.dll.dll 12KB
-
Accessibility.dll.dll 10KB
-
AviraLib.dll.dll 1.0MB
-
AviraLib.dll.config545B
-
BouncyCastle.Crypto.dll.dll 2.3MB
-
Branding.Desktop.dll.dll 23KB
-
D3DCompiler_47_cor3.dll.dll 3.9MB
-
DirectWriteForwarder.dll.dll 468KB
-
DotNetZip.dll.dll 233KB
-
Engine.Win.dll.dll 871KB
-
EntityFramework.SqlServer.dll.dll 566KB
-
EntityFramework.dll.dll 4.7MB
-
GUI.Win.deps.json156KB
-
GUI.Win.dll.exe 1.9MB
-
GUI.Win.runtimeconfig.json422B
-
HtmlAgilityPack.dll.dll 156KB
-
LICENSE.txt57KB
-
Manifest/chrome-manifest.json626B
-
Manifest/edge-manifest.json443B
-
Manifest/firefox-manifest.json447B
-
Microsoft.AppCenter.Analytics.dll.dll 13KB
-
Microsoft.AppCenter.Crashes.dll.dll 41KB
-
Microsoft.AppCenter.dll.dll 129KB
-
Microsoft.CSharp.dll.dll 287KB
-
Microsoft.DiaSymReader.Native.x86.dll.dll 1.1MB
-
Microsoft.Extensions.Configuration.Abstractions.dll.dll 12KB
-
Microsoft.Extensions.Configuration.Binder.dll.dll 15KB
-
Microsoft.Extensions.Configuration.dll.dll 17KB
-
Microsoft.Extensions.DependencyInjection.Abstractions.dll.dll 27KB
-
Microsoft.Extensions.DependencyInjection.dll.dll 61KB
-
Microsoft.Extensions.Logging.Abstractions.dll.dll 38KB
-
Microsoft.Extensions.Logging.dll.dll 24KB
-
Microsoft.Extensions.Options.dll.dll 40KB
-
Microsoft.Extensions.Primitives.dll.dll 39KB
-
Microsoft.Toolkit.Uwp.Notifications.dll.dll 111KB
-
Microsoft.VisualBasic.Core.dll.dll 1.1MB
-
Microsoft.VisualBasic.dll.dll 16KB
-
Microsoft.Win32.Primitives.dll.dll 7KB
-
Microsoft.Win32.Registry.AccessControl.dll.dll 7KB
-
Microsoft.Win32.Registry.dll.dll 33KB
-
Microsoft.Win32.SystemEvents.dll.dll 40KB
-
Mindscape.Raygun4Net.NetCore.Common.dll.dll 64KB
-
Mindscape.Raygun4Net.NetCore.dll.dll 4KB
-
NamedPipeServerStream.NetFrameworkVersion.dll.dll 46KB
-
Netlib.dll.dll 114KB
-
Newtonsoft.Json.dll.dll 667KB
-
Nito.AsyncEx.Context.dll.dll 12KB
-
Nito.AsyncEx.Coordination.dll.dll 38KB
-
Nito.AsyncEx.Interop.WaitHandles.dll.dll 7KB
-
Nito.AsyncEx.Oop.dll.dll 5KB
-
Nito.AsyncEx.Tasks.dll.dll 31KB
-
Nito.Cancellation.dll.dll 7KB
-
Nito.Collections.Deque.dll.dll 15KB
-
Nito.Disposables.dll.dll 7KB
-
PasswordExtension.Win.deps.json140KB
-
PasswordExtension.Win.dll.exe 87KB
-
PasswordExtension.Win.exe.exe 250KB
-
PasswordExtension.Win.runtimeconfig.json422B
-
PenImc_cor3.dll.dll 136KB
-
PresentationCore.dll.dll 3.3MB
-
PresentationFramework-SystemCore.dll.dll 9KB
-
PresentationFramework-SystemData.dll.dll 8KB
-
PresentationFramework-SystemDrawing.dll.dll 7KB
-
PresentationFramework-SystemXml.dll.dll 8KB
-
PresentationFramework-SystemXmlLinq.dll.dll 6KB
-
PresentationFramework.Aero.dll.dll 230KB
-
PresentationFramework.Aero2.dll.dll 236KB
-
PresentationFramework.AeroLite.dll.dll 164KB
-
PresentationFramework.Classic.dll.dll 174KB
-
PresentationFramework.Luna.dll.dll 476KB
-
PresentationFramework.Royale.dll.dll 194KB
-
PresentationFramework.dll.dll 5.5MB
-
PresentationNative_cor3.dll.dll 917KB
-
PresentationUI.dll.dll 809KB
-
PropertyChanged.dll.dll 6KB
-
ProtectedAPC.dll.dll 21KB
-
ProtocolFilters.dll.dll 686KB
-
ReachFramework.dll.dll 607KB
-
SAVAPI/aebb.dll.dll 93KB
-
SAVAPI/aecore.dll.dll 310KB
-
SAVAPI/aecrypto.dll.dll 163KB
-
SAVAPI/aedroid.dll.dll 2.7MB
-
SAVAPI/aedroid_gwf.dat4.2MB
-
SAVAPI/aeemu.dll.dll 407KB
-
SAVAPI/aeexp.dll.dll 386KB
-
SAVAPI/aeexp_gwf.dat59KB
-
SAVAPI/aegen.dll.dll 742KB
-
SAVAPI/aehelp.dll.dll 323KB
-
SAVAPI/aeheur.dll.dll 10.9MB
-
SAVAPI/aeheur_agen.dat2.1MB
-
SAVAPI/aeheur_gwf.dat912B
-
SAVAPI/aeheur_mv.dat3.4MB
-
SAVAPI/aelibinf.dll.dll 105KB
-
SAVAPI/aelibinf_db.dat86KB
-
SAVAPI/aelidb.dat86KB
-
SAVAPI/aeml.dll.dll 340KB
-
SAVAPI/aemobile.dll.dll 369KB
-
SAVAPI/aeoffice.dll.dll 1.1MB
-
SAVAPI/aeoffice_gwf.dat30KB
-
SAVAPI/aeoffice_mv.dat2KB
-
SAVAPI/aepack.dll.dll 863KB
-
SAVAPI/aerdl.dll.dll 1.1MB
-
SAVAPI/aesbx.dll.dll 1.6MB
-
SAVAPI/aescn.dll.dll 174KB
-
SAVAPI/aescript.dll.dll 1.3MB
-
SAVAPI/aeset.dat3KB
-
SAVAPI/aevdf.dat5KB
-
SAVAPI/aevdf.dll.dll 188KB
-
SAVAPI/ams_setup.exe.exe 171KB
-
SAVAPI/apc_random_id_generator.exe.exe 267KB
-
SAVAPI/apcfile.dll.dll 2.8MB
-
SAVAPI/apchash.dll.dll 144KB
-
SAVAPI/avupdate-apchash-product.conf266B
-
SAVAPI/avupdate-on-access-savapilib-product.conf324B
-
SAVAPI/avupdate-savapi-engine.conf304B
-
SAVAPI/avupdate-savapi-product.conf265B
-
SAVAPI/avupdate-savapilib-engine.conf315B
-
SAVAPI/avupdate-savapilib-product.conf253B
-
SAVAPI/avupdate-xvdfmerge-product.conf270B
-
SAVAPI/avupdate.exe.exe 2.8MB
-
SAVAPI/avupdate_msg.avr6KB
-
SAVAPI/cacert.crt5KB
-
SAVAPI/on_access/README516B
-
SAVAPI/on_access/win32/win7/avgio.dll.dll 153KB
-
SAVAPI/on_access/win32/win7/avgntflt.cat651B
-
SAVAPI/on_access/win32/win7/avgntflt.inf2KB
-
SAVAPI/on_access/win32/win7/avgntflt.sys.sys 152KB
-
SAVAPI/on_access/win32/win7/avipbb.cat647B
-
SAVAPI/on_access/win32/win7/avipbb.inf1KB
-
SAVAPI/on_access/win32/win7/avipbb.sys.sys 169KB
-
SAVAPI/on_access/win32/win7/avkmgr.cat647B
-
SAVAPI/on_access/win32/win7/avkmgr.inf1KB
-
SAVAPI/on_access/win32/win7/avkmgr.sys.sys 35KB
-
SAVAPI/on_access/win32/win8/avgio.dll.dll 153KB
-
SAVAPI/on_access/win32/win8/avgntflt.cat9KB
-
SAVAPI/on_access/win32/win8/avgntflt.inf2KB
-
SAVAPI/on_access/win32/win8/avgntflt.sys.sys 172KB
-
SAVAPI/on_access/win32/win8/avipbb.cat9KB
-
SAVAPI/on_access/win32/win8/avipbb.inf1KB
-
SAVAPI/on_access/win32/win8/avipbb.sys.sys 196KB
-
SAVAPI/on_access/win32/win8/avkmgr.cat9KB
-
SAVAPI/on_access/win32/win8/avkmgr.inf1KB
-
SAVAPI/on_access/win32/win8/avkmgr.sys.sys 53KB
-
SAVAPI/on_access/win64/win7/avgio.dll.dll 153KB
-
SAVAPI/on_access/win64/win7/avgntflt.cat9KB
-
SAVAPI/on_access/win64/win7/avgntflt.inf2KB
-
SAVAPI/on_access/win64/win7/avgntflt.sys.sys 216KB
-
SAVAPI/on_access/win64/win7/avipbb.cat9KB
-
SAVAPI/on_access/win64/win7/avipbb.inf1KB
-
SAVAPI/on_access/win64/win7/avipbb.sys.sys 172KB
-
SAVAPI/on_access/win64/win7/avkmgr.cat7KB
-
SAVAPI/on_access/win64/win7/avkmgr.inf1KB
-
SAVAPI/on_access/win64/win7/avkmgr.sys.sys 35KB
-
SAVAPI/on_access/win64/win8/avgio.dll.dll 153KB
-
SAVAPI/on_access/win64/win8/avgntflt.cat9KB
-
SAVAPI/on_access/win64/win8/avgntflt.inf2KB
-
SAVAPI/on_access/win64/win8/avgntflt.sys.sys 204KB
-
SAVAPI/on_access/win64/win8/avipbb.cat9KB
-
SAVAPI/on_access/win64/win8/avipbb.inf1KB
-
SAVAPI/on_access/win64/win8/avipbb.sys.sys 194KB
-
SAVAPI/on_access/win64/win8/avkmgr.cat9KB
-
SAVAPI/on_access/win64/win8/avkmgr.inf1KB
-
SAVAPI/on_access/win64/win8/avkmgr.sys.sys 45KB
-
SAVAPI/plg_fops_dummy.dll.dll 105KB
-
SAVAPI/productname.dat16B
-
SAVAPI/savapi.conf32KB
-
SAVAPI/savapi.dll.dll 2.8MB
-
SAVAPI/savapi.exe.exe 634KB
-
SAVAPI/savapi_post.bat.bat .vbs 2KB
-
SAVAPI/savapi_pre.bat509B
-
SAVAPI/savapi_pretest.bat.bat .vbs 2KB
-
SAVAPI/savapi_restart.exe.exe 126KB
-
SAVAPI/savapi_stub.exe.exe 302KB
-
SAVAPI/savapiclient.dll.dll 368KB
-
SAVAPI/scew.dll.dll 338KB
-
SAVAPI/update.bat702B
-
SAVAPI/xvdfmerge.dll.dll 329KB
-
SOS_README.md277B
-
SQLite.Interop.dll.dll 1.3MB
-
SQLitePCLRaw.batteries_v2.dll.dll 5KB
-
SQLitePCLRaw.core.dll.dll 56KB
-
SQLitePCLRaw.nativelibrary.dll.dll 5KB
-
SQLitePCLRaw.provider.dynamic_cdecl.dll.dll 55KB
-
SSCore.dll.dll 150KB
-
Savapi.Net.dll.dll 90KB
-
SecurityService.deps.json158KB
-
SecurityService.dll.exe 70KB
-
SecurityService.exe.exe 268KB
-
SecurityService.runtimeconfig.json422B
-
SharedDesktop.dll.dll 206KB
-
System.AppContext.dll.dll 14KB
-
System.Buffers.dll.dll 14KB
-
System.CodeDom.dll.dll 166KB
-
System.Collections.Concurrent.dll.dll 168KB
-
System.Collections.Immutable.dll.dll 163KB
-
System.Collections.NonGeneric.dll.dll 34KB
-
System.Collections.Specialized.dll.dll 31KB
-
System.Collections.dll.dll 287KB
-
System.ComponentModel.Annotations.dll.dll 68KB
-
System.ComponentModel.Composition.Registration.dll.dll 35KB
-
System.ComponentModel.Composition.dll.dll 252KB
-
System.ComponentModel.DataAnnotations.dll.dll 16KB
-
System.ComponentModel.EventBasedAsync.dll.dll 14KB
-
System.ComponentModel.Primitives.dll.dll 21KB
-
System.ComponentModel.TypeConverter.dll.dll 253KB
-
System.ComponentModel.dll.dll 5KB
-
System.Configuration.ConfigurationManager.dll.dll 357KB
-
System.Configuration.dll.dll 18KB
-
System.Console.dll.dll 73KB
-
System.Core.dll.dll 23KB
-
System.Data.Common.dll.dll 932KB
-
System.Data.DataSetExtensions.dll.dll 14KB
-
System.Data.Odbc.dll.dll 245KB
-
System.Data.OleDb.dll.dll 338KB
-
System.Data.SQLite.EF6.dll.dll 180KB
-
System.Data.SQLite.dll.dll 345KB
-
System.Data.SqlClient.dll.dll 988KB
-
System.Data.dll.dll 25KB
-
System.Design.dll.dll 9KB
-
System.Diagnostics.Contracts.dll.dll 15KB
-
System.Diagnostics.Debug.dll.dll 14KB
-
System.Diagnostics.DiagnosticSource.dll.dll 40KB
-
System.Diagnostics.EventLog.dll.dll 117KB
-
System.Diagnostics.FileVersionInfo.dll.dll 12KB
-
System.Diagnostics.PerformanceCounter.dll.dll 112KB
-
System.Diagnostics.Process.dll.dll 115KB
-
System.Diagnostics.StackTrace.dll.dll 32KB
-
System.Diagnostics.TextWriterTraceListener.dll.dll 49KB
-
System.Diagnostics.Tools.dll.dll 16KB
-
System.Diagnostics.TraceSource.dll.dll 105KB
-
System.Diagnostics.Tracing.dll.dll 15KB
-
System.DirectoryServices.AccountManagement.dll.dll 259KB
-
System.DirectoryServices.Protocols.dll.dll 114KB
-
System.DirectoryServices.dll.dll 345KB
-
System.Drawing.Common.dll.dll 409KB
-
System.Drawing.Design.dll.dll 5KB
-
System.Drawing.Primitives.dll.dll 46KB
-
System.Drawing.dll.dll 10KB
-
System.Dynamic.Runtime.dll.dll 15KB
-
System.Globalization.Calendars.dll.dll 15KB
-
System.Globalization.Extensions.dll.dll 15KB
-
System.Globalization.dll.dll 14KB
-
System.IO.Compression.Brotli.dll.dll 27KB
-
System.IO.Compression.FileSystem.dll.dll 14KB
-
System.IO.Compression.ZipFile.dll.dll 31KB
-
System.IO.Compression.dll.dll 89KB
-
System.IO.FileSystem.AccessControl.dll.dll 45KB
-
System.IO.FileSystem.DriveInfo.dll.dll 16KB
-
System.IO.FileSystem.Primitives.dll.dll 14KB
-
System.IO.FileSystem.Watcher.dll.dll 27KB
-
System.IO.FileSystem.dll.dll 95KB
-
System.IO.IsolatedStorage.dll.dll 30KB
-
System.IO.MemoryMappedFiles.dll.dll 28KB
-
System.IO.Packaging.dll.dll 106KB
-
System.IO.Pipes.AccessControl.dll.dll 14KB
-
System.IO.Pipes.dll.dll 64KB
-
System.IO.Ports.dll.dll 61KB
-
System.IO.UnmanagedMemoryStream.dll.dll 14KB
-
System.IO.dll.dll 14KB
-
System.Linq.Expressions.dll.dll 529KB
-
System.Linq.Parallel.dll.dll 205KB
-
System.Linq.Queryable.dll.dll 57KB
-
System.Linq.dll.dll 124KB
-
System.Management.dll.dll 277KB
-
System.Memory.dll.dll 164KB
-
System.Net.Http.dll.dll 521KB
-
System.Net.HttpListener.dll.dll 567KB
-
System.Net.Mail.dll.dll 475KB
-
System.Net.NameResolution.dll.dll 35KB
-
System.Net.NetworkInformation.dll.dll 89KB
-
System.Net.Ping.dll.dll 87KB
-
System.Net.Primitives.dll.dll 89KB
-
System.Net.Requests.dll.dll 127KB
-
System.Net.Security.dll.dll 233KB
-
System.Net.ServicePoint.dll.dll 14KB
-
System.Net.Sockets.dll.dll 201KB
-
System.Net.WebClient.dll.dll 56KB
-
System.Net.WebHeaderCollection.dll.dll 25KB
-
System.Net.WebProxy.dll.dll 9KB
-
System.Net.WebSockets.Client.dll.dll 30KB
-
System.Net.WebSockets.dll.dll 49KB
-
System.Net.dll.dll 16KB
-
System.Numerics.Vectors.dll.dll 140KB
-
System.Numerics.dll.dll 14KB
-
System.ObjectModel.dll.dll 34KB
-
System.Printing.dll.dll 872KB
-
System.Private.CoreLib.dll.dll 8.3MB
-
System.Private.DataContractSerialization.dll.dll 737KB
-
System.Private.ServiceModel.dll.dll 2.2MB
-
System.Private.Uri.dll.dll 225KB
-
System.Private.Xml.Linq.dll.dll 130KB
-
System.Private.Xml.dll.dll 2.9MB
-
System.Reflection.Context.dll.dll 66KB
-
System.Reflection.DispatchProxy.dll.dll 24KB
-
System.Reflection.Emit.ILGeneration.dll.dll 14KB
-
System.Reflection.Emit.Lightweight.dll.dll 14KB
-
System.Reflection.Emit.dll.dll 14KB
-
System.Reflection.Extensions.dll.dll 14KB
-
System.Reflection.Metadata.dll.dll 424KB
-
System.Reflection.Primitives.dll.dll 15KB
-
System.Reflection.TypeExtensions.dll.dll 27KB
-
System.Reflection.dll.dll 15KB
-
System.Resources.Extensions.dll.dll 44KB
-
System.Resources.Reader.dll.dll 14KB
-
System.Resources.ResourceManager.dll.dll 15KB
-
System.Resources.Writer.dll.dll 15KB
-
System.Runtime.Caching.dll.dll 75KB
-
System.Runtime.CompilerServices.Unsafe.dll.dll 7KB
-
System.Runtime.CompilerServices.VisualC.dll.dll 6KB
-
System.Runtime.Extensions.dll.dll 188KB
-
System.Runtime.Handles.dll.dll 14KB
-
System.Runtime.InteropServices.RuntimeInformation.dll.dll 10KB
-
System.Runtime.InteropServices.WindowsRuntime.dll.dll 15KB
-
System.Runtime.InteropServices.dll.dll 49KB
-
System.Runtime.Intrinsics.dll.dll 15KB
-
System.Runtime.Loader.dll.dll 14KB
-
System.Runtime.Numerics.dll.dll 73KB
-
System.Runtime.Serialization.Formatters.dll.dll 278KB
-
System.Runtime.Serialization.Json.dll.dll 15KB
-
System.Runtime.Serialization.Primitives.dll.dll 10KB
-
System.Runtime.Serialization.Xml.dll.dll 15KB
-
System.Runtime.Serialization.dll.dll 16KB
-
System.Runtime.WindowsRuntime.UI.Xaml.dll.dll 73KB
-
System.Runtime.WindowsRuntime.dll.dll 309KB
-
System.Runtime.dll.dll 51KB
-
System.Security.AccessControl.dll.dll 77KB
-
System.Security.Claims.dll.dll 38KB
-
System.Security.Cryptography.Algorithms.dll.dll 233KB
-
System.Security.Cryptography.Cng.dll.dll 146KB
-
System.Security.Cryptography.Csp.dll.dll 65KB
-
System.Security.Cryptography.Encoding.dll.dll 30KB
-
System.Security.Cryptography.OpenSsl.dll.dll 32KB
-
System.Security.Cryptography.Pkcs.dll.dll 271KB
-
System.Security.Cryptography.Primitives.dll.dll 51KB
-
System.Security.Cryptography.ProtectedData.dll.dll 16KB
-
System.Security.Cryptography.X509Certificates.dll.dll 176KB
-
System.Security.Cryptography.Xml.dll.dll 148KB
-
System.Security.Permissions.dll.dll 77KB
-
System.Security.Principal.Windows.dll.dll 59KB
-
System.Security.Principal.dll.dll 14KB
-
System.Security.SecureString.dll.dll 14KB
-
System.Security.dll.dll 17KB
-
System.ServiceModel.Duplex.dll.dll 5KB
-
System.ServiceModel.Http.dll.dll 5KB
-
System.ServiceModel.NetTcp.dll.dll 5KB
-
System.ServiceModel.Primitives.dll.dll 11KB
-
System.ServiceModel.Security.dll.dll 7KB
-
System.ServiceModel.Syndication.dll.dll 107KB
-
System.ServiceModel.Web.dll.dll 16KB
-
System.ServiceModel.dll.dll 10KB
-
System.ServiceProcess.ServiceController.dll.dll 60KB
-
System.ServiceProcess.dll.dll 15KB
-
System.Text.Encoding.CodePages.dll.dll 709KB
-
System.Text.Encoding.Extensions.dll.dll 14KB
-
System.Text.Encoding.dll.dll 15KB
-
System.Text.Encodings.Web.dll.dll 91KB
-
System.Text.Json.dll.dll 263KB
-
System.Text.RegularExpressions.dll.dll 146KB
-
System.Threading.AccessControl.dll.dll 17KB
-
System.Threading.Channels.dll.dll 100KB
-
System.Threading.Overlapped.dll.dll 15KB
-
System.Threading.Tasks.Dataflow.dll.dll 414KB
-
System.Threading.Tasks.Extensions.dll.dll 15KB
-
System.Threading.Tasks.Parallel.dll.dll 97KB
-
System.Threading.Tasks.dll.dll 16KB
-
System.Threading.Thread.dll.dll 17KB
-
System.Threading.ThreadPool.dll.dll 14KB
-
System.Threading.Timer.dll.dll 14KB
-
System.Threading.dll.dll 71KB
-
System.Transactions.Local.dll.dll 138KB
-
System.Transactions.dll.dll 15KB
-
System.ValueTuple.dll.dll 14KB
-
System.Web.HttpUtility.dll.dll 14KB
-
System.Web.dll.dll 14KB
-
System.Windows.Controls.Ribbon.dll.dll 717KB
-
System.Windows.Extensions.dll.dll 45KB
-
System.Windows.Forms.Design.Editors.dll.dll 241KB
-
System.Windows.Forms.Design.dll.dll 3.1MB
-
System.Windows.Forms.dll.dll 6.5MB
-
System.Windows.Input.Manipulations.dll.dll 49KB
-
System.Windows.Presentation.dll.dll 6KB
-
System.Windows.dll.dll 14KB
-
System.Xaml.dll.dll 551KB
-
System.Xml.Linq.dll.dll 15KB
-
System.Xml.ReaderWriter.dll.dll 21KB
-
System.Xml.Serialization.dll.dll 15KB
-
System.Xml.XDocument.dll.dll 15KB
-
System.Xml.XPath.XDocument.dll.dll 16KB
-
System.Xml.XPath.XmlDocument.dll.dll 99KB
-
System.Xml.XPath.dll.dll 14KB
-
System.Xml.XmlDocument.dll.dll 15KB
-
System.Xml.XmlSerializer.dll.dll 17KB
-
System.Xml.dll.dll 24KB
-
System.dll.dll 53KB
-
SystemToolsWindows.dll.dll 269KB
-
TotalAV.exe.exe 5.0MB
-
Trinet.Core.IO.Ntfs.dll.dll 19KB
-
UIAutomationClient.dll.dll 156KB
-
UIAutomationClientSideProviders.dll.dll 334KB
-
UIAutomationProvider.dll.dll 32KB
-
UIAutomationTypes.dll.dll 196KB
-
UiPath.CoreIpc.dll.dll 86KB
-
Utilizr.Native.Win.dll.dll 100KB
-
Utilizr.NotifyIcon.dll.dll 41KB
-
Utilizr.OpenVPN.dll.dll 33KB
-
Utilizr.Ras.dll.dll 121KB
-
Utilizr.VPN.RasSharp.NetCore.dll.dll 15KB
-
Utilizr.VPN.dll.dll 51KB
-
Utilizr.dll.dll 415KB
-
Utilzr.WPF.dll.dll 391KB
-
Webshield.Client.dll.dll 34KB
-
WindowsBase.dll.dll 1022KB
-
WindowsFormsIntegration.dll.dll 84KB
-
api-ms-win-core-console-l1-1-0.dll.dll 18KB
-
api-ms-win-core-datetime-l1-1-0.dll.dll 17KB
-
api-ms-win-core-debug-l1-1-0.dll.dll 17KB
-
api-ms-win-core-errorhandling-l1-1-0.dll.dll 17KB
-
api-ms-win-core-file-l1-1-0.dll.dll 21KB
-
api-ms-win-core-file-l1-2-0.dll.dll 17KB
-
api-ms-win-core-file-l2-1-0.dll.dll 17KB
-
api-ms-win-core-handle-l1-1-0.dll.dll 17KB
-
api-ms-win-core-heap-l1-1-0.dll.dll 17KB
-
api-ms-win-core-interlocked-l1-1-0.dll.dll 18KB
-
api-ms-win-core-libraryloader-l1-1-0.dll.dll 18KB
-
api-ms-win-core-localization-l1-2-0.dll.dll 20KB
-
api-ms-win-core-memory-l1-1-0.dll.dll 18KB
-
api-ms-win-core-namedpipe-l1-1-0.dll.dll 17KB
-
api-ms-win-core-processenvironment-l1-1-0.dll.dll 18KB
-
api-ms-win-core-processthreads-l1-1-0.dll.dll 19KB
-
api-ms-win-core-processthreads-l1-1-1.dll.dll 18KB
-
api-ms-win-core-profile-l1-1-0.dll.dll 17KB
-
api-ms-win-core-rtlsupport-l1-1-0.dll.dll 17KB
-
api-ms-win-core-string-l1-1-0.dll.dll 17KB
-
api-ms-win-core-synch-l1-1-0.dll.dll 19KB
-
api-ms-win-core-synch-l1-2-0.dll.dll 18KB
-
api-ms-win-core-sysinfo-l1-1-0.dll.dll 18KB
-
api-ms-win-core-timezone-l1-1-0.dll.dll 18KB
-
api-ms-win-core-util-l1-1-0.dll.dll 17KB
-
api-ms-win-crt-conio-l1-1-0.dll.dll 18KB
-
api-ms-win-crt-convert-l1-1-0.dll.dll 21KB
-
api-ms-win-crt-environment-l1-1-0.dll.dll 18KB
-
api-ms-win-crt-filesystem-l1-1-0.dll.dll 19KB
-
api-ms-win-crt-heap-l1-1-0.dll.dll 18KB
-
api-ms-win-crt-locale-l1-1-0.dll.dll 18KB
-
api-ms-win-crt-math-l1-1-0.dll.dll 28KB
-
api-ms-win-crt-multibyte-l1-1-0.dll.dll 25KB
-
api-ms-win-crt-private-l1-1-0.dll.dll 71KB
-
api-ms-win-crt-process-l1-1-0.dll.dll 18KB
-
api-ms-win-crt-runtime-l1-1-0.dll.dll 22KB
-
api-ms-win-crt-stdio-l1-1-0.dll.dll 23KB
-
api-ms-win-crt-string-l1-1-0.dll.dll 23KB
-
api-ms-win-crt-time-l1-1-0.dll.dll 20KB
-
api-ms-win-crt-utility-l1-1-0.dll.dll 18KB
-
avira.managed.remediation.dll.dll 26KB
-
avira.managed.sdk.dll.dll 39KB
-
avira.managed.update.dll.dll 23KB
-
bins/subinacl.exe.exe 291KB
-
cachey-bashi.netcore.dll.dll 24KB
-
clrcompression.dll.dll 723KB
-
clretwrc.dll.dll 238KB
-
clrjit.dll.dll 1.1MB
-
coreclr.dll.dll 4.1MB
-
dbgshim.dll.dll 119KB
-
driver/amd64/LICENSE.txt17KB
-
driver/amd64/OemWin2k.inf7KB
-
driver/amd64/devcon.exe.exe 87KB
-
driver/amd64/tap0901.cat8KB
-
driver/amd64/tap0901.sys.sys 38KB
-
driver/i386/LICENSE.txt17KB
-
driver/i386/OemWin2k.inf7KB
-
driver/i386/devcon.exe.exe 62KB
-
driver/i386/tap0901.cat8KB
-
driver/i386/tap0901.sys.sys 32KB
-
e_sqlite3.dll.dll 966KB
-
hostfxr.dll.dll 335KB
-
hostpolicy.dll.dll 328KB
-
installoptions.jdat380B
-
lib_SCAPI.dll.dll 244KB
-
lib_SCAPISharp.dll.dll 23KB
-
libcrypto-1_1.dll.dll 2.5MB
-
libssl-1_1.dll.dll 626KB
-
locale/da_DK.mo281KB
-
locale/de_DE.mo296KB
-
locale/es_ES.mo296KB
-
locale/fr_FR.mo308KB
-
locale/it_IT.mo293KB
-
locale/nl_NL.mo286KB
-
locale/nn_NO.mo281KB
-
locale/pl_PL.mo309KB
-
locale/pt_PT.mo297KB
-
locale/sv_SE.mo283KB
-
locale/tr_TR.mo300KB
-
mscordaccore.dll.dll 959KB
-
mscordaccore_x86_x86_4.700.22.55902.dll.dll 959KB
-
mscordbi.dll.dll 1002KB
-
mscorlib.dll.dll 38KB
-
mscorrc.debug.dll.dll 175KB
-
mscorrc.dll.dll 13KB
-
netstandard.dll.dll 72KB
-
nfapi.dll.dll 334KB
-
nfregdrv.exe.exe 48KB
-
ovpn/libcrypto-1_1.dll.dll 3.2MB
-
ovpn/liblzo2-2.dll.dll 193KB
-
ovpn/libpkcs11-helper-1.dll.dll 123KB
-
ovpn/libssl-1_1.dll.dll 924KB
-
ovpn/openssl-license .txt10KB
-
ovpn/openvpn-license.txt17KB
-
ovpn/openvpn.exe.exe 1013KB
-
ovpn/openvpn_down.bat475B
-
ovpn/openvpn_up.bat784B
-
protected_elam/amd64/protected_elam.sys.sys 18KB
-
protected_elam/x86/protected_elam.sys.sys 17KB
-
pwm.dll.dll 30KB
-
securityservice.cat1.4MB
-
sni.dll.dll 133KB
-
ucrtbase.dll.dll 1.1MB
-
uninst.exe.nsis52KB
-
urldrv/tdi/amd64/webshieldfilter.sys.sys 74KB
-
urldrv/tdi/i386/webshieldfilter.sys.sys 68KB
-
urldrv/wfp/win10/amd64/webshieldfilter.sys.sys 94KB
-
urldrv/wfp/win10/i386/webshieldfilter.sys.sys 80KB
-
urldrv/wfp/win7/amd64/webshieldfilter.sys.sys 84KB
-
urldrv/wfp/win7/i386/webshieldfilter.sys.sys 75KB
-
urldrv/wfp/win8/amd64/webshieldfilter.sys.sys 94KB
-
urldrv/wfp/win8/i386/webshieldfilter.sys.sys 80KB
-
vcruntime140_cor3.dll.dll 74KB
-
wpfgfx_cor3.dll.dll 1.7MB
-
wscf.exe.exe 289KB
-
x86/update.dll.dll 3.1MB
-
avast_free_antivirus_setup_online.exe.exe 243KB
-
avg_antivirus_free_setup.exe.exe 247KB
-
bitdefender_avfree.exe.exe 16.4MB
MBSetup.exe
- IMPHASH 63ccd71a76a39a85385ce6d1810f26c1
- SHA256 de9c4e8b4b0c756eee4e39221c1e4e0e11c2e67effb828e27de3c4b4470ccff2
- MD5 d21bf3852bb27fb6f5459d2cf2bcd51c
- SHA1 e59309bbe58c9584517e4bb50ff499dffb29d7b0
- SHA512 17bc7740f131a1d4e84fd7e4ab5e1ce510660f5046340ef6d09ef99c56c88da2b6be3ae5c5ddb7213841c506eaec147c65abba1a7a2a8eb4fb8f6329bbaa03d1
- SSDEEP 49152:FMofPlPU+QG/rOVcVz6StQyfvE0Z3R0nxiIq2dsTDwfw1Y:FMslc+QGjuTKtQRq261Y
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
35:c8:3f:70:66:b4:08:16:3b:bc:33:a7:f9:65:b6:82:46:45:7e:88:b4:15:73:db:62:35:c5:19:6c:2b:10:df
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US
Chains
Jul 30, 2024
Digest
35:c8:3f:70:66:b4:08:16:3b:bc:33:a7:f9:65:b6:82:46:45:7e:88:b4:15:73:db:62:35:c5:19:6c:2b:10:df
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
Chains
Jul 30, 2024
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US
Serial Number
a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 23, 2022 - Mar 16, 2025
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 1, 2010 - Jan 18, 2038
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US
Serial Number
33:00:01:47:6e:d7:fd:89:2a:65:cf:42:f3:00:00:00:01:47:6e
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 30, 2024 - Aug 2, 2024
Subject
CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=California,C=US
Serial Number
33:00:01:47:6e:d7:fd:89:2a:65:cf:42:f3:00:00:00:01:47:6e
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 30, 2024 - Aug 2, 2024
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
456301
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb
kernel32
LeaveCriticalSection
RaiseException
EnterCriticalSection
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionEx
DeleteCriticalSection
IsWow64Process
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryW
CreateFileW
DeviceIoControl
CloseHandle
GetCurrentThreadId
SetLastError
Sleep
DeleteFileW
GlobalFree
LockResource
FindResourceExW
LocalFree
FormatMessageW
LocalAlloc
CallNamedPipeW
GetWindowsDirectoryW
SetCurrentDirectoryW
GetCommandLineW
lstrcmpiW
CreateMutexW
GetNativeSystemInfo
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
CreateProcessW
FindNextFileW
WideCharToMultiByte
GlobalAlloc
GlobalLock
SetThreadUILanguage
LoadLibraryW
CreateDirectoryW
GetLogicalDrives
GetTempPathW
MoveFileExW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
OpenProcess
ResumeThread
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExW
GetCurrentDirectoryW
GetCurrentProcessId
GetModuleFileNameA
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleW
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
DecodePointer
MulDiv
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
FindFirstFileExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
RemoveDirectoryW
AreFileApisANSI
CopyFileW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
QueryPerformanceCounter
TryEnterCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
GetCommandLineA
ExitThread
GetStdHandle
WriteFile
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetFileSizeEx
GetDateFormatW
dwmapi
DwmGetWindowAttribute
crypt32
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
rpcrt4
UuidToStringW
RpcStringFreeW
UuidCreate
Name
.text
Size
735KB
Virtual Size
734KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=26213,
count=186, id=261, version=26213,
count=23, id=259, version=26706,
count=37, id=260, version=26706,
count=141, id=261, version=26706,
count=28, id=260, version=26213,
count=2, id=262, version=26213,
count=13, id=257, version=26213,
count=449, id=1, productName=Unmarked objects,
count=35, id=265, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
TotalAV_Setup.exe
- IMPHASH ea4e67a31ace1a72683a99b80cf37830
- SHA256 b9a83fd92044028d1dd0264b972c95c2cb7564e8bbf480b245c8bf28a1dcb51e
- MD5 7e1760c63553d56fd73d0fc2dcbf4b5a
- SHA1 3bfba02d7ecd632c34de3803faa73315be4edb98
- SHA512 5f732813fc40726f8762297ad0856232dd94c30695949915a1b2bc5303429765acec772c21408e9b88fc469a16ba721f58e1a8827ef797d002b666d756aeb00b
- SSDEEP 786432:lcAokzH8aNMYff0v2oOPWCf4/CK8aAsy5fkMOgs34S7F2MOoQJ+LAgsFGUET9Xhc:l7HHff0C74/C5a21VsKMOxa72GUWxA
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Digest
3e:87:f2:8c:b1:8c:14:5a:18:12:c4:03:18:8e:6c:e3:29:1e:c2:8d:da:00:86:77:9b:0e:a3:75:55:c0:c5:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
13409
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersion
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aebb.dll
- IMPHASH 3a20d38e32d00b58d66203e5798b7b1e
- SHA256 cd6fcce8f0a2e4f832894abe41f2c4e7c0ab97b4a46eb478d085ffbb9ca36b5b
- MD5 2af40e6f90240525f8cd27961b53f2db
- SHA1 5eab9dc2edef6140df6842811da9e8ae9a27cbd9
- SHA512 ba80cf1f33e14d5dd3a3f96196e265d33920ac4fcc23dd3da61e192233401aad522fceea4a295628f03345ec3e43ae16542b0adcf8adcf0ee93a3f2114c2bccf
- SSDEEP 1536:BwgYl1cyd7JwVYgPj73dFZEqusWhmcdhRktha4rbtqa:B4t7AYgPjfeZHhRkthaFa
- MD5 SHA1 SHA512 SSDEEP
Digest
1a:a3:e4:37:d0:7c:d7:3f:00:5b:a5:35:23:d8:a2:a3:76:f3:cd:10:fe:e1:34:d0:ba:c3:f2:94:25:63:da:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 25, 2022
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
1c:a2:8b:87:5c:8f:0d:56:fc:03:4b:f1:35:b7:07:99:74:d8:11:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Mar 25, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
6f:40:17:75:8e:d0:8a:39:e0:a3:bb:62
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6332
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=2, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecore.dll
- IMPHASH 217ebb8a365fd7faa7f8b379d9f92737
- SHA256 1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
- MD5 2a4261a7dde3fdfd43793ca431890f84
- SHA1 8be893f9fd941dc0971498587f52228e2e9d69b0
- SHA512 e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
- SSDEEP 6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv
- MD5 SHA1 SHA512 SSDEEP
Digest
82:6c:0f:56:e7:0c:d5:a9:f4:7f:c9:0b:0c:1f:03:9f:e5:b9:ea:91:27:13:2b:02:c8:5e:56:a7:77:a0:52:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Dec 12, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
5f:82:7d:5a:23:2a:e4:fe:53:6d:c0:84:2e:33:df:11:34:d1:b6:39
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Dec 12, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
165679
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileW
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
DeviceIoControl
FreeLibrary
GetProcAddress
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
DecodePointer
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFileAttributesW
DeleteFileW
MoveFileExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
CompareStringW
LCMapStringW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
WriteConsoleW
ave_proc
Name
.text
Size
235KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=153, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=97, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=47, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aecrypto.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
- MD5 e824d826c0ebb30047aaa308fe03b6c9
- SHA1 1778f29052920ddc7ef192761123013cb7f648d2
- SHA512 774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
- SSDEEP 3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ
- MD5 SHA1 SHA512 SSDEEP
Digest
4a:05:64:d4:25:70:65:06:c0:93:3f:16:bc:76:a0:b0:e6:16:62:11:68:71:03:6e:00:73:8a:f4:62:fb:00:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 3, 2021
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
3f:2c:05:37:63:c1:c2:73:53:9c:97:f4:07:18:b5:82:c1:1b:3d:8f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 3, 2021
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:09:d5:71:49:1d:e7:22:df:46:2f:a4
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
59087
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aedroid.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 12bfedbe10041d39020e9a15c4cc3d4b557a7d4fffe40cf2d75caecf5f1ed1ab
- MD5 8facd0e1b34b24d3b7adb3b9be3375dd
- SHA1 f7ac09b72c91a8c54e266b7f6b68b2e40366d026
- SHA512 55fba8645835c69fe6e93da395de726bbcc0b3dd0049b5e4673f811cb92bc911a8bf1f6706a0922548635aa81d8aef95c3779cf827e52e70f851fa0be6a0c502
- SSDEEP 49152:2bnUI0myoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/:OnUI0myoyI4rlfff/MtGcMnrjD4LTQXv
- MD5 SHA1 SHA512 SSDEEP
Digest
79:a9:b8:7b:e7:bd:78:32:f9:54:23:b3:fc:10:b3:6f:08:ec:26:c5:41:4c:21:05:07:2f:54:ed:24:21:19:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Dec 8, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
95:0a:d9:22:ef:4f:14:55:38:a1:c7:0d:74:7c:28:e2:83:5b:32:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Dec 8, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
119326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=58, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aedroid_gwf.dat
- SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
- MD5 961a1c1e0dfb8b54019c9ccec510b3ad
- SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
- SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
- SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeemu.dll
- IMPHASH 9b5c2716bd999e49e0bc0945944d4532
- SHA256 9c9e782ac4490372119a95cac641970d805679a8aeef2ad59ee28c1a942cf5ac
- MD5 02940a21ab69d26893bc00c064be569e
- SHA1 e6eb2ba77bfa72fda91ba46924a18b8ad726f7b5
- SHA512 fac2069467c574b856fdb4597fb973b9a4f3fef5288b0ed0bda72136f48ffce58063ea5b251ae01216f744ec17d2c824f07593f8de885bdad123f5867510b21b
- SSDEEP 6144:HC9iYUBfVOM2SO79GGphjkL1HEli3ETCmkGeqcupFRiZnlQpeIj8+u4:JfVYVFphjkpHEli3ETCaZpFdeIQy
- MD5 SHA1 SHA512 SSDEEP
Digest
1f:89:d6:7b:c4:23:37:c8:62:87:ea:5d:c5:fb:ae:4a:04:ec:b4:d5:53:6f:43:46:b8:8f:2b:93:52:e5:d2:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 3, 2021
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
PE Signature issue
Digest
dd:97:19:71:7d:89:7c:5f:cb:ce:18:aa:46:10:cb:3c:7f:79:2d:92
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:09:d5:71:49:1d:e7:22:df:46:2f:a4
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Minor OS version
0
Major OS version
6
Entry point
277265
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
CloseHandle
DecodePointer
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
328KB
Virtual Size
327KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=6, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeexp.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 911d01f963ab2236e7bc977f96e84f292bef07f48f40f8927115e2b056992aa8
- MD5 faee506a935d68524834d090cb0fc16e
- SHA1 f3927c0170f15c1ad895f57aab48167781c51eff
- SHA512 5b15442e84e828425832659124398cb867a3cd70f48e85c2ae6eb2261d9f83101e148264349f05b86fc8b034af6ab5dce0579c106e0bed95a8aa656839903a53
- SSDEEP 6144:TIJxzjiTLxYnFZ9YJSXAVkpzFJv+rN0QmwAdWy9kvTZceYD+Pzb8ljBUJ:sxzjiyj9s+D+rNmjYy9BeYbPUJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:d6:f5:8b:30:61:44:91:be:3f:7f:86:6c:c5:56:91:fb:0d:ca:e4:a6:77:ae:12:67:03:76:dc:fd:ae:ba:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
114287
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
180KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=20, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=102, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeexp_gwf.dat
- SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
- MD5 d68dbed2d9e81bb670e94b0b550cccdf
- SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
- SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
- SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aegen.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
- MD5 163ea96ca0a9b9f7469dd128fe5bce04
- SHA1 60f4a01001fe4ad3b2aea24ce0b535a7d863f333
- SHA512 b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
- SSDEEP 12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b
- MD5 SHA1 SHA512 SSDEEP
Digest
09:f4:52:55:bf:f9:02:43:c0:79:f1:a7:ce:55:db:fe:e8:ef:21:6e:7b:14:db:f9:bb:53:6a:07:84:b3:8b:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Aug 8, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
dc:b1:ae:62:aa:10:8a:bf:e6:9f:8a:5d:22:b4:1c:86:9f:02:f5:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Aug 8, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
569437
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
611KB
Virtual Size
611KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=20, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aehelp.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 2c0b8af1ed85fa5ff16f87f3c58beee9fc0230594dd062913ec5ce87abacba4a
- MD5 c56e6711d0c6dbb6bd7bafbde06e9c90
- SHA1 872c3d8d2a54ac10c22861052498c2ef954f8004
- SHA512 611892b7b5a4a51fca74ee0d4d2dfa6a02ec22eda0fb9c24ff51a7f33a695a2aef3bb222763cd7ac5d0d6d5529634493fd2abd0a2c38fbbef34358700d65cb8b
- SSDEEP 6144:qJcM9/q39zJguo+i6d5Pjsyb4BIdhqDiD+o9RScE72UG9zxAe:Ux09tghUZsyvPS4UG9zxJ
- MD5 SHA1 SHA512 SSDEEP
Digest
9d:91:74:e6:bd:51:20:c7:8f:bf:9a:39:8e:49:41:89:d3:b3:7c:4d:84:85:91:dd:dc:5f:bc:d7:84:76:18:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 8, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
163201
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=57, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur.dll
- IMPHASH 5b0f0adb0bc652db7edc954409410539
- SHA256 23bfdb21548d8b0da6b1d63167c44207a3fe7f613bf36406168c667bb7d0a4f5
- MD5 d3f86394440e679a8be729c2af168169
- SHA1 3c50ae00ca1c65b71f6f01c18a1507c03207df5a
- SHA512 40abd780623276742f4ff5e89135e1223e3f7226cfb8af66f87646bcbb46c46e23eebe1a4bf3e4e0603622fb803d91d4c7f25c31283cddacc9037335a436c936
- SSDEEP 98304:9/P/JUX4fQyJVTL4sxamHxu0dcSgrz/2FJEncELaq855k0rmMxzuIi5dYPnu62QX:nmN1C1Nn7
- MD5 SHA1 SHA512 SSDEEP
Digest
2f:61:ed:bb:69:80:c0:8b:13:ba:c8:c6:0c:aa:a5:8c:2a:ab:50:56:69:4f:1d:27:5e:27:22:f7:be:7f:57:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 15, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
9983951
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
DecodePointer
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
9.6MB
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
539KB
Virtual Size
538KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
180KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
509KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=145, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=496, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_agen.dat
- SHA256 ee8a06d4af03049c6699a37a24233f37eb08dd2720f57848e665ed6d1cc7eb78
- MD5 159a422ec89a6699396140a500ddbfb8
- SHA1 8bcc5d5ae855bb7e36412a6b2d9a8bbfa37f56a3
- SHA512 db67a5792624b632c8cb3ab4bef963817faaa62dfa29f2da71b034a90e766c5d569b4c6ca2c04d85368674373fc72e60d4fc53711438923690a1ca0dfb4bb404
- SSDEEP 49152:fAtG44TpuEkXGrhmWq6GOaJIf9x89H8KGAPg9ZFvh0JMfLU9g4:u4TbJYN6OOoH8KBPg9ZFviJr
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_gwf.dat
- SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
- MD5 27dbb4a716dc8d87eac34a14f814dbc8
- SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
- SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeheur_mv.dat
- SHA256 9ddc8bd72905ab30861d3ae37af5292b6162f63e6446c15a1ccee3f8aeb67910
- MD5 9c93a76d871b55028d607207a90b39ff
- SHA1 c3b33d3622dbc1d02d0ae0beaf2cef9db56962aa
- SHA512 7f9529bc2ae489a1a2bf92f54055543c933dd39359bc7a77ec19c9bf30272947e10d785c4f3baa3deee2654d5c23cd1154856b8e54031bc8c4ee985f4ee88a4a
- SSDEEP 24576:pDOi3wLUZGF509e2P/LjK7uXikERi7Rpo83imfmYc9yeLnx6LKd8AxBem0w1vo2m:0KFGuua+zN6WPmEH2LVlFFp
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelibinf.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 812442ad5cdaeb6dd5dff76ddc3941fb9a1a56f999aa836f8fcbf4bb9e1b488f
- MD5 21432626c63068ee47107da801c05ffc
- SHA1 1b011f00a0a01bf217c41a0f5cb7d8c0f6b7046b
- SHA512 1c6e973be37fbcfd2b945fbbde57afd37525aafd475b4229db8296ce48cbcffb2a092fb1d226b6f655a491535f7f2bff5139522daff92bf002304545fbeb596c
- SSDEEP 3072:nA5Fh7lNUcO4WsdDKs63FgJln2qVsdP0xKMSET:PAWsddFV5Vsu8pET
- MD5 SHA1 SHA512 SSDEEP
Digest
3a:3a:9b:c1:fc:e2:27:88:78:44:09:ef:82:da:55:b6:e7:3f:d7:58:c4:a7:7f:a3:2c:44:11:34:3c:89:fe:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Oct 26, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
34:24:aa:7b:be:bf:5f:de:ab:e3:15:6a:a8:48:82:e4:2c:b5:e6:6e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Oct 26, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
0
Major OS version
6
Entry point
14441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelibinf_db.dat
- SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
- MD5 ddc132992273330ec506e63fae4985b4
- SHA1 7bf3018217f136662c159994f6530edf4c976a10
- SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
- SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aelidb.dat
- SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
- MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
- SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
- SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
- SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeml.dll
- IMPHASH 987fabbe7aaa43f6606c10cbab26a0d8
- SHA256 537b3ea2ce48dc0cc343c1c6ce79ae5ba527b2fcddea24cadef1fc1eca8c42cc
- MD5 0de0cb670e3046e388829fdab6910a9c
- SHA1 2b9daea0200fd1c442c9a3a967bf51d68f7ab80d
- SHA512 7e7ab02d20c3a1b8f76ce8c951570be1e719e0533ffc14970c958240a6adbe1c8ab88c826ef21083db0c74c6f83a1c9262ec6b2371b72d357bf6d5a298ba6f33
- SSDEEP 3072:qsjdmLYGV1RkWeY9aN4R8kGW+JVhyTWrZy6xLqOVqrsyyP0Y:qsxmfRk4UkdGW+CqRVqrLY
- MD5 SHA1 SHA512 SSDEEP
Digest
96:61:e3:07:74:4c:5e:0e:ce:9d:11:39:70:14:73:d2:43:40:92:2f:b4:f5:7a:76:c4:b2:6e:f3:0e:de:89:69
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jun 29, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
d4:3c:a2:de:5c:d6:c0:94:0e:6a:a8:b1:9e:ec:e7:5f:84:dc:a6:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jun 29, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
42858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CloseHandle
CreateFileW
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=143, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=58, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aemobile.dll
- IMPHASH f26319b70fd0009dfeb674e39bde957c
- SHA256 3137d3d95d1caa59d349645ab8087d6b0c7cc3321873789c738553d4471143c6
- MD5 b132b36c0b53839ee1c0fc8198170157
- SHA1 3e7394ee8d3c4c0f36e00466fe0191ede592c01b
- SHA512 1bba22a77ceaa59c00cf0d10a7afced2161985d8baae94c9cfe0cd5171464f49c53113b4ba8a027cb727aa242a23f79c1cf19a4df821ef6ac00f7a7c2ecd155e
- SSDEEP 6144:pHfeO55RAQ9JUDSzFPCMhgFaaIembdw2p52s5dEy/ZAuvGnAQyFuDlXDG:dh3RAQ9FFPRImxw2fZiy/ZAu4DU
- MD5 SHA1 SHA512 SSDEEP
Digest
1a:e9:b0:72:4e:08:7f:6b:f9:b2:6f:68:f4:c9:01:13:b2:38:44:ab:ec:92:fb:88:12:f0:35:88:19:b0:b5:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jul 4, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
6c:ab:5d:1d:03:59:4a:57:18:a1:f6:10:d4:0f:51:c4:59:7e:87:89
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jul 4, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
226159
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=22, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=159, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 4a3c2f29b2ab5e78e5a1558d2ddbc564cbd4474ce4115001ba6662c143b6482a
- MD5 3dbd9c8da952507d0df2b46308fe83a2
- SHA1 0d38ee68466f818e880680b73f5f74ca300ae629
- SHA512 1e6b65fa80d95d1cb1da72b7905105f4b4fa6ee7c1fd63fdd7728a030ff42b9177e2eb0fbca1e64f44a11a253defd7bd179bc8c596fc565f3972ad89cf5c9616
- SSDEEP 12288:jk1fpTUcoWP1AOSRCEL6/CJ1KVm0yjw0REYVXkVzLKt98r0:i1UcoWPBEGyKVLow1YVUVCu0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
56:93:6e:3b:ea:de:0a:6e:1b:17:b1:5c:b1:e3:58:26:6b:fe:40:78:6e:e0:42:64:3f:e0:18:28:4c:1f:5d:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
622653
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
664KB
Virtual Size
664KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
337KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=80, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice_gwf.dat
- SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
- MD5 0c95def0894c5e5716cf7a3ecc7545a6
- SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
- SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
- SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeoffice_mv.dat
- SHA256 adac5f741e5ee6f669b76bca87a26bdafa9be60d8ac7e7c5059af9ccce919608
- MD5 e346fe238be4b645e20e1bd77e9167bf
- SHA1 252c2614387aef2304f85cebabcb89b7e5f04c96
- SHA512 29965365aa6a5dae7bdcda0f437202d5a2874d60d3d59895871d05b4ca3bbea539fd04ae1895a0f6c77992ae2b7a39dd74837a1a6a72f15e92129517ff6375c9
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aepack.dll
- IMPHASH 15e933b00ded9cae6f463a1796323b1f
- SHA256 fff47393adf070bc04d044c0a939c620234881e1ad69d3776146e32d25e1f36d
- MD5 26ab6a0a9b1c59a01f9b45bbc0bbc65d
- SHA1 ef282c4322c361aaac6d70d0e27d4b2292de4999
- SHA512 f17aca43e9f66ae21d295af5fbca5de0770ef77eb602f74ac6696aa9cf9af9884df21f9c9a98a6aa5d9ba5bbb3f9951c952d608dc3863e6a8a6a6c053639f26a
- SSDEEP 24576:1oHuMoULNqpg3NV0ug3YdXIsPt5AUzp/X:mvom5NkI+UNP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1a:58:64:45:e9:dd:68:f0:00:7b:e4:0d:32:d1:b5:fa:9c:78:ba:ef:b3:16:88:59:b3:7b:4f:88:9b:1a:f6:69
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
686048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
SetFilePointerEx
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
MultiByteToWideChar
WideCharToMultiByte
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
WriteFile
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
752KB
Virtual Size
751KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=149, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=23, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=216, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aerdl.dll
- IMPHASH 24bc7db91306bdc7881dc1f977fdebe3
- SHA256 d049ab67daae27ab3840730cadc5a82dfbd269b58896b9f8289324816e1680eb
- MD5 62f7467baebb56a8beea7fffa6c4ee7c
- SHA1 c13eb821d2675f110b1a38f8c0842b91edcab9b4
- SHA512 d31498bdee77fd498226d6c971dff65eeecec66811109f1a729858fee6aa92f6d1601256740417ba5abb72b4c7109eb3e69ecc7446093bebee62c559d4e7a61a
- SSDEEP 24576:8lGo7gc5YfW4W2ERk7IERLQw33gAcRRbfQ:xo5d4WPR7GLhofbfQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:13:92:df:78:40:eb:f2:43:3f:a2:f2:b8:a3:77:7c:ab:d0:18:07:59:0b:3c:c9:40:aa:96:ed:bd:44:d8:bc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2023 - Mar 18, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2023 - Mar 18, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
848574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
CloseHandle
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
CreateFileW
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
HeapSize
HeapReAlloc
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
887KB
Virtual Size
887KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
173KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=152, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=81, id=1, productName=Unmarked objects,
count=4, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=298, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aesbx.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 a03aa3e017606dce6f2cd19536db9306a6ebf2eaefb224be735569599a39330d
- MD5 63159174de5eff0c3ed33f887c00e1b4
- SHA1 aa787a058920e7010269d1286f32bda62206949a
- SHA512 398831b8cfebe1a7878658087594dcdd74f6be8d380bcacd415acd5bbed85e6bd939c1562b3cee4e8ecbe64b0704be1cdab2dcc9c7ae6a0dfa0e8b8d0317f884
- SSDEEP 24576:006liaoL0dhMPqd4MQSsnBuAZVeBV1XAw1CciqmjtLb5tNz/+SW728F6cLUpqfjr:00jL0nI54V1XdiJZtNS84jKsQi
- MD5 SHA1 SHA512 SSDEEP
Digest
0d:e8:0f:e4:e2:96:d7:84:c7:29:55:a0:b9:0b:22:c4:91:53:61:89:d9:08:82:82:a0:ff:7d:4b:3d:b1:9a:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
May 12, 2022
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
14:d2:18:78:6e:da:99:00:1b:81:3f:a7:46:da:53:42:3b:cf:22:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
May 12, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2021 - Jun 28, 2022
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1221506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
196KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=241, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aescn.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 b816a2810fc9c1a5294a59b0232a1725519a2a7472f509c336b9fd1b189d0f3d
- MD5 045180fa8eaf0c2409e101542014b5b8
- SHA1 70656f926020e02e7c67fd2d145ca90b5952a9d5
- SHA512 5659f42a6fe5cf259ad9528777ab5883f0185437b60710727c097cad2ceb60ac09eae4af59857c0021fc573343704ec6318cfc6d78ee2a1d7facc7321f4ae767
- SSDEEP 3072:LvsmKNM8p6TrjmZGYx/wpTKwEGGyQYwc74RZQygPYDlIKpEU8+GIBfKLov+4OuuL:Lviu2+XmEGwpVnQY7ERay7BKU8FYxudl
- MD5 SHA1 SHA512 SSDEEP
Digest
57:82:e1:6d:4d:a4:8b:7d:1f:c9:ce:bc:0c:e5:d5:79:aa:a3:4f:e4:34:2b:f1:6c:22:1c:37:9e:0e:ca:81:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
May 24, 2022
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
f5:3d:6f:65:1c:ce:03:88:12:2a:10:ad:ec:72:29:33:a0:06:53:23
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
May 24, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2021 - Jun 28, 2022
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
75362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=18, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aescript.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 8371b7ea7e0e0650a4aca997d270b68543d61ef873190d02db37d7c3349b5942
- MD5 11197cd2373a7b8364d9bb97406fa2b0
- SHA1 05b81929d797330803febd8231907b54462706f1
- SHA512 dff359f3330cceb1bbae2cb26748244509870f9f6f1307b4010e4a449cb50b87d4395fbc38e7b1a0fedfe16eb7b01b4cacac7631f606ec1467555ca5099138c9
- SSDEEP 24576:90UGScZK1H+snGqwKchYOLOY5XzIR/l5/v33lwjlOm5Ui2TQ:KU0ZRYOLTI1l53KlOm5UI
- MD5 SHA1 SHA512 SSDEEP
Digest
de:57:f7:53:86:16:57:63:c3:57:2a:42:2a:88:ff:04:c6:13:4b:65:dc:85:c3:8b:7d:9a:fd:b5:bf:81:ae:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 15, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1055938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
67KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=18, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=86, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aeset.dat
- SHA256 1d06844d6c0aae9b0a5f6f7f61b4c7c6284fb085b7f878d596ee8407c67b7357
- MD5 b78db48c5ff9494327032a27d5aa33cc
- SHA1 43ffc51ef1da90ec791a95ab6d20e3cae7a66482
- SHA512 855622613a0310cceb1b885f11d22876b1b6092fbdfa7ec19618d8ae71b2ad70ca75bfc44ea0e4069b38d9785c400025a8f6a4bedca539546eb10cbce078a051
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aevdf.dat
- SHA256 1fa5d91c9a58fa3f9d3761ace1a8f3bd97fe6e903eaa6540cee0c75f89c681d1
- MD5 7ad1fc9922e67652c346113289a557f3
- SHA1 9b7dcf5873d40fb45e2016051329cff4d628c336
- SHA512 c042d79fa0fffc8a173868f411242868b3a1b5d495dbaa0c70beca65f03b6a988d1dffa1e823ad3c126a5dde2592770e73029a184797fb7ab627e0564b34b5fa
- SSDEEP 48:b3sa0DNeR8vdNsv4lFgtKTY6rTsYj6xO/Jzl69sYue4:b3N05e+vdNC4lyKTFTsYj6xSJpYjue4
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/aevdf.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 3acf87d057b627745f588315c528ca19699bc6e5999fb785160a432c7d42b182
- MD5 1f2846f66f454dcd075690914c58d97c
- SHA1 f6e6c89c11aaffaffaf98791c1faafd00e5d8aec
- SHA512 20f555510d45aa62b0256f8898a360ef47f58a37faecfd014e34a0fdfe9f59178ad23532fd37c04edcad63b725571fdbd765ea5f30202b0525f6979d509e28ea
- SSDEEP 3072:VGkspwGVB18ldNUYDFjsRRGMKEBeP/EvKaBlbCPL00eAplUlCtvt1JdkbTFtkIpu:VGkseGVB18lXRDyGMKUenkNCYiPU0tvZ
- MD5 SHA1 SHA512 SSDEEP
Digest
a8:df:e2:88:b0:84:09:f2:b8:09:b5:18:e0:68:60:7a:73:58:2f:7b:9d:ce:b2:40:99:d9:25:ad:c2:99:36:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jul 15, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
74:92:d8:a0:37:3a:2f:cf:c8:6d:3e:7f:ff:50:18:c2:ca:25:48:0a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jul 15, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
64157
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/ams_setup.exe
- IMPHASH 159adfe0cb0b35b14c9ff83cb2d1a025
- SHA256 168c506b14418d3c64435d1e165e2b686b8c2273023d9f45848cee5a1355d27b
- MD5 30ad65d8805ff9356ac7e75e67585f01
- SHA1 7711885c3bcebe0bae7c5d33979eb52cbecb8f26
- SHA512 d45eee2a5ab487d4d614da497b4ebcbe34f93828a294dcee9db5f0e4eadebcfe3408f30956b15a5352c465c956adf68d89c97a2a6609b15c7c5c43408949aa15
- SSDEEP 3072:IjGFIi8a+vmi3zw4+j16h3U7yYYFOqnHifsW/bFYWoBKyMeTGXZ9PjlLgqER:W4IFb3z7O1iU73YFfe/jNXZ7pER
- MD5 SHA1 SHA512 SSDEEP
Digest
58:91:d3:92:dc:0e:d5:c5:d6:5c:90:7b:27:15:57:8d:4f:45:63:ec:2c:fd:90:a1:6a:78:06:79:fe:9a:f9:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
1
Major OS version
6
Entry point
30108
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\aviraoa\ams_setup\ams_setup.pdb
shlwapi
PathFileExistsW
PathRemoveFileSpecW
user32
GetSystemMetrics
ExitWindowsEx
MessageBoxW
kernel32
WriteFile
CopyFileW
SetEnvironmentVariableW
GetCurrentProcess
GetBinaryTypeW
HeapAlloc
HeapFree
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
MoveFileExW
SetFilePointerEx
GetFileSizeEx
GetSystemTime
LoadLibraryW
FreeLibrary
GetSystemDirectoryW
CreateProcessW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
CloseHandle
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetProcAddress
GetModuleHandleW
GetNativeSystemInfo
LocalFree
GetModuleFileNameW
GetLocalTime
GetLastError
GetCommandLineW
ReadFile
ReadConsoleW
HeapSize
HeapReAlloc
DecodePointer
SetEndOfFile
WriteConsoleW
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
ExitProcess
GetModuleHandleExW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
shell32
CommandLineToArgvW
advapi32
SetServiceObjectSecurity
BuildExplicitAccessWithNameW
SetEntriesInAclW
QueryServiceObjectSecurity
DeleteService
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
Name
.text
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=147, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=19, id=259, version=31616,
count=11, id=257, version=27412,
count=131, id=1, productName=Unmarked objects,
count=10, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apc_random_id_generator.exe
- IMPHASH da8ed38bc494edc43fed015b4c7918b8
- SHA256 1239ea35953b0fe8677bee09dedb7c3eea987e977c73e73ef8862c4a3774b659
- MD5 be6f0a323777bc43bce01fdc5ad58120
- SHA1 a6c1742269fb7879dcb54dfd25af57dba66ab732
- SHA512 921b11869d1ec2b5a19ef41b75504ac099429339a143cfa677fc54eb520a2b79b173e2e326afcaeceeab4f6b942098dd9a660b7c9dc3addc8b9ea53a3cac4548
- SSDEEP 6144:y8o+8urNJEXczi5CLqOhcg7vnDUbRypWCaoo/Jiq/mEwhDsQ8cNWE9Zu:y8o+8MNJEiTPvnDUbRypWCap/+p9Zu
- MD5 SHA1 SHA512 SSDEEP
Digest
08:ea:1c:34:71:84:d9:cd:dd:2c:fa:b7:5b:84:bb:35:87:16:d4:e9:f5:d9:71:17:e9:ba:3e:83:17:cf:d9:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
111069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\apc\random_id_gen\apc_random_id_generator.pdb
rpcrt4
UuidCreate
ws2_32
freeaddrinfo
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
WSAGetLastError
socket
shutdown
ntohl
select
recv
listen
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
getnameinfo
send
kernel32
ReadConsoleW
GetConsoleMode
LCMapStringW
CompareStringW
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FormatMessageA
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
PeekNamedPipe
GetOverlappedResult
CancelIo
WaitForSingleObject
CreateEventA
CloseHandle
InitializeCriticalSection
GetConsoleOutputCP
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
CreateFileA
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetStdHandle
GetHandleInformation
SetHandleInformation
WriteConsoleW
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
CreateHardLinkW
SetEndOfFile
LockFile
LockFileEx
UnlockFile
UnlockFileEx
DuplicateHandle
GetCurrentProcess
CreatePipe
CreateNamedPipeA
SetFilePointerEx
HeapReAlloc
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
HeapSize
EnterCriticalSection
WaitForMultipleObjects
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
advapi32
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=162, id=261, version=27412,
count=19, id=260, version=27412,
count=3, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=23, id=259, version=31616,
count=175, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=39, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apcfile.dll
- IMPHASH d0a7a04ab2c72e5a3c1169b60f06b849
- SHA256 7f6c31ea445c7b871a0ea2b73705776435b00f3e37223b53b5da9b4ad4d19c0c
- MD5 ecf74de0b990c96fcf961e89cf73768c
- SHA1 5ba320e5e1e4364cec95b130bebff52f3591c039
- SHA512 8ab9b876db9edaee8862fe3cd0cde688158a487cf00f12ac85983c8fbe93a6f116f5d4ce96bf717ce64f4a231aee618b8b023c735ac1783249beaae95a3030bf
- SSDEEP 49152:xCvhKevv/MEl1oInVGDM1UDtL0lzHYqV2WPY1KG5twA+arh2:xCvJ6IVGTyxHYqs/1KR
- MD5 SHA1 SHA512 SSDEEP
Digest
8c:be:8d:b8:6e:9b:1d:c2:fd:b9:a5:ee:68:c4:c6:4d:3a:8c:77:d2:5a:bf:b6:aa:01:58:e8:f9:f7:c5:8f:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
2089296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\bamboo-build\SAV-APCSDKPACKAGE-WINX86SDK\package_release\bin\apcfile.pdb
ws2_32
inet_addr
WSAGetLastError
gethostname
recv
socket
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
getservbyname
shutdown
ntohl
getnameinfo
ioctlsocket
getpeername
freeaddrinfo
getaddrinfo
closesocket
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
inet_ntop
WSASetLastError
ntohs
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
mswsock
TransmitFile
rpcrt4
UuidCreate
crypt32
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
kernel32
EncodePointer
DecodePointer
GetCPInfo
RaiseException
RtlUnwind
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
GetLastError
GetCurrentProcess
GetVersionExW
GetLocaleInfoA
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
Sleep
MoveFileExA
CloseHandle
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
GetStdHandle
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
DuplicateHandle
SwitchToThread
GetCurrentThread
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
FindFirstFileA
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetStdHandle
CreateFileW
HeapSize
SetFilePointer
DeviceIoControl
GetOverlappedResult
CancelIo
MoveFileExW
CreateHardLinkW
CreateDirectoryW
RemoveDirectoryW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GlobalFree
FormatMessageA
SetEndOfFile
SetEnvironmentVariableW
FlushFileBuffers
ReadFile
PeekNamedPipe
SetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
SetHandleInformation
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateFileA
GetModuleFileNameA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
InterlockedFlushSList
LoadLibraryExW
SetFilePointerEx
GetConsoleOutputCP
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
ExitProcess
GetModuleFileNameW
WriteConsoleW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
OutputDebugStringW
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InitializeSRWLock
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
bcrypt
BCryptGenRandom
apc_add_cache
apc_authenticate
apc_category_name
apc_create_context
apc_ctx_get_file_lookup_filter
apc_ctx_get_user_data
apc_ctx_set_connection_timeout
apc_ctx_set_data_timeout
apc_ctx_set_file_lookup_filter
apc_ctx_set_upload_connection_timeout
apc_ctx_set_upload_data_timeout
apc_ctx_set_user_data
apc_disable_logging
apc_enable_logging
apc_file_cache_disable
apc_file_cache_enable
apc_file_cancel_uploads
apc_file_check_file
apc_file_check_files
apc_file_check_files_ex
apc_file_check_hash
apc_file_check_hash_ex
apc_file_check_hashes
apc_file_check_hashes_ex
apc_file_ctx_call_filters
apc_file_ctx_get_elf_mode
apc_file_ctx_get_ext
apc_file_ctx_get_ext_policy
apc_file_ctx_get_filters
apc_file_ctx_get_mac_mode
apc_file_ctx_get_pe_mode
apc_file_ctx_hash
apc_file_ctx_set_elf_mode
apc_file_ctx_set_ext
apc_file_ctx_set_ext_policy
apc_file_ctx_set_filters
apc_file_ctx_set_fops
apc_file_ctx_set_mac_mode
apc_file_ctx_set_pe_mode
apc_file_ctx_set_temporary_dir
apc_file_hash
apc_file_hash_ex
apc_file_info_get_extra_info
apc_file_info_get_malware_name
apc_file_initialize
apc_file_initialize_context
apc_file_metadata_set_download_url
apc_file_set_batch_service
apc_file_set_temporary_dir
apc_file_set_upload_threadpool_limits
apc_file_uninitialize
apc_file_uninitialize_context
apc_file_unwilling_to_upload
apc_file_wait_for_uploads
apc_file_willing_to_upload
apc_free_context
apc_get_file_lookup_filter
apc_get_library_version
apc_load_cache
apc_save_cache
apc_set_cache_dump_secure
apc_set_connection_retries
apc_set_connection_timeout
apc_set_data_timeout
apc_set_file_lookup_filter
apc_set_low_upload_speed_limit
apc_set_low_upload_speed_time
apc_set_max_cache_size
apc_set_max_upload_speed
apc_set_metadata_product_id
apc_set_metadata_product_language
apc_set_metadata_product_license
apc_set_metadata_product_random_id
apc_set_metadata_product_type
apc_set_metadata_product_version
apc_set_out_of_memory_handler
apc_set_proxy
apc_set_proxy_auth
apc_set_proxy_ssl_ca_cert
apc_set_server_message_cb
apc_set_service_address
apc_set_ssl_ca_cert
apc_set_ssl_crl
apc_set_upload_connection_retries
apc_set_upload_connection_timeout
apc_set_upload_data_timeout
apc_ssl_threads_initialize
apc_ssl_threads_uninitialize
apc_strerror
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
545KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=27412,
count=212, id=261, version=27412,
count=24, id=260, version=27412,
count=11, id=253, version=31616,
count=86, id=261, version=31616,
count=17, id=260, version=31616,
count=28, id=259, version=31616,
count=307, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=21, productName=Unmarked objects (old),
count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=28, id=261, version=31629,
count=765, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/apchash.dll
- IMPHASH c45291f055d661a4d27149e1fd47d098
- SHA256 fb74e48074ba4d26049250bc68281751f9fb9a6c41c401e19f6870ebcfdf6a7a
- MD5 a0c5e8f7cd6c02a8719ade39c1955135
- SHA1 52153097ff4d14c89374ed9d144178ec104795ae
- SHA512 30901a8332e09311bee3c244226d533840f277f47170fa85a7f2e06e3c1bae18a95db82b45ab1f31062be6f7c5dc6918bfe088f3088cfdce8ecb52df863da3b9
- SSDEEP 3072:0IIIIb90Vo9gn6YfoT7lq3xsuHBfvPBwcbaGSI/2EQmhKeKhUbZXU0JxP05:0IIIIb9bYcI3xxZaGtuEQgtXU0k5
- MD5 SHA1 SHA512 SSDEEP
Digest
73:73:cf:2e:34:53:18:6e:6d:ef:61:5f:f7:97:0c:64:5b:86:b5:c9:50:ab:29:fd:d0:ba:24:1c:c1:64:82:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
30443
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\utils\apc\libapc_hash\apchash.pdb
kernel32
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WriteFile
SetEndOfFile
HeapReAlloc
HeapSize
GetFileType
GetEnvironmentVariableW
WriteConsoleW
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
CloseHandle
ReadFile
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
CreateFileW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
GetStringTypeW
DecodePointer
APC_hash_file_compute
APC_hash_free
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=148, id=261, version=27412,
count=18, id=260, version=27412,
count=30, id=261, version=31616,
count=16, id=260, version=31616,
count=19, id=259, version=31616,
count=7, id=257, version=27412,
count=88, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=4, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-apchash-product.conf
- SHA256 e2cbcd600dce59af50b624e2079f4b92186dd0536f5ffbc2b859c5c440657e05
- MD5 4257d3de2badf1811f90e8312bc74aee
- SHA1 85a5ddcd2282e8049bc5432932baf418bc02ebca
- SHA512 962cc45ff9aa7fe1bb8902bc195318408a7dc2728c7e89c5ceba3eaa7385d19eba52090a2f4e69bd25bb2a0a9f4500988f190e71fff84b9c9df6c8bb2052c4aa
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-on-access-savapilib-product.conf
- SHA256 e5e0ae1892dcae23e6b2b914234cc2111efd1ad746887c61266618ce5ec5852c
- MD5 c0d7ca0f42b0eb707f0ff09a1144d837
- SHA1 1c5d84bcf2bfd97a51b156b04fde285a8fddd35f
- SHA512 a4582b9ad7ae3bd795c271201850aa2ef5163b605f227fa4da06d6fd9d23144d811d16904257188832a2eeddb63692a12ed649ae4244eb3138b0a972e7686b19
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapi-engine.conf
- SHA256 cfd50eeea0c80b8dde883951aa6149410ccbb6a08fb001cee109c276648feb1f
- MD5 01a844c7204488b536c48a72090f8a39
- SHA1 417b1670c72d9c0c70953e88fcf2ba8bc82c245e
- SHA512 2aa341bbd42ad658bc4db5d5521dd1c5a882796b3bc745be89607ccbadc084bd790f92197e0881f4d45a13cee74fdd8c73b47e7cb86c2bf81598251c40591acf
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapi-product.conf
- SHA256 30ef0c181ee31e52efe06d44f5d33e5a868160e6f93f573f38aac4b05f681af0
- MD5 c94d4130ad378ddbc7e341937cf10692
- SHA1 81a7fc4c1ebaf2c19a590c43d60d4b9f3650edbc
- SHA512 59ac58e5ee40213cdbe8de93baa96db946fbd1e1c7b946ba31a61e4550e4bab29286811310fb966bb9725ffdd5f4b750b09a188193bd3bd5111eef5c882e2e49
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapilib-engine.conf
- SHA256 ea5ade6e1bc0df9e2773dcaf5cf9bb087965dba3c74a12eeb9727747cffbb614
- MD5 c0b5b102ad8dcb4190e4acd1e4c78d99
- SHA1 6364654bbe47f784d84eb8387fe14d0a7c267a78
- SHA512 76264a03d43d507574582aa6954d50ab3e0954153489abb4c311989226e9e951bb4de188cff8d92c4d48c96470d58d4d7bfc094a6a74c050ee8ef25a61395250
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-savapilib-product.conf
- SHA256 f6c89a441e41a381ccb1785d97d9aeac95d6d01f13227431baa6a4c06b4f78e8
- MD5 d8e715e99b1709e69303f9d9dfd0ba88
- SHA1 68964f716482230d2b3d28677257f8742235e6ea
- SHA512 3fce72763e81318f31bfb684fea8f189dc85fe3798d14978a3d589a649107e9a7ad61c0ea1f4f0ff2c50b8663fad3ec6870d9c595d7e66f8c0c11e3de42e5264
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate-xvdfmerge-product.conf
- SHA256 1ccfc728f83e1709ae01936e369610e6f9bf7d83e9b406af995cab5fa1863d4e
- MD5 c7e74ddde5788f5e9510034b66ff0fbd
- SHA1 8b821abbe25c98877836a4a76446bb98871a9aa0
- SHA512 7657ee00f0e8b5365b02d12393aa64e5862dc87e5ef5390824d536d72845b2e9e46a25ca0676f49e6d4cfcd7ee164e80832696a369e82d464d938139e8d745a4
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate.exe
- IMPHASH 35e07a3a55743a4b4805df293e470e40
- SHA256 afb45b8ae7d78085d95122ae01f6bac1515a89e7e2c87c55596670e2b5e922e1
- MD5 e0947f2084e589a4d7f1c0f541b54321
- SHA1 3ca9be3bc2678b85e36b9823a617376a268ab889
- SHA512 316a214436031a498de8b2b6ca33cb9f73cacc3ee19f22f86d90583f817e35f0b93bd44e3af8e47baf1c7e44fc66b9c2031995cc4ce69a1bdbe980de93e5938f
- SSDEEP 49152:JevEk9Vcz8AGAIaaQ2ldCPGwdYbO9ZMzYuWP011w99oUQ8Pbto:JevUsAz8ld+ubO9Ssur1a8
- MD5 SHA1 SHA512 SSDEEP
Digest
4d:f2:32:ce:e3:94:1e:21:31:7b:1d:01:4e:b9:fd:c9:b8:07:d9:1f:1b:fd:6a:c9:30:2c:1d:5f:15:76:5a:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
2059170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\kmr4g80c\updater\avupdate.pdb
scew
scew_element_by_name
scew_strcmp
scew_element_attributes
scew_element_children
XML_Parse
scew_list_next
scew_list_data
scew_element_attribute_by_name
scew_parser_ignore_whitespaces
scew_parser_free
scew_parser_create
scew_tree_set_root
scew_tree_create
scew_attribute_value
scew_attribute_name
scew_element_add_attribute_pair
scew_element_add_element
scew_element_add
scew_element_count
scew_element_set_contents
scew_element_free
scew_element_create
scew_tree_root
scew_element_contents
scew_element_name
scew_tree_free
ws2_32
WSASend
inet_addr
getsockopt
WSAGetOverlappedResult
sendto
recvfrom
shutdown
getservbyname
ntohl
getnameinfo
gethostbyname
gethostname
ioctlsocket
getpeername
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSARecv
send
WSACloseEvent
inet_ntop
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
mswsock
TransmitFile
rpcrt4
UuidCreate
shell32
CommandLineToArgvW
SHGetFolderPathW
mpr
WNetAddConnection2W
WNetCancelConnection2W
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
advapi32
CryptCreateHash
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SetThreadToken
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
GetUserNameW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegCreateKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
iphlpapi
GetAdaptersInfo
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
kernel32
ReleaseMutex
SetEvent
TryEnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FormatMessageA
WaitForMultipleObjects
InitializeCriticalSection
GetHandleInformation
SetEndOfFile
SetEnvironmentVariableW
SetFileTime
SetFileAttributesW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FindFirstFileA
CreateEventA
PeekNamedPipe
FlushFileBuffers
CancelIo
DuplicateHandle
SetFilePointer
GetFileInformationByHandle
DeleteFileW
SetStdHandle
LoadLibraryExW
SetErrorMode
RemoveDirectoryW
CreateDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
GetDriveTypeW
GetDriveTypeA
GetCurrentDirectoryW
SetCurrentDirectoryW
ConvertThreadToFiber
ConvertFiberToThread
SwitchToThread
GetCurrentThread
CreateFileA
CreateMutexA
GetModuleFileNameA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
GetConsoleOutputCP
WriteConsoleW
GetCommandLineA
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
WriteFile
GetFileType
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
ReleaseSemaphore
GetVersionExW
CreateSemaphoreA
DecodePointer
IsValidCodePage
GetCPInfo
FindFirstFileExW
GetStringTypeW
GetProcessHeap
ReadConsoleInputW
DeviceIoControl
TerminateProcess
GetLastError
GetLocaleInfoW
MoveFileExW
LocalFree
FormatMessageW
CreateFileW
ReadFile
CloseHandle
SetHandleInformation
CreateNamedPipeW
GetOverlappedResult
ResetEvent
WaitForSingleObject
CreateEventW
HeapSize
GetExitCodeProcess
CreateProcessW
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalFree
GetCurrentProcessId
OpenProcess
GlobalAlloc
GetComputerNameW
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleW
GetCurrentProcess
GetSystemDirectoryW
GetWindowsDirectoryW
IsWow64Process
LoadLibraryA
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
Sleep
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetTimeZoneInformation
CreateHardLinkW
GetACP
GetOEMCP
GetStdHandle
GetConsoleScreenBufferInfo
GetLocalTime
GetDateFormatW
GetTimeFormatW
OutputDebugStringW
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
bcrypt
BCryptGenRandom
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
506KB
Virtual Size
506KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=27412,
count=215, id=261, version=27412,
count=21, id=260, version=27412,
count=13, id=253, version=31616,
count=37, id=261, version=31616,
count=19, id=260, version=31616,
count=26, id=259, version=31616,
count=26, id=257, version=27412,
count=21, productName=Unmarked objects (old),
count=14, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=3, id=257, version=31629,
count=333, id=1, productName=Unmarked objects,
count=817, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/avupdate_msg.avr
- SHA256 056ec25ad90c88a86b85a9c72246b0d4003be39ef954a6bcb1baa92e63ed6101
- MD5 7ff9f5f6a65afe7c10b5de77f4986042
- SHA1 d19c140cade5ddf6d1f588f453fccad44525030b
- SHA512 3271017bbf7afa11cb6804c5578d8fbc4410f01fb544074302cc491f357dbf1e52f8ab9d58648443f5e5f3fb64adb8dda96fe08d94ca2525465844864cf2ca98
- SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13SrnZ:qiFRuCJNKzRxw3i5hSAIbyrZ+7wniZ
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/cacert.crt
- SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
- MD5 9956b172b62aeb41ca988999947a488e
- SHA1 199e3607abeafd168b02b062697656a847fe4de7
- SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
- SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/README
- SHA256 43b602dc083b9e5836f32def1521b42f5971f7b12e47e8d272049283316f0aed
- MD5 dd70354b0df8379ef2edecbe4304f900
- SHA1 04670a5a3d483ae50bb5488cf8cecdfa7b7083aa
- SHA512 1ee14e8834c0817305e01a03984a73484a23b26f9328224513412b764017501cdce0473f58d2d64ed647adf78f51bdc7b50f5efe3f0183d736154cab83ae70ad
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.cat
- SHA256 736c72051ea40058e98362f29a7a9a5ad73032bbbf8bda53ea897f64c5bc7de8
- MD5 622330091b3d75e6e562c37582ac8b2b
- SHA1 6915486dbaf7cbd2846e63a6d1e12bff67c56922
- SHA512 5f93f6a59d798bd25aab1fe9a75f6cb13210f07bb49b340861993deaea4206fec9fadbfad6cba0c000fa6709a2e6ec6de48cbb014232f7352d272586a414ce28
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.inf
- SHA256 88f7e8d81340ab33fc71702c2817427e7b26ee31a76d59f167a00f2af2c783f0
- MD5 139c7c318ef6d64fc6c7ecdf1f7422da
- SHA1 7fc18f8244ee8c795f0da452fbb1f9bb628f9e2c
- SHA512 504b7e7917f15e93bcdcdbd7189c8b29bc27487d2c61bf3d78f9edc4f361dc0136621b55f0e1b0bf7a69c8cee668f520b72d6f45197ab58f62b5b36371c7fd27
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avgntflt.sys
- IMPHASH 1ef61e02301b03f0dea57f84bcd2479d
- SHA256 33d6cc050cefb737b70431c7e493a0d7b7f5ae7546d36fd24a5d4b1ebf29d307
- MD5 6b60c0a7fdbabe955a183ae3b524d543
- SHA1 be68e043fb0f6e0ca745b8361924ad0869bf2bb9
- SHA512 040ecbb33bbba5bba6206cee7717cff01fc8d3436762a4f2af6647cd9f02b31d48538ebc0d91b627fd0f9324375544905c2e09e4040c55b3642480e683f73df9
- SSDEEP 3072:3dxo0Wbd5kOx92/nQdp2kRaZE/I+j8CR/ehwdwTe6vuypGe08Uxb24lOPy:3dxo0Wbd5pJ/I88CR/p6vAnA4e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
84:7c:33:ec:4c:fa:98:5a:f3:91:d2:68:da:ae:9b:55:a5:32:cb:f9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
1
Major OS version
6
Entry point
156286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb
ntoskrnl.exe
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
SeCreateClientSecurity
IoGetStackLimits
ExAcquireResourceSharedLite
RtlFreeUnicodeString
RtlUpcaseUnicodeString
ZwQueryValueKey
ZwOpenKey
toupper
ZwReadFile
ZwQueryInformationToken
ZwOpenProcessTokenEx
ZwOpenProcess
_alldiv
IoCreateSynchronizationEvent
KeInsertQueueApc
KeInitializeApc
InterlockedPopEntrySList
ZwDeleteValueKey
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
PsGetCurrentThreadId
RtlUpcaseUnicodeChar
ZwQueryDirectoryFile
RtlAppendUnicodeToString
ZwOpenFile
wcsncat
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwSetInformationFile
ZwQueryInformationFile
InterlockedPushEntrySList
ExReleaseResourceAndLeaveCriticalRegion
ExEnterCriticalRegionAndAcquireResourceExclusive
IoGetTopLevelIrp
NtClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualSid
RtlGetOwnerSecurityDescriptor
ZwQuerySecurityObject
RtlNtStatusToDosError
KeWaitForSingleObject
_allmul
SeQueryInformationToken
PsSetCreateProcessNotifyRoutine
ExInitializePagedLookasideList
ProbeForRead
MmMapLockedPagesSpecifyCache
towupper
KeResetEvent
RtlIntegerToUnicodeString
RtlCreateUnicodeString
ZwSetValueKey
PsCreateSystemThread
PsRevertToSelf
SeImpersonateClientEx
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
PsTerminateSystemThread
KeWaitForMultipleObjects
ZwWriteFile
IoDeleteDevice
IoUnregisterShutdownNotification
IoDeleteSymbolicLink
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
SeTokenType
_aulldiv
_aullrem
_wcsupr
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
IoFreeMdl
MmFreePagesFromMdl
MmUnmapLockedPages
RtlSetAllBits
ExWaitForRundownProtectionRelease
MmAllocatePagesForMdl
ExReleaseRundownProtection
RtlFindClearBitsAndSet
ExAcquireRundownProtection
RtlClearBit
ExReInitializeRundownProtection
KeTickCount
KeBugCheckEx
RtlUnwind
KeQueryPriorityThread
IoThreadToProcess
PsGetProcessId
IoIsSystemThread
RtlEqualUnicodeString
RtlCopyUnicodeString
ExDeletePagedLookasideList
KeGetCurrentThread
PsReferencePrimaryToken
PsLookupProcessByProcessId
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
ProbeForWrite
ExGetPreviousMode
MmIsAddressValid
NtOpenProcess
NtQueryInformationProcess
ZwQueryInformationProcess
memmove
KeDelayExecutionThread
_wcsnicmp
wcscpy_s
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAddAccessAllowedAce
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwCreateKey
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeQueryTimeIncrement
KeQuerySystemTime
ExInitializeRundownProtection
RtlInitializeBitMap
KeSetEvent
ObfDereferenceObject
IoCreateSymbolicLink
IoRegisterShutdownNotification
ZwCreateFile
ExInitializeResourceLite
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlValidSid
RtlLengthSid
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
IofCallDriver
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
ExFreePoolWithTag
memset
KeNumberProcessors
RtlGetVersion
IoGetCurrentProcess
RtlHashUnicodeString
KeInitializeEvent
hal
KeAcquireInStackQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KeReleaseInStackQueuedSpinLock
fltmgr.sys
FltGetDestinationFileNameInformation
FltDeleteInstanceContext
FltGetVolumeProperties
FltOpenVolume
FltDeviceIoControlFile
FltSetInstanceContext
FltObjectReference
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltGetFileNameInformation
FltParseFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltCloseClientPort
FltSendMessage
FltQuerySecurityObject
FltReferenceContext
FltFsControlFile
FltQueryInformationFile
FltGetInstanceContext
FltCreateFile
FltClose
FltGetStreamHandleContext
FltSetStreamHandleContext
FltReleaseContext
FltAllocateContext
FltReleaseFileNameInformation
FltRegisterFilter
FltStartFiltering
FltCloseCommunicationPort
FltUnregisterFilter
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltFreeSecurityDescriptor
FltGetRoutineAddress
FltDeleteContext
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=237, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=50, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.cat
- SHA256 d50ffe995b3ad0b44dcc30976cb047ef690646872fa9dbc3c48950cd8593e918
- MD5 116668cc50e8f234ba729a8d8895b1e3
- SHA1 cb987ae4def6e022dc5e62cbf8a76e374bf9404c
- SHA512 3c5d04ddfb87c0fc611f6eb7b281d7a67584f9b2a4713f3f14aa1f709cceace3898fc00e4a90bc9caf59cd11e006f917536e602f21b2ac610a0245af4f3bbf5b
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.inf
- SHA256 4ae6e2a7c2e11bf797ba3b4877fb4ddf2ca75c6f774d4dfd4b002a307b7f938a
- MD5 1b439a706d228a6dc534a3a8731c1afd
- SHA1 49e34aee2faa0cbaa9bfd004eefe3150e64451b0
- SHA512 d2cf3f4c289434654d7103f0517dc99bcf98f8db01e34af25c07015fe90ca88866bc0de8d6a1983406bb2f2ad85c179a47bc9095ce650a1ee0cedf23d2a8c3f0
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avipbb.sys
- IMPHASH 666004f477406d2edd34100136c011b0
- SHA256 2bf4e12f41f8d78737592b7f29b55206b2df15411cc2943e678f52096289d06f
- MD5 a17862525867081a577923e210604a64
- SHA1 9b6f498bbda86fc464d6e5094bc8529ecd3e7579
- SHA512 e33c701cad149844913e5853187e4bbf43f6bc230fccaec21c847b373da7299849f2f3d93e6a07dc2c3c774f5119a31f0f44ed77821cc1e8dda93661e620b2ca
- SSDEEP 3072:E6zDMkFB5rqrDX7r5E2wnyKVxqxJNxBIRxUcx5VEv3QuhznmZmopCn7:3zDMU5cHq2wn/EJNIRxXx5KB1Omo07
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
2d:b8:6c:ca:3b:b0:69:26:57:00:68:12:76:9a:52:6f:76:04:8f:3b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Serial Number
05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2019 - Nov 16, 2021
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
1
Major OS version
6
Entry point
163902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb
ntoskrnl.exe
IofCompleteRequest
IofCallDriver
KeServiceDescriptorTable
ZwClose
ObfDereferenceObject
KeSetEvent
KeReleaseMutex
KeWaitForSingleObject
RtlCopyUnicodeString
ZwReadFile
ZwCreateFile
RtlCompareUnicodeString
FsRtlIsNameInExpression
_strnicmp
memmove
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ProbeForRead
ObReferenceObjectByPointer
PsProcessType
PsGetCurrentProcessId
PsLookupProcessByProcessId
KeResetEvent
KeReadStateEvent
RtlAppendUnicodeStringToString
PsLookupThreadByThreadId
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
PsTerminateSystemThread
PsThreadType
PsCreateSystemThread
RtlInsertElementGenericTableAvl
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
IoDeleteDevice
IoDeleteSymbolicLink
RtlIntegerToUnicodeString
IoWMIRegistrationControl
ExInitializePagedLookasideList
IoCreateSymbolicLink
IoCreateDevice
ExInitializeResourceLite
KeInitializeMutex
KeGetCurrentThread
_vsnwprintf
KeWaitForMultipleObjects
ExGetPreviousMode
KeQuerySystemTime
PsGetCurrentThreadId
IoReleaseCancelSpinLock
IoBuildSynchronousFsdRequest
ObReferenceObjectByHandle
ZwWriteFile
_allmul
_aullrem
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
_aulldiv
ObfReferenceObject
ObOpenObjectByPointer
PsGetProcessId
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
wcsncpy
wcsrchr
strncpy
IoDriverObjectType
wcscpy_s
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
RtlUnwind
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
ExFreePoolWithTag
ExAcquireResourceSharedLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
memset
KeNumberProcessors
RtlGetVersion
IoGetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
ExInitializeNPagedLookasideList
KeInitializeEvent
ZwSetInformationFile
ZwQueryInformationFile
PsReferencePrimaryToken
PsDereferencePrimaryToken
SeQueryInformationToken
ZwQuerySystemInformation
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
ProbeForWrite
MmIsAddressValid
NtClose
NtOpenProcess
NtQueryInformationProcess
ZwQueryInformationProcess
ZwOpenProcess
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ZwDuplicateObject
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwQueryObject
ObQueryNameString
RtlDowncaseUnicodeChar
_wcsnicmp
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
hal
ExReleaseFastMutex
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter
ExAcquireFastMutex
avkmgr.sys
func4
func3
func5
func1
func0
func6
func7
func8
func9
funca
func2
funcd
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=156, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.cat
- SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
- MD5 8dbe5877f742d7d8fb652c84f76fab5b
- SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
- SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.inf
- SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
- MD5 e92853f21048c93a182a140e667983e9
- SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
- SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win7/avkmgr.sys
- IMPHASH df68c8435781307135dfe76497ab5341
- SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
- MD5 20894c53c0b9db8f86993d9ecb78f9d5
- SHA1 7c18c5b571c906535d393a5165379f6316143107
- SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
- SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Nov 14, 2018
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2016 - Jan 19, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
36926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb
ntoskrnl.exe
IoCreateDevice
RtlInitUnicodeString
KeServiceDescriptorTable
ExFreePoolWithTag
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
memset
MmGetSystemRoutineAddress
ZwCreateFile
RtlCompareString
ExGetPreviousMode
PsGetCurrentProcessId
KeTickCount
KeBugCheckEx
RtlUnwind
ExAllocatePoolWithTag
RtlGetVersion
ZwClose
memmove
KeDelayExecutionThread
_allmul
ZwQueryInformationFile
ZwDuplicateObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
hal
KeGetCurrentIrql
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
532B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
846B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.cat
- SHA256 853c6ba3a145bdd47656b525985632ad46e1d2e8ad127449d59e2bf62bfd5d8f
- MD5 49500efd1756f4b3934e8df70bf12d97
- SHA1 7ee81eb8aa3e448fd7d9cd4559b9077d55b2afb1
- SHA512 58b72baaffca047306915e09e9903b7fe6a6d9943e1d44644ad8ed2b3a31b371dd1ba2730789b75649bcc38df0782e8e6aad04f8f8b88eb800c333624aeea1a5
- SSDEEP 192:EwafyS9JCUQXooyKfPFWQFT7Q5YVZL1aqnajKs0edqC:E9VarPFR5UYVSlGs0jC
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.inf
- SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
- MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
- SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
- SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avgntflt.sys
- IMPHASH 369430b7330b145ea00a0d756880608f
- SHA256 33c6b1d49ab13d6ae9f22e05d77b70123de63c802363da0daf1be958b7d3d532
- MD5 f16335a9102ffc99a8c8e07e1b2d57d4
- SHA1 32ddb4251591e40db352661be4721c5c6402b90a
- SHA512 57746307cab7e82e9e7ef5f033628810997954a40cf57f34650cbc9ac77fc2fa3465f1206f87e0082edc4121114dd71f2f816a628872fde26136012766a5cc52
- SSDEEP 3072:mPhzNgtyTnwf3UCPID5tfaElzgbSvTR7VHhoxM732FrBT5t3BMXv8DBf:qhGtyTHC2tDcSvTZ9+Oarf9BMMd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
156256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb
ntoskrnl.exe
KeQueryPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
InterlockedPopEntrySList
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
IoCreateSynchronizationEvent
IoGetStackLimits
ZwOpenFile
ZwReadFile
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
PsGetCurrentThreadId
PsGetProcessId
ZwOpenProcess
SeCreateClientSecurity
SeQueryInformationToken
IoIsSystemThread
IoThreadToProcess
ZwQueryDirectoryFile
ZwOpenProcessTokenEx
ZwQueryInformationToken
KeInitializeApc
KeInsertQueueApc
_alldiv
memcmp
ZwQueryInformationFile
ZwSetInformationFile
InterlockedPushEntrySList
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
IoGetTopLevelIrp
ObReferenceObjectByHandle
IoSetFileObjectIgnoreSharing
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlNtStatusToDosError
NtClose
ZwQuerySecurityObject
IoFileObjectType
KeWaitForSingleObject
RtlClearBit
RtlSetAllBits
RtlFindClearBitsAndSet
ExReInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoFreeMdl
ExDeletePagedLookasideList
PoUnregisterPowerSettingCallback
PsSetCreateProcessNotifyRoutine
towupper
RtlIntegerToUnicodeString
RtlFreeUnicodeString
ExInitializePagedLookasideList
ProbeForRead
ZwSetValueKey
RtlCreateUnicodeString
_allmul
_aulldiv
KeWaitForMultipleObjects
wcsncat
PsTerminateSystemThread
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
SeImpersonateClientEx
PsRevertToSelf
ZwWriteFile
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoUnregisterShutdownNotification
RtlHashUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_aullrem
_wcsupr
RtlCompareMemory
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
wcscpy_s
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
memmove
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
KeDelayExecutionThread
ProbeForWrite
ExGetPreviousMode
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
NtOpenProcess
MmIsAddressValid
PsReferencePrimaryToken
PsLookupProcessByProcessId
ZwQueryInformationProcess
NtQueryInformationProcess
_wcsnicmp
toupper
RtlUnwind
RtlUpcaseUnicodeChar
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlEqualUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeResetEvent
KeGetCurrentThread
IoDeviceObjectType
IoCreateDevice
ZwSetSecurityObject
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSecurityDescriptor
_snwprintf
RtlCreateSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
wcschr
ZwCreateKey
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
SeTokenType
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeNumberProcessors
memset
memcpy
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlValidSid
ZwCreateFile
ObfDereferenceObject
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoRegisterShutdownNotification
IoGetCurrentProcess
IoCreateSymbolicLink
ExInitializeRundownProtection
ExInitializeResourceLite
ExFreePoolWithTag
ExAllocatePoolWithTag
KeQueryTimeIncrement
KeQuerySystemTime
KeInitializeSpinLock
KeSetEvent
KeInitializeEvent
RtlGetVersion
RtlInitializeBitMap
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
MmGetSystemRoutineAddress
PsCreateSystemThread
RtlInitUnicodeString
hal
ExAcquireFastMutex
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
fltmgr.sys
FltGetDestinationFileNameInformation
FltObjectReference
FltGetVolumeProperties
FltDeleteInstanceContext
FltSetInstanceContext
FltDeviceIoControlFile
FltOpenVolume
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltParseFileNameInformation
FltGetFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltSendMessage
FltCloseClientPort
FltReferenceContext
FltQuerySecurityObject
FltGetInstanceContext
FltClose
FltFsControlFile
FltQueryInformationFile
FltCreateFile
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltAllocateContext
FltReleaseFileNameInformation
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetRoutineAddress
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltDeleteContext
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=185, version=30716,
count=7, id=190, version=30716,
count=4, id=259, version=26715,
count=5, id=257, version=26715,
count=239, id=1, productName=Unmarked objects,
count=7, id=260, version=26715,
count=38, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.cat
- SHA256 4efdc56d06e5a17315784d3e700e359fd3ce701edceb6d3370de64d1617d42be
- MD5 8e59d322b492d531124a0a51a5eeaae9
- SHA1 c58672a169f96336e12c0367bd5afa5906bda93f
- SHA512 2ff077f6115c6c4b87b11c78b7fb48ecc0f800f2b8a89ce16d709b802ced671f175c80746aa89f745de6f33d1f894991335de39214909ac0a084e709529a2548
- SSDEEP 192:lBRIgR6uyHJCUymwBYyKaWFWQFO7EQDzBqqnaj/CdR4:59yVyPCFRNplLV
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.inf
- SHA256 a68faf360ca9d5da989a1b6e7ff69f7aabf7b52be7819ec862a6688b841125ff
- MD5 34c3d7f3bd04501338c421cd9c62b993
- SHA1 7feda197634072bc48e214800a3d4550cd1fa32a
- SHA512 166b4ba8653b3f932ff806e39d92a48e2e2ef7c87f82fc0560add528bf5dab34e0937253c8c5778dcd31f9a925448414066c623d976fbce21893bed08c7ead70
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avipbb.sys
- IMPHASH 8cf67a6f9f559410b2c92bfe6381b8f7
- SHA256 629da28ac97f5b17b1603059242088727e1552d68fe350f97fcd0b67d412ab25
- MD5 18ed8302d083dad602823988a304a4f6
- SHA1 01014fd10d7babd6d81bb7e9511ffa7e13c890fa
- SHA512 de9ea04221fb1270db37d35fcc1acdf7265103e079fd31566b0a043a1fa3b2267a034b720a3070538f289fd3847171d3d54277417ba0f67aede86f1b78db220d
- SSDEEP 3072:FiRnqR7d4wgBQIFnh/Lpx211rrYQwKiYB+Qua7KjoLxkAAFP:Fiq4PbL/2THYQwK7B+Bau0S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
172032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb
avkmgr.sys
func7
func8
func6
funca
funcd
func5
func4
func3
func2
func1
func9
func0
ntoskrnl.exe
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeInitializeEvent
KeReadStateEvent
KeResetEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ProbeForRead
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
PsTerminateSystemThread
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoWMIRegistrationControl
ObReferenceObjectByPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlInsertElementGenericTableAvl
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsLookupThreadByThreadId
FsRtlIsNameInExpression
memcpy
memmove
memset
KeNumberProcessors
PsProcessType
PsThreadType
KeServiceDescriptorTable
KeGetCurrentThread
KeWaitForMultipleObjects
MmGetSystemRoutineAddress
ExGetPreviousMode
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ZwWriteFile
PsGetCurrentThreadId
_vsnwprintf
_allmul
KeInitializeSpinLock
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
_aulldiv
_aullrem
ObfReferenceObject
PsGetProcessId
ObOpenObjectByPointer
ZwQueryVirtualMemory
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
strncpy
wcscpy_s
wcsncpy
wcsrchr
IoDriverObjectType
KeDelayExecutionThread
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoFreeMdl
ZwQueryInformationFile
NtOpenProcess
MmIsAddressValid
ZwOpenProcess
NtClose
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ObQueryNameString
ZwQueryObject
ZwDuplicateObject
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQuerySystemInformation
ZwQueryInformationProcess
NtQueryInformationProcess
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
_wcsnicmp
RtlDowncaseUnicodeChar
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
memcmp
ZwSetInformationFile
RtlInitUnicodeString
RtlUnwind
RtlInitAnsiString
RtlIntegerToUnicodeString
_strnicmp
_stricmp
RtlAnsiStringToUnicodeString
KeQuerySystemTime
hal
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=26715,
count=4, id=257, version=26715,
count=7, id=260, version=26715,
count=3, id=257, productName=VS2019 v16.1.2 build 27702, version=27702,
count=155, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.cat
- SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
- MD5 a63897b79888e60e29431eb1b28844de
- SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
- SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
- SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.inf
- SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
- MD5 dddb1f6ae43397a15af280de3ebc3c83
- SHA1 2651935088949e2dff211a7c1126a02836a9b781
- SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win32/win8/avkmgr.sys
- IMPHASH 915211291455160b181a1b35daf6bd20
- SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
- MD5 e3ab0eeb7613ddbacc0388b96048ff5d
- SHA1 f6e382597081451d6546339948edd3e854b7dfae
- SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
- SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
36864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb
ntoskrnl.exe
RtlGetVersion
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
memset
KeServiceDescriptorTable
IoCreateDevice
ExGetPreviousMode
PsGetCurrentProcessId
ZwCreateFile
RtlCompareString
memmove
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeDelayExecutionThread
MmGetSystemRoutineAddress
ZwClose
ZwDuplicateObject
_allmul
ZwQueryInformationFile
RtlUnwind
RtlInitUnicodeString
hal
KeGetCurrentIrql
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=5, id=257, version=25203,
count=3, id=259, version=25203,
count=7, id=260, version=25203,
count=10, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=256, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=255, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=258, productName=VS2017 v15.6.6 build 26131, version=26131,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.cat
- SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
- MD5 f3018b52949cdcbf666ffaf6c17f985d
- SHA1 9b4692f754d090cd8b2afb9c4ddce60a05aefc9e
- SHA512 69b1b5c607e37d6cb0e7049fb0ce1ee79b720992a354aee73b67e9b87dc1e2c16548ae55786dbb65ec4e8bcfffd39586edc660d5b41d58d69746b8c25b627af0
- SSDEEP 192:r2p32qXooyKfPFWQFTWQ0dPLrMhEqnajKsKmEU1Isb:6vrPFRoBjlGs6Ul
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.inf
- SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
- MD5 0d87b337d3a44a6b7de7bf6c4bbbabd6
- SHA1 692a736647a575278c65dcde5996410071df09ba
- SHA512 6910581b8f3b88596a5e8da43beac9ea68f6aa3644b8e634eefa8f12c3be1c243ad31eff0122904d8c61462f040667569a47c9f19950e5dac7e1a6c8f89aede2
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avgntflt.sys
- IMPHASH 935a7ea0e08363f64cb79c28de13e264
- SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
- MD5 d9f90202659f8ce4d5db6e83d24b46dd
- SHA1 29a7b1068a5090ee59db422364b42d2c8f072a46
- SHA512 b0a9a0c0f18446e6a2b9ad3200dbd2cb94acae5df553beb971b41220304941219d12d3e94ed91dec254e6b907dac6fcb1aa72a822a09a8e523cc76071b221c31
- SSDEEP 3072:vMPogiYZ1dqoWYYCGxbceUW8bUDsQWBsMPelkz4IQ9RLNM/qIn20aqB:vooQZ1ddW5VUWvDTMGls4IQ9ZN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
24:1f:15:7d:b4:a5:38:b4:a7:f7:b6:aa:a8:ce:4e:9f:ad:38:ba:ee:d0:06:bb:74:31:3f:d6:76:41:08:d2:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Digest
e9:26:4e:79:f5:74:82:d2:64:ce:b2:4e:33:13:25:11:8e:62:a6:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Oct 14, 2021
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
230332
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb
ntoskrnl.exe
RtlUpcaseUnicodeString
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
IoGetStackLimits
ZwQuerySymbolicLinkObject
ZwReadFile
KeInitializeApc
KeInsertQueueApc
RtlAppendUnicodeToString
RtlInitAnsiString
ZwDeleteValueKey
wcsncat
KeReleaseSpinLock
ExpInterlockedPopEntrySList
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
KeEnterCriticalRegion
ZwOpenProcessTokenEx
IoCreateSynchronizationEvent
SeCreateClientSecurity
RtlFreeUnicodeString
ZwQueryValueKey
ZwQueryDirectoryFile
ExAcquireResourceSharedLite
ExReleaseResourceLite
SeQueryInformationToken
ZwOpenProcess
toupper
PsGetCurrentThreadId
RtlCopyUnicodeString
ZwOpenFile
ZwQueryInformationToken
RtlUpcaseUnicodeChar
IoIsSystemThread
KeQueryPriorityThread
PsGetProcessId
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
ZwSetInformationFile
ZwQueryInformationFile
RtlEqualSid
ExReleaseResourceAndLeaveCriticalRegion
ExpInterlockedPushEntrySList
ZwQuerySecurityObject
IoFileObjectType
RtlNtStatusToDosError
ExEnterCriticalRegionAndAcquireResourceExclusive
NtClose
ExQueryDepthSList
ObReferenceObjectByHandle
IoGetTopLevelIrp
RtlGetOwnerSecurityDescriptor
KeWaitForSingleObject
PsSetCreateProcessNotifyRoutine
ExDeletePagedLookasideList
ProbeForRead
RtlCreateUnicodeString
KeResetEvent
RtlIntegerToUnicodeString
ZwSetValueKey
MmMapLockedPagesSpecifyCache
ExInitializePagedLookasideList
towupper
RtlDeleteElementGenericTableAvl
PsCreateSystemThread
PsTerminateSystemThread
SeImpersonateClientEx
PsRevertToSelf
KeWaitForMultipleObjects
RtlEnumerateGenericTableWithoutSplayingAvl
ZwWriteFile
IoDeleteSymbolicLink
IoDeleteDevice
IoThreadToProcess
ExInitializeNPagedLookasideList
RtlHashUnicodeString
ExDeleteNPagedLookasideList
_wcsupr
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
ExReleaseFastMutex
ExAcquireFastMutex
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
RtlInitializeGenericTableAvl
sprintf_s
MmUnmapLockedPages
ExWaitForRundownProtectionRelease
ExAcquireRundownProtection
KeReleaseInStackQueuedSpinLock
RtlSetAllBits
ExReleaseRundownProtection
KeAcquireInStackQueuedSpinLock
MmAllocatePagesForMdl
IoFreeMdl
RtlFindClearBitsAndSet
ExReInitializeRundownProtection
MmFreePagesFromMdl
RtlClearBit
KeBugCheckEx
IoGetDeviceObjectPointer
_wcsnicmp
PsLookupProcessByProcessId
PsReferencePrimaryToken
KeDelayExecutionThread
ZwQueryInformationProcess
wcscpy_s
RtlInsertElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
ZwCreateKey
ExAcquireResourceExclusiveLite
SeTokenType
PsDereferencePrimaryToken
ExDeleteResourceLite
PsDereferenceImpersonationToken
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
IofCallDriver
RtlLengthSid
KeNumberProcessors
ExInitializeResourceLite
ObfDereferenceObject
IoCreateSymbolicLink
RtlCompareMemory
RtlInitializeSid
RtlCompareUnicodeString
IofCompleteRequest
RtlAppendUnicodeStringToString
KeQueryTimeIncrement
IoGetCurrentProcess
ZwCreateFile
ExInitializeRundownProtection
RtlInitializeBitMap
RtlValidSid
RtlGetVersion
KeInitializeEvent
MmGetSystemRoutineAddress
KeSetEvent
RtlInitUnicodeString
InitializeSListHead
IoRegisterShutdownNotification
IoWMIWriteEvent
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
RtlLengthRequiredSid
IoUnregisterShutdownNotification
RtlSubAuthoritySid
__C_specific_handler
fltmgr.sys
FltGetDestinationFileNameInformation
FltOpenVolume
FltObjectReference
FltGetVolumeProperties
FltSetInstanceContext
FltDeleteInstanceContext
FltDeviceIoControlFile
FltDoCompletionProcessingWhenSafe
FltParseFileNameInformation
FltGetFileNameInformation
FltSetStreamContext
FltCancelFileOpen
FltGetStreamContext
FltGetDiskDeviceObject
FltObjectDereference
FltCloseClientPort
FltSendMessage
FltQuerySecurityObject
FltReferenceContext
FltFsControlFile
FltClose
FltQueryInformationFile
FltCreateFile
FltGetInstanceContext
FltReleaseFileNameInformation
FltAllocateContext
FltReleaseContext
FltSetStreamHandleContext
FltGetStreamHandleContext
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltGetRoutineAddress
FltCloseCommunicationPort
FltUnregisterFilter
FltFreeSecurityDescriptor
FltCreateCommunicationPort
FltDeleteContext
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
19B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=135, version=30729,
count=228, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.cat
- SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
- MD5 351a7acf84d15a92dc75d3fc2f504f0e
- SHA1 1d316b5d3a8729c0f03a140ac55066399fbc808f
- SHA512 f705ee3bb4aa9328e808d0a8793692e1b525c0413e2005bd5f1d442be4da23e05b9549d85ccc8c1ae1f9c818a4ccc19207f0feffcd11d7b2b3039ed4e20c3b23
- SSDEEP 192:Wh32QmwBYyKaWFWQFqtQjWMvN/qnaj9D6ad:WlPCFRkq/l5D6ad
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.inf
- SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
- MD5 b9a877ecc51ee9f13d9e5451f8b12895
- SHA1 45a8abeb8c295295e4952893452c54850f721868
- SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avipbb.sys
- IMPHASH c67071a7e71763082096de0aad8766fc
- SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
- MD5 b49a44df6fe77ccb861985f5a5dd7ba5
- SHA1 6e5163e191dd789f8cc33a531ce9ddd9bed2a842
- SHA512 d53f56966c8750edc513c86c8e9b47fa1f0445a86a1d92621f1aa5fc9b9400a4a7f65b9ae0d2e537c9dde1b23b16fbd56af8ab74d62a8a777106e9b16e58be89
- SSDEEP 3072:sUnNOdMrlqdSL3W3TRjWLKcudx0TzBrt6Ozv7druQuxAmP9FrN:PnQurlLLmxQu/0SOzZSBxDX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
ac:37:6a:b3:0e:25:4b:a1:7a:9b:38:3b:76:ef:af:ec:4a:6e:96:c8:6b:5b:80:08:2e:99:9f:33:bc:36:46:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
19:0f:6e:25:22:27:b3:83:8c:d4:bb:76:68:8a:0b:3a:01:f5:56:c7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Chains
Feb 4, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Serial Number
05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2019 - Nov 16, 2021
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb
ntoskrnl.exe
KeInitializeMutex
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
ExAcquireFastMutex
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
ZwReadFile
RtlInitUnicodeString
RtlIntegerToUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
KeInitializeEvent
RtlInitAnsiString
RtlGetVersion
ExpInterlockedPopEntrySList
ZwOpenSymbolicLinkObject
FsRtlIsNameInExpression
KeEnterCriticalRegion
KeReleaseMutex
ZwCreateFile
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
IoGetCurrentProcess
ExReleaseResourceLite
ZwClose
RtlAppendUnicodeStringToString
IofCompleteRequest
ExQueryDepthSList
KeWaitForSingleObject
RtlCompareUnicodeString
RtlCompareMemory
ExDeleteResourceLite
IoCreateSymbolicLink
PsGetCurrentProcessId
RtlCopyUnicodeString
ExInitializePagedLookasideList
KeReadStateEvent
IoCreateDevice
ExInitializeResourceLite
KeNumberProcessors
ObReferenceObjectByPointer
ExDeleteNPagedLookasideList
PsLookupThreadByThreadId
IofCallDriver
IoBuildSynchronousFsdRequest
ExGetPreviousMode
_vsnwprintf
ObReferenceObjectByHandle
PsGetCurrentThreadId
KeWaitForMultipleObjects
IoReleaseCancelSpinLock
ZwWriteFile
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
RtlInitializeGenericTableAvl
PsThreadType
RtlEnumerateGenericTableWithoutSplayingAvl
KeAcquireSpinLockRaiseToDpc
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
wcsncpy
strncpy
IoDriverObjectType
wcsrchr
PsGetProcessId
KeDelayExecutionThread
KeBugCheckEx
ExReleaseFastMutex
KeResetEvent
IoWMIWriteEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
PsProcessType
IoWMIRegistrationControl
ProbeForRead
ExAllocatePoolWithTag
_strnicmp
RtlInsertElementGenericTableAvl
ExAcquireResourceExclusiveLite
ObfDereferenceObject
_stricmp
ZwSetInformationFile
ZwQueryInformationFile
_wcsnicmp
RtlDowncaseUnicodeChar
PsReferencePrimaryToken
ZwQueryObject
ZwQuerySystemInformation
SeQueryInformationToken
ZwOpenProcess
ZwQueryInformationProcess
PsDereferencePrimaryToken
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
__C_specific_handler
hal
KeQueryPerformanceCounter
avkmgr.sys
funca
func8
func5
func0
func2
func7
func1
func4
func6
func3
func9
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.cat
- SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
- MD5 f3324c2c121d360f8ce3553e221c3ce6
- SHA1 85939054d39067cc7e1089de71138b4b4283f800
- SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
- SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.inf
- SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
- MD5 176af3c43b608af665f48a35f497bae1
- SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
- SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win7/avkmgr.sys
- IMPHASH bbbf29be00d696bbac6e5abddd6e312c
- SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
- MD5 eb5c2402e2f402a19504bf6ca9c3e06a
- SHA1 63aa9690c36d743951558422d841276c25cde77d
- SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
- SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Nov 14, 2018
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2016 - Jan 19, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2018 - Sep 20, 2019
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
32868
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb
ntoskrnl.exe
RtlGetVersion
IoCreateDevice
MmGetSystemRoutineAddress
KeBugCheckEx
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlInitUnicodeString
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
406B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.cat
- SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
- MD5 3ece229fca8ecdf8e4889e062abbf95a
- SHA1 47aa2952646097710297f5bded9b115e418bac00
- SHA512 985d4005541e25f39bc7abf80c05b97fe57220bf02bcbb7ff41f792283af5aba87d7db433217ffcea002d35dd113913bbb6e980fbf99778126f129a799b58573
- SSDEEP 192:NfafyZYxJCxuXooyKfPFWQFzWzQPIiQLCamylqnajsq3rQe:Nc0IrPFRI3iQ3Jllgkrb
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.inf
- SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
- MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
- SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
- SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avgntflt.sys
- IMPHASH 949a3f7ef15514eb7758bc1d821f6019
- SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
- MD5 ec059af10524644bddcc073916e78375
- SHA1 93a9466afee21f61f643f540b2ab82ac7db60b62
- SHA512 88310251e07eb6edda3eb28d057a18fd7d1ea7a9adc5f861fa7ad127561bfb035468974fd11685b66654fc37dc3577d7d720e2e9e4f4fc38d116c1089ee9afe7
- SSDEEP 6144:S2M8JRGRI16YO/HqUU2miFjq5K3vPRTh9EsRbmN6:S25ERI16htvo5K3vPRr+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
205488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb
ntoskrnl.exe
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
RtlFreeUnicodeString
KeQueryPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExpInterlockedPopEntrySList
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
IoCreateSynchronizationEvent
IoGetStackLimits
ZwOpenFile
ZwReadFile
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
PsGetCurrentThreadId
PsGetProcessId
ZwOpenProcess
SeCreateClientSecurity
SeQueryInformationToken
IoIsSystemThread
IoThreadToProcess
ZwQueryDirectoryFile
ZwOpenProcessTokenEx
ZwQueryInformationToken
KeInitializeApc
KeInsertQueueApc
ZwQueryInformationFile
ZwSetInformationFile
ExQueryDepthSList
ExpInterlockedPushEntrySList
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
IoGetTopLevelIrp
ObReferenceObjectByHandle
IoSetFileObjectIgnoreSharing
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlNtStatusToDosError
NtClose
ZwQuerySecurityObject
IoFileObjectType
KeWaitForSingleObject
RtlClearBit
RtlSetAllBits
RtlFindClearBitsAndSet
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExReInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoFreeMdl
ExDeletePagedLookasideList
PoUnregisterPowerSettingCallback
PsSetCreateProcessNotifyRoutine
towupper
RtlIntegerToUnicodeString
KeResetEvent
ExInitializePagedLookasideList
ProbeForRead
RtlAnsiStringToUnicodeString
RtlCreateUnicodeString
__C_specific_handler
KeWaitForMultipleObjects
PsCreateSystemThread
PsTerminateSystemThread
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
SeImpersonateClientEx
PsRevertToSelf
ZwWriteFile
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoUnregisterShutdownNotification
RtlHashUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_wcsupr
RtlCompareMemory
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
ExAcquireFastMutex
ExReleaseFastMutex
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
wcscpy_s
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
KeDelayExecutionThread
ProbeForWrite
ExGetPreviousMode
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
NtOpenProcess
MmIsAddressValid
PsReferencePrimaryToken
PsLookupProcessByProcessId
ZwQueryInformationProcess
NtQueryInformationProcess
_wcsnicmp
RtlInitAnsiString
IoDeviceObjectType
IoCreateDevice
ZwSetSecurityObject
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSecurityDescriptor
_snwprintf
RtlCreateSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
wcschr
ZwCreateKey
wcsncat
toupper
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
SeTokenType
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeNumberProcessors
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlValidSid
ZwCreateFile
ObfDereferenceObject
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoRegisterShutdownNotification
IoGetCurrentProcess
IoCreateSymbolicLink
ExInitializeRundownProtection
ExInitializeResourceLite
InitializeSListHead
ExFreePoolWithTag
ExAllocatePoolWithTag
KeQueryTimeIncrement
KeInitializeSpinLock
KeSetEvent
KeInitializeEvent
RtlGetVersion
RtlInitializeBitMap
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
MmGetSystemRoutineAddress
ZwSetValueKey
RtlInitUnicodeString
fltmgr.sys
FltGetDestinationFileNameInformation
FltObjectReference
FltGetVolumeProperties
FltDeleteInstanceContext
FltSetInstanceContext
FltDeviceIoControlFile
FltOpenVolume
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltParseFileNameInformation
FltGetFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltSendMessage
FltCloseClientPort
FltReferenceContext
FltQuerySecurityObject
FltGetInstanceContext
FltClose
FltFsControlFile
FltQueryInformationFile
FltCreateFile
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltAllocateContext
FltReleaseFileNameInformation
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetRoutineAddress
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltDeleteContext
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
3B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=185, version=30716,
count=7, id=190, version=30716,
count=3, id=257, version=26715,
count=230, id=1, productName=Unmarked objects,
count=5, id=259, version=26715,
count=7, id=260, version=26715,
count=38, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.cat
- SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
- MD5 209bedcc941da626c2db370a80e3513e
- SHA1 c88910bf5a4b35893e60d92828568d20420a9caf
- SHA512 ddef0175e3e2919c4504f99d054b314e48f4ed0ac5c1b3153e1581b3614f304fe3850a8d465163cb4c502d4b026986121d6e4e30fc421d2c583b689ec933a10f
- SSDEEP 192:CEbRVRDy8nJCx0mwBYyKaWFWQF259Q8I+XqnajlGupG8hod:njJn00PCFRO7ImlORd
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.inf
- SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
- MD5 b9a877ecc51ee9f13d9e5451f8b12895
- SHA1 45a8abeb8c295295e4952893452c54850f721868
- SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avipbb.sys
- IMPHASH b2557b252ab2c20a9c87b8e7393248c5
- SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
- MD5 c8d33c5b49a4760f2d81710eba839ba2
- SHA1 8f41e4333dabe52bfd988a68785d0687599f1154
- SHA512 451dca816d38538e082c7388aac0997eb04f5e8fc288fe44aeb661ece1e717060d73f24d60c7576403a68a5fbda3f931161602a2a8b98f506b56ff64c095cd78
- SSDEEP 3072:lRgvKNe0BiAKLgBy6IdaJHIcVOmBvU6vHCSEQuqQ3TJu7Gyz:l2069oIMbVOcvU6vxEBDJI7z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
188416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb
avkmgr.sys
func2
func3
func4
func5
func1
func7
func8
func9
funca
func6
func0
ntoskrnl.exe
RtlIntegerToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeInitializeEvent
KeReadStateEvent
KeResetEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ProbeForRead
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoWMIRegistrationControl
ObReferenceObjectByPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlInsertElementGenericTableAvl
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsLookupThreadByThreadId
FsRtlIsNameInExpression
__C_specific_handler
KeNumberProcessors
_stricmp
KeWaitForMultipleObjects
ExGetPreviousMode
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ZwWriteFile
PsGetCurrentThreadId
_vsnwprintf
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
PsThreadType
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
strncpy
wcsncpy
wcsrchr
PsGetProcessId
IoDriverObjectType
KeDelayExecutionThread
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoFreeMdl
ZwQueryInformationFile
NtOpenProcess
MmIsAddressValid
ZwOpenProcess
NtClose
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ZwQueryObject
ZwQuerySystemInformation
ZwQueryInformationProcess
NtQueryInformationProcess
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
_wcsnicmp
RtlDowncaseUnicodeChar
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
wcscpy_s
ZwSetInformationFile
_strnicmp
PsProcessType
hal
KeQueryPerformanceCounter
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=26715,
count=5, id=259, version=26715,
count=6, id=260, version=26715,
count=3, id=257, productName=VS2019 v16.1.2 build 27702, version=27702,
count=140, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.cat
- SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
- MD5 88ae7b9879c9ac3a65ef73424600ba65
- SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
- SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
- SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.inf
- SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
- MD5 fabaac0d5c0ef083150dec8615a8b2bb
- SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
- SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/on_access/win64/win8/avkmgr.sys
- IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
- SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
- MD5 40786e1ac650f9f7e8b67a672b5eb69e
- SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
- SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
- SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlGetVersion
IoCreateDevice
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInitUnicodeString
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
342B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=1, productName=Unmarked objects,
count=3, id=257, version=25203,
count=6, id=260, version=25203,
count=4, id=259, version=25203,
count=8, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=256, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=255, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=258, productName=VS2017 v15.6.6 build 26131, version=26131,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/plg_fops_dummy.dll
- IMPHASH 030a305e7c90f0e0ba6c00476e02031b
- SHA256 18f14d6ef36885b58dbe598cee1ff20c83afd5f9cf0c739394f74251f51bbf2f
- MD5 e31669de92895bb6b150e3f319267458
- SHA1 83a6ffc6da2421d28e4f8a068a0950726078673c
- SHA512 2d5f7f682e88fe83223efa7763e1dd46f50462eb8f164c90bf34c41c40ba06b98720b2acc04238809fa646b708a2c4a640ddb0e1ec0a8ae244cc29737e4fec6d
- SSDEEP 1536:ALBBbE9pvjyBQO53mWGw6abjwgNXjLEFSg1NZXarnYsWYEbcdOy/N5+q0q:ITbEP+BQO53mnanwmXjdIcnnO45+q0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
6689
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFileAttributesW
DeleteFileW
MoveFileExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
CompareStringW
LCMapStringW
SetStdHandle
GetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetTimeZoneInformation
GetStringTypeW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
DecodePointer
savapi_plg_main
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=171, id=261, version=27412,
count=18, id=260, version=27412,
count=30, id=261, version=31616,
count=16, id=260, version=31616,
count=20, id=259, version=31616,
count=3, id=257, version=27412,
count=94, id=1, productName=Unmarked objects,
count=2, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/productname.dat
- SHA256 84cc36c119381af58ccaead1ad8995b92317ca4ae8c38a38dc37071d712bb4d8
- MD5 53ce39cd5a411bb30c5b1d413e641ec8
- SHA1 0b7c31237c9b0a436ace5274938d420f8c7d6385
- SHA512 3524dea3bfd8cc9539d70102ab3f49da50a1b0c1a68b7073869b7f193a30562d716526a6de13a40f07480763e3841bcc3743b91f46f9f87630707e63e7d76f26
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.conf
- SHA256 b30e328a864f6c4bd5544f6a7c3dbdc2cb97e668e2e583de0590506c881a16b9
- MD5 c1f0cfade5c32a37b223f5f7b0ec3510
- SHA1 8fb0afd1a53feb25652937d09865e3cc8cf3f02e
- SHA512 9dc05c25f907ce29ebccca1c34fbf926ea7a4d803e2d2fb6106192176681fd151b82605bc066e7e55e03b14aae3ac81008dadc70889dbae887de5f67ec11aa40
- SSDEEP 768:CORmWh90JmGrHbKlckb58aomNOKggzy+Yq:thSPHpkmnmN/dW+Yq
- MD5 SHA1 SHA512 SSDEEP
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.dll
- IMPHASH 98df4127bc9f89b567dba0807b2d2ea7
- SHA256 5617fc94cdd8b0c7a14df62cfc77f64ffe157d5fe96cc02c9ff209db97274e0e
- MD5 85815e63269ec76386fd2a4d418f75be
- SHA1 34b6ae807c5ab324e3e5a624b4bfa325ad86d890
- SHA512 08401d39a1d8cd2b047b66c14236aaf04fc79d2a21c57e38198a6c2ccfca5e2959628a4674eb5609f7bb8d49eb87ea9033562bbdb058dc03beab81478b95e7d6
- SSDEEP 49152:CZb4QJm+I6aJ9YPizIT9E1mJ85NDVwwLRFytPzZnpvsqKTZb:CZb4QJDVOKwmaNDVwSC1Znp
- MD5 SHA1 SHA512 SSDEEP
Digest
a2:92:c9:67:e5:3a:02:3e:64:c3:a7:28:a2:47:ad:02:cf:a4:35:7f:71:c9:7b:9a:18:aa:6a:17:84:91:1a:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
2071915
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\libsavapi\daemon\libsavapi.pdb
kernel32
SetEvent
CreateEventW
GetCurrentProcess
FindClose
LoadLibraryW
LoadLibraryA
FreeLibrary
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateFiber
DeleteFiber
SwitchToFiber
GetProcAddress
GetModuleHandleW
WriteFile
GetFileType
GetEnvironmentVariableW
GetStdHandle
FormatMessageW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryDosDeviceW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
Sleep
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemInfo
CloseHandle
GetOEMCP
GetACP
WideCharToMultiByte
MultiByteToWideChar
CreateHardLinkW
GetTempPathW
SetLastError
GetNativeSystemInfo
HeapSize
GetStringTypeW
GetProcessHeap
GetCommandLineA
FindFirstFileExW
GetCPInfo
IsValidCodePage
DecodePointer
LCMapStringW
CompareStringW
GetModuleFileNameW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GlobalFree
FindNextFileW
OutputDebugStringW
FindFirstFileW
HeapReAlloc
HeapAlloc
HeapFree
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
GetConsoleOutputCP
SetFilePointerEx
RaiseException
EncodePointer
RtlUnwind
InterlockedFlushSList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
CreateNamedPipeA
CreatePipe
UnlockFileEx
UnlockFile
LockFileEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
SetErrorMode
LoadLibraryExW
FindFirstFileA
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetEnvironmentVariableW
SetStdHandle
CreateFileW
DeleteFileW
SetFilePointer
DeviceIoControl
GetOverlappedResult
CancelIo
MoveFileExW
FlushFileBuffers
ReadFile
PeekNamedPipe
ReleaseSemaphore
CreateSemaphoreA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
GetCurrentThread
OpenFileMappingW
FormatMessageA
DuplicateHandle
SwitchToThread
SetEndOfFile
ResetEvent
SetHandleInformation
CreateFileMappingA
CreateFileA
GetVersionExW
GetModuleFileNameA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
LockFile
user32
GetSystemMetrics
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
AllocateAndInitializeSid
CryptAcquireContextA
LogonUserW
CheckTokenMembership
FreeSid
CloseServiceHandle
OpenSCManagerW
OpenServiceW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoA
GetNamedSecurityInfoW
GetSecurityInfo
OpenProcessToken
OpenThreadToken
PrivilegeCheck
LookupPrivilegeValueA
CreateProcessAsUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
RevertToSelf
SetSecurityDescriptorDacl
QueryServiceStatus
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
ws2_32
inet_ntop
WSAWaitForMultipleEvents
htons
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAIoctl
WSAResetEvent
inet_pton
__WSAFDIsSet
select
htonl
inet_addr
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
getpeername
recv
getnameinfo
freeaddrinfo
getaddrinfo
ntohs
getsockopt
getsockname
ioctlsocket
gethostname
WSAAddressToStringW
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
ntohl
shutdown
getservbyname
recvfrom
sendto
WSAGetOverlappedResult
WSARecv
WSASend
socket
shlwapi
PathCanonicalizeW
winhttp
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
crypt32
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
iphlpapi
GetAdaptersAddresses
mswsock
TransmitFile
rpcrt4
UuidCreate
bcrypt
BCryptGenRandom
shell32
CommandLineToArgvW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
CharToSTCHAR
SAVAPI_APC_cache_operation
SAVAPI_APC_get_version
SAVAPI_APC_initialize
SAVAPI_APC_uninitialize
SAVAPI_FPC_disable_preinit
SAVAPI_OA_create_instances
SAVAPI_OA_initialize
SAVAPI_OA_start_scan
SAVAPI_OA_stop_scan
SAVAPI_OA_uninitialize
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_create_instance
SAVAPI_engine_modules_get
SAVAPI_engine_modules_get_ex
SAVAPI_engine_versions_get
SAVAPI_extract_malware_names
SAVAPI_free
SAVAPI_get
SAVAPI_get_dynamic_detect
SAVAPI_get_fops
SAVAPI_get_instance_pool
SAVAPI_get_type
SAVAPI_get_user_data
SAVAPI_get_version
SAVAPI_global_set
SAVAPI_initialize
SAVAPI_is_running
SAVAPI_is_running_ex
SAVAPI_register_callback
SAVAPI_release_instance
SAVAPI_reload_engine
SAVAPI_reload_engine_ex
SAVAPI_reset_instance
SAVAPI_scan
SAVAPI_send_signal
SAVAPI_set
SAVAPI_set_avpal_init_flags
SAVAPI_set_avpal_inited
SAVAPI_set_ex
SAVAPI_set_fops
SAVAPI_set_log_callback
SAVAPI_set_quickload_init
SAVAPI_set_user_data
SAVAPI_simple_scan
SAVAPI_uninitialize
SAVAPI_unregister_callback
SAVAPI_with_encoding_get
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
541KB
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=27412,
count=210, id=261, version=27412,
count=21, id=260, version=27412,
count=10, id=253, version=31616,
count=30, id=261, version=31616,
count=17, id=260, version=31616,
count=25, id=259, version=31616,
count=27, id=257, version=27412,
count=297, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,
count=21, productName=Unmarked objects (old),
count=10, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=812, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi.exe
- IMPHASH 4b8fd0313c7bf7140bc5c6706adc5060
- SHA256 212b3d2c8f570375b95fb2de9f681a9f85796220b4bcb5abb6a2d248ffd9e1ea
- MD5 ae60aaf104b487577024715df996309e
- SHA1 ca80a770fd21bf51a4f1a3c05b1d4dc974780804
- SHA512 108efd4b3e463a1ce658d497de80fcdcb9c6b7ab08abd8fddd639e8de4383b6a4f793cb3dc249d9c5e6d157db897d10b65d1e919487e65b480305fa61be3c98f
- SSDEEP 12288:w/PGF6AJykhK9Qc955YkgP4imIJ93moIdsLvBPREFxQKjFBtD1O9rDxO77pP9jkf:Wu185YkRimID2sav1O9rDxMnkYAbmS11
- MD5 SHA1 SHA512 SSDEEP
Digest
f6:aa:98:bc:f7:f9:f4:1c:d7:17:98:2c:75:dc:c7:c8:5b:74:a0:8f:08:c9:0e:ae:f6:e1:7d:7f:64:44:0a:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
391995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\src\savapi.pdb
ws2_32
htonl
getpeername
send
recv
inet_addr
getsockname
ioctlsocket
ntohl
freeaddrinfo
shutdown
select
getservbyname
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
ntohs
htons
listen
getaddrinfo
socket
setsockopt
WSACleanup
WSAStartup
gethostbyname
gethostname
WSAGetLastError
getsockopt
shlwapi
PathCanonicalizeW
mswsock
TransmitFile
rpcrt4
UuidCreate
kernel32
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
SetLastError
CreateHardLinkW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
OutputDebugStringW
Sleep
GetTickCount
GetStdHandle
GetConsoleScreenBufferInfo
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DeviceIoControl
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
SetHandleInformation
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
ExpandEnvironmentStringsW
GetCurrentProcess
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
ReadFile
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetStdHandle
DeleteFileW
SetFilePointer
GetOverlappedResult
MoveFileExW
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FlushFileBuffers
PeekNamedPipe
CreateFileA
ConnectNamedPipe
CreateNamedPipeA
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
HeapSize
FreeLibrary
GetProcAddress
LoadLibraryExW
SetEndOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FormatMessageA
DuplicateHandle
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
OpenFileMappingW
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateFileMappingA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
GetVersionExW
GetModuleFileNameA
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
CreateFileW
SetConsoleCtrlHandler
GetLastError
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
InitializeCriticalSectionAndSpinCount
RaiseException
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
GetConsoleMode
ReadConsoleW
ExitProcess
GetCommandLineA
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
HeapReAlloc
DecodePointer
CreatePipe
WriteFile
IsValidCodePage
GetCPInfo
GetConsoleOutputCP
FindFirstFileExW
GetStringTypeW
GetProcessHeap
SetConsoleMode
ReadConsoleInputW
GetFileSizeEx
SetErrorMode
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueA
PrivilegeCheck
OpenThreadToken
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExA
LookupAccountNameA
LookupAccountSidA
IsValidSid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
EqualSid
OpenProcessToken
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
CharToSTCHAR
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_free
SAVAPI_set_log_callback
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
494KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=185, id=261, version=27412,
count=19, id=260, version=27412,
count=8, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=26, id=259, version=31616,
count=1, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,
count=19, id=257, version=27412,
count=262, id=1, productName=Unmarked objects,
count=161, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_post.bat
- SHA256 4682c0f3dcbafa32e3dae743268a0babf67fe2970b4b0dd3f91cc7ed54627545
- MD5 0dc718c8c4ccc13e58f9224f1af1125d
- SHA1 51cca0861c564b973dc5017f6a9c86d47b2dad31
- SHA512 b6e4b9b9b50669198d35a06c15bf8334eb3e68801946a96be66aee00361faceed6eefd84303979c5fceb87588a21d4fc1c94ca2a9dea5fb062d2a9da8c4cf27f
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_pre.bat
- SHA256 ec07adec51dc57f42077b2757421012c49fc771fb8cf664c36505d664e996c36
- MD5 912510dd6dd41ca900d10834879601c7
- SHA1 4dcaa7061636cf05ad5fe72ecb20ca29f2c003fe
- SHA512 63f0e1b37d83d208d1d9fab44b74d5f0def82caeb4f2289d7ffb6bacb28013f6a24ae61d9a83e6684c80b5221675d76bc75a94c9fb2ebe31819465135753ea6c
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_pretest.bat
- SHA256 767637bffb932cad48218f8d128f2908e57c4a42326db29dfeaa1c5509018186
- MD5 55d563f40e716ab251760a52f49a0e68
- SHA1 fc8a086681368388dbf77199cabac654765b133b
- SHA512 b218b11f9d66812a76c99b5a9a8cc73f9c83c626cef17049425855d5242e9c2e4355557c94d8a9f4d8f0fa6edc99a4658849f5edbb0320f7342dae4bda18e34b
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_restart.exe
- IMPHASH 28329b2bbd34737edf89c242f51f5b11
- SHA256 4b75f1e230aa0195e8da68e481eeb90b9d85194f15e2d458bd8ebee6d9d69ccc
- MD5 9919de22bf888ab8d7122a04646aa313
- SHA1 35af4b2757b6d96e345ba43af1d126ccfbbeb23d
- SHA512 deb7c4af295ed1c90205bd4c1299c62dbed70711ae16e3eceb64b386ca5e78537f801c1641d13617a6ee448cb187bb0399990a8161abc6685f0ee941a110224e
- SSDEEP 3072:F52hQmn2wcv4N6eQQlhsPGhUI/CR5zC3MBqtRsivf1Z8OpyXBg7HZP0k:Le12w7tBlaV5zHqdEBsyk
- MD5 SHA1 SHA512 SSDEEP
Digest
ab:57:a6:80:c4:ea:58:25:e7:8d:b5:52:70:f1:55:ac:6e:3d:08:c2:c2:aa:0a:47:59:b6:84:fe:e8:23:50:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
8116
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_restart\savapi_restart.pdb
kernel32
WriteConsoleW
GetTickCount
Sleep
FormatMessageW
LocalFree
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetLastError
CloseHandle
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
DecodePointer
advapi32
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=141, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=31616,
count=18, id=260, version=31616,
count=19, id=259, version=31616,
count=5, id=257, version=27412,
count=98, id=1, productName=Unmarked objects,
count=3, id=261, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapi_stub.exe
- IMPHASH 25235b078b3d329488576152e6e2b169
- SHA256 91265685308da5d2a1cc5f478b83e43a4656fd075d7cfee3923380905fd8dfaf
- MD5 3899d956a9c88d0519e188d067de5d19
- SHA1 241b01e86a121694a48722ce4dc6c08bd0bf5cfd
- SHA512 7f6e4d7b279f3c08022af6290e4015f12d4e8ba54ef65681d162bb421f08a81b57b4b2e7004861638c227da746127f5e9d4ee7932f3e2067b990f6b2951cb633
- SSDEEP 6144:a+UDVHIZD9qmbvM3Y+c8A50LBZAzOejDx19iM856t0Q+GAC9k0q3Yl8rif9P2432:a+UDVHIZfbU3Y8/fejDxfiM85m0Q+GAr
- MD5 SHA1 SHA512 SSDEEP
Digest
8f:16:bb:ad:47:5f:b8:8f:62:0e:4e:b0:45:aa:d3:89:cf:fe:3a:cd:1a:9c:4e:28:5c:77:f3:42:cd:62:97:80
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
1
Major OS version
6
Entry point
128989
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_stub\savapi_stub.pdb
ws2_32
getnameinfo
freeaddrinfo
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
gethostbyname
socket
shutdown
send
select
recv
listen
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
ntohl
WSAGetLastError
WSACleanup
WSAStartup
gethostname
rpcrt4
UuidCreate
kernel32
CreateThread
WriteConsoleW
RaiseException
LoadLibraryExW
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
CreateHardLinkW
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetStdHandle
CloseHandle
GetHandleInformation
SetHandleInformation
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FormatMessageA
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
ExitProcess
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
TryEnterCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
CreateEventA
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
PeekNamedPipe
GetOverlappedResult
CancelIo
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapSize
GetTimeZoneInformation
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
TerminateProcess
CreateFileA
CreatePipe
CreateNamedPipeA
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FreeLibrary
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
DecodePointer
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
GetStringTypeW
GetProcessHeap
SetFilePointerEx
SetFileAttributesW
SystemTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
Name
.text
Size
229KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=170, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=23, id=259, version=31616,
count=202, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=57, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/savapiclient.dll
- IMPHASH c23ac466c64dc5ed7062eba2817f1e18
- SHA256 8f5aedf1f8e8dd027aabb3420ed7e0e38219a7d8d3b880f3a46671d32270fc69
- MD5 eb905e77afda1a6e65342a83ac5fba75
- SHA1 93434d20f75db97bf1947043982d33d282db96a0
- SHA512 4fdb07e66639fe5efeea5f45a57db932be99e7ce81aac392f7fd52dc0b333a219da5af9df980ca3caf256f899640a4bcebdbdb8aa4bb2269160f692a72b880a2
- SSDEEP 6144:+e0cf8LyAE2TDdvqRyTsJEgXHr067z7WcYj57l5nFLFzGTDkYXVjdZn/FOoiOTFS:+e0cf8LyeTDdvqRyTsNHr0GG5FBzGTDM
- MD5 SHA1 SHA512 SSDEEP
Digest
1b:8d:ab:08:2a:9f:64:95:d8:31:2d:38:d5:c5:46:3f:a9:5b:8b:1c:b2:ab:a7:07:06:06:90:b4:14:6a:be:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
180806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\libsavapi\client\libsavapiclient.pdb
ws2_32
recv
inet_addr
setsockopt
send
freeaddrinfo
getaddrinfo
getservbyname
ntohl
htons
htonl
getsockname
getpeername
ioctlsocket
getnameinfo
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
socket
shutdown
select
ntohs
listen
connect
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
WSAStartup
gethostbyname
gethostname
WSAGetLastError
getsockopt
mswsock
TransmitFile
rpcrt4
UuidCreate
advapi32
GetNamedSecurityInfoA
RegisterEventSourceW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
DeregisterEventSource
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
PrivilegeCheck
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
kernel32
GetModuleHandleExW
RaiseException
LoadLibraryExW
FreeLibrary
WriteConsoleW
RtlUnwind
InterlockedFlushSList
GetModuleHandleW
GetStartupInfoW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
CompareStringW
LCMapStringW
DecodePointer
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetProcessHeap
GetStringTypeW
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
GetOverlappedResult
GetLastError
SetLastError
CloseHandle
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
SetHandleInformation
WaitForSingleObject
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
GetCurrentProcess
GetCurrentThread
OpenFileMappingW
GetStdHandle
SetStdHandle
CreateFileW
DeleteFileW
GetFileInformationByHandle
SetFilePointer
DeviceIoControl
HeapSize
CancelIo
MoveFileExW
CreateHardLinkW
FlushFileBuffers
ReadFile
WriteFile
PeekNamedPipe
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FormatMessageA
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
SwitchToThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
CreateFileA
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
shell32
CommandLineToArgvW
CharToSTCHAR
SAVAPI_APC_cache_operation
SAVAPI_APC_get_version
SAVAPI_APC_initialize
SAVAPI_APC_uninitialize
SAVAPI_FPC_disable_preinit
SAVAPI_OA_create_instances
SAVAPI_OA_initialize
SAVAPI_OA_start_scan
SAVAPI_OA_stop_scan
SAVAPI_OA_uninitialize
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_create_instance
SAVAPI_engine_modules_get
SAVAPI_engine_modules_get_ex
SAVAPI_engine_versions_get
SAVAPI_extract_malware_names
SAVAPI_free
SAVAPI_get
SAVAPI_get_dynamic_detect
SAVAPI_get_fops
SAVAPI_get_instance_pool
SAVAPI_get_type
SAVAPI_get_user_data
SAVAPI_get_version
SAVAPI_global_set
SAVAPI_initialize
SAVAPI_is_running
SAVAPI_is_running_ex
SAVAPI_register_callback
SAVAPI_release_instance
SAVAPI_reload_engine
SAVAPI_reload_engine_ex
SAVAPI_reset_instance
SAVAPI_scan
SAVAPI_send_signal
SAVAPI_set
SAVAPI_set_avpal_init_flags
SAVAPI_set_avpal_inited
SAVAPI_set_fops
SAVAPI_set_log_callback
SAVAPI_set_quickload_init
SAVAPI_set_user_data
SAVAPI_simple_scan
SAVAPI_uninitialize
SAVAPI_unregister_callback
SAVAPI_with_encoding_get
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=169, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=23, id=259, version=31616,
count=217, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=76, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/scew.dll
- IMPHASH 571b82e04a3103a0e1e37478d9e58122
- SHA256 10f3a985da345376502bb8e4fce9c59aa15633b78347bf9080fb61bdd2e3cd5d
- MD5 4a144eb1f737dc00689659b36aff0384
- SHA1 4ce0c8afbd153473d6a03fb2743e209b5ddd1c0e
- SHA512 68e5044ed77ebdcef9b0b3fec7174ef5faf56b38aebf5df64ec925c817021453e97a3a02a348996cfb3976b995e59439b3128930ba176600ab4b10c12ff40726
- SSDEEP 6144:G5ieH3XO7LeWBl3bVan3/G6C1XNj7rFIgQM3mbPnTbqMalXwnhHyz:G5PH3Xciil3kne6C1XNj7rFbQMYIwnk
- MD5 SHA1 SHA512 SSDEEP
Digest
c1:2a:dd:1d:b0:2a:c6:c6:97:1c:24:59:34:88:24:37:bb:16:26:f3:4a:42:f2:97:20:2d:01:3e:82:63:50:3e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
173781
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\kmr4g80c\common\scew\scew.pdb
kernel32
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapAlloc
HeapFree
GetStringTypeW
CompareStringW
LCMapStringW
CloseHandle
ReadFile
GetConsoleMode
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
WriteFile
OutputDebugStringW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
SetStdHandle
CreateFileW
HeapSize
DecodePointer
XML_Parse
scew_attribute_compare
scew_attribute_copy
scew_attribute_create
scew_attribute_free
scew_attribute_name
scew_attribute_parent
scew_attribute_set_name
scew_attribute_set_value
scew_attribute_value
scew_element_add
scew_element_add_attribute
scew_element_add_attribute_pair
scew_element_add_element
scew_element_add_pair
scew_element_attribute_by_index
scew_element_attribute_by_name
scew_element_attribute_count
scew_element_attributes
scew_element_by_index
scew_element_by_name
scew_element_children
scew_element_compare
scew_element_contents
scew_element_copy
scew_element_count
scew_element_create
scew_element_delete_all
scew_element_delete_all_by_name
scew_element_delete_attribute
scew_element_delete_attribute_all
scew_element_delete_attribute_by_index
scew_element_delete_attribute_by_name
scew_element_delete_by_index
scew_element_delete_by_name
scew_element_detach
scew_element_free
scew_element_free_contents
scew_element_list_by_name
scew_element_name
scew_element_parent
scew_element_set_contents
scew_element_set_name
scew_error_code
scew_error_expat_code
scew_error_expat_column
scew_error_expat_line
scew_error_expat_string
scew_error_string
scew_isempty
scew_list_append
scew_list_create
scew_list_data
scew_list_delete
scew_list_delete_item
scew_list_find
scew_list_find_custom
scew_list_first
scew_list_foreach
scew_list_free
scew_list_index
scew_list_last
scew_list_next
scew_list_prepend
scew_list_previous
scew_list_size
scew_parser_create
scew_parser_expat
scew_parser_free
scew_parser_ignore_whitespaces
scew_parser_load
scew_parser_load_stream
scew_parser_namespace_create
scew_parser_reset
scew_parser_set_element_hook
scew_parser_set_tree_hook
scew_printer_create
scew_printer_free
scew_printer_print_attribute
scew_printer_print_element
scew_printer_print_element_attributes
scew_printer_print_element_children
scew_printer_print_tree
scew_printer_set_indentation
scew_printer_set_indented
scew_printer_set_writer
scew_reader_buffer_create
scew_reader_close
scew_reader_create
scew_reader_data
scew_reader_end
scew_reader_error
scew_reader_file_create
scew_reader_fp_create
scew_reader_free
scew_reader_read
scew_strcmp
scew_strdup
scew_strescape
scew_strtrim
scew_tree_compare
scew_tree_copy
scew_tree_create
scew_tree_free
scew_tree_root
scew_tree_set_root
scew_tree_set_root_element
scew_tree_set_xml_encoding
scew_tree_set_xml_preamble
scew_tree_set_xml_standalone
scew_tree_set_xml_version
scew_tree_xml_encoding
scew_tree_xml_preamble
scew_tree_xml_standalone
scew_tree_xml_version
scew_writer_buffer_create
scew_writer_close
scew_writer_create
scew_writer_data
scew_writer_end
scew_writer_error
scew_writer_file_create
scew_writer_fp_create
scew_writer_free
scew_writer_write
Name
.text
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=157, id=261, version=27412,
count=20, id=260, version=27412,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=20, id=259, version=31616,
count=3, id=257, version=27412,
count=81, id=1, productName=Unmarked objects,
count=24, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/update.bat
- SHA256 924f07591863b3e6d43371593a3c4d57bba93cdbf59fdf102ba72abd55e92879
- MD5 b862a1baac142bcacd391414d665a0a1
- SHA1 79aa0c97010707640bfa3082b29fd61b1373dbce
- SHA512 788f4e959fdf91f2c3a2a46ff9d1ed51f96c73238f3e9aaab9e2b2bd45759645085082aa831220c9ce023a7a741213538d852658b9cbe4b12bbee5705e1f2d7b
- MD5 SHA1 SHA512
$APPDATA/TotalAV/updates/SAVAPI 11.0.1/xvdfmerge.dll
- IMPHASH 8e0283b879a0a5a261fb176ecb652c35
- SHA256 d20f7ad78d1d548ebea41f6b496cb2399f8186493564c777f192c9a0eed23f18
- MD5 af329640a44f6dc93e395e167a0c80f9
- SHA1 9f3c6e132c874ec689c2ab5ad21282f326d93694
- SHA512 988ce1e03736fbb4369bd5e0ffc52dae9c70811c65d11066d99a76e372fb72108d80c727fe4dd4e4e1125c927a68caf97af18009fb362048f408dbe36caba440
- SSDEEP 6144:ylOdse4zxgQM+50K5xDAcAd5gL22nn0kvrDmENiyoJjK7bdgaO/10kGsKceGAqUh:ylOdse41gW50K5xDBXlvrDdiyoJjK7bh
- MD5 SHA1 SHA512 SSDEEP
Digest
64:f1:e3:7c:88:4f:69:d7:db:03:39:7d:13:fd:48:88:53:4f:5b:08:ce:bc:80:66:18:e8:5d:80:cb:78:84:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
148328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\common\xvdf_merge\xvdfmerge.pdb
ws2_32
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
socket
shutdown
send
select
recv
getnameinfo
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
ntohl
freeaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
gethostname
listen
rpcrt4
UuidCreate
kernel32
CreateThread
WriteConsoleW
GetModuleHandleExW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
RaiseException
InitializeCriticalSectionAndSpinCount
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
CreateHardLinkW
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
FreeLibraryAndExitThread
GetOverlappedResult
CancelIo
WaitForSingleObject
CreateEventA
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ExitThread
ReleaseMutex
CreateMutexA
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
HeapSize
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
GetHandleInformation
SetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
FormatMessageA
CreateFileA
GetVersionExW
GetModuleFileNameA
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
RtlUnwind
InterlockedFlushSList
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
CompareStringW
LCMapStringW
GetConsoleOutputCP
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
DecodePointer
FindFirstFileExW
GetCommandLineA
GetProcessHeap
SetEvent
GetStringTypeW
PeekNamedPipe
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
XVDF_files_merge
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=173, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=24, id=259, version=31616,
count=15, id=257, version=27412,
count=203, id=1, productName=Unmarked objects,
count=74, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
$PLUGINSDIR/AccessControl.dll
- IMPHASH b79de4e8687b3fce7173ec8dc917f685
- SHA256 d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d
- MD5 9e7d36edcc188e166dee9552017ac94f
- SHA1 0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a
- SHA512 92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783
- SSDEEP 192:y26NwF1FF8GqdxASZlSOnNGGPCqLXUdadWo2FfTCWWqDsYjGI5hBslft8gWNPjQo:I+8vwSZlgaJ3/4/4Q/bN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12852
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpynA
CloseHandle
GetCurrentProcess
LocalAlloc
lstrlenA
LoadLibraryA
GetProcAddress
lstrcmpiA
GetLastError
lstrcatA
GetFileAttributesA
lstrcpyA
LocalFree
GlobalAlloc
user32
wsprintfA
advapi32
LookupPrivilegeValueA
RegCloseKey
LookupAccountNameA
AdjustTokenPrivileges
GetUserNameA
GetSidSubAuthorityCount
RegSetKeySecurity
IsValidSid
SetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSidSubAuthority
OpenProcessToken
SetSecurityDescriptorOwner
GetSidIdentifierAuthority
RegGetKeySecurity
LookupAccountSidA
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=48, version=9044,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=37, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/INetC.dll
- IMPHASH 8e4c63f70f7cc6490634d743e795c93e
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16201
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TerminateThread
CreateThread
LocalAlloc
lstrcpyA
WaitForSingleObject
MulDiv
ReadFile
GetModuleHandleA
SleepEx
lstrcatA
GetTickCount
CreateFileA
GetFileSize
DeleteFileA
lstrcmpA
lstrcmpiA
SetFilePointer
WriteFile
GetProcAddress
CloseHandle
lstrlenA
LoadLibraryA
lstrcpynA
LocalFree
GlobalAlloc
GlobalFree
GetLastError
WideCharToMultiByte
user32
LoadIconA
SystemParametersInfoA
GetWindowLongA
GetParent
MessageBoxA
DispatchMessageA
SetWindowLongA
KillTimer
PostMessageA
IsWindow
GetWindowTextA
ShowWindow
SendDlgItemMessageA
TranslateMessage
IsDialogMessageA
CreateDialogParamA
SetDlgItemTextA
GetWindowRect
SetWindowPos
SetTimer
SendMessageA
RedrawWindow
GetClientRect
EnableWindow
FindWindowExA
UpdateWindow
GetMessageA
GetDlgItem
wsprintfA
DestroyWindow
SetWindowTextA
IsWindowVisible
comctl32
ord17
wininet
InternetSetOptionA
InternetQueryOptionA
FtpCreateDirectoryA
InternetConnectA
InternetWriteFile
FtpOpenFileA
InternetSetFilePointer
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetGetLastResponseInfoA
InternetOpenA
InternetCrackUrlA
HttpOpenRequestA
HttpSendRequestExA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetErrorDlg
get
head
post
put
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=81, id=1, productName=Unmarked objects,
count=3, id=114, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PLUGINSDIR/SysRestore.dll
- IMPHASH a4814f13f35bacb060420cabbf9e8154
- SHA256 c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
- MD5 da046184a8d7269a0e138b0b0b9b2eb5
- SHA1 d9bc5ea397857e17a86f80df1e50615eb6859044
- SHA512 9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
- SSDEEP 48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4848
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
GlobalAlloc
lstrcpyA
lstrcpynA
GetProcAddress
LoadLibraryW
SetLastError
FreeLibrary
GetLastError
user32
wsprintfA
FinishRestorePoint
RemoveRestorePoint
StartRestorePoint
StartUnRestorePoint
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
587B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
514B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=12, id=1, productName=Unmarked objects,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=48, version=9044,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 123918b9bc59785fa8ff2142b20d537cd1b09848ba5d88e201e70510b74be295
- MD5 c493cb5a2e37620ee28be3665a29e84b
- SHA1 c29d5d793953871935bc2a253bcedf44b9d7565f
- SHA512 21e09e6092bad24b7a049651a1874b7e7e4b12b3ee60d2199e6852f4540d7e5b1c46d64ab591460d58f3f2227d35de6991470795f7ecaeda662b8f03c7897c54
- SSDEEP 768:xkT6kcDk+kTkAktSkBhUkRkG3SkBkfHkck21k2qkGakUttkTkcktsk2k2Sk2aFkp:3VMcSF3piU0fQQRMAJLXyTeICJw
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 42f0da3301c3739d99de30e1a58ff39baed543c3e0447bce9c15f8a95e8b3090
- MD5 d8d29ac4330a252c15fb48d9758aa378
- SHA1 21ced4f2220106e592b2edc6ef5756f26c12f588
- SHA512 4f4ca9d3653a4587c6080a4e8827dbf274defade44cd9a7432c94828ee19dc89e3bec00eada5650db0b0f22bcb28bfe459378d2b19cc90d9fabce19a1a5b44a7
- SSDEEP 768:FUw/kctENM58S4uXr/y+74RFhK/F0xZ+GdGTk:qne4ubT74RFhoF0xZ+GdIk
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/nsDialogs.dll
- IMPHASH ebc2d915841be8afc8fa1ee9f6850960
- SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
- MD5 1c8b2b40c642e8b5a5b3ff102796fb37
- SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
- SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
- SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7513
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc
user32
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
SetWindowLongA
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
628B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsExec.dll
- IMPHASH e269b6260a93a17ceff5184b3982ded8
- SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
- MD5 09c2e27c626d6f33018b8a34d3d98cb6
- SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
- SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
- SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4231
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
user32
wsprintfA
SendMessageA
CharNextA
OemToCharBuffA
FindWindowExA
CharNextExA
CharPrevA
kernel32
GetVersion
lstrcmpiA
lstrlenA
lstrcpynA
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
CreatePipe
CreateFileA
DeleteFileA
CopyFileA
GetCommandLineA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalAlloc
GetTempFileNameA
GlobalFree
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
Exec
ExecToLog
ExecToStack
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/nsRandom.dll
- SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
- MD5 ab467b8dfaa660a0f0e5b26e28af5735
- SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
- SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
- SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
GetRandom
Name
UPX0
Size
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
19KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
- MD5 501650d47110eec0b72b7d73b41478f7
- SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
- SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
- SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
73B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
API-MS-Win-core-xstate-l2-1-0.dll
- SHA256 4879fe3ea58d853f21658aefc5e8b92b7e6333d77c0af31a6bf9ff769475f6fd
- MD5 5f11b9bb427753bdae6d312a02c516f9
- SHA1 6fb327e5a64a94c2489f3a82999b7d60babb228a
- SHA512 09a317ecb7d83f1aa2d06e65371513ae770c9df4691b5ad3d50918e4bfacf1635fafaa43ada4efd5d23c448a7eb80675baecccb3ca9dbbfba4e829248a5bf466
- SSDEEP 384:9cf5b+W1hWx7HRN7izd72vH3rPR9z/gtP:uf5bVGic3l9zM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:b0:a6:c1:2a:89:2b:6b:a6:85:fb:59:46:20:71:bb:e5:19:ef:65:42:23:60:0f:4f:88:d8:f0:50:ee:9e:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-xstate-l2-1-0.pdb
CopyContext
GetEnabledXStateFeatures
GetXStateFeaturesMask
InitializeContext
LocateXStateFeature
SetXStateFeaturesMask
Name
.text
Size
1024B
Virtual Size
682B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
Accessibility.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
- MD5 1b4cc6782e295675217cd17df70057f3
- SHA1 f468087e7fbaa5aeed1fc41062b198570ae017e3
- SHA512 05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
- SSDEEP 192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AviraLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1cf8f0fad70f9adda6b54ea13622c440d624ddd31c801f1c3493e1cef7d84747
- MD5 d6d0cc37647a75064f98df7be2f90fd3
- SHA1 bee54ae9b3fd3686a8b672e341bda18ec6123b32
- SHA512 23b805ab3cf0d0da5f6a7d792ed3e7a854f8d23055a4686b9b37d792756a971edf877433a6c4ac6c1f328b04e9e9130802aecc8ffe3ec27b63fe955424d7c6d6
- SSDEEP 12288:LquZ72AyO5lpt5dFjTMrEtZZwem1ajAHOGeVy+BIRwcls9P5m6wYnKoPyS:Lq4yAy8lT5d6oVjj/8Hls9P5munmS
- MD5 SHA1 SHA512 SSDEEP
Digest
fc:83:af:35:53:5f:44:e4:4c:f2:df:8b:52:5e:6f:36:5e:20:4d:b9:04:41:30:49:fc:2d:d3:4f:04:bc:76:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1083182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AviraLib.dll.config
- SHA256 f9c12d9f6a4625c20e1f3bda1a076b50587be63ca2207376b085bd8b9d6bae86
- MD5 7b6547aba2712929a012d362eb8adf74
- SHA1 e7dde0f13bb8289f6b63aef2650d04ce6a8b1056
- SHA512 9ed2348d075db48da699cc0f1131c17770ab2ab2b45298b003641201ac2b4639bdf2028cc2a0492b317de9d951a0cad2ce6dcd259e2f0421055a04ac43620985
- MD5 SHA1 SHA512
BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e7c9e901e6d927778938d3ee5d183dce495d6b6eb2a89242a700afe25d921cf6
- MD5 9d34c40df4c87e378bdb0a3ebd36bfc2
- SHA1 5c110a3a90e792270b44e3e3f6cf31bdd9020295
- SHA512 51eea2113ac5acfd553b3e0b35390c38323218de55fd5b8abc8cf44bd0445df84eaf9349b52491737aa826ce76cfc2fe5eb5aaa60413cf376b4479ff21a19339
- SSDEEP 49152:2brsw7nZ8pRbkwLdPkSAu5LdPkSAu5LdPkSAu5LdPkzkHi2LdPkSAu5LdPkSAu51:U8pRbx4kg1qA4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2369022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Branding.Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9131d33f63f660abd1025812fc20cd8a545feaf72eb288ca797e9f1e4bc348a
- MD5 0a55314b9ff6edf2616e5a1e136886a6
- SHA1 64f5fdfcc14962c1b9750b289afb3b94fc7bffbe
- SHA512 a2181bd8fd97261666be02100aa0de24a298c90d61970e60bfa382b4b84fae85c79e1708b65ece3e2b9a66f77c0323d9e844d0ed4341d2d22d8ab984014e5fdb
- SSDEEP 384:JhPZBx2Y3p1iS90bIqElZzHoNZsHL0tkIKAM+o/8E9VF0NyUxLXP:/BL2Gp1i7bIJPVmkIKAMxkEsz
- MD5 SHA1 SHA512 SSDEEP
Digest
df:03:b7:17:03:23:b4:db:2d:f1:5a:59:80:49:01:92:95:7b:f4:98:ff:98:98:1d:ab:18:33:ec:a1:bc:b2:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
18142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
D3DCompiler_47_cor3.dll
- IMPHASH 185ce3a45c3a9cfb3bf83afd7f79c140
- SHA256 e745872db4dd114a65ee1504f401ea26d879edb6614e369a07a80ce7ad1950ca
- MD5 5e717c95808bcb5f654bb312d289b837
- SHA1 c69448eafa40e35424744c28e68cf69ce11a3d97
- SHA512 dc5e6ee0c8fe22897009060821b18bf2f7d0317d30682f7fa84a4c1889358c152d84d22ebe57d0ec8ccc1be8714bce6b1257d30671b8d0fea88309bbd137b8f0
- SSDEEP 98304:q4czLWVMYHItqGZ5CNjEhrZ0T2S1kHn8:qMpGZ5CFEh10TD1kHn8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:03:25:89:c2:7e:fa:d3:87:c6:eb:60:79:f2:01:b5:35:a8:aa:17:92:20:75:6f:af:f9:c9:69:d8:6c:2d:89
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:df:fb:6a:e3:f4:27:ec:b6:a3:00:00:00:00:03:df
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
3010368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D3DCompiler_47.pdb
kernel32
WriteFile
FreeLibrary
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcAddress
LoadLibraryExW
SetLastError
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadFile
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadConsoleW
HeapSize
HeapReAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LocalAlloc
LocalFree
GetFileSizeEx
GetLastError
CreateFileW
HeapFree
GetProcessHeap
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEndOfFile
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
ExpandEnvironmentStringsW
HeapAlloc
OutputDebugStringA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
HeapCreate
GetModuleFileNameA
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetCurrentDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
MultiByteToWideChar
SetEnvironmentVariableW
DisableThreadLibraryCalls
advapi32
CryptDestroyHash
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptCreateHash
CryptHashData
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
rpcrt4
UuidCreate
D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
38KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=29395,
count=141, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=261, version=27316,
count=1, id=260, version=27316,
count=1, id=253, version=29395,
count=65, id=259, version=29395,
count=219, id=261, version=29395,
count=1, id=256, version=29395,
count=136, id=264, version=29395,
count=51, id=260, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
DirectWriteForwarder.dll
- SHA256 440c95dcdbe402d843095649773d1fc6da5d035802dd540ce29c71bc915d433b
- MD5 a36d73301123334adc95e034b327daad
- SHA1 cb4bd930cbe2c930d665dd4467e8b88815de8c1d
- SHA512 438abf9aa1c00bf1f3e9ec7e9ac6bf5d89c492d68301044ba7fb205d3c5d34aae4940893eff721b91696de4c782a8a3558cdb39955943e350361639893ef3393
- SSDEEP 6144:eTDF2kb51CJfk7g9wSikA+6Bl5f7d5rBkwLENfTKSr1dDqY9DGKwHrD:oDVbK6kA+6B/d5rlUfTrDT6KwHr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
47:d4:5c:5c:90:32:55:f6:ba:5a:1c:98:40:cf:5d:04:b2:38:eb:c0:52:e5:b7:cb:28:5a:8c:74:c0:7e:01:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DirectWriteForwarder.ni.pdb
D:\a\_work\1\s\artifacts\bin\DirectWriteForwarder\Release\netcoreapp3.1\DirectWriteForwarder.pdb
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
447KB
Virtual Size
447KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28d76d7ac169c5b71cca4e3073226f885a2f06720413a11e8db9b7fc08359462
- MD5 6a8c8771bd399dd468595bab186c3e88
- SHA1 df56e2573396ad8da5998c6aaf89c508f2060a85
- SHA512 3e7a0e3b0b182e97e44504c4aa511065ea910a88e88ea849a5977f64dfd64aca6008815a6307e1d82a706b66811ddc5a1234b37c95a80e1a01feaa8b8fdc3d74
- SSDEEP 3072:QXsFvbsM5ecgKXnukd2sn8Dhm58yEJEYkbQcHPoOFqvAvIMqUo1SccvdH8UfrxA6:tmE7gX22sGhs2JcjpIN9+8UfrOsWs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
231KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Engine.Win.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f5aea1bc55e102a2c3d0db554411531260ee04ca2eac6c256050fb2dfdd6b366
- MD5 c905cf67539797d58a75b238201a1383
- SHA1 500351c4c7151596c0c782a4e6de8495f5a3edca
- SHA512 49ac338b68dbafbbaf63a4994d093195a69f12b74dd4b0ba554f3ad9453d7e998b5328004b49be92f44b7f0aad2cda9bb4bd368ae60e7948d6c6ad2ac6cf093d
- SSDEEP 12288:tL43XI03XQnigPCHS/cEYjKbs4OjQ/I51Pq6Cs6YAD/z+87thX:tkoIXQigPJ/clg5kr6s07D
- MD5 SHA1 SHA512 SSDEEP
Digest
db:e3:0b:40:67:d3:02:36:8b:4d:29:43:ab:52:fa:e1:50:1a:2f:a5:78:22:c7:89:37:44:6b:55:84:78:23:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
878734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
850KB
Virtual Size
850KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EntityFramework.SqlServer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4c39d8f0fb669e6e337c5f3138f6171b0905cf875a92b0e3253f33955b87b55
- MD5 4010a41e4730439275c00c358550393f
- SHA1 572a2fb0526523e3669a53264fc51adac70c4ad8
- SHA512 5a554c85ea0222c9d96ebe24b2b0730c3974c59389e2fd0672ccd2c99f78b937bc4529151a24cc68357a308d3e9990f09eb854b05466538c422847d9849f84a9
- SSDEEP 6144:frmoela3kPuG2p6GeqDmjaVmnSmr/u65oPWtduB6yHtYw:fvelMwu65oqs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
584878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
563KB
Virtual Size
563KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
EntityFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7f8427f0d039ba33d7b414604baec4b62d6dfef9e1f5c078d403e7a04e8dd9b
- MD5 ab3c40670c848ac52f32221a7976cedb
- SHA1 20a05ff58f34ae9c6b046169e42db3b68b805fb2
- SHA512 8e97b78a6ae9590e84b0d06f5a37586893c4c099a99aad2c50a6ea49ea1aae2acd07501d4e6af905a2263cd2a14f743746e18059204d8dff9b19439000cba705
- SSDEEP 24576:nhI7iceqhqPP3COtQmJnfylfF6RTazewudnOCJNBZ3tc1D1Q5UGLG16pd4XtwZou:IOm2y5Ea8c1p2fa+wvHo8IryABzw1k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4936030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GUI.Win.deps.json
- SHA256 31057e87e93969845fa1e9d9585e7f28859f69a301d3b03c0091aab62c62413a
- MD5 9ad72fd35adefee97e45c7d3f4aca4d2
- SHA1 36f507f2cdeb0fa168e231a12f16a6182a465887
- SHA512 8a3467cf8b05efe30c43da72801729c43592a6279166430e332d2cbd9f20a5de5586c6c046486f64930049e9e544e5e9f0a68b5a2bc7ea08560f2ba8e4ecd505
- SSDEEP 3072:/A5fgBS/Rt1Y9Im07R1ARkgT9uextHZqeajAXhKg09p:/Dm
- MD5 SHA1 SHA512 SSDEEP
GUI.Win.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 34457195be0bf8ba64bf7c81ab9e882cb53dda3cb9f6b96874dfeedc8d08f775
- MD5 0c1b42213f71d7768598f1e526d42565
- SHA1 82ccf92240e48252d006183b1bfff1d1dc45436c
- SHA512 a2fd84f2c619031739962f256fdd85fa0d3aa977db1f2f2d6e6adfe1e73e0be2a56866a915cfbf1b396e3a7c5fd3e8fe6c6b0515d786a2e0bfd284495d1c91b4
- SSDEEP 12288:kw2bFAzeuL9lRC5+Rh2gVS8GZdgdGuJggQT4KJeEyMF5OcRkZBN:T25AzfC5+RfVodgdzJOOskZ3
- MD5 SHA1 SHA512 SSDEEP
Digest
c5:7b:2e:01:9a:13:0b:fd:9d:ff:89:bf:bb:8b:2d:32:14:49:45:a8:70:69:76:07:e7:ad:40:18:56:68:d3:79
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1929614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GUI.Win.runtimeconfig.json
- SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
- MD5 1bc39e80d6d10935c1e3c9503108e508
- SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
- SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
- MD5 SHA1 SHA512
HtmlAgilityPack.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f35cffed9992cf7af5710d8f48dd1ba55b9c16211746e16fa474277ec5e5e1a7
- MD5 2ccdd5e34604c7b55df78be8d1977135
- SHA1 785dfda116c774afa7270713b1308ad1d8c2d200
- SHA512 89947874a3c167b6e1202f338ef084baca5c7f954205f65ecaa0b284e74618058b3b1db0fa8d45fd558746eb278feeedd98320c8b79cd67049af244f511e7049
- SSDEEP 3072:imEWPCpf49WhHIDkWMeqoAomvoPdk/kdGYp9i5R3N:Yf49WMkso7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
166014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LICENSE.txt
- SHA256 f9524cf8d591c32dc21902590e3182d0d0bef0cb0ba431f91bf6c9d71bd38cfa
- MD5 6b1c894157e404adfa2c9168cc1feaf0
- SHA1 de643d125afb3f3fbc698c87f125d5a0f64cd73b
- SHA512 46ba913816ea8156aa1b676c415b98966ebaad608ce2b2b098d784a8f1b28323a12e47852a9c4f9aea8235854fa922ce3deaa75db790d955fb3c36a728691156
- SSDEEP 1536:euu3tHOSJpAg81+XjOFYwT3Jtfefsw1FYwTbjQTfw0:ItHLzR8EOnJ61Ljo
- MD5 SHA1 SHA512 SSDEEP
Manifest/chrome-manifest.json
- SHA256 542db227dad2ca52cbfb3bbd15a56a319870e0f86a819dda8c3d2931644a8120
- MD5 21b2a99408f622ba3de5751c6042f794
- SHA1 b661b1de6aac5992d47d9119c5bc30327466660a
- SHA512 7590e9f4fd15acd234598d17eb60a79804c22db4e393240d164757dd68606e29f11e030c5df4824fef04e7677f91a92c8bceb8e4ac73184f239dd845f44ccce4
- MD5 SHA1 SHA512
Manifest/edge-manifest.json
- SHA256 8a96c6c31ed88f6c7b28a28dc965b3776edb3e7c5ba857aa203b33e39efb853b
- MD5 71a0a11da12e252bd32dd5b467295ece
- SHA1 d58458ee3a4612cb72804961e981176242394dd7
- SHA512 a1c0238cb9c5c2c95a0f92c8bc40c9f6f61046a381d9391245fca3cfa11eed1d6f7b2176b2d52ef1dc9f6b6fed72618b363f11096c9cdc811f1bebc30e778416
- MD5 SHA1 SHA512
Manifest/firefox-manifest.json
- SHA256 17e6cc438c28f43b3935d1747b767a4a0e518adba95a56aa7918dcb92d8af4be
- MD5 cd6fbf69675912c8fb36a977e189514a
- SHA1 6dc5f321251160ad77f415f5f3ac6ceef0e2044a
- SHA512 0ead4652e686e8985ab8ea52a2958cdd59078807cbba2b6e27f1b10dfd9a2e7c05eee3a3b64d11b16b03e8fbe22e7c0f32fdc0b99a057d6f0dc5c5e94757bc55
- MD5 SHA1 SHA512
Microsoft.AppCenter.Analytics.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac8b2f3785163b38c4473f1aa25616a4616e2fbb29332fe3dd8da9574fc3c4cf
- MD5 d4041b4e6cef641e52922aae24358e67
- SHA1 03cd00c2094e6747b0bc489f1927d29dae39b5ea
- SHA512 728dcee4a9e3909f760edbd6a6e582c6c40162f37cf0c5e61bb092679ef91e47e8e5bdba468c40f24010ae795f6e277ff1c60b9e46bee2dbc94b3d9c6491570a
- SSDEEP 384:FHusqPUYyBiwwu9sXZsQb+Jx4veT6pzBcwyWUVMW:FOsqsYb9w7UBcH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.AppCenter.Crashes.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1ac20df009a8879ff946388741b781b37f8209ac93260ff8a00573376def08be
- MD5 389e880efe79f750488feed7fa52b1d2
- SHA1 b0a58209ddd87d4ec1240bc1b556889850965148
- SHA512 ce378858dd67c8ff7972036db1b558603c0c7bf74b82c0c965fcd039138be3eee08fb729b879a1c66b41d8fab7c70c0a9ad1c8e5c9490c4967cec87b2f62b436
- SSDEEP 768:qs8Fis/HebQPbM9z9iDk+gGCHeHGoSMwdevPf:qr1bMvHXlemtde3f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.AppCenter.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c7ddc86b6500a27783071abb2a0769a1f47a7cb78d039642c2126ad1b879cefe
- MD5 395ca70f6def000f67ae3334682c3a73
- SHA1 5b32bb4f106e490044f8cb95b1da24605e66ffd0
- SHA512 a47cde27ec3af919d68f6bba485b24c31b681b3572cc9af9c8df8e46af6d1441d4c5836303c4901f531fdc6e2092c6ecbd28a17b42616e42a0f9a2a9dd46dbec
- SSDEEP 3072:O/6mN7KWjKL7gHdJWRYhvoiJVIAQlHvIRQ0OzbXq:cN7PjKL7gHdJWRYD5UHv3ZT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.CSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d5ce9323fc09281f1f8d86d741a594e29f7a9797de0284e1b168b1043c6c9a02
- MD5 550c3defa28f7da52cfeb896254d5446
- SHA1 9769ad55aee4cfbc94053e885d229ca98d953254
- SHA512 264181da5f80966f2b0a76912d496ad55b403f99d31097b258c9ab87d39b41435015b8e702bfceed5f333fac9367f542dd397778504c8ed2a4b4ff4bb3a82370
- SSDEEP 6144:3MsCfqudVKjZSkSNw1oxu0LhdkjVsZBwRnIfPk9eG3u9yHcohyz:csCfidSkSNw1otkcG3u9yHc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
299150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
284KB
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.DiaSymReader.Native.x86.dll
- IMPHASH 2750e561997e3d2f8e185972112eba29
- SHA256 f21da9fb831ac943736135b6ee109a4b352511b8d6c07cb03c66b61996d1ddc9
- MD5 4ff7094e3edfda47ced912012044296b
- SHA1 c6f3c9d81713687dc3820d8cabf14c2a32208d27
- SHA512 372867bbae96c51ee11b413f552a67a53992b16dbfa44105381db3813e3c2f9a3dc9d16fc6bd6366514d4e1b4bf1eeccce5261bc3df837bf3e3eb5a04446c551
- SSDEEP 24576:7Xg0Ff/wSOM0TJuCD0Kbyk3dIf//LXpWhIHWLRDAcc17QXk0:7HHFRKbhdIf/TcIIhk/0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
74:c7:89:0c:ca:76:a2:a2:df:f4:32:36:58:11:7b:17:64:4f:20:f8:9b:a5:3b:ae:53:9e:3f:43:a1:04:1f:89
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
62:bc:ea:ec:38:b2:c7:42:45:0d:0a:8a:25:44:ac:fc:cb:e1:75:36
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 28, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 2, 2017 - Jan 2, 2019
Subject
CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:78:25:5a:b5:cd:23:c6:5f:95:00:01:00:00:01:78
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:0e:9b:a7:d8:b2:dc:f7:2c:00:00:00:00:00:c3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
256480
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.DiaSymReader.Native.x86.pdb
kernel32
GetLastError
FreeLibrary
WaitForSingleObjectEx
ResetEvent
SetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
MapViewOfFileEx
GetFileSizeEx
GetFullPathNameW
ExpandEnvironmentStringsW
DeviceIoControl
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetFileType
DeleteFileW
VirtualFree
VirtualAlloc
WideCharToMultiByte
SetFileAttributesW
GetFileAttributesW
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
UnmapViewOfFile
CloseHandle
MultiByteToWideChar
GetSystemInfo
DisableThreadLibraryCalls
GetTickCount
GetEnvironmentVariableW
LCMapStringW
FormatMessageW
LocalFree
RaiseException
LoadLibraryExW
GetProcAddress
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
InterlockedFlushSList
RtlUnwind
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LocalAlloc
GetCurrentThreadId
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
ole32
CoTaskMemAlloc
CoTaskMemFree
api-ms-win-crt-heap-l1-1-0
_calloc_base
_callnewh
_free_base
free
malloc
calloc
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-string-l1-1-0
wcsncmp
wcscpy_s
_wcsdup
wcscat_s
_wcsicmp
_wcsnicmp
strcat_s
_stricmp
strncpy_s
towlower
wcsncat_s
strcpy_s
strncmp
wcsncpy_s
_memicmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_errno
_crt_atexit
_cexit
abort
__doserrno
_execute_onexit_table
_initterm_e
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo
_seh_filter_dll
terminate
api-ms-win-crt-stdio-l1-1-0
_get_osfhandle
_close
_chsize_s
__stdio_common_vsnwprintf_s
__stdio_common_vfprintf
_wfsopen
_wfopen_s
fread
fseek
fflush
__stdio_common_vswprintf
__acrt_iob_func
ftell
_wsopen_s
__stdio_common_vsscanf
_open_osfhandle
__stdio_common_vswprintf_s
_read
__stdio_common_vsprintf_s
_filelengthi64
fclose
_lseeki64
__stdio_common_vsnprintf_s
_write
api-ms-win-crt-convert-l1-1-0
atoi
wcstoul
atol
_wtoi
api-ms-win-crt-filesystem-l1-1-0
_wstat64
_wfullpath
_wsplitpath_s
_wmakepath_s
_fullpath
api-ms-win-crt-environment-l1-1-0
_wdupenv_s
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
api-ms-win-crt-time-l1-1-0
_time32
CreateNGenPdbWriter
CreateSymReader
CreateSymWriter
DllCanUnloadNow
DllGetClassObject
DllGetClassObjectInternal
DllRegisterServer
DllUnregisterServer
VSDllRegisterServer
VSDllUnregisterServer
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=244, version=40116,
count=1, id=199, version=41118,
count=19, id=259, version=25810,
count=18, id=260, version=25810,
count=7, id=239, version=40116,
count=187, id=1, productName=Unmarked objects,
count=99, id=261, version=25810,
count=31, id=265, version=25810,
count=1, id=256, version=25810,
count=1, id=255, version=25810,
count=1, id=258, version=25810,
Microsoft.Extensions.Configuration.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9e4bf73dfed3d5aa9ff25780e87109a985cb6e2feab30bea42689cf7d1d4ed1
- MD5 542b6ef0d8d600f43cecdaa5fe6a99a5
- SHA1 3e5626ab326b8e0a08d48f1347c09eb3a8b1b882
- SHA512 4ba7499c2b5cab18d185f63f857f8e94785642b5d0909d2c978b039d8920aadc0401f57ab7603f2ddae396c4c8edff5f56b31de36d24620733c9847f5b3152cd
- SSDEEP 192:DMt6XYVhN6y0mb+dXM+4POdTJ6V2fGtbn/PTG/AxXEzRjz6P+M/FbSZbWsKTWM:D+V/6PI+1z8bXTG/ABEzRjz6P+M/Fbk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Configuration.Binder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4950a8400717903c28cd5b9562cff761afe5ac3470ab699855a898b29fe8a2e3
- MD5 99ed54569b703e903f674ea4eda6c662
- SHA1 5c59e3c564b4c057ebc1455cf7bc219b825aa11c
- SHA512 fe4937471fee583ee73411eac6e256a622c2f8a10d885e2096546bbc93e393435fbc20d40b3f885f48f48767bfdde906209890e9088318505b10d84a7d4ae7e7
- SSDEEP 384:dqnWO8HPEfXZ5PAxmLKRTuVWU28UJjyFygZ7gYU8ud/WiaGWM:dSWO86zgm0qfUTMuY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Configuration.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 91be5d8e169d4e809d077108827c041988018f37924c312dcf3c3c77264eaa7c
- MD5 d29ef3e603946cdd964ded903c205d62
- SHA1 959896475fe1dd758adf857b72bea25cdcd405cd
- SHA512 3f82b58932bbe771fd102065399e36822f061c769a211b85661d4b0575cbca90cd18ae92d76101e2219f22bc247a163ba95718a4303a6d43784723437f7b88cc
- SSDEEP 384:/dfVJtVnucJYXVJig3xLm+NMsTks7WK4WJeVWWM:FtluT31Ugi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.DependencyInjection.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1663be664cb7a7afa5786dc9f071fca8aeac3737fe8e29153f29223c8ab1608f
- MD5 1cca6bb1ef856aed16e29b17b92ea225
- SHA1 59bcdfef44880db1daf87951619cbc776a22746d
- SHA512 6daea2c19e873594e8486ee09ab0cb9d30e4f76a1ba51fd3c2a40ac5c27c870e1e7b533247c17b8386c9016103d1423cd886efbf1256e89ca2a8b99f0d2d57fd
- SSDEEP 768:jwd02Ew1NODPOlwlwlwlwlNm/ST5T1yEf:jwd02EacZ/mJz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.DependencyInjection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21d64f47e3d226854b93ec5b1f94d3b8ecabb0000a5b759decd96507789c307c
- MD5 692c5f999645b4e9babc2e830a2534e5
- SHA1 da1ce989d55ef32809a4c0471be5ae9e5614e483
- SHA512 ee6da0eeb5617b6b0ddb754cdced46a68a4aa95e5127ed94090f3640d4d0df3f003135ca84e5b4870679b0972e3c4f6b8059bd8a9c870ce8c5237cb0930235d7
- SSDEEP 1536:CPkLGoLSeeeJHlFDj4aQsxYZiKdD4Zfg+:Q+XHzjeN4ZfD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Logging.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 971a367da28ccca459fe2f7d755f0cea978310fdd064f6368fb8c8af814d74fd
- MD5 613442a0e2cd90d79c3401554b8fba9e
- SHA1 380df211e2bada028536a6c55bc8f33495bce1a2
- SHA512 ef9a5696774f111a7ec99a6cc96d976e761faee4e128510f278a6f606de3f898413808f4c53cd19d27e83a46a1adef945c60d4bdc41f2aef70f710027c6bac87
- SSDEEP 768:qwHqGdhpezbPK/QN8jmN8CduUNxYci62wyq/:T3dv6eAuUocywyi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Logging.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 30f4630b82b19f77abf33c8287cf4a00e8285aa71df1bb3fc05b7abf9026841b
- MD5 1649856f9ae8ea8aa53b5aaa04da894d
- SHA1 03574a2e9baf4edab20375bbf968228ca717ce8b
- SHA512 20dda82a3c9501c7de052c86c09dafe4251042011305a7224bdd7bbf99f7b705cf6f5992f9fc27fdd5526dcbb3fd6caf6fe2128631c769c59fbbd5c639dbfc17
- SSDEEP 384:uUNoqS641Wkrb90zrAj1+dOECTEPC5nnAKacrWYrqpWraVWM:uS/SkkrbqxdOEQ3AFchr+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1332dfbef2bb538faed7c85ae6f6c26d64333eed95486e3f81c9f2c1af5b9f33
- MD5 e80731180d3f61c207d1e759b5e422fd
- SHA1 c9a8989cdb44ae95f6f6404a6618bd001ddf95fe
- SHA512 da74e650dbe60705e02882e7877cf0f5e7f08c1a17b3da5cd892b9a66fc06dfc7be8e324c13d8df17f7bc9898f22b399e0e81808c76e1274f70b6b1f58564a82
- SSDEEP 768:JmOSgq1fwDct4Ipp8nV485AoX5R9iV+Wml9lblyMbWndaM:O1fwDct4+YJA0R9I+X5bo8M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 16ff7d5019e361cfe19de448166383f9a915fe9ea1e08a475a59abe1ec8aa9c0
- MD5 79dec1364dfc994ba0e0af665cfe1379
- SHA1 67080f49ee9ed691253ffc4475d912cd2385ec44
- SHA512 88f1cc84d919ae86d141c0dc95aec3eb20961a81a50c2bb30a85439cb980d9933bb5667eaddd3eea94378d11d632fb2bd1c1b6737e6a9ccda513eb33cc79bb40
- SSDEEP 768:k3/GX+hgQVTGdJS6CPIUqOF0vWusFQaui4m1/LcfJtVKAMxkE9AqYa:q/GX+BVTGbfi9qOF0v3sqauiJkJtaxJR
- MD5 SHA1 SHA512 SSDEEP
Digest
0e:2f:1e:b1:81:a8:66:ae:e6:21:7a:ae:98:18:04:d0:18:a6:01:7b:5f:5c:2c:86:de:cc:c7:45:35:70:02:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
34190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Toolkit.Uwp.Notifications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b14999bfdbb2a55f335ed3e9da022a73e9ff6e96ba341ffef22637a6f1826188
- MD5 71829de02b099241bad4ef0efba785cf
- SHA1 625aca08f1b7020456303794543cc669853003a3
- SHA512 dc5248ec12ff04db6722d6640ce2eab8dbf154ceaecbcb5f473e4ca869f60ada4bd136d849db82524743c652f2bb27d08870d28e2d54977c717b73fc853d6557
- SSDEEP 1536:I3FYVCl7jqFaTsU6+QFBwkGKXX/3+fibJ+zGgr6j0tdISOUpUfZ:ooClnxsU6+QFtxXX/3+2+3r/c
- MD5 SHA1 SHA512 SSDEEP
Digest
1a:a8:a5:6f:e0:19:7c:75:8d:62:66:2b:14:a6:cc:fd:85:59:5d:68:92:91:b7:62:e7:c1:3c:d2:db:5e:d0:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
Chains
Aug 12, 2020
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
Serial Number
0e:71:58:6e:7d:8a:28:36:54:3d:5e:15:d2:b4:5d:e4
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 11, 2018 - Jun 15, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
109974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Microsoft.Toolkit.Uwp.Notifications/obj/Release/netcoreapp3.0/Microsoft.Toolkit.Uwp.Notifications.pdb
mscoree
_CorDllMain
Name
.text
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.VisualBasic.Core.dll
- SHA256 e0864f46e0f0ca66143b43c12a4b37dbe2fbe8fd138d5da59326fd632d6a3571
- MD5 4ca0c139b698ff4b1a4fbaf653d8b607
- SHA1 4881028e15d3fe3e52a6e0e8a10a3d926f3400d3
- SHA512 db0e1eea47f75bde5427234888d88829fb184e31be0aefcf687e2dd4e351d9daa7cd5fdc5457ac445f17c5f784f4602f48fa8f49faa2c22c511729c5f550b93f
- SSDEEP 24576:92o6FIAG8DgwIB0RLQh71gPOpxEDoQt7g8m:f6FjDgwAps2Itto
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
88:e2:c1:63:bc:69:df:61:1d:7e:fa:fc:f8:d6:62:f7:2d:79:1a:c8:da:00:2f:6f:49:16:cd:5c:96:7d:8e:ad
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.VisualBasic.Core.ni.pdb
Microsoft.VisualBasic.Core.pdb
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Microsoft.VisualBasic.dll
- SHA256 89896b1dfdac9c395ef24e7e032f9b746ccc331bc0c9d791de3e5d2b357f1185
- MD5 54427033e0d65a39722a76e07e430eb8
- SHA1 7b83a4fe9997310c77aeaa5868b01b2b5a7b7c84
- SHA512 b6304ec9042eee9d4c9e5f866fe9fa92582fe24dd3ba8f82374a17a7b87cc84e5f9608149269cc4c8e64cdc2c7b5ad7ac228070fe5cdd66da5b3bb9f00dfcb19
- SSDEEP 384:JxWmH6L9QKWwQ3cgznLIqddm7HRN7d7EHR9zcIX:Y5QMgznLIkKd7Ex9zH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c2:b3:d2:9f:88:41:0d:3f:2c:f7:2c:87:ac:f0:24:2d:67:d0:8c:e9:45:d1:85:52:41:ce:e7:5b:4b:c1:ac:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Microsoft.VisualBasic.ni.pdb
Microsoft.VisualBasic.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
Microsoft.Win32.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 85c9a4fac07761d259bd91c669e4e1c10cf79d0939e64ee96e32abdcce51c86c
- MD5 8607bdfc638e4fa1d8e716486a9c6475
- SHA1 9e246a9f462097de2b3b2472950eb6273e874efc
- SHA512 91314554e0937194f74c802c695090582e9a6b857da72026ccf5432f5ad960547b4f4e2235f0a56108a63cbb40d60fb7d7bbb30b39f1851606a09bcf34371c5a
- SSDEEP 96:/0TYpaXzERVpxxeDZeoIqA4NVPiDKWUOLfW+qxv87xbO+XDS8PODxVWhPIeWE:8spQgrpnkeQwRUOKlxEdr50WhPIeW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Win32.Registry.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1af18aa247c88bdfa1dbee361b6b901e541c0f7a0c1c31336d65ed5176b13e39
- MD5 47c158136040881155f35b4877460849
- SHA1 a60ab328c456cdcb7f71e14358a0ac202287a534
- SHA512 14ff78a7029229c046117afc1292c3a4712dc3a4e3c4ce735781deab842b41a9bbb5fb516f19eb614299199074bc1da583d903bc08dacda6b8eb969f1bb78525
- SSDEEP 96:MUhxTU0KDgJtLuWcL1v8Pcir4c2+qR3nsluxvbo+mDmDBEbKWFF3a9wxW:MOKDYrcL1cc1UsXxhfWFlscW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Win32.Registry.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d72bbe2fe0fbc2177dd211308ae7331504ba0317aae60761e94817dc8856580a
- MD5 90ce1c7910d0f504b2e3787e1ba199f1
- SHA1 3acb3b6dec3b9c51e887f6a750035357bea5ee5e
- SHA512 da7f23717e9341565d36bfaa90ec1e37d7d1ec59df91e495c607d404b00324d7e1c8d216e7adb64ba4bf7973888342098debbb8b8a4a95019200e1735b5204d5
- SSDEEP 768:anNkMiBZdxRhmlhOPXwYMIKNwqSAVi2jsd/v:qkBZFhmlMPXJpkIAViWs5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Win32.SystemEvents.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5f05110e122fa7c73ac3571b82a0bfd5a8462a4b42b0b945c4f901928a29f3fc
- MD5 fa51d1d280c2114a1de24feb9be14a32
- SHA1 aa0916a3b709e2a19b7d3a55d2fdcb9cac333f88
- SHA512 25c35857c79e03538825ccd6b87cee1d4a569d871889fd256fa413d69585a8e50340a0ececcf1824cac4ea976e15a3eff6ab367b0c4846f66593e0f67d233921
- SSDEEP 768:Q8lYXXu7a7jtvp4VM7/9f+5KOo4KD2lJzPIsFPbPDT+9NWIc5YlL3qj:QyYXXu7a7jtvp4VM7/tSKO3KD8IsFr+4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mindscape.Raygun4Net.NetCore.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ea613cfa8e489c15d44bc1360e11be1d321de2d0327386df657425db4ebd847
- MD5 2520a5a2506531cf6f8b4f2a733957bb
- SHA1 202e824c042d89400c856a64624db4bd98e51f52
- SHA512 8a95c483023177a8a88a1ebcdf8e00577f14a7b8603b722896ba1c714b2cc10477a74a0ff0bf7ffb70aba7e51327e54d07ee5dff6bfaffbb0ef51f08fe9adfac
- SSDEEP 768:jOwA4HYdvQRXNJThTFYZSRcxEpZL5BWo1J8Bm5LhPUEfTZ75QluC9cjQvU+FlsLv:jOJ8PXNB5FZPL5BmBi8Ex+lbjkv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mindscape.Raygun4Net.NetCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 839a8f2b052dadd685a7222f69c42c11edf9f1e06964dfddec61320e9f359a98
- MD5 94b6fa3995eb2ba34afa532b9fab39a9
- SHA1 42480243477d813498bd83839cd16f6b7b828e96
- SHA512 3bc4eeead6053cbf09d48297b75e270117b52562ba21a71d8163e7dc932f02c837fed47a813d6dd3efd43812faf1c9cd934e43bd482d8664fbc5191437bb6d90
- SSDEEP 48:6xJk1fkEdDhOGGmntavItLNMwxLFvLmehCZutd22JMKM6ER5MtR5MPTHX:4SkEdDaOXv3Jv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NamedPipeServerStream.NetFrameworkVersion.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 463e1a53996e8de4d2ff2a7b3919e24358c1895da120060d32c1bf4f9462bc83
- MD5 f8d4f30967bf2a130721f2ebc084cc7a
- SHA1 14d81ae3e20c321636262cfca5c2fd6caa59fb9c
- SHA512 a9cdf2ae64e408349e321a69fe609f7b9e7d14505468c9d986bf46fd9ac77d5c79bb14eefe67f6b977705150a2787a41b74e685545240d7d60c524b3bfbbcbca
- SSDEEP 768:g/VWCKBOs3a0k/c6sYB3zYD0DvlRGh/D/QPi:6WXBK0c13Bu/Ai
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Netlib.dll
- IMPHASH f68acbcd9b68ea2a855ac109b1fca5e9
- SHA256 9b33915254ff7c566937b73c0c98e579547fd50b65e4483277159d5c7eb44549
- MD5 822cc56add5d97691b993f64b11f9847
- SHA1 42b92efd9348f2306315274e34827953b8b26814
- SHA512 a3c2e95bddeec26ae516e3b0cfa69a44ccd22f3930a692dd6e90fd4869676f5213781bc5523c15534eaaf3be5a949be07c0f5da4d6b2edf762b457363528f97e
- SSDEEP 3072:GoC7RcDXGZYcS+sWv42+qct9iywOw174uXl8N:jc8uS+V42HcT/CXeN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11249
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Netlib.pdb
fwpuclnt
FwpmSubLayerAdd0
FwpmEngineClose0
FwpmFilterAdd0
FwpmFreeMemory0
FwpmFilterDeleteByKey0
FwpmEngineOpen0
FwpmFilterGetByKey0
FwpmSubLayerDeleteByKey0
FwpmGetAppIdFromFileName0
ws2_32
htonl
inet_pton
inet_addr
iphlpapi
ConvertInterfaceIndexToLuid
rasapi32
RasGetEntryDialParamsW
RasGetConnectionStatistics
RasGetConnectStatusW
RasEnumConnectionsW
RasDialW
RasGetEntryPropertiesW
RasHangUpW
RasSetEntryPropertiesW
RasEnumDevicesW
RasValidateEntryNameW
kernel32
WriteConsoleW
CreateFileW
DecodePointer
HeapSize
GetStringTypeW
SetFilePointerEx
SetStdHandle
GetConsoleMode
CloseHandle
TlsAlloc
GetConsoleOutputCP
WriteFile
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
HeapAlloc
GetProcessHeap
HeapReAlloc
GetLastError
lstrcmpiW
HeapFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetOEMCP
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetCPInfo
AbortIkevVpn
ConnectIkevVpn
CreateIkevVpnDevice
DisconnectIkevVpn
GetIkevVpnStatistics
KillswitchDisengage
KillswitchEngage2
KillswitchIsEngaged
RaslibSetLogCallback
ResetAbortIkevVpn
Name
.text
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=137, id=261, version=30795,
count=30, id=261, version=30034,
count=16, id=260, version=30034,
count=20, id=259, version=30034,
count=21, id=260, version=30795,
count=11, id=257, version=30795,
count=106, id=1, productName=Unmarked objects,
count=6, id=265, version=30145,
count=1, id=256, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 74deaa342747cf77f6efac6bee1cb6da2e7fa31988b3f1304eb1d01d621ba4ee
- MD5 3c88cafb11eb9ee403dc2980edfaed36
- SHA1 b9664b423200e28882a8e543cfdb8bca5ebe25de
- SHA512 c5044bcc98bbb639c40cac5b5333c890feb4afb2d54b55d5d702ee7f83d86d3aa329303f88c70683f89658d7fca279104bd2c94ef3641a6fde522716c8365dd6
- SSDEEP 12288:7QXc8tdRz3R5TzIQ/cVEfH9LbCtubHkttbXBfGpYoC:kXX33R54Q/XbCtuWhXBfGpYoC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
688574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
664KB
Virtual Size
664KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.AsyncEx.Context.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14e949e8c2eff5bc7afda30804bdab15e293fde2c9f573c8d52ece54bb21c2a0
- MD5 49add3e0dae1181cffc0d4dcde4e9502
- SHA1 d2941dd7672b7e1d20ffe3d70dad84a71fb33852
- SHA512 daa90a6db7cc28f4759deb2ffd3dd8c8f981839a8cca1299ebd558b41488ab0d9c56bda336396e7c6f46af192ca0fb02afb5851b66c65c47e3e39604fcdbf8d4
- SSDEEP 384:iHd+/aJB+7+atTbuKE6CY+CTbkKM5E9P7EljEeDFkoFhx:i9SSaJ6KEpdBdrzx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.AsyncEx.Coordination.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fe34dfb558d65d8b072f466021a0d15de8d202513b1f13a7b45ffc3e9125b588
- MD5 805c7a0a6c838cd2e96b402417638ee9
- SHA1 843ae9a6129c73f17df1a91ec09c4ac2a06099c6
- SHA512 ccd6383841af4188b448d1ba153672b5861814ea8570d29ced77cffc10346c403a6f37bbf2d003b705f7a50a9c008e3a5e45a6bc30f617d9a34f64e0bc103e55
- SSDEEP 768:m5MwEXdl+dbSMyWJ9TFOOo8pufD1oq2UcgFixdHGIcxCJVENySzWi+G:m5MIOEwJoDU1ixdCa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.AsyncEx.Interop.WaitHandles.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f6c3af2124d0a7385ec595093062ae203573167332473c0dd6af323a8010190
- MD5 a4a934cb7cda9fe457e751f43946b47d
- SHA1 4cce8c0d38247450b158de3abd320003da9a4844
- SHA512 15862a759007cf6211e0062e5257468e86f99868901c6565c08e6c401f9035ee86e2e639ceb8843ed4162adff35b3048c222948565a46e1df25b604254d9aa2f
- SSDEEP 96:QH+IoX50CwqlKA2ANwIIv/GWnNwAh4TqBQBT+mu2hDOLFio1Xr5vKDAl:QpovZz9cGWiwBOa2hDOLFiWVl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.AsyncEx.Oop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75a30af7c9e46e45e6c2b11a8284d5eaf681b8d71e531200d4b480fc66b0f65e
- MD5 73c77e64e8e1f0f010fc4158a1a7060f
- SHA1 ed7a2e982f5475d4479467aa248e1e6cc4adb455
- SHA512 0fbfa1d573da283c5898e9222349c523cb9c8b22f650af24b6980ab9202249020ee74e079acb6ed9ea3c1a74debef2aa70d33448d1012fc66868fe2f8db32c77
- SSDEEP 96:zfaZaAMFhVyhCEvX7O+pqCbS0X1V0TzCw1:TAQ7QX/KCqz8eF1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.AsyncEx.Tasks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 edef045c965f1dc14805cd66e2a0b2cae2bb34aa2c8e80468f34c34446906d0d
- MD5 17f57e0d9b7c5cc602553301cd7b1607
- SHA1 cd7567d67967684e72ba10d24c47e3d5c0eaedbd
- SHA512 759fcc7914add3c80080c6ed9da94e9fa5e2af91752f5d7846b8cf01cc261b1eb76ba59188b1391d04a61f7ffffab7b68e0d8ce3f4b5b81fc4ff53c4aed78bef
- SSDEEP 384:ardaj8E2h7/D8tg1a3FLF/pNw2QNmtMdIDToMiOrS6U07dYdt0EYP8R0OekBVg2B:Jj8E6oflfOtdgTo+/Ugd6R0UVk4m6z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.Cancellation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f905ec7901dd2b3e59ec23142518996769b3c6916075776319a1c960fbddef08
- MD5 df073384d167ac9baf66b991ecd6df79
- SHA1 1278cb3cb7fbca5736fc386ff5e72053c6eb0f28
- SHA512 5d06ca462cdcfbf4223c1b354c3578a8074e15ce850b91861f642c1d9cb29ad31fff9c16144dd2e34c289788b678296a7fc3a664c4b27e655d39415923432330
- SSDEEP 192:VE6Vnko3LO0Gnr1CPkjMD1oE8jEXXwgRh:VHHO3nWkjMD1oE8jEXgah
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.Collections.Deque.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 570f6df8ea487a9977c23cca5ce9ae582f645f057015ef779bb1c75afc208052
- MD5 f37027e4b63b3f6468fd37332684d105
- SHA1 68c3e376ba053990875dabf222fbb320b2495a8d
- SHA512 ca8c0eb8a5b884d015131de216d97045a5b7e7ab457901db231b28a289d829803adfe18f58ccd26b153ebff64bb542cc8a7cf0c5f628e7108aa02196933461d5
- SSDEEP 384:WRLkjeUXeOVXGAUbDYNt93FLr+hK9oY7W++wj8a7WwF5LMmXU5rGoMjnJX6eP6+3:WNOVYbo93FLr+gnEz01/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nito.Disposables.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 36be2376633d785adec9031ea49b2f578f50d5d2c74babf86f44566b903b4197
- MD5 e4f25b163ce2b0cfdd30e22d2fed7e07
- SHA1 16ca226a1380d219ba511a872eaea47c51818d76
- SHA512 5afb2c7b8aaf67eb40964bb0fecd50a9522aeedbe18fcaa3fa02c7305ac3815f49a1e17732fa6a3f08f79507b0f2e19e1bb3cd0246ec3c95a247f7c789c3deec
- SSDEEP 192:w3zvRqpaQjjXdct0MDxRYJEHrlBqw16ho:Qzv4LAuJExf8o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PasswordExtension.Win.deps.json
- SHA256 7b34d7ea90a9664a8f6370c3b0e98ac3114eb96f0ee9edab6c669d86c2c3cdc1
- MD5 cb9268125c592ca792954257032bd7ec
- SHA1 6b2f1f5b425639aabc73dd0c0b119a1a51fe5549
- SHA512 0ed3ac6039d742768ad3eeede207d96abb393780a431330cca8c27561a8dc79777ed11174890513ba7ef71cefe79cb1e3e54e7dab11b9208cedfb754b2ef389b
- SSDEEP 3072:dsA5agPSxot1Y9Im07R1ARkgT9ueGtHZqeag6K7gn9U:a9W
- MD5 SHA1 SHA512 SSDEEP
PasswordExtension.Win.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8971085fe9cb1bb47d0f757e01a504babd51c624c140c19251c63956745d163d
- MD5 4d4dc71f2e8ed5301fe1ade1ae8a6489
- SHA1 c1f5fe2e247b3d9ec5f4d7da2b94409967109fb1
- SHA512 d98be09cedfd786b132efae325dfeb98afd9d2541aa415168ac5a4839c1353ac9daafa204f891ff9d0a7cca2a482988c453d0ab2886459f196f4e7d5434d943c
- SSDEEP 1536:lkYuTKG4tSaSsqnOcizwuAyZEpjZgxM9Na6WATrKpRF1EjniN7gmFOXrhOLvgq9O:SYpxgfnqXZEpjZgxM9NZWATrKpRF1Ejv
- MD5 SHA1 SHA512 SSDEEP
Digest
76:01:98:dc:ee:de:4a:2e:de:74:94:b9:81:12:b2:f1:e6:af:20:e9:8c:89:7f:6d:3f:b1:1f:32:d9:42:5f:b8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
82206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PasswordExtension.Win.exe
- IMPHASH 0e4978c6d7358363a563494a824fabf2
- SHA256 6df0c68d62a6aaeb997e78cb65b572a005b7a3f72d5ffdcdcadd1711d23f5773
- MD5 30a037962d22c88a6c8a1c1221097fd0
- SHA1 8b7f1064a80e42f0de3af2e11d9b76b48a0f5dd5
- SHA512 1da9e0ec0a7bfd2f6e0a2d9214f715d1be9a7e00b96f6277ad9a0f3dc0685963db154b7034a8aff3171338bcc5575a2a3ccadfe537216eeaeb1fcc2ea80837b5
- SSDEEP 6144:VQPq1nKLOxCM4A2Xvc/vUkXVXXCXXzXXXAXXXUXXXPXXHXXXHXXX3XXXXXXXTXXE:Vhl0Mwk/ICjX
- MD5 SHA1 SHA512 SSDEEP
Digest
b6:1a:a5:09:ca:b4:2a:07:1f:12:6a:3b:35:65:7f:c4:06:6e:fd:12:b0:ea:d4:ea:d1:22:2b:59:4b:30:11:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
74032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb
kernel32
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
GetTempPathW
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
OutputDebugStringW
GetModuleHandleW
GetCurrentProcessId
Sleep
RemoveDirectoryW
DeleteCriticalSection
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_get_initial_wide_environment
_register_onexit_function
_initialize_onexit_table
_controlfp_s
_exit
__p___argc
__p___wargv
_c_exit
_initterm
_initterm_e
terminate
_errno
abort
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fflush
_wfopen
__stdio_common_vswprintf
fclose
__stdio_common_vsprintf_s
_set_fmode
__p__commode
fread
fseek
fwrite
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsicmp
strcpy_s
_wcsnicmp
_wcsdup
strcspn
wcsnlen
memset
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
_set_new_mode
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
setlocale
__pctype_func
___lc_codepage_func
_unlock_locales
_lock_locales
_configthreadlocale
___lc_locale_name_func
localeconv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_time64
_gmtime64
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=260, version=30034,
count=13, id=259, version=30034,
count=76, id=261, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=26213,
count=163, id=1, productName=Unmarked objects,
count=13, id=261, version=30140,
count=1, id=258, version=30140,
PasswordExtension.Win.runtimeconfig.json
- SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
- MD5 1bc39e80d6d10935c1e3c9503108e508
- SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
- SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
- MD5 SHA1 SHA512
PenImc_cor3.dll
- IMPHASH 897d4b325f4d1ecbf05e1d417468dc0f
- SHA256 3002b51d51172b402fdb20cb6f87a6c9c0abe8a4a8feab3d2bc4b82f1216e5e9
- MD5 7560e528fcc8df6c4d4bbd86e0749c0d
- SHA1 df3fee25640fb715b7ec590aba394e0457a612de
- SHA512 c1871aa76e7ab34ab0e0a7ad9540b306ee45bded1e0e5cb0c9f031da6f69f057d34e0b4a386a0d1e31aab8ba17bd2e0d564e327b828e33dc4eb828eaf00b0a81
- SSDEEP 3072:9/TNcQAdQk1RaV6tS/vfAcdtMUqfY4AvdhFXk:UQA+QSPATLA0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1e:8b:ae:78:77:81:91:fb:d5:1b:b9:f6:e9:be:e5:60:4a:b0:05:5e:ea:ec:21:fd:2a:3b:5a:30:f9:ad:68:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
68928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\PenImc\Win32\Release\PenImc_cor3.pdb
kernel32
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
DecodePointer
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
CreateEventW
GetCurrentProcessId
OpenEventW
OpenMutexW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEvent
LocalFree
SignalObjectAndWait
IsWow64Process
GetCurrentProcess
OutputDebugStringW
CreateMutexW
CreateThread
QueueUserAPC
SetWaitableTimer
CancelWaitableTimer
CreateActCtxW
ActivateActCtx
VerSetConditionMask
LoadLibraryW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedFlushSList
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CloseHandle
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
FreeLibrary
CreateWaitableTimerW
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
GetCurrentThreadId
user32
MsgWaitForMultipleObjectsEx
CharNextW
GetWindowRect
EqualRect
CallNextHookEx
IsWindow
SetWindowsHookExW
MonitorFromWindow
GetParent
GetDesktopWindow
GetWindowThreadProcessId
PeekMessageW
GetMonitorInfoW
UnhookWindowsHookEx
GetSystemMetrics
GetWindow
advapi32
ConvertSidToStringSidW
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
shell32
ShellExecuteExW
ole32
CoLockObjectExternal
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoGetApartmentType
oleaut32
SysStringLen
RegisterTypeLi
SysFreeString
LoadTypeLi
SysAllocString
VarUI4FromStr
UnRegisterTypeLi
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncpy_s
wcscat_s
wcscpy_s
memset
wcsncmp
api-ms-win-crt-heap-l1-1-0
_recalloc
realloc
calloc
free
_callnewh
malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
abort
_invalid_parameter_noinfo
_errno
_initterm_e
_initterm
_cexit
_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
rpcrt4
CStdStubBuffer_AddRef
IUnknown_Release_Proxy
NdrDllUnregisterProxy
NdrOleFree
CStdStubBuffer_DebugServerQueryInterface
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
NdrDllRegisterProxy
NdrDllGetClassObject
CStdStubBuffer_Disconnect
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
NdrDllCanUnloadNow
CStdStubBuffer_Connect
NdrCStdStubBuffer_Release
CStdStubBuffer_CountRefs
CreateResetEvent
DestroyResetEvent
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetLastSystemEventData
GetPenEvent
GetPenEventMultiple
GetProxyDllInfo
LockWispObjectFromGit
RaiseResetEvent
RegisterDllForSxSCOM
UnlockWispObjectFromGit
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.orpc
Size
512B
Virtual Size
228B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=261, version=30034,
count=15, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=260, version=25711,
count=15, id=257, version=25711,
count=164, id=1, productName=Unmarked objects,
count=13, id=264, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=1, id=151,
count=1, id=258, version=30140,
PresentationCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a711c29f615b2f292851650cb12cd64b6074913c29125ffc399ed760c853ad3
- MD5 00bd4ac73d8c20b14e9887f45454e381
- SHA1 a24ac293000375ca862376b5d397a0c3b2911067
- SHA512 db32923fec19ec450b21e8b2380d06bcf9d562ee05559c53ba47c208d91d89ebe1fb0492329ba6ef072c47ce4c65fe8e7673dbd16307fc74e2c4a7e67d25ad9e
- SSDEEP 49152:X1BB4con0YW9r81922/V6nOrB89rXintYP2H5msUIc4:FBB4cg0Yqc922/V2F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3415742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4ec952a95cb5f7102bd63c59dfdd0491b7948287f2c64d75a57cbb3ea5ffc89c
- MD5 3d59b212dff3c0fa45214c6291a9a330
- SHA1 87311de58423e64b75a91b6319e2a4ae666e011c
- SHA512 bcbda26622427ecf3a6906821c8d74a97d180adcae6ca168bca73774a898e65f80b10824a1cdd1a578b533d1f3e4a9c2f64417f7e68d7727e70ab315e8b6e1ee
- SSDEEP 96:18eLal55RmWyfkmgE5/a4Mr+A5onJY7h2mziS+Df0v3sGK1NQcXP+3zkuGD/D6W1:TKzFyDCK8onJAZv+bR7f+3dWEc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemData.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92abd19ddce03e86f9c884325f615976d7578a5b4d9607d9871290a588c9e809
- MD5 dff4cee2431337eeea633854d81fc38d
- SHA1 eb138c089ea3da756c847cfaaac595586734a098
- SHA512 adfb1077cad4308a4547e8cce9d489c3c4822595feeefe1cd54ea716d77ad5952101c51807fd4a2413a7938f6268c8aea12e129e05731d69006fba2a68cef8ec
- SSDEEP 192:daA9pDysNjR05zgo5f80zup/WKZWbzPWks:9bPRRvo5kaVK0Wks
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemDrawing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6a167a15ce94ebdf4c627fb651e05c694fadeb6bb00e5814db13b2e7dd33cbeb
- MD5 9dd4e7e817c6c220f7abe2db522a9578
- SHA1 0671ebba04cf1a4b003f821cb43dd159b3373b2e
- SHA512 33a5fd207225c54710c027ce966f7abbf3a3c91622c68cdc4f8efa99a5e6f5ae6f3eaa98edeb894779ca3d383e08de804c5da6ebaaece17ad47e2cf515decd36
- SSDEEP 96:TMF4vTAt+hsY5RypreziMit/ziozRoNH7+sGD/D6HY+Ub7W5b:IF479urqJK9RoNHSdW5b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemXml.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7e63047da788d63ba9967157fab4a441bc83bab628e00abf6dd044e5d1969688
- MD5 f9ab7399b269797a093d268b1a71bac5
- SHA1 6263304ea5c307c54ef35479aeb6d1564036b928
- SHA512 3442a2a8b8af5960a2aa4a4db1771ccd4f5cf48da4eb7364b1c8ce9bd465ea20defdb1ba5aedd59dcdc7efd60db92f3ffc417ffd6d837b8e6db4c71ed3f8270f
- SSDEEP 192:gpZRDlQ/LIw+zsT1tTTtfDo++DGjITBYWNH:gpDh+L3+Ut1fDo4jITBYWNH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework-SystemXmlLinq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d9bb8146142744b5514ac1ad82306961cf594b6f0b75adcbdb61241d2e02d76
- MD5 a0a471e2ca1ab5cdb84165223aa1ac93
- SHA1 9190b6b20445bb109aea2bd135d11103c8f71306
- SHA512 5b4a5892ab3323138bd455b626d2ec540c73eae89c2aa4b3b639ba1e6d9946c50d557f5059483c71b6def344a9d31c4ade9026f049358c5ebfcd43b487f178bc
- SSDEEP 96:n6w2ETNHQziY1qGuuTxWzGD/D6s2Y+Ub7Wp7:n6wfH0t1qGuuTxWwjWp7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.Aero.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54411e1de691917d2ff59be6551af95fa3a20556e5f8058bcf49b0cc1bcf68f6
- MD5 74026ffe0933b4afe3fe8810e950763d
- SHA1 b8813272fd54b2f67e65715f4b7374568dca163a
- SHA512 8887dd784d071b6b28f0e54ef0dba9488a741f2c109d46aa5d074121aa5c7d1f1ca2e79aefab8b53f7de9a7369352853c6f5ec6aadcb5b068c94da69017a7e78
- SSDEEP 3072:ihFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZW8WUnkXFuW6xu5FyTMR:/aojguW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
241534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.Aero2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24e62ac897f6af99631940184a2d26e1f18d6949dc2a1b00fef5a5fe9d98b37c
- MD5 59fff35603af5369086a2dcc69517236
- SHA1 b03b644518e87b234bdc488daa7567d380e74c6c
- SHA512 f7484b2aa9acbc2934723077e46a77f6930918ef8bd5f4c93e75f2322fc135089464d56504c29a769c393174e6e03d8323e1319d632626417e2949cd50af377f
- SSDEEP 3072:QhFMtkl2zoy1WOakqSA7g56hMyeTAaI6/QDHE4ZPGUnVHiFcAaQImTTl:haSUnVEPaQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
247598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
234KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.AeroLite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82c55e4e8d7c81cbacea3b7042a3bd6ceb7064b66bfa3d63477784b01e02a609
- MD5 2a37a62d650f02344025a450e343bd1f
- SHA1 c65d91b21db6823ae36273712e01d4bee1a019a6
- SHA512 5460b87607ea14f5652b468e4b2d61fb8960f8d31d6b9cbf275cf9fe9b99e3d59396ba3c3c2baf1111d574fff92ed3328ffc1404933b505c8f5e34d473600d0d
- SSDEEP 1536:QoauV8x9p/uvS++D1k9T7DwVNSPoV66yEKMtqWC6XOz9MFhpLBS+FN6LsbPCXbPp:QoauSr0K9K2SwFhZStsk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.Classic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e061162ee7263fdfc72db682b71e220e8108f1c523dbf634ef630a2393522535
- MD5 7bf91a2c218036feb7f66c043d12bfb0
- SHA1 ab29704c24f7b394ddc716f17d9bbcf97ba151a9
- SHA512 61cc8a77cf28daf38f9b782f8fa1e914f310f9ad16adc7d6af8ac49708a12b97164304ecaa370cb5b3c4a73677584059ca77a636d3ded9c672cb91f6181ff53f
- SSDEEP 1536:9txgsnh7pkcLCX4fSFl5UXEUlFCpHVpltqznYqafevHnfFtJxN5zJf81OSmOHOLF:7x3h9cXxFlquptRHU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
183422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
171KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.Luna.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 737477e6150f9f5fb6b63456883df87b5cc0ec59ddc75de8c8cf69749ef41229
- MD5 28c01af7048caa566bc544843e666b14
- SHA1 362be72687fb1e98e5669a17230efdf5c6e393ab
- SHA512 78a910c1e616e5d9a5e9d8aa9307ddd00879efe452adbc0b69c541ab0adcec9c9a8825e1cdaba4d7b0deef6f127f20cae589cdb771583ad84c5f13df2a788dd4
- SSDEEP 3072:Uepl3sO85wLbfp3G/uqv2tXFq278biT2SmDu1vqylFYNrySbjJfrLqiuqvOfmFqZ:tnfQ/uqQB7Miahu1puryejxrruqfd77
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
492686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
473KB
Virtual Size
473KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.Royale.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 105a980b2fcbd8fbc3262b87a5d97890f8612158f95f9cbffa23b238e0acc729
- MD5 b576e7f9cebd41b158174153d91fe0db
- SHA1 84d7c508b3ad1646bbf5b5fb6e2f249db5723188
- SHA512 99a14743bafb174b85fc4062ae21fef86a689dc5ff0cc7435784abcf6d5245430b7634e8141695c4dee5600a3e086633c1ae363fe4296a81d05c76dfdd44a31e
- SSDEEP 1536:MgSAnQHC9yhfbLH3zPvcut4Xs892JXcfMChHhvG0gd8LxmEEbk0qdBw3jFdENYGK:MgSAQHUILvK96Xcfb81vFdqhGkdg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
204750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 73e08d9f4afc20be63c3309c6aec1b840df189f9c22018a7b44665184004d1da
- MD5 03c9a4de00b3f8835146b5a364ecd065
- SHA1 d390564ace7f72818f69c9b0d9eb58c1ab8fd182
- SHA512 2e5217b52a61b966acc233091f44cecf97b8703a5ec77fcab10f9467505d5da209199b47959f1383ad4f6d8c6aefbcf2ce8e7fa33fda04f2cb9f428a58e0c611
- SSDEEP 49152:OBf1XN6xcqFQaU4LxamTnQ5iw3AJzGpEUzbH/loQcI1fDyqzO:OBfFN6xRFQaJWpb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5802638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PresentationNative_cor3.dll
- IMPHASH 1ba17ed539f0828d6eb789fa20855dd9
- SHA256 5a71ba70796a1d679ba83f28cfe0cdd44eaa1778e2084cc6bf2785682e6d9447
- MD5 80df7c9c106dcbb1d7ee2cacfca143cd
- SHA1 997c002394d0c7e818bd3068a26afa2dbf6beb58
- SHA512 81911a29b4e21302414ea632a2ce6ba58fd6b889ca202f5a73f582a5e8dbe9f473a593ad19230b97fc2c37e5654d7026b7915183c357f302dd75a388a7b205f3
- SSDEEP 24576:1FDj94E+ReeC/xOFX/yQv6QjLDWnL+pzfqPa25ljGVgH+ZPZQlEA:1Fj94E+ReewyPyQCQTwAzqPaylA1OlD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
48:14:cc:e4:73:d9:ea:d8:18:98:f1:c7:60:a4:63:28:fe:df:ca:7a:1e:32:7d:0a:6e:40:c5:ca:b8:35:fd:53
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\PresentationNative\Win32\Release\PresentationNative_cor3.pdb
kernel32
TerminateProcess
IsProcessorFeaturePresent
LoadLibraryW
GetProcAddress
VerSetConditionMask
SetUnhandledExceptionFilter
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
InitializeCriticalSection
OutputDebugStringW
GetCurrentThread
TerminateThread
InitializeCriticalSectionEx
GlobalDeleteAtom
OutputDebugStringA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
GetLastError
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
abort
terminate
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
api-ms-win-crt-string-l1-1-0
iswpunct
wcsncmp
strcpy_s
memset
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
ntdll
NtQuerySystemInformation
DbgPrintEx
DbgPrompt
DbgBreakPoint
RtlUnwind
user32
GetMenuBarInfo
SetWindowLongW
SetScrollPos
SetFocus
MapWindowPoints
GetWindowTextLengthW
GetWindowTextW
GetWindowLongW
GetWindow
GetParent
GetKeyboardLayoutList
GetAncestor
FindWindowExW
EnableWindow
gdi32
GetTextExtentPoint32W
ole32
CoCreateInstance
CoTaskMemFree
oleaut32
SysAllocString
VariantInit
VariantChangeType
VariantClear
CreateDocContext
CreateInstalledObjectsInfo
CreateTextAnalysisSink
CreateTextAnalysisSource
DestroyDocContext
DestroyInstalledObjectsInfo
EnableWindowWrapper
FindWindowExWrapper
FsAddFigureObstacle
FsClearUpdateInfoInPage
FsClearUpdateInfoInSubpage
FsClearUpdateInfoInSubtrack
FsClearUpdateInfoInTableSrv
FsCommitFilledRectangle
FsCompareSubpages
FsCompareSubtrack
FsCompareTableSrv
FsCreateDocContext
FsCreateDummyFootnoteRejector
FsCreatePageBottomless
FsCreatePageFinite
FsCreateSubpageBottomless
FsCreateSubpageFinite
FsDestroyDocContext
FsDestroyFootnoteRejector
FsDestroyPage
FsDestroyPageBreakRecord
FsDestroySubpage
FsDestroySubpageBreakRecord
FsDestroySubtrack
FsDestroySubtrackBreakRecord
FsDestroyTableSrv
FsDestroyTableSrvBreakRecord
FsDuplicateGeometry
FsDuplicatePageBreakRecord
FsDuplicateSubpageBreakRecord
FsDuplicateSubtrackBreakRecord
FsDuplicateTableSrvBreakRecord
FsFAllFootnotesAllowed
FsFFootnoteAllowed
FsFormatSubtrackBottomless
FsFormatSubtrackFinite
FsFormatTableSrvBottomless
FsFormatTableSrvFinite
FsGetClientHandle
FsGetColumnRectangle
FsGetEmptySpaces
FsGetFigureObstacleData
FsGetFloaterFsimethods
FsGetIntervals
FsGetMaxNumberEmptySpaces
FsGetMaxNumberIntervals
FsGetNextTick
FsGetNumberSubpageFootnotes
FsGetNumberSubtrackFootnotes
FsGetPageRectangle
FsGetShiftOffset
FsGetSubpageColumnBalancingInfo
FsGetSubpageFootnoteInfo
FsGetSubtrackColumnBalancingInfo
FsGetSubtrackFootnoteInfo
FsGetTableObjFsimethods
FsGetTableSrvColumnBalancingInfo
FsGetTableSrvFootnoteInfo
FsGetTableSrvNumberFootnotes
FsJustifySubpage
FsQueryAttachedObjectList
FsQueryCompositeColumnDetails
FsQueryCompositeColumnFootnoteList
FsQueryDcpLineVariantsFromCachedTextPara
FsQueryEndnoteColumnDetails
FsQueryFigureObjectDetails
FsQueryFloaterDetails
FsQueryFootnoteColumnDetails
FsQueryFootnoteColumnTrackList
FsQueryHeightDefinedColumnSpanAreaList
FsQueryLineCompositeElementList
FsQueryLineListComposite
FsQueryLineListSingle
FsQueryPageDetails
FsQueryPageFootnoteColumnList
FsQueryPageSectionList
FsQuerySectionBasicColumnList
FsQuerySectionCompositeColumnList
FsQuerySectionDetails
FsQuerySectionEndnoteColumnList
FsQuerySegmentDefinedColumnSpanAreaList
FsQuerySubpageBasicColumnList
FsQuerySubpageDetails
FsQuerySubpageHeightDefinedColumnSpanAreaList
FsQuerySubpageSegmentDefinedColumnSpanAreaList
FsQuerySubtrackDetails
FsQuerySubtrackParaList
FsQueryTableObjCellList
FsQueryTableObjDetails
FsQueryTableObjFigureCountWord
FsQueryTableObjFigureListWord
FsQueryTableObjRowDetails
FsQueryTableObjRowList
FsQueryTableObjTableProperDetails
FsQueryTableSrvCellList
FsQueryTableSrvRowDetails
FsQueryTableSrvRowList
FsQueryTableSrvTableDetails
FsQueryTextDetails
FsQueryTrackDetails
FsQueryTrackParaList
FsRegisterFloatObstacle
FsReleaseGeometry
FsResolveOverlap
FsRestoreGeometry
FsShiftSubtrackVertical
FsSynchronizeBottomlessSubtrack
FsTransferDisplayInfoSubpage
FsTransferDisplayInfoSubtrack
FsTransferDisplayInfoTableSrv
FsTransformBbox
FsTransformPoint
FsTransformRectangle
FsTransformVector
FsUpdateBottomlessPage
FsUpdateBottomlessSubpage
FsUpdateBottomlessSubtrack
FsUpdateBottomlessTableSrv
FsUpdateFinitePage
GetAncestorWrapper
GetFloaterHandlerInfo
GetKeyboardLayoutListWrapper
GetMenuBarInfoWrapper
GetNumberSubstitutionList
GetParentWrapper
GetScriptAnalysisList
GetTableObjHandlerInfo
GetTextExtentPoint32Wrapper
GetWindowLongPtrWrapper
GetWindowLongWrapper
GetWindowTextLengthWrapper
GetWindowTextWrapper
GetWindowWrapper
GlobalDeleteAtomWrapper
IsPrintPackageTargetSupported
IsStartXpsPrintJobSupported
IsWindows10OrGreater
IsWindows10RS1OrGreater
IsWindows10RS2OrGreater
IsWindows10RS3OrGreater
IsWindows10RS5OrGreater
IsWindows10TH1OrGreater
IsWindows10TH2OrGreater
IsWindows7OrGreater
IsWindows7SP1OrGreater
IsWindows8OrGreater
IsWindows8Point1OrGreater
IsWindowsServer
IsWindowsVistaOrGreater
IsWindowsVistaSP1OrGreater
IsWindowsVistaSP2OrGreater
IsWindowsXPOrGreater
IsWindowsXPSP1OrGreater
IsWindowsXPSP2OrGreater
IsWindowsXPSP3OrGreater
LateBoundStartXpsPrintJob
LoAcquireBreakRecord
LoAcquirePenaltyModule
LoCloneBreakRecord
LoCreateBreaks
LoCreateContext
LoCreateLine
LoCreateParaBreakingSession
LoDestroyContext
LoDisplayLine
LoDisposeBreakRecord
LoDisposeLine
LoDisposeParaBreakingSession
LoDisposePenaltyModule
LoEnumLine
LoGetEscString
LoGetPenaltyModuleInternalHandle
LoQueryLineCpPpoint
LoQueryLinePointPcp
LoRelievePenaltyResource
LoSetBreaking
LoSetDoc
LoSetTabs
LocbkGetObjectHandlerInfo
MILGetClassificationTables
MapWindowPointsWrapper
NlCreateHyphenator
NlDestroyHyphenator
NlGetClassObject
NlHyphenate
NlLoad
NlUnload
PrintToPackageTarget
SetFocusWrapper
SetScrollPosWrapper
SetWindowLongPtrWrapper
SetWindowLongWrapper
Name
.text
Size
757KB
Virtual Size
756KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=261, version=30034,
count=13, id=260, version=30034,
count=8, id=259, version=30034,
count=15, id=257, version=25711,
count=105, id=1, productName=Unmarked objects,
count=228, id=265, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=2, id=151,
count=1, id=258, version=30140,
PresentationUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b77e0b332b763360827c9d76371015cb50b46ce1a611e5ececfa0601c6ff94e9
- MD5 4af1178bebfd8b52ff646b10130d7057
- SHA1 91685be41b4e616c6b0cb480b52b9eaa951b65f5
- SHA512 b62bb3aac73ae66c8d8e632d4d02384ae2281d68ec259f54cb71dee784bab4f11fa4d548bc6ba44e3e2d964be427c36d6d58585e8fb97b2fc68b356ba2090dd8
- SSDEEP 6144:qJEFeOBKsz8cSUvVBjtTWPGgoDTcS/TXIjVQfoVGd3HyG2KusN2qoKl4vVIL9Ioa:1FTJwwGlyTcssQfoVGd3HyGNuwU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
834046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
807KB
Virtual Size
806KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PropertyChanged.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 52ec64563ea08f61ef3f568699fd8a66eb5e532d5f7fc342ad46a69ccdf81ae3
- MD5 4826da1d501c41bf5869823d4540cbab
- SHA1 311cabfeb0aeeeda3495af1f529e5427b0241a14
- SHA512 ba7475503aabb5b602ab1d748cf5ff4e55fb3a6d0ea3b67dc3c1d6142c9f87f88e814b9cd819f66cdcf2c387b3e79cddd1314a6c32906e9e71c0ce0d93ca202f
- SSDEEP 96:SI/1qHR6SLIrUVGYK5wVWRyLdYag/GDC5F9:Si1qHRnkgVGneVWRyJaB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\propertychanged\PropertyChanged\obj\Release\netstandard2.0\PropertyChanged.pdb
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ProtectedAPC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c7f836ca5ba7b282712c7e5972855cca616d53956b144be1576f83ea44be9743
- MD5 ec918ed1f2f603ba94a2507227d39f26
- SHA1 ecad966014ff84d553203ae02a84b8e23e225550
- SHA512 f2fe12e9f7c81aa25122b0c28e90366a8d23170e476f644d111b602417ba5d531a6c6de5a7e0c9b37fc68f86154f9ae82bcd3a69aa1454e25f24a86526815524
- SSDEEP 384:SLm5VUtFAhV707OF7GH1CPBMmvjztR5mDzqQzfDeIw2kPtWa:koVUtFGFCH1OBlvjztREeYdwlPtWa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ProtocolFilters.dll
- IMPHASH 0c3f6577c4dea6e1634d3e32a034907a
- SHA256 e02b3bd979db2a64d13dd6e8df2dc805531ac2f960e08755054ba6e0e4b03e80
- MD5 a9ac0cc5fe79a8e772cbb731ad4c7bd1
- SHA1 bd138692843d2dcea3adc7df5df94eb7603d1ed0
- SHA512 768cf34962d91032a0fd2defec4512f49b8fd1e5f2350be652b43deb45898b6ab106f9ac0284beed94ff19a733d60982cabf8a5811583018a884693609081cc8
- SSDEEP 12288:NBELhX3eiRFvy4z6uZxE+j7tWZmTgmkMVeJDi9LPDMwn4jzpp7U7RwM5xXrMkmHq:XoKcxEWtWZmLVegBnKX/Mg4OOFf2TaqO
- MD5 SHA1 SHA512 SSDEEP
Digest
d4:84:e8:ea:6c:f6:ce:bc:d6:49:30:8c:47:03:bd:e3:34:c1:9f:ba:ed:82:7f:9d:b7:2e:89:0d:32:5d:ce:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
358094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_c_api\win32\protocolfilters.pdb
kernel32
ProcessIdToSessionId
FreeLibrary
GetVersion
LoadLibraryA
CreateEventA
CreateMutexA
SetEvent
GetLastError
DeleteFileW
GetFileAttributesW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
OpenProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetTempFileNameW
CreateProcessW
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetShortPathNameW
FindNextFileW
FindFirstFileW
FindClose
GetProcAddress
ExpandEnvironmentStringsW
SetConsoleCtrlHandler
LoadLibraryW
OutputDebugStringW
CreateFileW
WriteConsoleW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
FlushFileBuffers
HeapSize
AreFileApisANSI
GetModuleHandleExW
ExitProcess
SetStdHandle
GetCurrentProcessId
GetModuleFileNameW
GetConsoleCP
WideCharToMultiByte
WriteFile
GetFileType
GetStdHandle
SetFilePointerEx
SetFilePointer
ReadConsoleW
GetConsoleMode
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCurrentThread
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FatalAppExitA
InitializeCriticalSectionAndSpinCount
GetCommandLineA
GetSystemTimeAsFileTime
LoadLibraryExW
ExitThread
GetCurrentThreadId
CreateThread
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
SetEndOfFile
GetTempPathA
DecodePointer
EncodePointer
ReadFile
MultiByteToWideChar
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
RaiseException
InterlockedExchange
Sleep
GetFileAttributesExW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
LookupAccountSidA
LookupAccountSidW
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegEnumKeyExW
crypt32
CertCloseStore
CertFreeCertificateContext
CertAddEncodedCertificateToStore
CertEnumCertificatesInStore
CertSetCertificateContextProperty
CertOpenSystemStoreA
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFindCertificateInStore
CertAddCertificateContextToStore
CertOpenStore
PFXExportCertStoreEx
libssl-1_1
SSL_set_accept_state
SSL_set_connect_state
TLS_client_method
TLS_server_method
SSL_free
SSL_new
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_default_passwd_cb
SSL_CTX_use_certificate
SSL_CTX_use_PrivateKey
SSL_set_bio
SSL_CTX_free
SSL_CTX_new
SSL_CTX_set_options
SSL_get_session
SSL_version
SSL_get_shutdown
SSL_shutdown
SSL_renegotiate_pending
SSL_renegotiate
SSL_do_handshake
SSL_get_ciphers
SSL_get_error
SSL_CTX_callback_ctrl
SSL_CTX_ctrl
SSL_ctrl
SSL_write
SSL_read
SSL_connect
SSL_accept
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_set_session
SSL_set_verify
SSL_set_cipher_list
SSL_CIPHER_get_name
SSL_CTX_set_cipher_list
SSL_is_init_finished
SSL_get_servername
SSL_get0_alpn_selected
SSL_CTX_set_alpn_select_cb
SSL_set_alpn_protos
SSL_select_next_proto
SSL_CTX_set_client_cert_cb
OPENSSL_init_ssl
SSL_get1_session
SSL_SESSION_free
libcrypto-1_1
X509_STORE_CTX_free
X509_STORE_CTX_init
X509_STORE_add_cert
X509_STORE_load_locations
X509_STORE_CTX_get_error
X509_verify_cert_error_string
X509_sign
X509_digest
X509_cmp_time
X509_gmtime_adj
X509_EXTENSION_free
EVP_PKEY_new
i2d_X509
X509_get_signature_nid
X509_NAME_oneline
X509_set_version
X509_set_serialNumber
X509_get_serialNumber
X509_set_issuer_name
X509_get_issuer_name
X509_set_subject_name
X509_get_subject_name
X509_getm_notBefore
X509_set1_notBefore
X509_getm_notAfter
X509_set1_notAfter
X509_set_pubkey
X509_NAME_get_index_by_NID
X509_NAME_get_entry
X509_NAME_delete_entry
X509_NAME_add_entry_by_txt
X509_NAME_ENTRY_get_data
X509_get_ext_by_NID
X509_get_ext
X509_delete_ext
X509_add_ext
X509_get_ext_d2i
X509_verify_cert
X509_find_by_subject
X509_STORE_CTX_new
X509V3_set_ctx
AES_set_encrypt_key
AES_set_decrypt_key
AES_cbc_encrypt
OCSP_cert_to_id
OCSP_response_status
OCSP_response_get1_basic
OCSP_resp_get0_certs
OCSP_resp_find_status
OCSP_check_validity
OCSP_basic_add1_cert
OCSP_BASICRESP_free
OCSP_basic_verify
OPENSSL_sk_pop_free
BIO_write
OBJ_obj2nid
EVP_PKEY_id
EVP_PKEY_bits
PKCS7_free
X509_NAME_get_text_by_NID
PKCS8_PRIV_KEY_INFO_free
EVP_PKCS82PKEY
ERR_get_error
PKCS12_SAFEBAG_get_nid
PKCS12_SAFEBAG_get_bag_nid
PKCS12_SAFEBAG_get1_cert
PKCS12_SAFEBAG_get0_safes
PKCS12_SAFEBAG_get0_p8inf
PKCS12_decrypt_skey
PKCS12_unpack_p7data
PKCS12_unpack_p7encdata
PKCS12_unpack_authsafes
PKCS12_free
PKCS12_SAFEBAG_free
d2i_PKCS12_bio
BIO_f_buffer
PEM_read_bio_X509
PEM_read_bio_PrivateKey
X509_STORE_free
X509_STORE_new
RSA_generate_key
i2d_PrivateKey
d2i_AutoPrivateKey
X509V3_EXT_conf_nid
EVP_PKEY_free
EVP_PKEY_assign
EVP_get_digestbyname
EVP_sha256
EVP_sha1
OBJ_nid2sn
ASN1_STRING_to_UTF8
BN_to_ASN1_INTEGER
i2a_ASN1_INTEGER
BN_free
BN_new
BN_pseudo_rand
OPENSSL_init_crypto
CRYPTO_free
CRYPTO_malloc
OPENSSL_sk_push
OPENSSL_sk_free
OPENSSL_sk_new_null
OPENSSL_sk_value
OPENSSL_sk_num
PEM_write_bio_X509
d2i_X509
X509_free
BIO_s_mem
BIO_ctrl
BIO_read
BIO_free
BIO_new
X509_new
ws2_32
WSAStartup
ntohs
ntohl
htons
WSAAddressToStringA
WSACleanup
PFHeaderField_getName
PFHeaderField_getUnfoldedValue
PFHeaderField_getValue
PFHeader_addField
PFHeader_clear
PFHeader_create
PFHeader_findFirstField
PFHeader_free
PFHeader_getField
PFHeader_parse
PFHeader_removeFields
PFHeader_size
PFObject_clear
PFObject_clone
PFObject_create
PFObject_detach
PFObject_free
PFObject_getStream
PFObject_getStreamCount
PFObject_getType
PFObject_isReadOnly
PFObject_setReadOnly
PFObject_setType
PFStream_copyTo
PFStream_read
PFStream_reset
PFStream_seek
PFStream_setEndOfStream
PFStream_size
PFStream_write
pfc_addFilter
pfc_canDisableFiltering
pfc_deleteExceptions
pfc_deleteFilter
pfc_free
pfc_getFilterCount
pfc_getNFEventHandler
pfc_getProcessOwnerA
pfc_getProcessOwnerW
pfc_getRootSSLCertFileName
pfc_init
pfc_isFilterActive
pfc_loadCAStore
pfc_postObject
pfc_readHeader
pfc_setExceptionsTimeout
pfc_setRootSSLCertImportFlags
pfc_setRootSSLCertSubject
pfc_setRootSSLCertSubjectEx
pfc_startLog
pfc_stopLog
pfc_unzipStream
pfc_waitForImportCompletion
pfc_writeHeader
Name
.text
Size
526KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=6, id=199, version=41118,
count=21, id=205, version=50929,
count=47, id=207, version=50929,
count=128, id=206, version=50929,
count=296, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=6, id=206, version=61219,
count=33, id=207, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
ReachFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8d6192a62168a5ee42b45eefb3abaae9cbaf0fd46e2b4ab64a612b6efe8a4c8e
- MD5 948cb84290473e06b8f69bed5a38ffaa
- SHA1 61acb3f2aafd33d9c40ff848ed02e91995d02986
- SHA512 69ef93290fe2b1f180a78fcf99c9fe9871d4f29361493649e1ead42fb032af6c0b9ec0ecbfb46af64a2aefdfa5202b67a16a86e16e9b4d0a6c61ec2f307e94e4
- SSDEEP 12288:83Ovqr3RAN/d3z9A+lt34Dv672/Z5YQMmV1K1UzlZuwR4rcf7E4F6:83Ovqj+N/dFltIF5YQMS1K1UzlZu84rE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
627438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
605KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SAVAPI/aebb.dll
- IMPHASH 3a20d38e32d00b58d66203e5798b7b1e
- SHA256 cd6fcce8f0a2e4f832894abe41f2c4e7c0ab97b4a46eb478d085ffbb9ca36b5b
- MD5 2af40e6f90240525f8cd27961b53f2db
- SHA1 5eab9dc2edef6140df6842811da9e8ae9a27cbd9
- SHA512 ba80cf1f33e14d5dd3a3f96196e265d33920ac4fcc23dd3da61e192233401aad522fceea4a295628f03345ec3e43ae16542b0adcf8adcf0ee93a3f2114c2bccf
- SSDEEP 1536:BwgYl1cyd7JwVYgPj73dFZEqusWhmcdhRktha4rbtqa:B4t7AYgPjfeZHhRkthaFa
- MD5 SHA1 SHA512 SSDEEP
Digest
1a:a3:e4:37:d0:7c:d7:3f:00:5b:a5:35:23:d8:a2:a3:76:f3:cd:10:fe:e1:34:d0:ba:c3:f2:94:25:63:da:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 25, 2022
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
1c:a2:8b:87:5c:8f:0d:56:fc:03:4b:f1:35:b7:07:99:74:d8:11:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Mar 25, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
6f:40:17:75:8e:d0:8a:39:e0:a3:bb:62
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
6332
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=2, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aecore.dll
- IMPHASH 217ebb8a365fd7faa7f8b379d9f92737
- SHA256 1eff4b5bafa7a567f756a85297733802215bd9135e627e0cc6255c65dc87ca22
- MD5 2a4261a7dde3fdfd43793ca431890f84
- SHA1 8be893f9fd941dc0971498587f52228e2e9d69b0
- SHA512 e0e584174d61387e88adb6e5a618461a71039de773666f557fd19ad4c6300d8b9bfce505b032efcfdf443ded1e97678c2e504b4e893209ffb246add683b26abf
- SSDEEP 6144:xwIt+l+nab5lgF9KqSUuYM5hXLbnlaAcQkwYxhTsEaq:rtqVYF9KqSUuZhXLbnlwhTsEv
- MD5 SHA1 SHA512 SSDEEP
Digest
82:6c:0f:56:e7:0c:d5:a9:f4:7f:c9:0b:0c:1f:03:9f:e5:b9:ea:91:27:13:2b:02:c8:5e:56:a7:77:a0:52:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Dec 12, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
5f:82:7d:5a:23:2a:e4:fe:53:6d:c0:84:2e:33:df:11:34:d1:b6:39
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Dec 12, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
165679
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileW
GetFileSize
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
DeviceIoControl
FreeLibrary
GetProcAddress
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
DecodePointer
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFileAttributesW
DeleteFileW
MoveFileExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
CompareStringW
LCMapStringW
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
WriteConsoleW
ave_proc
Name
.text
Size
235KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=153, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=97, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=47, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aecrypto.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 8cb77f5fccdae7f9661b81454437928fa697a8d2c2cef8f61a3772cc766d6d10
- MD5 e824d826c0ebb30047aaa308fe03b6c9
- SHA1 1778f29052920ddc7ef192761123013cb7f648d2
- SHA512 774111704c1d7680bce109e7fe5b2f91f415e5ff62432f8e52ba6c2a2b8986aa17c8487e0f0562818fe8d0f12af76d29965fc24a1f612eb71f149ecf60f0537a
- SSDEEP 3072:YVuJFpYwK3LS25lBkL3zijjk+omocplwyew0CCNMCDLZ:GuJ43eAIEjkwdHMZ
- MD5 SHA1 SHA512 SSDEEP
Digest
4a:05:64:d4:25:70:65:06:c0:93:3f:16:bc:76:a0:b0:e6:16:62:11:68:71:03:6e:00:73:8a:f4:62:fb:00:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 3, 2021
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Digest
3f:2c:05:37:63:c1:c2:73:53:9c:97:f4:07:18:b5:82:c1:1b:3d:8f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 3, 2021
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:09:d5:71:49:1d:e7:22:df:46:2f:a4
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
59087
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aedroid.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 12bfedbe10041d39020e9a15c4cc3d4b557a7d4fffe40cf2d75caecf5f1ed1ab
- MD5 8facd0e1b34b24d3b7adb3b9be3375dd
- SHA1 f7ac09b72c91a8c54e266b7f6b68b2e40366d026
- SHA512 55fba8645835c69fe6e93da395de726bbcc0b3dd0049b5e4673f811cb92bc911a8bf1f6706a0922548635aa81d8aef95c3779cf827e52e70f851fa0be6a0c502
- SSDEEP 49152:2bnUI0myoyI4rlfff/MtGcMnrjD4LTQXJfRI14Ka8eGAp7dp9sCais5jDY5rGjS/:OnUI0myoyI4rlfff/MtGcMnrjD4LTQXv
- MD5 SHA1 SHA512 SSDEEP
Digest
79:a9:b8:7b:e7:bd:78:32:f9:54:23:b3:fc:10:b3:6f:08:ec:26:c5:41:4c:21:05:07:2f:54:ed:24:21:19:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Dec 8, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
95:0a:d9:22:ef:4f:14:55:38:a1:c7:0d:74:7c:28:e2:83:5b:32:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Dec 8, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
119326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=58, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aedroid_gwf.dat
- SHA256 50a9af9ac743d6a7f2741a3ab39717c8c7e618630b7688dab60b57b97f840b9d
- MD5 961a1c1e0dfb8b54019c9ccec510b3ad
- SHA1 ced9c7e98809bb7506a17644144efcbf50bfd10a
- SHA512 fca12aea31d0cb3b71b73456606b91d97f6bd3366591b65191ce6edda8b6ca8d53e07da4a5a95d9242a43b2c20842dfc1f9b39bb4ddc47058afd86530bb2afe4
- SSDEEP 98304:pn7ccmeV0TkXxuwIxSt/C5ytS0BLC5KjeVdL+l/wSFHiw/OGPWqxcH8U:VccJ0TkhuLx2qyt/LC5vXGYSl9nOBHh
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aeemu.dll
- IMPHASH 9b5c2716bd999e49e0bc0945944d4532
- SHA256 9c9e782ac4490372119a95cac641970d805679a8aeef2ad59ee28c1a942cf5ac
- MD5 02940a21ab69d26893bc00c064be569e
- SHA1 e6eb2ba77bfa72fda91ba46924a18b8ad726f7b5
- SHA512 fac2069467c574b856fdb4597fb973b9a4f3fef5288b0ed0bda72136f48ffce58063ea5b251ae01216f744ec17d2c824f07593f8de885bdad123f5867510b21b
- SSDEEP 6144:HC9iYUBfVOM2SO79GGphjkL1HEli3ETCmkGeqcupFRiZnlQpeIj8+u4:JfVYVFphjkpHEli3ETCaZpFdeIQy
- MD5 SHA1 SHA512 SSDEEP
Digest
1f:89:d6:7b:c4:23:37:c8:62:87:ea:5d:c5:fb:ae:4a:04:ec:b4:d5:53:6f:43:46:b8:8f:2b:93:52:e5:d2:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Aug 3, 2021
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
PE Signature issue
Digest
dd:97:19:71:7d:89:7c:5f:cb:ce:18:aa:46:10:cb:3c:7f:79:2d:92
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
54:09:d5:71:49:1d:e7:22:df:46:2f:a4
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 26, 2019 - Apr 26, 2022
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Minor OS version
0
Major OS version
6
Entry point
277265
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
CloseHandle
DecodePointer
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
328KB
Virtual Size
327KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=6, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aeexp.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 911d01f963ab2236e7bc977f96e84f292bef07f48f40f8927115e2b056992aa8
- MD5 faee506a935d68524834d090cb0fc16e
- SHA1 f3927c0170f15c1ad895f57aab48167781c51eff
- SHA512 5b15442e84e828425832659124398cb867a3cd70f48e85c2ae6eb2261d9f83101e148264349f05b86fc8b034af6ab5dce0579c106e0bed95a8aa656839903a53
- SSDEEP 6144:TIJxzjiTLxYnFZ9YJSXAVkpzFJv+rN0QmwAdWy9kvTZceYD+Pzb8ljBUJ:sxzjiyj9s+D+rNmjYy9BeYbPUJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:d6:f5:8b:30:61:44:91:be:3f:7f:86:6c:c5:56:91:fb:0d:ca:e4:a6:77:ae:12:67:03:76:dc:fd:ae:ba:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
114287
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
180KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=20, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=102, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aeexp_gwf.dat
- SHA256 2d7925f16b1b835b7265d1c04c38c599f2b25c5087a0005dec60dcd22e9f3dd7
- MD5 d68dbed2d9e81bb670e94b0b550cccdf
- SHA1 edebaf42b7b772274ffbdf070d965aa585cb14f4
- SHA512 162c6078492870fb1712968e5cf81e99b0e16dc2c737eb56f5dac1e17a66457382d555faf2ae9096b5e0103cf79e79c629007ca2ccb80d422e424fefe3a6c734
- SSDEEP 1536:lalK69DzGxZ+w0R++MOp3lH3iEZdmD4QKdTZ8bEnicyhgAj:IoGDixZ+n4+Ma1yIPQOZV9e
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aegen.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 519de6c5006127a5f4174c6f6a13d87cf30a2e866bc1eb95545d67a2ec0292f2
- MD5 163ea96ca0a9b9f7469dd128fe5bce04
- SHA1 60f4a01001fe4ad3b2aea24ce0b535a7d863f333
- SHA512 b088619bcb30e2f91c5ab4c6a2777a0b163e60f33ec6475a2b00d1c711f6fa86f621f8475026adf71adf3ca863911686e03cf98bf913412ac5f8e4b269fffbc1
- SSDEEP 12288:dgIV1xhEHTAr7c218TOVDkAIx7RdvpkqpApOxvwwacO71fYl59y+mFTV:/lEzAr7cU8TUIAIBvpkqpApV7cy1y96b
- MD5 SHA1 SHA512 SSDEEP
Digest
09:f4:52:55:bf:f9:02:43:c0:79:f1:a7:ce:55:db:fe:e8:ef:21:6e:7b:14:db:f9:bb:53:6a:07:84:b3:8b:15
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Aug 8, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
dc:b1:ae:62:aa:10:8a:bf:e6:9f:8a:5d:22:b4:1c:86:9f:02:f5:d4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Aug 8, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
569437
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
611KB
Virtual Size
611KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=20, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aehelp.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 2c0b8af1ed85fa5ff16f87f3c58beee9fc0230594dd062913ec5ce87abacba4a
- MD5 c56e6711d0c6dbb6bd7bafbde06e9c90
- SHA1 872c3d8d2a54ac10c22861052498c2ef954f8004
- SHA512 611892b7b5a4a51fca74ee0d4d2dfa6a02ec22eda0fb9c24ff51a7f33a695a2aef3bb222763cd7ac5d0d6d5529634493fd2abd0a2c38fbbef34358700d65cb8b
- SSDEEP 6144:qJcM9/q39zJguo+i6d5Pjsyb4BIdhqDiD+o9RScE72UG9zxAe:Ux09tghUZsyvPS4UG9zxJ
- MD5 SHA1 SHA512 SSDEEP
Digest
9d:91:74:e6:bd:51:20:c7:8f:bf:9a:39:8e:49:41:89:d3:b3:7c:4d:84:85:91:dd:dc:5f:bc:d7:84:76:18:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 8, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
163201
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=137, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=57, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aeheur.dll
- IMPHASH 5b0f0adb0bc652db7edc954409410539
- SHA256 23bfdb21548d8b0da6b1d63167c44207a3fe7f613bf36406168c667bb7d0a4f5
- MD5 d3f86394440e679a8be729c2af168169
- SHA1 3c50ae00ca1c65b71f6f01c18a1507c03207df5a
- SHA512 40abd780623276742f4ff5e89135e1223e3f7226cfb8af66f87646bcbb46c46e23eebe1a4bf3e4e0603622fb803d91d4c7f25c31283cddacc9037335a436c936
- SSDEEP 98304:9/P/JUX4fQyJVTL4sxamHxu0dcSgrz/2FJEncELaq855k0rmMxzuIi5dYPnu62QX:nmN1C1Nn7
- MD5 SHA1 SHA512 SSDEEP
Digest
2f:61:ed:bb:69:80:c0:8b:13:ba:c8:c6:0c:aa:a5:8c:2a:ab:50:56:69:4f:1d:27:5e:27:22:f7:be:7f:57:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 15, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
9983951
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
DecodePointer
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
9.6MB
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
539KB
Virtual Size
538KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
180KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
509KB
Virtual Size
508KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=145, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=496, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aeheur_agen.dat
- SHA256 ee8a06d4af03049c6699a37a24233f37eb08dd2720f57848e665ed6d1cc7eb78
- MD5 159a422ec89a6699396140a500ddbfb8
- SHA1 8bcc5d5ae855bb7e36412a6b2d9a8bbfa37f56a3
- SHA512 db67a5792624b632c8cb3ab4bef963817faaa62dfa29f2da71b034a90e766c5d569b4c6ca2c04d85368674373fc72e60d4fc53711438923690a1ca0dfb4bb404
- SSDEEP 49152:fAtG44TpuEkXGrhmWq6GOaJIf9x89H8KGAPg9ZFvh0JMfLU9g4:u4TbJYN6OOoH8KBPg9ZFviJr
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aeheur_gwf.dat
- SHA256 b90baa70bd07bc5b3573909b37a6cf4fcccc3d7c9702806c94bd843988d0ed5d
- MD5 27dbb4a716dc8d87eac34a14f814dbc8
- SHA1 2f3c673d444a0b996d609136d8741f6dfc47ba6a
- SHA512 dcfba0317f02771d40fa190e78c19fa2e178d0ffadd6b8d22da4be7f66a3e7983da2a0c14741ab9df0d9f034754c4ea758d758ec7a65c53f77f922d13648e9a5
- MD5 SHA1 SHA512
SAVAPI/aeheur_mv.dat
- SHA256 9ddc8bd72905ab30861d3ae37af5292b6162f63e6446c15a1ccee3f8aeb67910
- MD5 9c93a76d871b55028d607207a90b39ff
- SHA1 c3b33d3622dbc1d02d0ae0beaf2cef9db56962aa
- SHA512 7f9529bc2ae489a1a2bf92f54055543c933dd39359bc7a77ec19c9bf30272947e10d785c4f3baa3deee2654d5c23cd1154856b8e54031bc8c4ee985f4ee88a4a
- SSDEEP 24576:pDOi3wLUZGF509e2P/LjK7uXikERi7Rpo83imfmYc9yeLnx6LKd8AxBem0w1vo2m:0KFGuua+zN6WPmEH2LVlFFp
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aelibinf.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 812442ad5cdaeb6dd5dff76ddc3941fb9a1a56f999aa836f8fcbf4bb9e1b488f
- MD5 21432626c63068ee47107da801c05ffc
- SHA1 1b011f00a0a01bf217c41a0f5cb7d8c0f6b7046b
- SHA512 1c6e973be37fbcfd2b945fbbde57afd37525aafd475b4229db8296ce48cbcffb2a092fb1d226b6f655a491535f7f2bff5139522daff92bf002304545fbeb596c
- SSDEEP 3072:nA5Fh7lNUcO4WsdDKs63FgJln2qVsdP0xKMSET:PAWsddFV5Vsu8pET
- MD5 SHA1 SHA512 SSDEEP
Digest
3a:3a:9b:c1:fc:e2:27:88:78:44:09:ef:82:da:55:b6:e7:3f:d7:58:c4:a7:7f:a3:2c:44:11:34:3c:89:fe:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Oct 26, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
34:24:aa:7b:be:bf:5f:de:ab:e3:15:6a:a8:48:82:e4:2c:b5:e6:6e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Oct 26, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
0
Major OS version
6
Entry point
14441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aelibinf_db.dat
- SHA256 0544403357dbff7551fc17f348a446d556a094d6c42e1121eb337de3ff88ca5c
- MD5 ddc132992273330ec506e63fae4985b4
- SHA1 7bf3018217f136662c159994f6530edf4c976a10
- SHA512 fd1233c02cfd72116b92833810db084c1caa08530cdc0626a1e2fe035236b29348fdb4d89192aa473dec5ece5694017f3a3a46eda7f87c20a89cd07132f4d122
- SSDEEP 1536:NO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1w:dNzXDFjvM25o2iHMWMzPZ0i6
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aelidb.dat
- SHA256 ca5bb2f6c93eccc1ef5a2b2aae25b4976a2ce320a52d13d74f12b65205678e53
- MD5 e12b4507919ef2d5b5f2b5332f7c2bb1
- SHA1 4dd0c1870754a4052f9de5f09f69df3f7bae4b3d
- SHA512 74a2e05077726ab00a810325d6be729c001f290977c9e4e3d81d3f4fe4398317698510a0bf5d5014625e5c740f11dc10cf004cac343cd1e4d8ab82908a0376ad
- SSDEEP 1536:FO4WQ7zW+Du+XTe8+bv2OMtIW82iH5ytCHyfiaHBzPTZZXB8jirkm1l:1NzXDFjvM25o2iHMWMzPZ0ib
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aeml.dll
- IMPHASH 987fabbe7aaa43f6606c10cbab26a0d8
- SHA256 537b3ea2ce48dc0cc343c1c6ce79ae5ba527b2fcddea24cadef1fc1eca8c42cc
- MD5 0de0cb670e3046e388829fdab6910a9c
- SHA1 2b9daea0200fd1c442c9a3a967bf51d68f7ab80d
- SHA512 7e7ab02d20c3a1b8f76ce8c951570be1e719e0533ffc14970c958240a6adbe1c8ab88c826ef21083db0c74c6f83a1c9262ec6b2371b72d357bf6d5a298ba6f33
- SSDEEP 3072:qsjdmLYGV1RkWeY9aN4R8kGW+JVhyTWrZy6xLqOVqrsyyP0Y:qsxmfRk4UkdGW+CqRVqrLY
- MD5 SHA1 SHA512 SSDEEP
Digest
96:61:e3:07:74:4c:5e:0e:ce:9d:11:39:70:14:73:d2:43:40:92:2f:b4:f5:7a:76:c4:b2:6e:f3:0e:de:89:69
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jun 29, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
d4:3c:a2:de:5c:d6:c0:94:0e:6a:a8:b1:9e:ec:e7:5f:84:dc:a6:98
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jun 29, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
42858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CloseHandle
CreateFileW
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
226KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=143, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=58, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aemobile.dll
- IMPHASH f26319b70fd0009dfeb674e39bde957c
- SHA256 3137d3d95d1caa59d349645ab8087d6b0c7cc3321873789c738553d4471143c6
- MD5 b132b36c0b53839ee1c0fc8198170157
- SHA1 3e7394ee8d3c4c0f36e00466fe0191ede592c01b
- SHA512 1bba22a77ceaa59c00cf0d10a7afced2161985d8baae94c9cfe0cd5171464f49c53113b4ba8a027cb727aa242a23f79c1cf19a4df821ef6ac00f7a7c2ecd155e
- SSDEEP 6144:pHfeO55RAQ9JUDSzFPCMhgFaaIembdw2p52s5dEy/ZAuvGnAQyFuDlXDG:dh3RAQ9FFPRImxw2fZiy/ZAu4DU
- MD5 SHA1 SHA512 SSDEEP
Digest
1a:e9:b0:72:4e:08:7f:6b:f9:b2:6f:68:f4:c9:01:13:b2:38:44:ab:ec:92:fb:88:12:f0:35:88:19:b0:b5:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jul 4, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
6c:ab:5d:1d:03:59:4a:57:18:a1:f6:10:d4:0f:51:c4:59:7e:87:89
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jul 4, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2020 - Dec 29, 2030
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
226159
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
WriteConsoleW
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=22, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=159, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aeoffice.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 4a3c2f29b2ab5e78e5a1558d2ddbc564cbd4474ce4115001ba6662c143b6482a
- MD5 3dbd9c8da952507d0df2b46308fe83a2
- SHA1 0d38ee68466f818e880680b73f5f74ca300ae629
- SHA512 1e6b65fa80d95d1cb1da72b7905105f4b4fa6ee7c1fd63fdd7728a030ff42b9177e2eb0fbca1e64f44a11a253defd7bd179bc8c596fc565f3972ad89cf5c9616
- SSDEEP 12288:jk1fpTUcoWP1AOSRCEL6/CJ1KVm0yjw0REYVXkVzLKt98r0:i1UcoWPBEGyKVLow1YVUVCu0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
56:93:6e:3b:ea:de:0a:6e:1b:17:b1:5c:b1:e3:58:26:6b:fe:40:78:6e:e0:42:64:3f:e0:18:28:4c:1f:5d:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
622653
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
664KB
Virtual Size
664KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
337KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=2, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=80, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aeoffice_gwf.dat
- SHA256 96e2488023689abf71cf9b951548420ff3ad9d6ff37116d4279a43b5b736968b
- MD5 0c95def0894c5e5716cf7a3ecc7545a6
- SHA1 51ce428514d454e7a428d57e3e050c1edad93a20
- SHA512 2884dfc79a869b3e2db3f62340dccd3cee7746852006f67a26a26a4716ec719ba196627b18ddd775655b7baf954f668e9b5229297a4b87685f087e693184b369
- SSDEEP 768:y6NQXRQOmhg0jm0fbaakNk8AWdp/2cqMgMYD82ew4uT7jKq:y6NQQi0jfGakNbAGX5gP82h4Iqq
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aeoffice_mv.dat
- SHA256 adac5f741e5ee6f669b76bca87a26bdafa9be60d8ac7e7c5059af9ccce919608
- MD5 e346fe238be4b645e20e1bd77e9167bf
- SHA1 252c2614387aef2304f85cebabcb89b7e5f04c96
- SHA512 29965365aa6a5dae7bdcda0f437202d5a2874d60d3d59895871d05b4ca3bbea539fd04ae1895a0f6c77992ae2b7a39dd74837a1a6a72f15e92129517ff6375c9
- MD5 SHA1 SHA512
SAVAPI/aepack.dll
- IMPHASH 15e933b00ded9cae6f463a1796323b1f
- SHA256 fff47393adf070bc04d044c0a939c620234881e1ad69d3776146e32d25e1f36d
- MD5 26ab6a0a9b1c59a01f9b45bbc0bbc65d
- SHA1 ef282c4322c361aaac6d70d0e27d4b2292de4999
- SHA512 f17aca43e9f66ae21d295af5fbca5de0770ef77eb602f74ac6696aa9cf9af9884df21f9c9a98a6aa5d9ba5bbb3f9951c952d608dc3863e6a8a6a6c053639f26a
- SSDEEP 24576:1oHuMoULNqpg3NV0ug3YdXIsPt5AUzp/X:mvom5NkI+UNP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1a:58:64:45:e9:dd:68:f0:00:7b:e4:0d:32:d1:b5:fa:9c:78:ba:ef:b3:16:88:59:b3:7b:4f:88:9b:1a:f6:69
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:c5:de:85:c0:ac:48:ba:0e:5e:00:00:00:00:71:c5
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 17, 2023 - Mar 20, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
686048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
SetFilePointerEx
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
MultiByteToWideChar
WideCharToMultiByte
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
WriteFile
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
752KB
Virtual Size
751KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=27412,
count=149, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=23, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=216, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aerdl.dll
- IMPHASH 24bc7db91306bdc7881dc1f977fdebe3
- SHA256 d049ab67daae27ab3840730cadc5a82dfbd269b58896b9f8289324816e1680eb
- MD5 62f7467baebb56a8beea7fffa6c4ee7c
- SHA1 c13eb821d2675f110b1a38f8c0842b91edcab9b4
- SHA512 d31498bdee77fd498226d6c971dff65eeecec66811109f1a729858fee6aa92f6d1601256740417ba5abb72b4c7109eb3e69ecc7446093bebee62c559d4e7a61a
- SSDEEP 24576:8lGo7gc5YfW4W2ERk7IERLQw33gAcRRbfQ:xo5d4WPR7GLhofbfQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:13:92:df:78:40:eb:f2:43:3f:a2:f2:b8:a3:77:7c:ab:d0:18:07:59:0b:3c:c9:40:aa:96:ed:bd:44:d8:bc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2023 - Mar 18, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:71:3b:29:76:9c:ff:2b:b6:72:4e:00:00:00:00:71:3b
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2023 - Mar 18, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
848574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
CloseHandle
GetConsoleMode
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
CreateFileW
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
HeapSize
HeapReAlloc
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
887KB
Virtual Size
887KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
173KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=152, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=81, id=1, productName=Unmarked objects,
count=4, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=17, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=298, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aesbx.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 a03aa3e017606dce6f2cd19536db9306a6ebf2eaefb224be735569599a39330d
- MD5 63159174de5eff0c3ed33f887c00e1b4
- SHA1 aa787a058920e7010269d1286f32bda62206949a
- SHA512 398831b8cfebe1a7878658087594dcdd74f6be8d380bcacd415acd5bbed85e6bd939c1562b3cee4e8ecbe64b0704be1cdab2dcc9c7ae6a0dfa0e8b8d0317f884
- SSDEEP 24576:006liaoL0dhMPqd4MQSsnBuAZVeBV1XAw1CciqmjtLb5tNz/+SW728F6cLUpqfjr:00jL0nI54V1XdiJZtNS84jKsQi
- MD5 SHA1 SHA512 SSDEEP
Digest
0d:e8:0f:e4:e2:96:d7:84:c7:29:55:a0:b9:0b:22:c4:91:53:61:89:d9:08:82:82:a0:ff:7d:4b:3d:b1:9a:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
May 12, 2022
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
14:d2:18:78:6e:da:99:00:1b:81:3f:a7:46:da:53:42:3b:cf:22:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
May 12, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2021 - Jun 28, 2022
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1221506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
196KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=21, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=241, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aescn.dll
- IMPHASH 3683678e5963198141430a6a94214b32
- SHA256 b816a2810fc9c1a5294a59b0232a1725519a2a7472f509c336b9fd1b189d0f3d
- MD5 045180fa8eaf0c2409e101542014b5b8
- SHA1 70656f926020e02e7c67fd2d145ca90b5952a9d5
- SHA512 5659f42a6fe5cf259ad9528777ab5883f0185437b60710727c097cad2ceb60ac09eae4af59857c0021fc573343704ec6318cfc6d78ee2a1d7facc7321f4ae767
- SSDEEP 3072:LvsmKNM8p6TrjmZGYx/wpTKwEGGyQYwc74RZQygPYDlIKpEU8+GIBfKLov+4OuuL:Lviu2+XmEGwpVnQY7ERay7BKU8FYxudl
- MD5 SHA1 SHA512 SSDEEP
Digest
57:82:e1:6d:4d:a4:8b:7d:1f:c9:ce:bc:0c:e5:d5:79:aa:a3:4f:e4:34:2b:f1:6c:22:1c:37:9e:0e:ca:81:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
May 24, 2022
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
f5:3d:6f:65:1c:ce:03:88:12:2a:10:ad:ec:72:29:33:a0:06:53:23
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
May 24, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HBA 722586,CN=Avira Operations GmbH & Co. KG,OU=Engineering Services,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
04:0a:1d:f3:b9:06:fe:7f:2b:10:97:fa:d2:d9:da:2f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2021 - Jun 28, 2022
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
75362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=138, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=18, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/aescript.dll
- IMPHASH 50b01ef98383f0b7d4ee3108645e1bfa
- SHA256 8371b7ea7e0e0650a4aca997d270b68543d61ef873190d02db37d7c3349b5942
- MD5 11197cd2373a7b8364d9bb97406fa2b0
- SHA1 05b81929d797330803febd8231907b54462706f1
- SHA512 dff359f3330cceb1bbae2cb26748244509870f9f6f1307b4010e4a449cb50b87d4395fbc38e7b1a0fedfe16eb7b01b4cacac7631f606ec1467555ca5099138c9
- SSDEEP 24576:90UGScZK1H+snGqwKchYOLOY5XzIR/l5/v33lwjlOm5Ui2TQ:KU0ZRYOLTI1l53KlOm5UI
- MD5 SHA1 SHA512 SSDEEP
Digest
de:57:f7:53:86:16:57:63:c3:57:2a:42:2a:88:ff:04:c6:13:4b:65:dc:85:c3:8b:7d:9a:fd:b5:bf:81:ae:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 15, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0e:58:3c:7f:69:eb:a2:f9:19:4a:97:04:98:e3:df:49
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
0
Major OS version
6
Entry point
1055938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
67KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=1, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=15, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=18, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=86, id=260, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=1, id=258, version=30146,
SAVAPI/aeset.dat
- SHA256 1d06844d6c0aae9b0a5f6f7f61b4c7c6284fb085b7f878d596ee8407c67b7357
- MD5 b78db48c5ff9494327032a27d5aa33cc
- SHA1 43ffc51ef1da90ec791a95ab6d20e3cae7a66482
- SHA512 855622613a0310cceb1b885f11d22876b1b6092fbdfa7ec19618d8ae71b2ad70ca75bfc44ea0e4069b38d9785c400025a8f6a4bedca539546eb10cbce078a051
- MD5 SHA1 SHA512
SAVAPI/aevdf.dat
- SHA256 1fa5d91c9a58fa3f9d3761ace1a8f3bd97fe6e903eaa6540cee0c75f89c681d1
- MD5 7ad1fc9922e67652c346113289a557f3
- SHA1 9b7dcf5873d40fb45e2016051329cff4d628c336
- SHA512 c042d79fa0fffc8a173868f411242868b3a1b5d495dbaa0c70beca65f03b6a988d1dffa1e823ad3c126a5dde2592770e73029a184797fb7ab627e0564b34b5fa
- SSDEEP 48:b3sa0DNeR8vdNsv4lFgtKTY6rTsYj6xO/Jzl69sYue4:b3N05e+vdNC4lyKTFTsYj6xSJpYjue4
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/aevdf.dll
- IMPHASH 08d194711eac35605e4b049b8990031b
- SHA256 3acf87d057b627745f588315c528ca19699bc6e5999fb785160a432c7d42b182
- MD5 1f2846f66f454dcd075690914c58d97c
- SHA1 f6e6c89c11aaffaffaf98791c1faafd00e5d8aec
- SHA512 20f555510d45aa62b0256f8898a360ef47f58a37faecfd014e34a0fdfe9f59178ad23532fd37c04edcad63b725571fdbd765ea5f30202b0525f6979d509e28ea
- SSDEEP 3072:VGkspwGVB18ldNUYDFjsRRGMKEBeP/EvKaBlbCPL00eAplUlCtvt1JdkbTFtkIpu:VGkseGVB18lXRDyGMKUenkNCYiPU0tvZ
- MD5 SHA1 SHA512 SSDEEP
Digest
a8:df:e2:88:b0:84:09:f2:b8:09:b5:18:e0:68:60:7a:73:58:2f:7b:9d:ce:b2:40:99:d9:25:ad:c2:99:36:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Jul 15, 2022
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
74:92:d8:a0:37:3a:2f:cf:c8:6d:3e:7f:ff:50:18:c2:ca:25:48:0a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Chains
Jul 15, 2022
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Serial Number
9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - May 24, 2036
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,ST=Baden-Württemberg,C=DE
Serial Number
3a:25:10:17:3a:04:67:cf:d3:2b:01:df:5a:17:cf:67
Issuer
CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 17, 2022 - Feb 16, 2023
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
0c:16:7c:dc:e7:dd:38:41:72:a0:e8:1f:18:7a:6d:9f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 3, 2022 - Apr 28, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
0
Major OS version
6
Entry point
64157
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
DecodePointer
CloseHandle
WriteConsoleW
module_get_abi_version
module_get_api
module_get_info
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=27412,
count=136, id=261, version=27412,
count=18, id=260, version=27412,
count=3, id=257, version=27412,
count=80, id=1, productName=Unmarked objects,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=16, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=19, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, version=29917,
count=1, id=256, version=29917,
count=1, id=255, version=29917,
count=1, id=258, version=29917,
SAVAPI/ams_setup.exe
- IMPHASH 159adfe0cb0b35b14c9ff83cb2d1a025
- SHA256 168c506b14418d3c64435d1e165e2b686b8c2273023d9f45848cee5a1355d27b
- MD5 30ad65d8805ff9356ac7e75e67585f01
- SHA1 7711885c3bcebe0bae7c5d33979eb52cbecb8f26
- SHA512 d45eee2a5ab487d4d614da497b4ebcbe34f93828a294dcee9db5f0e4eadebcfe3408f30956b15a5352c465c956adf68d89c97a2a6609b15c7c5c43408949aa15
- SSDEEP 3072:IjGFIi8a+vmi3zw4+j16h3U7yYYFOqnHifsW/bFYWoBKyMeTGXZ9PjlLgqER:W4IFb3z7O1iU73YFfe/jNXZ7pER
- MD5 SHA1 SHA512 SSDEEP
Digest
58:91:d3:92:dc:0e:d5:c5:d6:5c:90:7b:27:15:57:8d:4f:45:63:ec:2c:fd:90:a1:6a:78:06:79:fe:9a:f9:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
1
Major OS version
6
Entry point
30108
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\aviraoa\ams_setup\ams_setup.pdb
shlwapi
PathFileExistsW
PathRemoveFileSpecW
user32
GetSystemMetrics
ExitWindowsEx
MessageBoxW
kernel32
WriteFile
CopyFileW
SetEnvironmentVariableW
GetCurrentProcess
GetBinaryTypeW
HeapAlloc
HeapFree
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
MoveFileExW
SetFilePointerEx
GetFileSizeEx
GetSystemTime
LoadLibraryW
FreeLibrary
GetSystemDirectoryW
CreateProcessW
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
CloseHandle
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetProcAddress
GetModuleHandleW
GetNativeSystemInfo
LocalFree
GetModuleFileNameW
GetLocalTime
GetLastError
GetCommandLineW
ReadFile
ReadConsoleW
HeapSize
HeapReAlloc
DecodePointer
SetEndOfFile
WriteConsoleW
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
ExitProcess
GetModuleHandleExW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
shell32
CommandLineToArgvW
advapi32
SetServiceObjectSecurity
BuildExplicitAccessWithNameW
SetEntriesInAclW
QueryServiceObjectSecurity
DeleteService
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegDeleteKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CloseServiceHandle
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
Name
.text
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=147, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=19, id=259, version=31616,
count=11, id=257, version=27412,
count=131, id=1, productName=Unmarked objects,
count=10, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/apc_random_id_generator.exe
- IMPHASH da8ed38bc494edc43fed015b4c7918b8
- SHA256 1239ea35953b0fe8677bee09dedb7c3eea987e977c73e73ef8862c4a3774b659
- MD5 be6f0a323777bc43bce01fdc5ad58120
- SHA1 a6c1742269fb7879dcb54dfd25af57dba66ab732
- SHA512 921b11869d1ec2b5a19ef41b75504ac099429339a143cfa677fc54eb520a2b79b173e2e326afcaeceeab4f6b942098dd9a660b7c9dc3addc8b9ea53a3cac4548
- SSDEEP 6144:y8o+8urNJEXczi5CLqOhcg7vnDUbRypWCaoo/Jiq/mEwhDsQ8cNWE9Zu:y8o+8MNJEiTPvnDUbRypWCap/+p9Zu
- MD5 SHA1 SHA512 SSDEEP
Digest
08:ea:1c:34:71:84:d9:cd:dd:2c:fa:b7:5b:84:bb:35:87:16:d4:e9:f5:d9:71:17:e9:ba:3e:83:17:cf:d9:12
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
111069
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\apc\random_id_gen\apc_random_id_generator.pdb
rpcrt4
UuidCreate
ws2_32
freeaddrinfo
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
WSAGetLastError
socket
shutdown
ntohl
select
recv
listen
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
getnameinfo
send
kernel32
ReadConsoleW
GetConsoleMode
LCMapStringW
CompareStringW
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FormatMessageA
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
PeekNamedPipe
GetOverlappedResult
CancelIo
WaitForSingleObject
CreateEventA
CloseHandle
InitializeCriticalSection
GetConsoleOutputCP
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
CreateFileA
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetStdHandle
GetHandleInformation
SetHandleInformation
WriteConsoleW
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
CreateHardLinkW
SetEndOfFile
LockFile
LockFileEx
UnlockFile
UnlockFileEx
DuplicateHandle
GetCurrentProcess
CreatePipe
CreateNamedPipeA
SetFilePointerEx
HeapReAlloc
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
HeapSize
EnterCriticalSection
WaitForMultipleObjects
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
advapi32
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=162, id=261, version=27412,
count=19, id=260, version=27412,
count=3, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=23, id=259, version=31616,
count=175, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=39, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/apcfile.dll
- IMPHASH d0a7a04ab2c72e5a3c1169b60f06b849
- SHA256 7f6c31ea445c7b871a0ea2b73705776435b00f3e37223b53b5da9b4ad4d19c0c
- MD5 ecf74de0b990c96fcf961e89cf73768c
- SHA1 5ba320e5e1e4364cec95b130bebff52f3591c039
- SHA512 8ab9b876db9edaee8862fe3cd0cde688158a487cf00f12ac85983c8fbe93a6f116f5d4ce96bf717ce64f4a231aee618b8b023c735ac1783249beaae95a3030bf
- SSDEEP 49152:xCvhKevv/MEl1oInVGDM1UDtL0lzHYqV2WPY1KG5twA+arh2:xCvJ6IVGTyxHYqs/1KR
- MD5 SHA1 SHA512 SSDEEP
Digest
8c:be:8d:b8:6e:9b:1d:c2:fd:b9:a5:ee:68:c4:c6:4d:3a:8c:77:d2:5a:bf:b6:aa:01:58:e8:f9:f7:c5:8f:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
2089296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\bamboo-build\SAV-APCSDKPACKAGE-WINX86SDK\package_release\bin\apcfile.pdb
ws2_32
inet_addr
WSAGetLastError
gethostname
recv
socket
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
getservbyname
shutdown
ntohl
getnameinfo
ioctlsocket
getpeername
freeaddrinfo
getaddrinfo
closesocket
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
inet_ntop
WSASetLastError
ntohs
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
mswsock
TransmitFile
rpcrt4
UuidCreate
crypt32
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
kernel32
EncodePointer
DecodePointer
GetCPInfo
RaiseException
RtlUnwind
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
GetLastError
GetCurrentProcess
GetVersionExW
GetLocaleInfoA
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
LoadLibraryA
Sleep
MoveFileExA
CloseHandle
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
GetStdHandle
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
InitializeCriticalSection
TryEnterCriticalSection
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
DuplicateHandle
SwitchToThread
GetCurrentThread
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
FindFirstFileA
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetStdHandle
CreateFileW
HeapSize
SetFilePointer
DeviceIoControl
GetOverlappedResult
CancelIo
MoveFileExW
CreateHardLinkW
CreateDirectoryW
RemoveDirectoryW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GlobalFree
FormatMessageA
SetEndOfFile
SetEnvironmentVariableW
FlushFileBuffers
ReadFile
PeekNamedPipe
SetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
SetHandleInformation
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateFileA
GetModuleFileNameA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
InterlockedFlushSList
LoadLibraryExW
SetFilePointerEx
GetConsoleOutputCP
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetConsoleCtrlHandler
ExitProcess
GetModuleFileNameW
WriteConsoleW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
HeapReAlloc
OutputDebugStringW
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InitializeSRWLock
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
bcrypt
BCryptGenRandom
apc_add_cache
apc_authenticate
apc_category_name
apc_create_context
apc_ctx_get_file_lookup_filter
apc_ctx_get_user_data
apc_ctx_set_connection_timeout
apc_ctx_set_data_timeout
apc_ctx_set_file_lookup_filter
apc_ctx_set_upload_connection_timeout
apc_ctx_set_upload_data_timeout
apc_ctx_set_user_data
apc_disable_logging
apc_enable_logging
apc_file_cache_disable
apc_file_cache_enable
apc_file_cancel_uploads
apc_file_check_file
apc_file_check_files
apc_file_check_files_ex
apc_file_check_hash
apc_file_check_hash_ex
apc_file_check_hashes
apc_file_check_hashes_ex
apc_file_ctx_call_filters
apc_file_ctx_get_elf_mode
apc_file_ctx_get_ext
apc_file_ctx_get_ext_policy
apc_file_ctx_get_filters
apc_file_ctx_get_mac_mode
apc_file_ctx_get_pe_mode
apc_file_ctx_hash
apc_file_ctx_set_elf_mode
apc_file_ctx_set_ext
apc_file_ctx_set_ext_policy
apc_file_ctx_set_filters
apc_file_ctx_set_fops
apc_file_ctx_set_mac_mode
apc_file_ctx_set_pe_mode
apc_file_ctx_set_temporary_dir
apc_file_hash
apc_file_hash_ex
apc_file_info_get_extra_info
apc_file_info_get_malware_name
apc_file_initialize
apc_file_initialize_context
apc_file_metadata_set_download_url
apc_file_set_batch_service
apc_file_set_temporary_dir
apc_file_set_upload_threadpool_limits
apc_file_uninitialize
apc_file_uninitialize_context
apc_file_unwilling_to_upload
apc_file_wait_for_uploads
apc_file_willing_to_upload
apc_free_context
apc_get_file_lookup_filter
apc_get_library_version
apc_load_cache
apc_save_cache
apc_set_cache_dump_secure
apc_set_connection_retries
apc_set_connection_timeout
apc_set_data_timeout
apc_set_file_lookup_filter
apc_set_low_upload_speed_limit
apc_set_low_upload_speed_time
apc_set_max_cache_size
apc_set_max_upload_speed
apc_set_metadata_product_id
apc_set_metadata_product_language
apc_set_metadata_product_license
apc_set_metadata_product_random_id
apc_set_metadata_product_type
apc_set_metadata_product_version
apc_set_out_of_memory_handler
apc_set_proxy
apc_set_proxy_auth
apc_set_proxy_ssl_ca_cert
apc_set_server_message_cb
apc_set_service_address
apc_set_ssl_ca_cert
apc_set_ssl_crl
apc_set_upload_connection_retries
apc_set_upload_connection_timeout
apc_set_upload_data_timeout
apc_ssl_threads_initialize
apc_ssl_threads_uninitialize
apc_strerror
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
545KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
43KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=27412,
count=212, id=261, version=27412,
count=24, id=260, version=27412,
count=11, id=253, version=31616,
count=86, id=261, version=31616,
count=17, id=260, version=31616,
count=28, id=259, version=31616,
count=307, id=1, productName=Unmarked objects,
count=19, id=257, version=27412,
count=21, productName=Unmarked objects (old),
count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=28, id=261, version=31629,
count=765, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/apchash.dll
- IMPHASH c45291f055d661a4d27149e1fd47d098
- SHA256 fb74e48074ba4d26049250bc68281751f9fb9a6c41c401e19f6870ebcfdf6a7a
- MD5 a0c5e8f7cd6c02a8719ade39c1955135
- SHA1 52153097ff4d14c89374ed9d144178ec104795ae
- SHA512 30901a8332e09311bee3c244226d533840f277f47170fa85a7f2e06e3c1bae18a95db82b45ab1f31062be6f7c5dc6918bfe088f3088cfdce8ecb52df863da3b9
- SSDEEP 3072:0IIIIb90Vo9gn6YfoT7lq3xsuHBfvPBwcbaGSI/2EQmhKeKhUbZXU0JxP05:0IIIIb9bYcI3xxZaGtuEQgtXU0k5
- MD5 SHA1 SHA512 SSDEEP
Digest
73:73:cf:2e:34:53:18:6e:6d:ef:61:5f:f7:97:0c:64:5b:86:b5:c9:50:ab:29:fd:d0:ba:24:1c:c1:64:82:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
30443
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\utils\apc\libapc_hash\apchash.pdb
kernel32
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
WriteFile
SetEndOfFile
HeapReAlloc
HeapSize
GetFileType
GetEnvironmentVariableW
WriteConsoleW
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
CloseHandle
ReadFile
GetConsoleMode
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
CreateFileW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
GetStringTypeW
DecodePointer
APC_hash_file_compute
APC_hash_free
Name
.text
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=148, id=261, version=27412,
count=18, id=260, version=27412,
count=30, id=261, version=31616,
count=16, id=260, version=31616,
count=19, id=259, version=31616,
count=7, id=257, version=27412,
count=88, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=4, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/avupdate-apchash-product.conf
- SHA256 e2cbcd600dce59af50b624e2079f4b92186dd0536f5ffbc2b859c5c440657e05
- MD5 4257d3de2badf1811f90e8312bc74aee
- SHA1 85a5ddcd2282e8049bc5432932baf418bc02ebca
- SHA512 962cc45ff9aa7fe1bb8902bc195318408a7dc2728c7e89c5ceba3eaa7385d19eba52090a2f4e69bd25bb2a0a9f4500988f190e71fff84b9c9df6c8bb2052c4aa
- MD5 SHA1 SHA512
SAVAPI/avupdate-on-access-savapilib-product.conf
- SHA256 e5e0ae1892dcae23e6b2b914234cc2111efd1ad746887c61266618ce5ec5852c
- MD5 c0d7ca0f42b0eb707f0ff09a1144d837
- SHA1 1c5d84bcf2bfd97a51b156b04fde285a8fddd35f
- SHA512 a4582b9ad7ae3bd795c271201850aa2ef5163b605f227fa4da06d6fd9d23144d811d16904257188832a2eeddb63692a12ed649ae4244eb3138b0a972e7686b19
- MD5 SHA1 SHA512
SAVAPI/avupdate-savapi-engine.conf
- SHA256 cfd50eeea0c80b8dde883951aa6149410ccbb6a08fb001cee109c276648feb1f
- MD5 01a844c7204488b536c48a72090f8a39
- SHA1 417b1670c72d9c0c70953e88fcf2ba8bc82c245e
- SHA512 2aa341bbd42ad658bc4db5d5521dd1c5a882796b3bc745be89607ccbadc084bd790f92197e0881f4d45a13cee74fdd8c73b47e7cb86c2bf81598251c40591acf
- MD5 SHA1 SHA512
SAVAPI/avupdate-savapi-product.conf
- SHA256 30ef0c181ee31e52efe06d44f5d33e5a868160e6f93f573f38aac4b05f681af0
- MD5 c94d4130ad378ddbc7e341937cf10692
- SHA1 81a7fc4c1ebaf2c19a590c43d60d4b9f3650edbc
- SHA512 59ac58e5ee40213cdbe8de93baa96db946fbd1e1c7b946ba31a61e4550e4bab29286811310fb966bb9725ffdd5f4b750b09a188193bd3bd5111eef5c882e2e49
- MD5 SHA1 SHA512
SAVAPI/avupdate-savapilib-engine.conf
- SHA256 ea5ade6e1bc0df9e2773dcaf5cf9bb087965dba3c74a12eeb9727747cffbb614
- MD5 c0b5b102ad8dcb4190e4acd1e4c78d99
- SHA1 6364654bbe47f784d84eb8387fe14d0a7c267a78
- SHA512 76264a03d43d507574582aa6954d50ab3e0954153489abb4c311989226e9e951bb4de188cff8d92c4d48c96470d58d4d7bfc094a6a74c050ee8ef25a61395250
- MD5 SHA1 SHA512
SAVAPI/avupdate-savapilib-product.conf
- SHA256 f6c89a441e41a381ccb1785d97d9aeac95d6d01f13227431baa6a4c06b4f78e8
- MD5 d8e715e99b1709e69303f9d9dfd0ba88
- SHA1 68964f716482230d2b3d28677257f8742235e6ea
- SHA512 3fce72763e81318f31bfb684fea8f189dc85fe3798d14978a3d589a649107e9a7ad61c0ea1f4f0ff2c50b8663fad3ec6870d9c595d7e66f8c0c11e3de42e5264
- MD5 SHA1 SHA512
SAVAPI/avupdate-xvdfmerge-product.conf
- SHA256 1ccfc728f83e1709ae01936e369610e6f9bf7d83e9b406af995cab5fa1863d4e
- MD5 c7e74ddde5788f5e9510034b66ff0fbd
- SHA1 8b821abbe25c98877836a4a76446bb98871a9aa0
- SHA512 7657ee00f0e8b5365b02d12393aa64e5862dc87e5ef5390824d536d72845b2e9e46a25ca0676f49e6d4cfcd7ee164e80832696a369e82d464d938139e8d745a4
- MD5 SHA1 SHA512
SAVAPI/avupdate.exe
- IMPHASH 35e07a3a55743a4b4805df293e470e40
- SHA256 afb45b8ae7d78085d95122ae01f6bac1515a89e7e2c87c55596670e2b5e922e1
- MD5 e0947f2084e589a4d7f1c0f541b54321
- SHA1 3ca9be3bc2678b85e36b9823a617376a268ab889
- SHA512 316a214436031a498de8b2b6ca33cb9f73cacc3ee19f22f86d90583f817e35f0b93bd44e3af8e47baf1c7e44fc66b9c2031995cc4ce69a1bdbe980de93e5938f
- SSDEEP 49152:JevEk9Vcz8AGAIaaQ2ldCPGwdYbO9ZMzYuWP011w99oUQ8Pbto:JevUsAz8ld+ubO9Ssur1a8
- MD5 SHA1 SHA512 SSDEEP
Digest
4d:f2:32:ce:e3:94:1e:21:31:7b:1d:01:4e:b9:fd:c9:b8:07:d9:1f:1b:fd:6a:c9:30:2c:1d:5f:15:76:5a:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
02:77:47:43:6f:b5:61:06:48:55:d0:9a:31:7c:3e:cf
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
2059170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\kmr4g80c\updater\avupdate.pdb
scew
scew_element_by_name
scew_strcmp
scew_element_attributes
scew_element_children
XML_Parse
scew_list_next
scew_list_data
scew_element_attribute_by_name
scew_parser_ignore_whitespaces
scew_parser_free
scew_parser_create
scew_tree_set_root
scew_tree_create
scew_attribute_value
scew_attribute_name
scew_element_add_attribute_pair
scew_element_add_element
scew_element_add
scew_element_count
scew_element_set_contents
scew_element_free
scew_element_create
scew_tree_root
scew_element_contents
scew_element_name
scew_tree_free
ws2_32
WSASend
inet_addr
getsockopt
WSAGetOverlappedResult
sendto
recvfrom
shutdown
getservbyname
ntohl
getnameinfo
gethostbyname
gethostname
ioctlsocket
getpeername
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSARecv
send
WSACloseEvent
inet_ntop
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
mswsock
TransmitFile
rpcrt4
UuidCreate
shell32
CommandLineToArgvW
SHGetFolderPathW
mpr
WNetAddConnection2W
WNetCancelConnection2W
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
advapi32
CryptCreateHash
OpenProcessToken
GetTokenInformation
LookupAccountSidW
SetThreadToken
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
GetUserNameW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegCreateKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
iphlpapi
GetAdaptersInfo
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
kernel32
ReleaseMutex
SetEvent
TryEnterCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
FormatMessageA
WaitForMultipleObjects
InitializeCriticalSection
GetHandleInformation
SetEndOfFile
SetEnvironmentVariableW
SetFileTime
SetFileAttributesW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FindFirstFileA
CreateEventA
PeekNamedPipe
FlushFileBuffers
CancelIo
DuplicateHandle
SetFilePointer
GetFileInformationByHandle
DeleteFileW
SetStdHandle
LoadLibraryExW
SetErrorMode
RemoveDirectoryW
CreateDirectoryW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
GetDriveTypeW
GetDriveTypeA
GetCurrentDirectoryW
SetCurrentDirectoryW
ConvertThreadToFiber
ConvertFiberToThread
SwitchToThread
GetCurrentThread
CreateFileA
CreateMutexA
GetModuleFileNameA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
GetConsoleOutputCP
WriteConsoleW
GetCommandLineA
GetConsoleCP
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
WriteFile
GetFileType
FindNextFileW
FindFirstFileW
FindClose
CreateFiber
ReleaseSemaphore
GetVersionExW
CreateSemaphoreA
DecodePointer
IsValidCodePage
GetCPInfo
FindFirstFileExW
GetStringTypeW
GetProcessHeap
ReadConsoleInputW
DeviceIoControl
TerminateProcess
GetLastError
GetLocaleInfoW
MoveFileExW
LocalFree
FormatMessageW
CreateFileW
ReadFile
CloseHandle
SetHandleInformation
CreateNamedPipeW
GetOverlappedResult
ResetEvent
WaitForSingleObject
CreateEventW
HeapSize
GetExitCodeProcess
CreateProcessW
FreeLibrary
GetProcAddress
LoadLibraryW
GlobalFree
GetCurrentProcessId
OpenProcess
GlobalAlloc
GetComputerNameW
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleW
GetCurrentProcess
GetSystemDirectoryW
GetWindowsDirectoryW
IsWow64Process
LoadLibraryA
MultiByteToWideChar
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
Sleep
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetTimeZoneInformation
CreateHardLinkW
GetACP
GetOEMCP
GetStdHandle
GetConsoleScreenBufferInfo
GetLocalTime
GetDateFormatW
GetTimeFormatW
OutputDebugStringW
GetSystemTime
SystemTimeToFileTime
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
bcrypt
BCryptGenRandom
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
506KB
Virtual Size
506KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=27412,
count=215, id=261, version=27412,
count=21, id=260, version=27412,
count=13, id=253, version=31616,
count=37, id=261, version=31616,
count=19, id=260, version=31616,
count=26, id=259, version=31616,
count=26, id=257, version=27412,
count=21, productName=Unmarked objects (old),
count=14, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=3, id=257, version=31629,
count=333, id=1, productName=Unmarked objects,
count=817, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/avupdate_msg.avr
- SHA256 056ec25ad90c88a86b85a9c72246b0d4003be39ef954a6bcb1baa92e63ed6101
- MD5 7ff9f5f6a65afe7c10b5de77f4986042
- SHA1 d19c140cade5ddf6d1f588f453fccad44525030b
- SHA512 3271017bbf7afa11cb6804c5578d8fbc4410f01fb544074302cc491f357dbf1e52f8ab9d58648443f5e5f3fb64adb8dda96fe08d94ca2525465844864cf2ca98
- SSDEEP 96:7+rz/vx3SFRuC9nNKZRllhXBpQisZ3i5hSAFCLYIFrGZk2Z+5ZDSLW2vnv13SrnZ:qiFRuCJNKzRxw3i5hSAIbyrZ+7wniZ
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/cacert.crt
- SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
- MD5 9956b172b62aeb41ca988999947a488e
- SHA1 199e3607abeafd168b02b062697656a847fe4de7
- SHA512 5d365e0b88a15b43bf84650f0e98bb05fd6e0257cbd73b2227bc27b94cad3086df2a65fa227ddfdf484447d91297c48800a1ed111a6bc880da53195b8657f189
- SSDEEP 96:LrBwgYufFy6nfwJeMmFtBuyuCk+Plvz49wC5UnhVhdnZrYGjWwbhliiuD:HBwgY2FLfFpbunCXlv09wfnXhNZrXxfq
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/README
- SHA256 43b602dc083b9e5836f32def1521b42f5971f7b12e47e8d272049283316f0aed
- MD5 dd70354b0df8379ef2edecbe4304f900
- SHA1 04670a5a3d483ae50bb5488cf8cecdfa7b7083aa
- SHA512 1ee14e8834c0817305e01a03984a73484a23b26f9328224513412b764017501cdce0473f58d2d64ed647adf78f51bdc7b50f5efe3f0183d736154cab83ae70ad
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
SAVAPI/on_access/win32/win7/avgntflt.cat
- SHA256 736c72051ea40058e98362f29a7a9a5ad73032bbbf8bda53ea897f64c5bc7de8
- MD5 622330091b3d75e6e562c37582ac8b2b
- SHA1 6915486dbaf7cbd2846e63a6d1e12bff67c56922
- SHA512 5f93f6a59d798bd25aab1fe9a75f6cb13210f07bb49b340861993deaea4206fec9fadbfad6cba0c000fa6709a2e6ec6de48cbb014232f7352d272586a414ce28
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avgntflt.inf
- SHA256 88f7e8d81340ab33fc71702c2817427e7b26ee31a76d59f167a00f2af2c783f0
- MD5 139c7c318ef6d64fc6c7ecdf1f7422da
- SHA1 7fc18f8244ee8c795f0da452fbb1f9bb628f9e2c
- SHA512 504b7e7917f15e93bcdcdbd7189c8b29bc27487d2c61bf3d78f9edc4f361dc0136621b55f0e1b0bf7a69c8cee668f520b72d6f45197ab58f62b5b36371c7fd27
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avgntflt.sys
- IMPHASH 1ef61e02301b03f0dea57f84bcd2479d
- SHA256 33d6cc050cefb737b70431c7e493a0d7b7f5ae7546d36fd24a5d4b1ebf29d307
- MD5 6b60c0a7fdbabe955a183ae3b524d543
- SHA1 be68e043fb0f6e0ca745b8361924ad0869bf2bb9
- SHA512 040ecbb33bbba5bba6206cee7717cff01fc8d3436762a4f2af6647cd9f02b31d48538ebc0d91b627fd0f9324375544905c2e09e4040c55b3642480e683f73df9
- SSDEEP 3072:3dxo0Wbd5kOx92/nQdp2kRaZE/I+j8CR/ehwdwTe6vuypGe08Uxb24lOPy:3dxo0Wbd5pJ/I88CR/p6vAnA4e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
84:7c:33:ec:4c:fa:98:5a:f3:91:d2:68:da:ae:9b:55:a5:32:cb:f9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
1
Major OS version
6
Entry point
156286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_x86\i386\avgntflt.pdb
ntoskrnl.exe
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
SeCreateClientSecurity
IoGetStackLimits
ExAcquireResourceSharedLite
RtlFreeUnicodeString
RtlUpcaseUnicodeString
ZwQueryValueKey
ZwOpenKey
toupper
ZwReadFile
ZwQueryInformationToken
ZwOpenProcessTokenEx
ZwOpenProcess
_alldiv
IoCreateSynchronizationEvent
KeInsertQueueApc
KeInitializeApc
InterlockedPopEntrySList
ZwDeleteValueKey
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
PsGetCurrentThreadId
RtlUpcaseUnicodeChar
ZwQueryDirectoryFile
RtlAppendUnicodeToString
ZwOpenFile
wcsncat
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwSetInformationFile
ZwQueryInformationFile
InterlockedPushEntrySList
ExReleaseResourceAndLeaveCriticalRegion
ExEnterCriticalRegionAndAcquireResourceExclusive
IoGetTopLevelIrp
NtClose
ObReferenceObjectByHandle
IoFileObjectType
RtlEqualSid
RtlGetOwnerSecurityDescriptor
ZwQuerySecurityObject
RtlNtStatusToDosError
KeWaitForSingleObject
_allmul
SeQueryInformationToken
PsSetCreateProcessNotifyRoutine
ExInitializePagedLookasideList
ProbeForRead
MmMapLockedPagesSpecifyCache
towupper
KeResetEvent
RtlIntegerToUnicodeString
RtlCreateUnicodeString
ZwSetValueKey
PsCreateSystemThread
PsRevertToSelf
SeImpersonateClientEx
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
PsTerminateSystemThread
KeWaitForMultipleObjects
ZwWriteFile
IoDeleteDevice
IoUnregisterShutdownNotification
IoDeleteSymbolicLink
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
SeTokenType
_aulldiv
_aullrem
_wcsupr
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
IoFreeMdl
MmFreePagesFromMdl
MmUnmapLockedPages
RtlSetAllBits
ExWaitForRundownProtectionRelease
MmAllocatePagesForMdl
ExReleaseRundownProtection
RtlFindClearBitsAndSet
ExAcquireRundownProtection
RtlClearBit
ExReInitializeRundownProtection
KeTickCount
KeBugCheckEx
RtlUnwind
KeQueryPriorityThread
IoThreadToProcess
PsGetProcessId
IoIsSystemThread
RtlEqualUnicodeString
RtlCopyUnicodeString
ExDeletePagedLookasideList
KeGetCurrentThread
PsReferencePrimaryToken
PsLookupProcessByProcessId
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
ProbeForWrite
ExGetPreviousMode
MmIsAddressValid
NtOpenProcess
NtQueryInformationProcess
ZwQueryInformationProcess
memmove
KeDelayExecutionThread
_wcsnicmp
wcscpy_s
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAddAccessAllowedAce
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwCreateKey
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeQueryTimeIncrement
KeQuerySystemTime
ExInitializeRundownProtection
RtlInitializeBitMap
KeSetEvent
ObfDereferenceObject
IoCreateSymbolicLink
IoRegisterShutdownNotification
ZwCreateFile
ExInitializeResourceLite
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlValidSid
RtlLengthSid
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
IofCallDriver
IofCompleteRequest
IoWMIRegistrationControl
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
ExFreePoolWithTag
memset
KeNumberProcessors
RtlGetVersion
IoGetCurrentProcess
RtlHashUnicodeString
KeInitializeEvent
hal
KeAcquireInStackQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
KeReleaseInStackQueuedSpinLock
fltmgr.sys
FltGetDestinationFileNameInformation
FltDeleteInstanceContext
FltGetVolumeProperties
FltOpenVolume
FltDeviceIoControlFile
FltSetInstanceContext
FltObjectReference
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltGetFileNameInformation
FltParseFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltCloseClientPort
FltSendMessage
FltQuerySecurityObject
FltReferenceContext
FltFsControlFile
FltQueryInformationFile
FltGetInstanceContext
FltCreateFile
FltClose
FltGetStreamHandleContext
FltSetStreamHandleContext
FltReleaseContext
FltAllocateContext
FltReleaseFileNameInformation
FltRegisterFilter
FltStartFiltering
FltCloseCommunicationPort
FltUnregisterFilter
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltFreeSecurityDescriptor
FltGetRoutineAddress
FltDeleteContext
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=237, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=50, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win32/win7/avipbb.cat
- SHA256 d50ffe995b3ad0b44dcc30976cb047ef690646872fa9dbc3c48950cd8593e918
- MD5 116668cc50e8f234ba729a8d8895b1e3
- SHA1 cb987ae4def6e022dc5e62cbf8a76e374bf9404c
- SHA512 3c5d04ddfb87c0fc611f6eb7b281d7a67584f9b2a4713f3f14aa1f709cceace3898fc00e4a90bc9caf59cd11e006f917536e602f21b2ac610a0245af4f3bbf5b
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avipbb.inf
- SHA256 4ae6e2a7c2e11bf797ba3b4877fb4ddf2ca75c6f774d4dfd4b002a307b7f938a
- MD5 1b439a706d228a6dc534a3a8731c1afd
- SHA1 49e34aee2faa0cbaa9bfd004eefe3150e64451b0
- SHA512 d2cf3f4c289434654d7103f0517dc99bcf98f8db01e34af25c07015fe90ca88866bc0de8d6a1983406bb2f2ad85c179a47bc9095ce650a1ee0cedf23d2a8c3f0
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avipbb.sys
- IMPHASH 666004f477406d2edd34100136c011b0
- SHA256 2bf4e12f41f8d78737592b7f29b55206b2df15411cc2943e678f52096289d06f
- MD5 a17862525867081a577923e210604a64
- SHA1 9b6f498bbda86fc464d6e5094bc8529ecd3e7579
- SHA512 e33c701cad149844913e5853187e4bbf43f6bc230fccaec21c847b373da7299849f2f3d93e6a07dc2c3c774f5119a31f0f44ed77821cc1e8dda93661e620b2ca
- SSDEEP 3072:E6zDMkFB5rqrDX7r5E2wnyKVxqxJNxBIRxUcx5VEv3QuhznmZmopCn7:3zDMU5cHq2wn/EJNIRxXx5KB1Omo07
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
2d:b8:6c:ca:3b:b0:69:26:57:00:68:12:76:9a:52:6f:76:04:8f:3b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Chains
Aug 22, 2024
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Serial Number
05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2019 - Nov 16, 2021
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Subject
CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2020 - Jan 22, 2032
Minor OS version
1
Major OS version
6
Entry point
163902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_x86\i386\avipbb.pdb
ntoskrnl.exe
IofCompleteRequest
IofCallDriver
KeServiceDescriptorTable
ZwClose
ObfDereferenceObject
KeSetEvent
KeReleaseMutex
KeWaitForSingleObject
RtlCopyUnicodeString
ZwReadFile
ZwCreateFile
RtlCompareUnicodeString
FsRtlIsNameInExpression
_strnicmp
memmove
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ProbeForRead
ObReferenceObjectByPointer
PsProcessType
PsGetCurrentProcessId
PsLookupProcessByProcessId
KeResetEvent
KeReadStateEvent
RtlAppendUnicodeStringToString
PsLookupThreadByThreadId
RtlAnsiStringToUnicodeString
RtlInitAnsiString
_stricmp
PsTerminateSystemThread
PsThreadType
PsCreateSystemThread
RtlInsertElementGenericTableAvl
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
IoDeleteDevice
IoDeleteSymbolicLink
RtlIntegerToUnicodeString
IoWMIRegistrationControl
ExInitializePagedLookasideList
IoCreateSymbolicLink
IoCreateDevice
ExInitializeResourceLite
KeInitializeMutex
KeGetCurrentThread
_vsnwprintf
KeWaitForMultipleObjects
ExGetPreviousMode
KeQuerySystemTime
PsGetCurrentThreadId
IoReleaseCancelSpinLock
IoBuildSynchronousFsdRequest
ObReferenceObjectByHandle
ZwWriteFile
_allmul
_aullrem
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
_aulldiv
ObfReferenceObject
ObOpenObjectByPointer
PsGetProcessId
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
wcsncpy
wcsrchr
strncpy
IoDriverObjectType
wcscpy_s
KeDelayExecutionThread
KeTickCount
KeBugCheckEx
RtlUnwind
RtlCompareMemory
RtlInitUnicodeString
MmGetSystemRoutineAddress
memcpy
ExAllocatePoolWithTag
IoWMIWriteEvent
ExFreePoolWithTag
ExAcquireResourceSharedLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
memset
KeNumberProcessors
RtlGetVersion
IoGetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
ExInitializeNPagedLookasideList
KeInitializeEvent
ZwSetInformationFile
ZwQueryInformationFile
PsReferencePrimaryToken
PsDereferencePrimaryToken
SeQueryInformationToken
ZwQuerySystemInformation
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
ProbeForWrite
MmIsAddressValid
NtClose
NtOpenProcess
NtQueryInformationProcess
ZwQueryInformationProcess
ZwOpenProcess
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ZwDuplicateObject
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwQueryObject
ObQueryNameString
RtlDowncaseUnicodeChar
_wcsnicmp
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
hal
ExReleaseFastMutex
KeGetCurrentIrql
KfReleaseSpinLock
KfAcquireSpinLock
KeQueryPerformanceCounter
ExAcquireFastMutex
avkmgr.sys
func4
func3
func5
func1
func0
func6
func7
func8
func9
funca
func2
funcd
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=156, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win32/win7/avkmgr.cat
- SHA256 40b23a7d83bd3595a714918778249b6f999c8b016aee814207c893c8aa791e9f
- MD5 8dbe5877f742d7d8fb652c84f76fab5b
- SHA1 126f9190ef1822764e8d7d16bc14c4f03d0fffa9
- SHA512 70fc63d4a4b101829a0e32135562cceb9ddebb36f907c96f01639b29248d4417af98dfa5ec8143e55db4e19c159c4a08a176bbcf2ff17a3ffe4627e7550fccf1
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avkmgr.inf
- SHA256 9fedd6e956b7cd59180920ba7a6c94d0c0fa1dee867ed6087ba753ca47d21a37
- MD5 e92853f21048c93a182a140e667983e9
- SHA1 4265adb15d2f6ed70b7521d3887bd2304528ebef
- SHA512 11617cc1fd33066ba4e54be9a174b7b4a610de66712299dbcd379d0f5b2cc4bcb1590c1719867129cac962619d0e04b25a177139a4c6f5b041c9c8711fc1b419
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win7/avkmgr.sys
- IMPHASH df68c8435781307135dfe76497ab5341
- SHA256 d5e35a021e2a8e676b9034a2c712907f170d3f5b7315d516f317f51cd03ddd06
- MD5 20894c53c0b9db8f86993d9ecb78f9d5
- SHA1 7c18c5b571c906535d393a5165379f6316143107
- SHA512 7fbd637c64a3ed5ce202864197ee26e0d97f84be8bb0bfd5bdbfcf500f370764545489de8d83c347e5f15a414bf5d614377a60983803924935453266f8af5d24
- SSDEEP 384:pSxWv2ZhZ4mAjuPUEA1aVrFiFdWeFuu9BTQe7r/nYPLvdJUHeMPP:gS8ZIuPwoz4dWeFuubQEr/KdkP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
0e:11:dc:93:87:33:df:91:40:f0:90:a9:a0:f6:04:da:25:c2:45:3c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Nov 14, 2018
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2016 - Jan 19, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
6
Entry point
36926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_x86\i386\avkmgr.pdb
ntoskrnl.exe
IoCreateDevice
RtlInitUnicodeString
KeServiceDescriptorTable
ExFreePoolWithTag
IoFreeMdl
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
memset
MmGetSystemRoutineAddress
ZwCreateFile
RtlCompareString
ExGetPreviousMode
PsGetCurrentProcessId
KeTickCount
KeBugCheckEx
RtlUnwind
ExAllocatePoolWithTag
RtlGetVersion
ZwClose
memmove
KeDelayExecutionThread
_allmul
ZwQueryInformationFile
ZwDuplicateObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
hal
KeGetCurrentIrql
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
532B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
846B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=58, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win32/win8/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
SAVAPI/on_access/win32/win8/avgntflt.cat
- SHA256 853c6ba3a145bdd47656b525985632ad46e1d2e8ad127449d59e2bf62bfd5d8f
- MD5 49500efd1756f4b3934e8df70bf12d97
- SHA1 7ee81eb8aa3e448fd7d9cd4559b9077d55b2afb1
- SHA512 58b72baaffca047306915e09e9903b7fe6a6d9943e1d44644ad8ed2b3a31b371dd1ba2730789b75649bcc38df0782e8e6aad04f8f8b88eb800c333624aeea1a5
- SSDEEP 192:EwafyS9JCUQXooyKfPFWQFT7Q5YVZL1aqnajKs0edqC:E9VarPFR5UYVSlGs0jC
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win32/win8/avgntflt.inf
- SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
- MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
- SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
- SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win8/avgntflt.sys
- IMPHASH 369430b7330b145ea00a0d756880608f
- SHA256 33c6b1d49ab13d6ae9f22e05d77b70123de63c802363da0daf1be958b7d3d532
- MD5 f16335a9102ffc99a8c8e07e1b2d57d4
- SHA1 32ddb4251591e40db352661be4721c5c6402b90a
- SHA512 57746307cab7e82e9e7ef5f033628810997954a40cf57f34650cbc9ac77fc2fa3465f1206f87e0082edc4121114dd71f2f816a628872fde26136012766a5cc52
- SSDEEP 3072:mPhzNgtyTnwf3UCPID5tfaElzgbSvTR7VHhoxM732FrBT5t3BMXv8DBf:qhGtyTHC2tDcSvTZ9+Oarf9BMMd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
156256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avgntflt.pdb
ntoskrnl.exe
KeQueryPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
InterlockedPopEntrySList
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
IoCreateSynchronizationEvent
IoGetStackLimits
ZwOpenFile
ZwReadFile
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
PsGetCurrentThreadId
PsGetProcessId
ZwOpenProcess
SeCreateClientSecurity
SeQueryInformationToken
IoIsSystemThread
IoThreadToProcess
ZwQueryDirectoryFile
ZwOpenProcessTokenEx
ZwQueryInformationToken
KeInitializeApc
KeInsertQueueApc
_alldiv
memcmp
ZwQueryInformationFile
ZwSetInformationFile
InterlockedPushEntrySList
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
IoGetTopLevelIrp
ObReferenceObjectByHandle
IoSetFileObjectIgnoreSharing
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlNtStatusToDosError
NtClose
ZwQuerySecurityObject
IoFileObjectType
KeWaitForSingleObject
RtlClearBit
RtlSetAllBits
RtlFindClearBitsAndSet
ExReInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoFreeMdl
ExDeletePagedLookasideList
PoUnregisterPowerSettingCallback
PsSetCreateProcessNotifyRoutine
towupper
RtlIntegerToUnicodeString
RtlFreeUnicodeString
ExInitializePagedLookasideList
ProbeForRead
ZwSetValueKey
RtlCreateUnicodeString
_allmul
_aulldiv
KeWaitForMultipleObjects
wcsncat
PsTerminateSystemThread
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
SeImpersonateClientEx
PsRevertToSelf
ZwWriteFile
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoUnregisterShutdownNotification
RtlHashUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_aullrem
_wcsupr
RtlCompareMemory
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
wcscpy_s
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
memmove
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
KeDelayExecutionThread
ProbeForWrite
ExGetPreviousMode
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
NtOpenProcess
MmIsAddressValid
PsReferencePrimaryToken
PsLookupProcessByProcessId
ZwQueryInformationProcess
NtQueryInformationProcess
_wcsnicmp
toupper
RtlUnwind
RtlUpcaseUnicodeChar
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlEqualUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeResetEvent
KeGetCurrentThread
IoDeviceObjectType
IoCreateDevice
ZwSetSecurityObject
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSecurityDescriptor
_snwprintf
RtlCreateSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
wcschr
ZwCreateKey
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
SeTokenType
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeNumberProcessors
memset
memcpy
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlValidSid
ZwCreateFile
ObfDereferenceObject
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoRegisterShutdownNotification
IoGetCurrentProcess
IoCreateSymbolicLink
ExInitializeRundownProtection
ExInitializeResourceLite
ExFreePoolWithTag
ExAllocatePoolWithTag
KeQueryTimeIncrement
KeQuerySystemTime
KeInitializeSpinLock
KeSetEvent
KeInitializeEvent
RtlGetVersion
RtlInitializeBitMap
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
MmGetSystemRoutineAddress
PsCreateSystemThread
RtlInitUnicodeString
hal
ExAcquireFastMutex
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
fltmgr.sys
FltGetDestinationFileNameInformation
FltObjectReference
FltGetVolumeProperties
FltDeleteInstanceContext
FltSetInstanceContext
FltDeviceIoControlFile
FltOpenVolume
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltParseFileNameInformation
FltGetFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltSendMessage
FltCloseClientPort
FltReferenceContext
FltQuerySecurityObject
FltGetInstanceContext
FltClose
FltFsControlFile
FltQueryInformationFile
FltCreateFile
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltAllocateContext
FltReleaseFileNameInformation
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetRoutineAddress
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltDeleteContext
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=185, version=30716,
count=7, id=190, version=30716,
count=4, id=259, version=26715,
count=5, id=257, version=26715,
count=239, id=1, productName=Unmarked objects,
count=7, id=260, version=26715,
count=38, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
SAVAPI/on_access/win32/win8/avipbb.cat
- SHA256 4efdc56d06e5a17315784d3e700e359fd3ce701edceb6d3370de64d1617d42be
- MD5 8e59d322b492d531124a0a51a5eeaae9
- SHA1 c58672a169f96336e12c0367bd5afa5906bda93f
- SHA512 2ff077f6115c6c4b87b11c78b7fb48ecc0f800f2b8a89ce16d709b802ced671f175c80746aa89f745de6f33d1f894991335de39214909ac0a084e709529a2548
- SSDEEP 192:lBRIgR6uyHJCUymwBYyKaWFWQFO7EQDzBqqnaj/CdR4:59yVyPCFRNplLV
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win32/win8/avipbb.inf
- SHA256 a68faf360ca9d5da989a1b6e7ff69f7aabf7b52be7819ec862a6688b841125ff
- MD5 34c3d7f3bd04501338c421cd9c62b993
- SHA1 7feda197634072bc48e214800a3d4550cd1fa32a
- SHA512 166b4ba8653b3f932ff806e39d92a48e2e2ef7c87f82fc0560add528bf5dab34e0937253c8c5778dcd31f9a925448414066c623d976fbce21893bed08c7ead70
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win8/avipbb.sys
- IMPHASH 8cf67a6f9f559410b2c92bfe6381b8f7
- SHA256 629da28ac97f5b17b1603059242088727e1552d68fe350f97fcd0b67d412ab25
- MD5 18ed8302d083dad602823988a304a4f6
- SHA1 01014fd10d7babd6d81bb7e9511ffa7e13c890fa
- SHA512 de9ea04221fb1270db37d35fcc1acdf7265103e079fd31566b0a043a1fa3b2267a034b720a3070538f289fd3847171d3d54277417ba0f67aede86f1b78db220d
- SSDEEP 3072:FiRnqR7d4wgBQIFnh/Lpx211rrYQwKiYB+Qua7KjoLxkAAFP:Fiq4PbL/2THYQwK7B+Bau0S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
172032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\Win32\avipbb.pdb
avkmgr.sys
func7
func8
func6
funca
funcd
func5
func4
func3
func2
func1
func9
func0
ntoskrnl.exe
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeInitializeEvent
KeReadStateEvent
KeResetEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ProbeForRead
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
PsCreateSystemThread
PsTerminateSystemThread
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoWMIRegistrationControl
ObReferenceObjectByPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlInsertElementGenericTableAvl
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsLookupThreadByThreadId
FsRtlIsNameInExpression
memcpy
memmove
memset
KeNumberProcessors
PsProcessType
PsThreadType
KeServiceDescriptorTable
KeGetCurrentThread
KeWaitForMultipleObjects
MmGetSystemRoutineAddress
ExGetPreviousMode
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ZwWriteFile
PsGetCurrentThreadId
_vsnwprintf
_allmul
KeInitializeSpinLock
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
_aulldiv
_aullrem
ObfReferenceObject
PsGetProcessId
ObOpenObjectByPointer
ZwQueryVirtualMemory
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
strncpy
wcscpy_s
wcsncpy
wcsrchr
IoDriverObjectType
KeDelayExecutionThread
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoFreeMdl
ZwQueryInformationFile
NtOpenProcess
MmIsAddressValid
ZwOpenProcess
NtClose
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ObQueryNameString
ZwQueryObject
ZwDuplicateObject
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQuerySystemInformation
ZwQueryInformationProcess
NtQueryInformationProcess
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
_wcsnicmp
RtlDowncaseUnicodeChar
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
memcmp
ZwSetInformationFile
RtlInitUnicodeString
RtlUnwind
RtlInitAnsiString
RtlIntegerToUnicodeString
_strnicmp
_stricmp
RtlAnsiStringToUnicodeString
KeQuerySystemTime
hal
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=26715,
count=4, id=257, version=26715,
count=7, id=260, version=26715,
count=3, id=257, productName=VS2019 v16.1.2 build 27702, version=27702,
count=155, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
SAVAPI/on_access/win32/win8/avkmgr.cat
- SHA256 4f7410877d36f20a802c5db603149a33beed2d10e3e83f6c5372e52be42fdae0
- MD5 a63897b79888e60e29431eb1b28844de
- SHA1 86feb4a8ff0beda3b6c349fbf17c7b6a37e771db
- SHA512 b176be196dd4967b28305a4f59325034b8ec4e7b544a2011f8b8f908a8154db8d86a3183e25b22232597024d04bc536d42556df89fea3169f0c21251da27ef9c
- SSDEEP 192:3i9X2cACJCztpyKWFWQF82QKZ8fNLyFqnajktKF4m:wAC5FRRte1olwkF4m
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win32/win8/avkmgr.inf
- SHA256 431367c384e680b0f4feafaf7529319ab2cc3cd37bccd291b46c711fa49204ff
- MD5 dddb1f6ae43397a15af280de3ebc3c83
- SHA1 2651935088949e2dff211a7c1126a02836a9b781
- SHA512 6b5d7715d691d18647d1cdf5e3d3bcaae84fa9614378770d544e0263261b99539977922632acbed76a520aebe045396635e45dec9defa9527500f5889d9e8069
- MD5 SHA1 SHA512
SAVAPI/on_access/win32/win8/avkmgr.sys
- IMPHASH 915211291455160b181a1b35daf6bd20
- SHA256 5fdde96d05b4284fa7ee985a7777739c46040ad89b3b8217a729da9695e3e542
- MD5 e3ab0eeb7613ddbacc0388b96048ff5d
- SHA1 f6e382597081451d6546339948edd3e854b7dfae
- SHA512 40c0c7ac884297350a40d58a6a870796381ccb82ade22d69ca3cb9be0c3251b8768f95ab4b0f28f209ed65aed23894a7e77529316250ace7e5da8a99d0bb81a1
- SSDEEP 768:ginpYN85Ry72IqbyReYU6uPwoz4djHIEoF+NdKduH1Qk8AI24o3whJ:BpsK64yRGwospoJFsEuH+k8AH1ghJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
36864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\Bld\128\795\bin\Win32\Release8\avkmgr.pdb
ntoskrnl.exe
RtlGetVersion
ExAllocatePoolWithTag
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
memset
KeServiceDescriptorTable
IoCreateDevice
ExGetPreviousMode
PsGetCurrentProcessId
ZwCreateFile
RtlCompareString
memmove
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeDelayExecutionThread
MmGetSystemRoutineAddress
ZwClose
ZwDuplicateObject
_allmul
ZwQueryInformationFile
RtlUnwind
RtlInitUnicodeString
hal
KeGetCurrentIrql
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=5, id=257, version=25203,
count=3, id=259, version=25203,
count=7, id=260, version=25203,
count=10, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=256, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=255, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=258, productName=VS2017 v15.6.6 build 26131, version=26131,
SAVAPI/on_access/win64/win7/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
SAVAPI/on_access/win64/win7/avgntflt.cat
- SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
- MD5 f3018b52949cdcbf666ffaf6c17f985d
- SHA1 9b4692f754d090cd8b2afb9c4ddce60a05aefc9e
- SHA512 69b1b5c607e37d6cb0e7049fb0ce1ee79b720992a354aee73b67e9b87dc1e2c16548ae55786dbb65ec4e8bcfffd39586edc660d5b41d58d69746b8c25b627af0
- SSDEEP 192:r2p32qXooyKfPFWQFTWQ0dPLrMhEqnajKsKmEU1Isb:6vrPFRoBjlGs6Ul
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win7/avgntflt.inf
- SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
- MD5 0d87b337d3a44a6b7de7bf6c4bbbabd6
- SHA1 692a736647a575278c65dcde5996410071df09ba
- SHA512 6910581b8f3b88596a5e8da43beac9ea68f6aa3644b8e634eefa8f12c3be1c243ad31eff0122904d8c61462f040667569a47c9f19950e5dac7e1a6c8f89aede2
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win7/avgntflt.sys
- IMPHASH 935a7ea0e08363f64cb79c28de13e264
- SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
- MD5 d9f90202659f8ce4d5db6e83d24b46dd
- SHA1 29a7b1068a5090ee59db422364b42d2c8f072a46
- SHA512 b0a9a0c0f18446e6a2b9ad3200dbd2cb94acae5df553beb971b41220304941219d12d3e94ed91dec254e6b907dac6fcb1aa72a822a09a8e523cc76071b221c31
- SSDEEP 3072:vMPogiYZ1dqoWYYCGxbceUW8bUDsQWBsMPelkz4IQ9RLNM/qIn20aqB:vooQZ1ddW5VUWvDTMGls4IQ9ZN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
24:1f:15:7d:b4:a5:38:b4:a7:f7:b6:aa:a8:ce:4e:9f:ad:38:ba:ee:d0:06:bb:74:31:3f:d6:76:41:08:d2:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Digest
e9:26:4e:79:f5:74:82:d2:64:ce:b2:4e:33:13:25:11:8e:62:a6:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Oct 14, 2021
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,POSTALCODE=88069,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
a9:5b:61:11:e3:75:4f:4f:01:41:3d:0a:90:f5:38:c0
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 3, 2021 - Mar 1, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Serial Number
33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2015 - Jul 22, 2025
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b5:21:3f:ca:1e:4a:a0:3d:e4:00:00:00:00:00:b5
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
230332
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avgntflt.sys\objfre_win7_amd64\amd64\avgntflt.pdb
ntoskrnl.exe
RtlUpcaseUnicodeString
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
IoGetStackLimits
ZwQuerySymbolicLinkObject
ZwReadFile
KeInitializeApc
KeInsertQueueApc
RtlAppendUnicodeToString
RtlInitAnsiString
ZwDeleteValueKey
wcsncat
KeReleaseSpinLock
ExpInterlockedPopEntrySList
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
KeEnterCriticalRegion
ZwOpenProcessTokenEx
IoCreateSynchronizationEvent
SeCreateClientSecurity
RtlFreeUnicodeString
ZwQueryValueKey
ZwQueryDirectoryFile
ExAcquireResourceSharedLite
ExReleaseResourceLite
SeQueryInformationToken
ZwOpenProcess
toupper
PsGetCurrentThreadId
RtlCopyUnicodeString
ZwOpenFile
ZwQueryInformationToken
RtlUpcaseUnicodeChar
IoIsSystemThread
KeQueryPriorityThread
PsGetProcessId
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
ZwSetInformationFile
ZwQueryInformationFile
RtlEqualSid
ExReleaseResourceAndLeaveCriticalRegion
ExpInterlockedPushEntrySList
ZwQuerySecurityObject
IoFileObjectType
RtlNtStatusToDosError
ExEnterCriticalRegionAndAcquireResourceExclusive
NtClose
ExQueryDepthSList
ObReferenceObjectByHandle
IoGetTopLevelIrp
RtlGetOwnerSecurityDescriptor
KeWaitForSingleObject
PsSetCreateProcessNotifyRoutine
ExDeletePagedLookasideList
ProbeForRead
RtlCreateUnicodeString
KeResetEvent
RtlIntegerToUnicodeString
ZwSetValueKey
MmMapLockedPagesSpecifyCache
ExInitializePagedLookasideList
towupper
RtlDeleteElementGenericTableAvl
PsCreateSystemThread
PsTerminateSystemThread
SeImpersonateClientEx
PsRevertToSelf
KeWaitForMultipleObjects
RtlEnumerateGenericTableWithoutSplayingAvl
ZwWriteFile
IoDeleteSymbolicLink
IoDeleteDevice
IoThreadToProcess
ExInitializeNPagedLookasideList
RtlHashUnicodeString
ExDeleteNPagedLookasideList
_wcsupr
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
ExReleaseFastMutex
ExAcquireFastMutex
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
RtlInitializeGenericTableAvl
sprintf_s
MmUnmapLockedPages
ExWaitForRundownProtectionRelease
ExAcquireRundownProtection
KeReleaseInStackQueuedSpinLock
RtlSetAllBits
ExReleaseRundownProtection
KeAcquireInStackQueuedSpinLock
MmAllocatePagesForMdl
IoFreeMdl
RtlFindClearBitsAndSet
ExReInitializeRundownProtection
MmFreePagesFromMdl
RtlClearBit
KeBugCheckEx
IoGetDeviceObjectPointer
_wcsnicmp
PsLookupProcessByProcessId
PsReferencePrimaryToken
KeDelayExecutionThread
ZwQueryInformationProcess
wcscpy_s
RtlInsertElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
ZwCreateKey
ExAcquireResourceExclusiveLite
SeTokenType
PsDereferencePrimaryToken
ExDeleteResourceLite
PsDereferenceImpersonationToken
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
IofCallDriver
RtlLengthSid
KeNumberProcessors
ExInitializeResourceLite
ObfDereferenceObject
IoCreateSymbolicLink
RtlCompareMemory
RtlInitializeSid
RtlCompareUnicodeString
IofCompleteRequest
RtlAppendUnicodeStringToString
KeQueryTimeIncrement
IoGetCurrentProcess
ZwCreateFile
ExInitializeRundownProtection
RtlInitializeBitMap
RtlValidSid
RtlGetVersion
KeInitializeEvent
MmGetSystemRoutineAddress
KeSetEvent
RtlInitUnicodeString
InitializeSListHead
IoRegisterShutdownNotification
IoWMIWriteEvent
ExFreePoolWithTag
IoWMIRegistrationControl
ExAllocatePoolWithTag
RtlLengthRequiredSid
IoUnregisterShutdownNotification
RtlSubAuthoritySid
__C_specific_handler
fltmgr.sys
FltGetDestinationFileNameInformation
FltOpenVolume
FltObjectReference
FltGetVolumeProperties
FltSetInstanceContext
FltDeleteInstanceContext
FltDeviceIoControlFile
FltDoCompletionProcessingWhenSafe
FltParseFileNameInformation
FltGetFileNameInformation
FltSetStreamContext
FltCancelFileOpen
FltGetStreamContext
FltGetDiskDeviceObject
FltObjectDereference
FltCloseClientPort
FltSendMessage
FltQuerySecurityObject
FltReferenceContext
FltFsControlFile
FltClose
FltQueryInformationFile
FltCreateFile
FltGetInstanceContext
FltReleaseFileNameInformation
FltAllocateContext
FltReleaseContext
FltSetStreamHandleContext
FltGetStreamHandleContext
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltGetRoutineAddress
FltCloseCommunicationPort
FltUnregisterFilter
FltFreeSecurityDescriptor
FltCreateCommunicationPort
FltDeleteContext
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
19B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=135, version=30729,
count=228, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win64/win7/avipbb.cat
- SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
- MD5 351a7acf84d15a92dc75d3fc2f504f0e
- SHA1 1d316b5d3a8729c0f03a140ac55066399fbc808f
- SHA512 f705ee3bb4aa9328e808d0a8793692e1b525c0413e2005bd5f1d442be4da23e05b9549d85ccc8c1ae1f9c818a4ccc19207f0feffcd11d7b2b3039ed4e20c3b23
- SSDEEP 192:Wh32QmwBYyKaWFWQFqtQjWMvN/qnaj9D6ad:WlPCFRkq/l5D6ad
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win7/avipbb.inf
- SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
- MD5 b9a877ecc51ee9f13d9e5451f8b12895
- SHA1 45a8abeb8c295295e4952893452c54850f721868
- SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win7/avipbb.sys
- IMPHASH c67071a7e71763082096de0aad8766fc
- SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
- MD5 b49a44df6fe77ccb861985f5a5dd7ba5
- SHA1 6e5163e191dd789f8cc33a531ce9ddd9bed2a842
- SHA512 d53f56966c8750edc513c86c8e9b47fa1f0445a86a1d92621f1aa5fc9b9400a4a7f65b9ae0d2e537c9dde1b23b16fbd56af8ab74d62a8a777106e9b16e58be89
- SSDEEP 3072:sUnNOdMrlqdSL3W3TRjWLKcudx0TzBrt6Ozv7druQuxAmP9FrN:PnQurlLLmxQu/0SOzZSBxDX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
ac:37:6a:b3:0e:25:4b:a1:7a:9b:38:3b:76:ef:af:ec:4a:6e:96:c8:6b:5b:80:08:2e:99:9f:33:bc:36:46:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
19:0f:6e:25:22:27:b3:83:8c:d4:bb:76:68:8a:0b:3a:01:f5:56:c7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Chains
Feb 4, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,C=DE
Serial Number
05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2019 - Nov 16, 2021
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
176228
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\bamboo-build\wavui-winav257-bd\av\source\avipbb.sys\objfre_win7_amd64\amd64\avipbb.pdb
ntoskrnl.exe
KeInitializeMutex
KeLeaveCriticalRegion
RtlAnsiStringToUnicodeString
ExInitializeNPagedLookasideList
ExAcquireFastMutex
PsLookupProcessByProcessId
ZwQuerySymbolicLinkObject
ZwReadFile
RtlInitUnicodeString
RtlIntegerToUnicodeString
IoDeleteDevice
KeSetEvent
ExpInterlockedPushEntrySList
MmGetSystemRoutineAddress
KeInitializeEvent
RtlInitAnsiString
RtlGetVersion
ExpInterlockedPopEntrySList
ZwOpenSymbolicLinkObject
FsRtlIsNameInExpression
KeEnterCriticalRegion
KeReleaseMutex
ZwCreateFile
ExDeletePagedLookasideList
ExAcquireResourceSharedLite
IoGetCurrentProcess
ExReleaseResourceLite
ZwClose
RtlAppendUnicodeStringToString
IofCompleteRequest
ExQueryDepthSList
KeWaitForSingleObject
RtlCompareUnicodeString
RtlCompareMemory
ExDeleteResourceLite
IoCreateSymbolicLink
PsGetCurrentProcessId
RtlCopyUnicodeString
ExInitializePagedLookasideList
KeReadStateEvent
IoCreateDevice
ExInitializeResourceLite
KeNumberProcessors
ObReferenceObjectByPointer
ExDeleteNPagedLookasideList
PsLookupThreadByThreadId
IofCallDriver
IoBuildSynchronousFsdRequest
ExGetPreviousMode
_vsnwprintf
ObReferenceObjectByHandle
PsGetCurrentThreadId
KeWaitForMultipleObjects
IoReleaseCancelSpinLock
ZwWriteFile
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
RtlInitializeGenericTableAvl
PsThreadType
RtlEnumerateGenericTableWithoutSplayingAvl
KeAcquireSpinLockRaiseToDpc
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
wcsncpy
strncpy
IoDriverObjectType
wcsrchr
PsGetProcessId
KeDelayExecutionThread
KeBugCheckEx
ExReleaseFastMutex
KeResetEvent
IoWMIWriteEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
PsProcessType
IoWMIRegistrationControl
ProbeForRead
ExAllocatePoolWithTag
_strnicmp
RtlInsertElementGenericTableAvl
ExAcquireResourceExclusiveLite
ObfDereferenceObject
_stricmp
ZwSetInformationFile
ZwQueryInformationFile
_wcsnicmp
RtlDowncaseUnicodeChar
PsReferencePrimaryToken
ZwQueryObject
ZwQuerySystemInformation
SeQueryInformationToken
ZwOpenProcess
ZwQueryInformationProcess
PsDereferencePrimaryToken
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
__C_specific_handler
hal
KeQueryPerformanceCounter
avkmgr.sys
funca
func8
func5
func0
func2
func7
func1
func4
func6
func3
func9
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win64/win7/avkmgr.cat
- SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
- MD5 f3324c2c121d360f8ce3553e221c3ce6
- SHA1 85939054d39067cc7e1089de71138b4b4283f800
- SHA512 045db8fab56ab1c4ff0cea326cd44624c3bbab2d042b3065541707bec0021b669e6a49fcb2adf502fbea38dd4823e85fe0f2c588f93efeae4108239ae1271c78
- SSDEEP 96:SZR2gYJUzSDaSDqhRwUWcGDvbop6WDfeRDUzxwLhPjkFokPXhVEM0YDfez6rEfga:S32HmX0c0YWEhV0+3Ef5KYpBjSwrQa
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win7/avkmgr.inf
- SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
- MD5 176af3c43b608af665f48a35f497bae1
- SHA1 e992df632b9758b3df7b4ea69c632f12a03daaf6
- SHA512 03cec71f9ca56d99304b6dff1b90a2ca5d04bf5cf7cd0e41e1134cdb1cac50540d6e3bec18313f970420af4bf29d76653e9c5a9fa1351d1747989dfafc208493
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win7/avkmgr.sys
- IMPHASH bbbf29be00d696bbac6e5abddd6e312c
- SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
- MD5 eb5c2402e2f402a19504bf6ca9c3e06a
- SHA1 63aa9690c36d743951558422d841276c25cde77d
- SHA512 9b6b7c06e904cf36aefc17e14a108e9636c3a8920a34960dcb26fa520326c7ff47f03c24bacaec6ba91440237fb16afde0df01c299cdd7a89c40cc489a3f0151
- SSDEEP 768:p5UbgvCkoe+nuPwoz4dC2xfDKKdqe0nKUbZ:88axeLwos42xfDpqevq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
67:03:5e:7d:2d:97:2d:65:2b:25:6f:b7:39:13:c4:12:e0:cf:0a:5f:c3:7f:d1:d6:5b:ce:39:2e:35:ec:d8:57
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
5a:6a:8a:38:66:a5:ea:f2:62:5c:0a:0e:de:29:fb:20:b7:df:d1:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Nov 14, 2018
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Avira Operations GmbH & Co. KG,O=Avira Operations GmbH & Co. KG,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
76:ba:94:23:dd:bc:e7:b1:45:a9:5f:01:ee:01:5f:17
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2016 - Jan 19, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6d:9d:a5:3e:87:00:9d:33:49:00:00:00:00:00:6d
Issuer
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 20, 2018 - Sep 20, 2019
Subject
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0b:aa:c1:00:00:00:00:00:09
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
1
Major OS version
6
Entry point
32868
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\bld\128\795\src\source\avkmgr.sys\objfre_win7_amd64\amd64\avkmgr.pdb
ntoskrnl.exe
RtlGetVersion
IoCreateDevice
MmGetSystemRoutineAddress
KeBugCheckEx
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlInitUnicodeString
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
316B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
406B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=1, productName=Unmarked objects,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
SAVAPI/on_access/win64/win8/avgio.dll
- IMPHASH 72e2cd9e129b18aa647a30bd6ed95591
- SHA256 73b563935d96d328d5e13d05ddc35f24b69237e4c4b7b183ee66aeeb3ccd9c16
- MD5 49e51045f2951fd248318ac9f1ccb18e
- SHA1 7a09bfa925fb2703bba5b26ddeae1ec7e3a481fb
- SHA512 df00015514bbcdd6d0ff9c38485ee65d7700fb7cadd4327d12230d63f078da5e9aa5fd11aec9f8c741bdf7c84c84c38543af1f71ebc12a4477415e2c5ab9deda
- SSDEEP 3072:kBWuZL07xXI4ZUgZ/aAD4uQWh3C56jn/KutS8t/6aqDDNYt0c:Sw9Y4GVAD40h3f/KutSgGk
- MD5 SHA1 SHA512 SSDEEP
Digest
22:4c:b7:e1:ed:ee:0d:dc:8d:0b:ae:1f:fa:51:6b:56:0e:0d:52:05:ce:94:ae:bb:43:7d:df:bc:60:ec:0c:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 27, 2020
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 19, 2018 - Jan 28, 2028
Subject
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Serial Number
48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Jun 15, 2016 - Jun 15, 2024
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:29:15:27:00:00:00:00:00:2a
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=HRA 722586,CN=Avira Operations GmbH & Co. KG,OU=Cloud\, Services and Infrastructure,O=Avira Operations GmbH & Co. KG,STREET=Kaplaneiweg 1,L=Tettnang,ST=Baden-Wuerttemberg,C=DE,1.2.840.113549.1.9.1=#0c0c63614061766972612e636f6d,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#1312426164656e2d577565727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
2a:09:50:26:3e:06:49:6a:27:81:f5:50
Issuer
CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 11, 2018 - Jul 11, 2021
Subject
CN=GlobalSign TSA for Standard - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:b4:55:35:1e:bb:1a:b2:4f:97:ef:07:fe:2a:b3:0b:8a
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2011 - Jan 28, 2028
Minor OS version
0
Major OS version
6
Entry point
32568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\SRC\Sources\Avira\antivirus\AV\BuildOutput\Bin\Release\avgio-oasdk.dll.pdb
kernel32
SetProcessWorkingSetSize
VerifyVersionInfoW
DeleteFileW
GetFileSize
SetFileAttributesW
WriteFile
CreateIoCompletionPort
PostQueuedCompletionStatus
GetFileSizeEx
ReadFile
SetFilePointerEx
QueryPerformanceCounter
GetQueuedCompletionStatus
LoadLibraryW
ResetEvent
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
TerminateThread
GetTickCount
VirtualQuery
MapViewOfFile
UnmapViewOfFile
WriteConsoleW
GetProcAddress
GetModuleHandleW
FreeLibrary
GetSystemInfo
OpenProcess
GetCurrentProcessId
GetCurrentProcess
Sleep
QueryPerformanceFrequency
SetErrorMode
VerSetConditionMask
GetModuleFileNameW
CreateEventW
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetOverlappedResult
DeviceIoControl
CreateFileW
SetLastError
GetLastError
CloseHandle
SetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
MoveFileExW
HeapValidate
GetConsoleMode
GetFileType
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
LCMapStringW
MultiByteToWideChar
GetProcessHeap
SetStdHandle
GetConsoleOutputCP
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
FlushFileBuffers
HeapSize
DecodePointer
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
SetServiceStatus
TraceMessage
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AVGDLL01
AVGDLL02
AVGDLL03
AVGDLL04
AVGDLL05
AVGDLL06
AVGDLL07
AVGDLL08
AVGDLL09
AVGDLL10
AVGDLL11
AVGDLL12
AVGDLL13
AVGDLL14
AVGDLL15
Name
.text
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=155, id=261, version=27412,
count=18, id=260, version=27412,
count=16, id=260, version=28920,
count=20, id=259, version=28920,
count=35, id=261, version=28920,
count=5, id=257, version=27412,
count=144, id=1, productName=Unmarked objects,
count=15, id=260, productName=VS2019 v16.7.5 build 29112, version=29112,
count=10, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
SAVAPI/on_access/win64/win8/avgntflt.cat
- SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
- MD5 3ece229fca8ecdf8e4889e062abbf95a
- SHA1 47aa2952646097710297f5bded9b115e418bac00
- SHA512 985d4005541e25f39bc7abf80c05b97fe57220bf02bcbb7ff41f792283af5aba87d7db433217ffcea002d35dd113913bbb6e980fbf99778126f129a799b58573
- SSDEEP 192:NfafyZYxJCxuXooyKfPFWQFzWzQPIiQLCamylqnajsq3rQe:Nc0IrPFRI3iQ3Jllgkrb
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win8/avgntflt.inf
- SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
- MD5 6fae3f1bb20b9e1f2ea6d8e0a1c35e68
- SHA1 d281eaf5659ac3b6dfa501bb2206b8a7af86f230
- SHA512 f77032a6451e43e0b0c7e881afde1ee83fc542412ff6ee3dc9932608f1c61943f18da31200c4347e9373f575f5e6f2ee3ebca655cf9f190adbc12e5f7e7b5ac6
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win8/avgntflt.sys
- IMPHASH 949a3f7ef15514eb7758bc1d821f6019
- SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
- MD5 ec059af10524644bddcc073916e78375
- SHA1 93a9466afee21f61f643f540b2ab82ac7db60b62
- SHA512 88310251e07eb6edda3eb28d057a18fd7d1ea7a9adc5f861fa7ad127561bfb035468974fd11685b66654fc37dc3577d7d720e2e9e4f4fc38d116c1089ee9afe7
- SSDEEP 6144:S2M8JRGRI16YO/HqUU2miFjq5K3vPRTh9EsRbmN6:S25ERI16htvo5K3vPRr+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
205488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avgntflt.pdb
ntoskrnl.exe
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlUpcaseUnicodeChar
RtlFreeUnicodeString
KeQueryPriorityThread
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExpInterlockedPopEntrySList
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
IoCreateSynchronizationEvent
IoGetStackLimits
ZwOpenFile
ZwReadFile
ZwOpenKey
ZwDeleteValueKey
ZwQueryValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
PsGetCurrentThreadId
PsGetProcessId
ZwOpenProcess
SeCreateClientSecurity
SeQueryInformationToken
IoIsSystemThread
IoThreadToProcess
ZwQueryDirectoryFile
ZwOpenProcessTokenEx
ZwQueryInformationToken
KeInitializeApc
KeInsertQueueApc
ZwQueryInformationFile
ZwSetInformationFile
ExQueryDepthSList
ExpInterlockedPushEntrySList
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
IoGetTopLevelIrp
ObReferenceObjectByHandle
IoSetFileObjectIgnoreSharing
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlNtStatusToDosError
NtClose
ZwQuerySecurityObject
IoFileObjectType
KeWaitForSingleObject
RtlClearBit
RtlSetAllBits
RtlFindClearBitsAndSet
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExReInitializeRundownProtection
ExAcquireRundownProtection
ExReleaseRundownProtection
ExWaitForRundownProtectionRelease
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
IoFreeMdl
ExDeletePagedLookasideList
PoUnregisterPowerSettingCallback
PsSetCreateProcessNotifyRoutine
towupper
RtlIntegerToUnicodeString
KeResetEvent
ExInitializePagedLookasideList
ProbeForRead
RtlAnsiStringToUnicodeString
RtlCreateUnicodeString
__C_specific_handler
KeWaitForMultipleObjects
PsCreateSystemThread
PsTerminateSystemThread
RtlDeleteElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
SeImpersonateClientEx
PsRevertToSelf
ZwWriteFile
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoUnregisterShutdownNotification
RtlHashUnicodeString
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
_wcsupr
RtlCompareMemory
RtlPrefixUnicodeString
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
RtlLookupElementGenericTableAvl
ExAcquireFastMutex
ExReleaseFastMutex
RtlInitializeGenericTableAvl
RtlGetElementGenericTableAvl
RtlIsGenericTableEmptyAvl
sprintf_s
wcscpy_s
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInsertElementGenericTableAvl
IoGetDeviceObjectPointer
KeDelayExecutionThread
ProbeForWrite
ExGetPreviousMode
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
NtOpenProcess
MmIsAddressValid
PsReferencePrimaryToken
PsLookupProcessByProcessId
ZwQueryInformationProcess
NtQueryInformationProcess
_wcsnicmp
RtlInitAnsiString
IoDeviceObjectType
IoCreateDevice
ZwSetSecurityObject
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSecurityDescriptor
_snwprintf
RtlCreateSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
wcschr
ZwCreateKey
wcsncat
toupper
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
SeTokenType
ExDeleteResourceLite
PsGetCurrentProcessId
ObOpenObjectByPointer
ZwClose
KeNumberProcessors
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlValidSid
ZwCreateFile
ObfDereferenceObject
PoRegisterPowerSettingCallback
IoWMIRegistrationControl
IoRegisterShutdownNotification
IoGetCurrentProcess
IoCreateSymbolicLink
ExInitializeRundownProtection
ExInitializeResourceLite
InitializeSListHead
ExFreePoolWithTag
ExAllocatePoolWithTag
KeQueryTimeIncrement
KeInitializeSpinLock
KeSetEvent
KeInitializeEvent
RtlGetVersion
RtlInitializeBitMap
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
MmGetSystemRoutineAddress
ZwSetValueKey
RtlInitUnicodeString
fltmgr.sys
FltGetDestinationFileNameInformation
FltObjectReference
FltGetVolumeProperties
FltDeleteInstanceContext
FltSetInstanceContext
FltDeviceIoControlFile
FltOpenVolume
FltDoCompletionProcessingWhenSafe
FltGetStreamContext
FltSetStreamContext
FltCancelFileOpen
FltParseFileNameInformation
FltGetFileNameInformation
FltGetDiskDeviceObject
FltObjectDereference
FltSendMessage
FltCloseClientPort
FltReferenceContext
FltQuerySecurityObject
FltGetInstanceContext
FltClose
FltFsControlFile
FltQueryInformationFile
FltCreateFile
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltAllocateContext
FltReleaseFileNameInformation
FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetRoutineAddress
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltDeleteContext
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
NONPAGED
Size
512B
Virtual Size
3B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=185, version=30716,
count=7, id=190, version=30716,
count=3, id=257, version=26715,
count=230, id=1, productName=Unmarked objects,
count=5, id=259, version=26715,
count=7, id=260, version=26715,
count=38, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
SAVAPI/on_access/win64/win8/avipbb.cat
- SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
- MD5 209bedcc941da626c2db370a80e3513e
- SHA1 c88910bf5a4b35893e60d92828568d20420a9caf
- SHA512 ddef0175e3e2919c4504f99d054b314e48f4ed0ac5c1b3153e1581b3614f304fe3850a8d465163cb4c502d4b026986121d6e4e30fc421d2c583b689ec933a10f
- SSDEEP 192:CEbRVRDy8nJCx0mwBYyKaWFWQF259Q8I+XqnajlGupG8hod:njJn00PCFRO7ImlORd
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win8/avipbb.inf
- SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
- MD5 b9a877ecc51ee9f13d9e5451f8b12895
- SHA1 45a8abeb8c295295e4952893452c54850f721868
- SHA512 079cd60a4d3f6bc990119574a4d493571afbb24209f1a15bb0202d3c24c66fcec3151e132d84ca036f46cceabac34d1a20c7d1034f0bc487fe9feb2740fb95fc
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win8/avipbb.sys
- IMPHASH b2557b252ab2c20a9c87b8e7393248c5
- SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
- MD5 c8d33c5b49a4760f2d81710eba839ba2
- SHA1 8f41e4333dabe52bfd988a68785d0687599f1154
- SHA512 451dca816d38538e082c7388aac0997eb04f5e8fc288fe44aeb661ece1e717060d73f24d60c7576403a68a5fbda3f931161602a2a8b98f506b56ff64c095cd78
- SSDEEP 3072:lRgvKNe0BiAKLgBy6IdaJHIcVOmBvU6vHCSEQuqQ3TJu7Gyz:l2069oIMbVOcvU6vxEBDJI7z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
188416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\bamboo-build\WAVUI-WINAV257-BD\AV\BuildOutput\Bin\Release8\drivers\x64\avipbb.pdb
avkmgr.sys
func2
func3
func4
func5
func1
func7
func8
func9
funca
func6
func0
ntoskrnl.exe
RtlIntegerToUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlGetVersion
KeInitializeEvent
KeReadStateEvent
KeResetEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
ExInitializePagedLookasideList
ExDeletePagedLookasideList
ProbeForRead
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IoWMIRegistrationControl
ObReferenceObjectByPointer
ObfDereferenceObject
ZwCreateFile
ZwReadFile
ZwClose
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlInsertElementGenericTableAvl
PsGetCurrentProcessId
PsLookupProcessByProcessId
PsLookupThreadByThreadId
FsRtlIsNameInExpression
__C_specific_handler
KeNumberProcessors
_stricmp
KeWaitForMultipleObjects
ExGetPreviousMode
IoBuildSynchronousFsdRequest
IofCallDriver
IofCompleteRequest
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ZwWriteFile
PsGetCurrentThreadId
_vsnwprintf
KeInitializeSpinLock
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
PsThreadType
wcschr
RtlUpcaseUnicodeChar
KeClearEvent
strncpy
wcsncpy
wcsrchr
PsGetProcessId
IoDriverObjectType
KeDelayExecutionThread
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IoFreeMdl
ZwQueryInformationFile
NtOpenProcess
MmIsAddressValid
ZwOpenProcess
NtClose
SeQueryInformationToken
PsReferencePrimaryToken
PsDereferencePrimaryToken
ZwQueryObject
ZwQuerySystemInformation
ZwQueryInformationProcess
NtQueryInformationProcess
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
_wcsnicmp
RtlDowncaseUnicodeChar
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
wcscpy_s
ZwSetInformationFile
_strnicmp
PsProcessType
hal
KeQueryPerformanceCounter
Name
.text
Size
123KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=26715,
count=5, id=259, version=26715,
count=6, id=260, version=26715,
count=3, id=257, productName=VS2019 v16.1.2 build 27702, version=27702,
count=140, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=255, productName=VS2019 v16.1.2 build 27702, version=27702,
count=1, id=258, productName=VS2019 v16.1.2 build 27702, version=27702,
SAVAPI/on_access/win64/win8/avkmgr.cat
- SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
- MD5 88ae7b9879c9ac3a65ef73424600ba65
- SHA1 67f74e5f569aed30bda54b5a6467d86d0110e448
- SHA512 5b87166c206dee390e81a3ad334578a9b1ca7274b677af3cfeb2c6cfe46b756a59df78b0ea5ab7c1e11d3465f5955e58bac8dd45daeda61ac683ae53388c3dc8
- SSDEEP 192:niBT2KJC2tpyKWFWQF8ESQ85SD7Zqnaje1cwrxFh:+mFRTS9Ell61cwrxn
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/on_access/win64/win8/avkmgr.inf
- SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
- MD5 fabaac0d5c0ef083150dec8615a8b2bb
- SHA1 23b864f150922bd020b679e018b1b0ee59a7353f
- SHA512 51cac3b029a5ec11ba36e8b7ad86b720da7e6546cb4ba8cad319200892ff143e9664e4a29d915a79f4a302b15078e44f0bc934715b8fcf8deaef4d7e3dde5801
- MD5 SHA1 SHA512
SAVAPI/on_access/win64/win8/avkmgr.sys
- IMPHASH 1a89cb31ddbe098dfbe56321442ce0b1
- SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
- MD5 40786e1ac650f9f7e8b67a672b5eb69e
- SHA1 f529c7b666b029e19a301a30463abcadd59f4b0b
- SHA512 da8453b4d97dc4994a6db2fbdb741119513bd007078bc352b664f77790a7c7de876f038943cf826dbab81962bc5551f506dc04e7d69945bf324f3a23a5e9e6ba
- SSDEEP 768:Z6e6av+nuPwoz4d0ggKdeql0dsKI2Nr3h+1y:ZuavLwosugz3aHR3h+s
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
32768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
e:\Bld\128\795\bin\x64\Release8\avkmgr.pdb
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlGetVersion
IoCreateDevice
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
RtlInitUnicodeString
func0
func1
func2
func3
func4
func5
func6
func7
func8
func9
funca
funcb
funcc
funcd
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
275B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
512B
Virtual Size
342B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=1, productName=Unmarked objects,
count=3, id=257, version=25203,
count=6, id=260, version=25203,
count=4, id=259, version=25203,
count=8, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=256, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=255, productName=VS2017 v15.6.6 build 26131, version=26131,
count=1, id=258, productName=VS2017 v15.6.6 build 26131, version=26131,
SAVAPI/plg_fops_dummy.dll
- IMPHASH 030a305e7c90f0e0ba6c00476e02031b
- SHA256 18f14d6ef36885b58dbe598cee1ff20c83afd5f9cf0c739394f74251f51bbf2f
- MD5 e31669de92895bb6b150e3f319267458
- SHA1 83a6ffc6da2421d28e4f8a068a0950726078673c
- SHA512 2d5f7f682e88fe83223efa7763e1dd46f50462eb8f164c90bf34c41c40ba06b98720b2acc04238809fa646b708a2c4a640ddb0e1ec0a8ae244cc29737e4fec6d
- SSDEEP 1536:ALBBbE9pvjyBQO53mWGw6abjwgNXjLEFSg1NZXarnYsWYEbcdOy/N5+q0q:ITbEP+BQO53mnanwmXjdIcnnO45+q0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
6689
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\utils\SDK\examples\cmake\advanced\plg_fops_dummy\plg_fops_dummy.pdb
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileAttributesExW
SetFileAttributesW
DeleteFileW
MoveFileExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
CompareStringW
LCMapStringW
SetStdHandle
GetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetTimeZoneInformation
GetStringTypeW
HeapSize
HeapReAlloc
SetEndOfFile
WriteConsoleW
DecodePointer
savapi_plg_main
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=171, id=261, version=27412,
count=18, id=260, version=27412,
count=30, id=261, version=31616,
count=16, id=260, version=31616,
count=20, id=259, version=31616,
count=3, id=257, version=27412,
count=94, id=1, productName=Unmarked objects,
count=2, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=258, version=31629,
SAVAPI/productname.dat
- SHA256 84cc36c119381af58ccaead1ad8995b92317ca4ae8c38a38dc37071d712bb4d8
- MD5 53ce39cd5a411bb30c5b1d413e641ec8
- SHA1 0b7c31237c9b0a436ace5274938d420f8c7d6385
- SHA512 3524dea3bfd8cc9539d70102ab3f49da50a1b0c1a68b7073869b7f193a30562d716526a6de13a40f07480763e3841bcc3743b91f46f9f87630707e63e7d76f26
- MD5 SHA1 SHA512
SAVAPI/savapi.conf
- SHA256 b30e328a864f6c4bd5544f6a7c3dbdc2cb97e668e2e583de0590506c881a16b9
- MD5 c1f0cfade5c32a37b223f5f7b0ec3510
- SHA1 8fb0afd1a53feb25652937d09865e3cc8cf3f02e
- SHA512 9dc05c25f907ce29ebccca1c34fbf926ea7a4d803e2d2fb6106192176681fd151b82605bc066e7e55e03b14aae3ac81008dadc70889dbae887de5f67ec11aa40
- SSDEEP 768:CORmWh90JmGrHbKlckb58aomNOKggzy+Yq:thSPHpkmnmN/dW+Yq
- MD5 SHA1 SHA512 SSDEEP
SAVAPI/savapi.dll
- IMPHASH 98df4127bc9f89b567dba0807b2d2ea7
- SHA256 5617fc94cdd8b0c7a14df62cfc77f64ffe157d5fe96cc02c9ff209db97274e0e
- MD5 85815e63269ec76386fd2a4d418f75be
- SHA1 34b6ae807c5ab324e3e5a624b4bfa325ad86d890
- SHA512 08401d39a1d8cd2b047b66c14236aaf04fc79d2a21c57e38198a6c2ccfca5e2959628a4674eb5609f7bb8d49eb87ea9033562bbdb058dc03beab81478b95e7d6
- SSDEEP 49152:CZb4QJm+I6aJ9YPizIT9E1mJ85NDVwwLRFytPzZnpvsqKTZb:CZb4QJDVOKwmaNDVwSC1Znp
- MD5 SHA1 SHA512 SSDEEP
Digest
a2:92:c9:67:e5:3a:02:3e:64:c3:a7:28:a2:47:ad:02:cf:a4:35:7f:71:c9:7b:9a:18:aa:6a:17:84:91:1a:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
1
Major OS version
6
Entry point
2071915
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\libsavapi\daemon\libsavapi.pdb
kernel32
SetEvent
CreateEventW
GetCurrentProcess
FindClose
LoadLibraryW
LoadLibraryA
FreeLibrary
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateFiber
DeleteFiber
SwitchToFiber
GetProcAddress
GetModuleHandleW
WriteFile
GetFileType
GetEnvironmentVariableW
GetStdHandle
FormatMessageW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryDosDeviceW
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
Sleep
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemInfo
CloseHandle
GetOEMCP
GetACP
WideCharToMultiByte
MultiByteToWideChar
CreateHardLinkW
GetTempPathW
SetLastError
GetNativeSystemInfo
HeapSize
GetStringTypeW
GetProcessHeap
GetCommandLineA
FindFirstFileExW
GetCPInfo
IsValidCodePage
DecodePointer
LCMapStringW
CompareStringW
GetModuleFileNameW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GlobalFree
FindNextFileW
OutputDebugStringW
FindFirstFileW
HeapReAlloc
HeapAlloc
HeapFree
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
GetConsoleOutputCP
SetFilePointerEx
RaiseException
EncodePointer
RtlUnwind
InterlockedFlushSList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
CreateNamedPipeA
CreatePipe
UnlockFileEx
UnlockFile
LockFileEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetEnvironmentVariableA
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
SetErrorMode
LoadLibraryExW
FindFirstFileA
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetEnvironmentVariableW
SetStdHandle
CreateFileW
DeleteFileW
SetFilePointer
DeviceIoControl
GetOverlappedResult
CancelIo
MoveFileExW
FlushFileBuffers
ReadFile
PeekNamedPipe
ReleaseSemaphore
CreateSemaphoreA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
CreateDirectoryW
RemoveDirectoryW
GetCurrentThread
OpenFileMappingW
FormatMessageA
DuplicateHandle
SwitchToThread
SetEndOfFile
ResetEvent
SetHandleInformation
CreateFileMappingA
CreateFileA
GetVersionExW
GetModuleFileNameA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
LockFile
user32
GetSystemMetrics
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
AllocateAndInitializeSid
CryptAcquireContextA
LogonUserW
CheckTokenMembership
FreeSid
CloseServiceHandle
OpenSCManagerW
OpenServiceW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoA
GetNamedSecurityInfoW
GetSecurityInfo
OpenProcessToken
OpenThreadToken
PrivilegeCheck
LookupPrivilegeValueA
CreateProcessAsUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
RevertToSelf
SetSecurityDescriptorDacl
QueryServiceStatus
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
ws2_32
inet_ntop
WSAWaitForMultipleEvents
htons
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAIoctl
WSAResetEvent
inet_pton
__WSAFDIsSet
select
htonl
inet_addr
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
getpeername
recv
getnameinfo
freeaddrinfo
getaddrinfo
ntohs
getsockopt
getsockname
ioctlsocket
gethostname
WSAAddressToStringW
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
ntohl
shutdown
getservbyname
recvfrom
sendto
WSAGetOverlappedResult
WSARecv
WSASend
socket
shlwapi
PathCanonicalizeW
winhttp
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
crypt32
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreA
CertFreeCertificateContext
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertCloseStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
iphlpapi
GetAdaptersAddresses
mswsock
TransmitFile
rpcrt4
UuidCreate
bcrypt
BCryptGenRandom
shell32
CommandLineToArgvW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
CharToSTCHAR
SAVAPI_APC_cache_operation
SAVAPI_APC_get_version
SAVAPI_APC_initialize
SAVAPI_APC_uninitialize
SAVAPI_FPC_disable_preinit
SAVAPI_OA_create_instances
SAVAPI_OA_initialize
SAVAPI_OA_start_scan
SAVAPI_OA_stop_scan
SAVAPI_OA_uninitialize
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_create_instance
SAVAPI_engine_modules_get
SAVAPI_engine_modules_get_ex
SAVAPI_engine_versions_get
SAVAPI_extract_malware_names
SAVAPI_free
SAVAPI_get
SAVAPI_get_dynamic_detect
SAVAPI_get_fops
SAVAPI_get_instance_pool
SAVAPI_get_type
SAVAPI_get_user_data
SAVAPI_get_version
SAVAPI_global_set
SAVAPI_initialize
SAVAPI_is_running
SAVAPI_is_running_ex
SAVAPI_register_callback
SAVAPI_release_instance
SAVAPI_reload_engine
SAVAPI_reload_engine_ex
SAVAPI_reset_instance
SAVAPI_scan
SAVAPI_send_signal
SAVAPI_set
SAVAPI_set_avpal_init_flags
SAVAPI_set_avpal_inited
SAVAPI_set_ex
SAVAPI_set_fops
SAVAPI_set_log_callback
SAVAPI_set_quickload_init
SAVAPI_set_user_data
SAVAPI_simple_scan
SAVAPI_uninitialize
SAVAPI_unregister_callback
SAVAPI_with_encoding_get
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
541KB
Virtual Size
540KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=259, version=27412,
count=210, id=261, version=27412,
count=21, id=260, version=27412,
count=10, id=253, version=31616,
count=30, id=261, version=31616,
count=17, id=260, version=31616,
count=25, id=259, version=31616,
count=27, id=257, version=27412,
count=297, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2019 v16.1.2 build 27702, version=27702,
count=21, productName=Unmarked objects (old),
count=10, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,
count=812, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/savapi.exe
- IMPHASH 4b8fd0313c7bf7140bc5c6706adc5060
- SHA256 212b3d2c8f570375b95fb2de9f681a9f85796220b4bcb5abb6a2d248ffd9e1ea
- MD5 ae60aaf104b487577024715df996309e
- SHA1 ca80a770fd21bf51a4f1a3c05b1d4dc974780804
- SHA512 108efd4b3e463a1ce658d497de80fcdcb9c6b7ab08abd8fddd639e8de4383b6a4f793cb3dc249d9c5e6d157db897d10b65d1e919487e65b480305fa61be3c98f
- SSDEEP 12288:w/PGF6AJykhK9Qc955YkgP4imIJ93moIdsLvBPREFxQKjFBtD1O9rDxO77pP9jkf:Wu185YkRimID2sav1O9rDxMnkYAbmS11
- MD5 SHA1 SHA512 SSDEEP
Digest
f6:aa:98:bc:f7:f9:f4:1c:d7:17:98:2c:75:dc:c7:c8:5b:74:a0:8f:08:c9:0e:ae:f6:e1:7d:7f:64:44:0a:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
391995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\src\savapi.pdb
ws2_32
htonl
getpeername
send
recv
inet_addr
getsockname
ioctlsocket
ntohl
freeaddrinfo
shutdown
select
getservbyname
connect
closesocket
bind
accept
__WSAFDIsSet
getnameinfo
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
ntohs
htons
listen
getaddrinfo
socket
setsockopt
WSACleanup
WSAStartup
gethostbyname
gethostname
WSAGetLastError
getsockopt
shlwapi
PathCanonicalizeW
mswsock
TransmitFile
rpcrt4
UuidCreate
kernel32
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitNamedPipeW
CancelIo
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
SetLastError
CreateHardLinkW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
OutputDebugStringW
Sleep
GetTickCount
GetStdHandle
GetConsoleScreenBufferInfo
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
DeviceIoControl
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
SetHandleInformation
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
ExpandEnvironmentStringsW
GetCurrentProcess
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
ReadFile
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetStdHandle
DeleteFileW
SetFilePointer
GetOverlappedResult
MoveFileExW
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FlushFileBuffers
PeekNamedPipe
CreateFileA
ConnectNamedPipe
CreateNamedPipeA
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
HeapSize
FreeLibrary
GetProcAddress
LoadLibraryExW
SetEndOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FormatMessageA
DuplicateHandle
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
OpenFileMappingW
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateFileMappingA
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
GetVersionExW
GetModuleFileNameA
LoadLibraryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
CreateFileW
SetConsoleCtrlHandler
GetLastError
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
InitializeCriticalSectionAndSpinCount
RaiseException
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
GetConsoleMode
ReadConsoleW
ExitProcess
GetCommandLineA
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
HeapReAlloc
DecodePointer
CreatePipe
WriteFile
IsValidCodePage
GetCPInfo
GetConsoleOutputCP
FindFirstFileExW
GetStringTypeW
GetProcessHeap
SetConsoleMode
ReadConsoleInputW
GetFileSizeEx
SetErrorMode
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueA
PrivilegeCheck
OpenThreadToken
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExA
LookupAccountNameA
LookupAccountSidA
IsValidSid
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
EqualSid
OpenProcessToken
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
QueryServiceStatusEx
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptReleaseContext
CharToSTCHAR
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_free
SAVAPI_set_log_callback
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
494KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=185, id=261, version=27412,
count=19, id=260, version=27412,
count=8, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=26, id=259, version=31616,
count=1, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,
count=19, id=257, version=27412,
count=262, id=1, productName=Unmarked objects,
count=161, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/savapi_post.bat
- SHA256 4682c0f3dcbafa32e3dae743268a0babf67fe2970b4b0dd3f91cc7ed54627545
- MD5 0dc718c8c4ccc13e58f9224f1af1125d
- SHA1 51cca0861c564b973dc5017f6a9c86d47b2dad31
- SHA512 b6e4b9b9b50669198d35a06c15bf8334eb3e68801946a96be66aee00361faceed6eefd84303979c5fceb87588a21d4fc1c94ca2a9dea5fb062d2a9da8c4cf27f
- MD5 SHA1 SHA512
SAVAPI/savapi_pre.bat
- SHA256 ec07adec51dc57f42077b2757421012c49fc771fb8cf664c36505d664e996c36
- MD5 912510dd6dd41ca900d10834879601c7
- SHA1 4dcaa7061636cf05ad5fe72ecb20ca29f2c003fe
- SHA512 63f0e1b37d83d208d1d9fab44b74d5f0def82caeb4f2289d7ffb6bacb28013f6a24ae61d9a83e6684c80b5221675d76bc75a94c9fb2ebe31819465135753ea6c
- MD5 SHA1 SHA512
SAVAPI/savapi_pretest.bat
- SHA256 767637bffb932cad48218f8d128f2908e57c4a42326db29dfeaa1c5509018186
- MD5 55d563f40e716ab251760a52f49a0e68
- SHA1 fc8a086681368388dbf77199cabac654765b133b
- SHA512 b218b11f9d66812a76c99b5a9a8cc73f9c83c626cef17049425855d5242e9c2e4355557c94d8a9f4d8f0fa6edc99a4658849f5edbb0320f7342dae4bda18e34b
- MD5 SHA1 SHA512
SAVAPI/savapi_restart.exe
- IMPHASH 28329b2bbd34737edf89c242f51f5b11
- SHA256 4b75f1e230aa0195e8da68e481eeb90b9d85194f15e2d458bd8ebee6d9d69ccc
- MD5 9919de22bf888ab8d7122a04646aa313
- SHA1 35af4b2757b6d96e345ba43af1d126ccfbbeb23d
- SHA512 deb7c4af295ed1c90205bd4c1299c62dbed70711ae16e3eceb64b386ca5e78537f801c1641d13617a6ee448cb187bb0399990a8161abc6685f0ee941a110224e
- SSDEEP 3072:F52hQmn2wcv4N6eQQlhsPGhUI/CR5zC3MBqtRsivf1Z8OpyXBg7HZP0k:Le12w7tBlaV5zHqdEBsyk
- MD5 SHA1 SHA512 SSDEEP
Digest
ab:57:a6:80:c4:ea:58:25:e7:8d:b5:52:70:f1:55:ac:6e:3d:08:c2:c2:aa:0a:47:59:b6:84:fe:e8:23:50:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
8116
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_restart\savapi_restart.pdb
kernel32
WriteConsoleW
GetTickCount
Sleep
FormatMessageW
LocalFree
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetLastError
CloseHandle
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
DecodePointer
advapi32
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=141, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=31616,
count=18, id=260, version=31616,
count=19, id=259, version=31616,
count=5, id=257, version=27412,
count=98, id=1, productName=Unmarked objects,
count=3, id=261, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/savapi_stub.exe
- IMPHASH 25235b078b3d329488576152e6e2b169
- SHA256 91265685308da5d2a1cc5f478b83e43a4656fd075d7cfee3923380905fd8dfaf
- MD5 3899d956a9c88d0519e188d067de5d19
- SHA1 241b01e86a121694a48722ce4dc6c08bd0bf5cfd
- SHA512 7f6e4d7b279f3c08022af6290e4015f12d4e8ba54ef65681d162bb421f08a81b57b4b2e7004861638c227da746127f5e9d4ee7932f3e2067b990f6b2951cb633
- SSDEEP 6144:a+UDVHIZD9qmbvM3Y+c8A50LBZAzOejDx19iM856t0Q+GAC9k0q3Yl8rif9P2432:a+UDVHIZfbU3Y8/fejDxfiM85m0Q+GAr
- MD5 SHA1 SHA512 SSDEEP
Digest
8f:16:bb:ad:47:5f:b8:8f:62:0e:4e:b0:45:aa:d3:89:cf:fe:3a:cd:1a:9c:4e:28:5c:77:f3:42:cd:62:97:80
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Serial Number
38:63:de:f8
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 24, 1999 - Jul 24, 2029
Subject
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Serial Number
58:da:13:ff:00:00:00:00:51:ce:0d:f7
Issuer
CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 22, 2015 - Jun 22, 2029
Subject
CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA
Serial Number
56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f
Issuer
CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 4, 2022 - Jan 1, 2029
Minor OS version
1
Major OS version
6
Entry point
128989
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Windows\Temp\a2a2bepz\utils\forupdater\savapi_stub\savapi_stub.pdb
ws2_32
getnameinfo
freeaddrinfo
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
gethostbyname
socket
shutdown
send
select
recv
listen
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
ntohl
WSAGetLastError
WSACleanup
WSAStartup
gethostname
rpcrt4
UuidCreate
kernel32
CreateThread
WriteConsoleW
RaiseException
LoadLibraryExW
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
CreateHardLinkW
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetStdHandle
CloseHandle
GetHandleInformation
SetHandleInformation
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FormatMessageA
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
ExitProcess
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
TryEnterCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
CreateEventA
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
PeekNamedPipe
GetOverlappedResult
CancelIo
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapSize
GetTimeZoneInformation
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
TerminateProcess
CreateFileA
CreatePipe
CreateNamedPipeA
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
FreeLibrary
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetCommandLineA
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
HeapReAlloc
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
DecodePointer
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
GetStringTypeW
GetProcessHeap
SetFilePointerEx
SetFileAttributesW
SystemTimeToFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
Name
.text
Size
229KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=170, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=23, id=259, version=31616,
count=202, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=57, id=260, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/savapiclient.dll
- IMPHASH c23ac466c64dc5ed7062eba2817f1e18
- SHA256 8f5aedf1f8e8dd027aabb3420ed7e0e38219a7d8d3b880f3a46671d32270fc69
- MD5 eb905e77afda1a6e65342a83ac5fba75
- SHA1 93434d20f75db97bf1947043982d33d282db96a0
- SHA512 4fdb07e66639fe5efeea5f45a57db932be99e7ce81aac392f7fd52dc0b333a219da5af9df980ca3caf256f899640a4bcebdbdb8aa4bb2269160f692a72b880a2
- SSDEEP 6144:+e0cf8LyAE2TDdvqRyTsJEgXHr067z7WcYj57l5nFLFzGTDkYXVjdZn/FOoiOTFS:+e0cf8LyeTDdvqRyTsNHr0GG5FBzGTDM
- MD5 SHA1 SHA512 SSDEEP
Digest
1b:8d:ab:08:2a:9f:64:95:d8:31:2d:38:d5:c5:46:3f:a9:5b:8b:1c:b2:ab:a7:07:06:06:90:b4:14:6a:be:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
180806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\libsavapi\client\libsavapiclient.pdb
ws2_32
recv
inet_addr
setsockopt
send
freeaddrinfo
getaddrinfo
getservbyname
ntohl
htons
htonl
getsockname
getpeername
ioctlsocket
getnameinfo
WSASend
WSARecv
WSAGetOverlappedResult
sendto
recvfrom
socket
shutdown
select
ntohs
listen
connect
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
WSAStartup
gethostbyname
gethostname
WSAGetLastError
getsockopt
mswsock
TransmitFile
rpcrt4
UuidCreate
advapi32
GetNamedSecurityInfoA
RegisterEventSourceW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
DeregisterEventSource
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
PrivilegeCheck
OpenThreadToken
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
kernel32
GetModuleHandleExW
RaiseException
LoadLibraryExW
FreeLibrary
WriteConsoleW
RtlUnwind
InterlockedFlushSList
GetModuleHandleW
GetStartupInfoW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
CompareStringW
LCMapStringW
DecodePointer
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
GetConsoleOutputCP
GetConsoleMode
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetProcessHeap
GetStringTypeW
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
GetOverlappedResult
GetLastError
SetLastError
CloseHandle
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
SetHandleInformation
WaitForSingleObject
CreateEventA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ReleaseMutex
CreateMutexA
GetCurrentProcess
GetCurrentThread
OpenFileMappingW
GetStdHandle
SetStdHandle
CreateFileW
DeleteFileW
GetFileInformationByHandle
SetFilePointer
DeviceIoControl
HeapSize
CancelIo
MoveFileExW
CreateHardLinkW
FlushFileBuffers
ReadFile
WriteFile
PeekNamedPipe
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FormatMessageA
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
SwitchToThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
CreateFileA
GetVersionExW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
shell32
CommandLineToArgvW
CharToSTCHAR
SAVAPI_APC_cache_operation
SAVAPI_APC_get_version
SAVAPI_APC_initialize
SAVAPI_APC_uninitialize
SAVAPI_FPC_disable_preinit
SAVAPI_OA_create_instances
SAVAPI_OA_initialize
SAVAPI_OA_start_scan
SAVAPI_OA_stop_scan
SAVAPI_OA_uninitialize
SAVAPI_TCHAR_free
SAVAPI_char_free
SAVAPI_create_instance
SAVAPI_engine_modules_get
SAVAPI_engine_modules_get_ex
SAVAPI_engine_versions_get
SAVAPI_extract_malware_names
SAVAPI_free
SAVAPI_get
SAVAPI_get_dynamic_detect
SAVAPI_get_fops
SAVAPI_get_instance_pool
SAVAPI_get_type
SAVAPI_get_user_data
SAVAPI_get_version
SAVAPI_global_set
SAVAPI_initialize
SAVAPI_is_running
SAVAPI_is_running_ex
SAVAPI_register_callback
SAVAPI_release_instance
SAVAPI_reload_engine
SAVAPI_reload_engine_ex
SAVAPI_reset_instance
SAVAPI_scan
SAVAPI_send_signal
SAVAPI_set
SAVAPI_set_avpal_init_flags
SAVAPI_set_avpal_inited
SAVAPI_set_fops
SAVAPI_set_log_callback
SAVAPI_set_quickload_init
SAVAPI_set_user_data
SAVAPI_simple_scan
SAVAPI_uninitialize
SAVAPI_unregister_callback
SAVAPI_with_encoding_get
STCHARToChar
STCHARToString
STCHARToTCHAR
StringToSTCHAR
TCHARToSTCHAR
asc2bin
bin2asc
bin2hex
hex2bin
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=169, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=23, id=259, version=31616,
count=217, id=1, productName=Unmarked objects,
count=15, id=257, version=27412,
count=76, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/scew.dll
- IMPHASH 571b82e04a3103a0e1e37478d9e58122
- SHA256 10f3a985da345376502bb8e4fce9c59aa15633b78347bf9080fb61bdd2e3cd5d
- MD5 4a144eb1f737dc00689659b36aff0384
- SHA1 4ce0c8afbd153473d6a03fb2743e209b5ddd1c0e
- SHA512 68e5044ed77ebdcef9b0b3fec7174ef5faf56b38aebf5df64ec925c817021453e97a3a02a348996cfb3976b995e59439b3128930ba176600ab4b10c12ff40726
- SSDEEP 6144:G5ieH3XO7LeWBl3bVan3/G6C1XNj7rFIgQM3mbPnTbqMalXwnhHyz:G5PH3Xciil3kne6C1XNj7rFbQMYIwnk
- MD5 SHA1 SHA512 SSDEEP
Digest
c1:2a:dd:1d:b0:2a:c6:c6:97:1c:24:59:34:88:24:37:bb:16:26:f3:4a:42:f2:97:20:2d:01:3e:82:63:50:3e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Feb 20, 2019 - Mar 18, 2029
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
04:00:00:00:00:01:21:58:53:08:a2
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Mar 18, 2029
Minor OS version
1
Major OS version
6
Entry point
173781
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\kmr4g80c\common\scew\scew.pdb
kernel32
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEndOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
HeapAlloc
HeapFree
GetStringTypeW
CompareStringW
LCMapStringW
CloseHandle
ReadFile
GetConsoleMode
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
WriteFile
OutputDebugStringW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
SetStdHandle
CreateFileW
HeapSize
DecodePointer
XML_Parse
scew_attribute_compare
scew_attribute_copy
scew_attribute_create
scew_attribute_free
scew_attribute_name
scew_attribute_parent
scew_attribute_set_name
scew_attribute_set_value
scew_attribute_value
scew_element_add
scew_element_add_attribute
scew_element_add_attribute_pair
scew_element_add_element
scew_element_add_pair
scew_element_attribute_by_index
scew_element_attribute_by_name
scew_element_attribute_count
scew_element_attributes
scew_element_by_index
scew_element_by_name
scew_element_children
scew_element_compare
scew_element_contents
scew_element_copy
scew_element_count
scew_element_create
scew_element_delete_all
scew_element_delete_all_by_name
scew_element_delete_attribute
scew_element_delete_attribute_all
scew_element_delete_attribute_by_index
scew_element_delete_attribute_by_name
scew_element_delete_by_index
scew_element_delete_by_name
scew_element_detach
scew_element_free
scew_element_free_contents
scew_element_list_by_name
scew_element_name
scew_element_parent
scew_element_set_contents
scew_element_set_name
scew_error_code
scew_error_expat_code
scew_error_expat_column
scew_error_expat_line
scew_error_expat_string
scew_error_string
scew_isempty
scew_list_append
scew_list_create
scew_list_data
scew_list_delete
scew_list_delete_item
scew_list_find
scew_list_find_custom
scew_list_first
scew_list_foreach
scew_list_free
scew_list_index
scew_list_last
scew_list_next
scew_list_prepend
scew_list_previous
scew_list_size
scew_parser_create
scew_parser_expat
scew_parser_free
scew_parser_ignore_whitespaces
scew_parser_load
scew_parser_load_stream
scew_parser_namespace_create
scew_parser_reset
scew_parser_set_element_hook
scew_parser_set_tree_hook
scew_printer_create
scew_printer_free
scew_printer_print_attribute
scew_printer_print_element
scew_printer_print_element_attributes
scew_printer_print_element_children
scew_printer_print_tree
scew_printer_set_indentation
scew_printer_set_indented
scew_printer_set_writer
scew_reader_buffer_create
scew_reader_close
scew_reader_create
scew_reader_data
scew_reader_end
scew_reader_error
scew_reader_file_create
scew_reader_fp_create
scew_reader_free
scew_reader_read
scew_strcmp
scew_strdup
scew_strescape
scew_strtrim
scew_tree_compare
scew_tree_copy
scew_tree_create
scew_tree_free
scew_tree_root
scew_tree_set_root
scew_tree_set_root_element
scew_tree_set_xml_encoding
scew_tree_set_xml_preamble
scew_tree_set_xml_standalone
scew_tree_set_xml_version
scew_tree_xml_encoding
scew_tree_xml_preamble
scew_tree_xml_standalone
scew_tree_xml_version
scew_writer_buffer_create
scew_writer_close
scew_writer_create
scew_writer_data
scew_writer_end
scew_writer_error
scew_writer_file_create
scew_writer_fp_create
scew_writer_free
scew_writer_write
Name
.text
Size
258KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=157, id=261, version=27412,
count=20, id=260, version=27412,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=20, id=259, version=31616,
count=3, id=257, version=27412,
count=81, id=1, productName=Unmarked objects,
count=24, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SAVAPI/update.bat
- SHA256 924f07591863b3e6d43371593a3c4d57bba93cdbf59fdf102ba72abd55e92879
- MD5 b862a1baac142bcacd391414d665a0a1
- SHA1 79aa0c97010707640bfa3082b29fd61b1373dbce
- SHA512 788f4e959fdf91f2c3a2a46ff9d1ed51f96c73238f3e9aaab9e2b2bd45759645085082aa831220c9ce023a7a741213538d852658b9cbe4b12bbee5705e1f2d7b
- MD5 SHA1 SHA512
SAVAPI/xvdfmerge.dll
- IMPHASH 8e0283b879a0a5a261fb176ecb652c35
- SHA256 d20f7ad78d1d548ebea41f6b496cb2399f8186493564c777f192c9a0eed23f18
- MD5 af329640a44f6dc93e395e167a0c80f9
- SHA1 9f3c6e132c874ec689c2ab5ad21282f326d93694
- SHA512 988ce1e03736fbb4369bd5e0ffc52dae9c70811c65d11066d99a76e372fb72108d80c727fe4dd4e4e1125c927a68caf97af18009fb362048f408dbe36caba440
- SSDEEP 6144:ylOdse4zxgQM+50K5xDAcAd5gL22nn0kvrDmENiyoJjK7bdgaO/10kGsKceGAqUh:ylOdse41gW50K5xDBXlvrDdiyoJjK7bh
- MD5 SHA1 SHA512 SSDEEP
Digest
64:f1:e3:7c:88:4f:69:d7:db:03:39:7d:13:fd:48:88:53:4f:5b:08:ce:bc:80:66:18:e8:5d:80:cb:78:84:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Chains
Mar 21, 2023
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=HRB 742261,CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1303556c6d,1.3.6.1.4.1.311.60.2.1.2=#0c12426164656e2d57c3bc727474656d62657267,1.3.6.1.4.1.311.60.2.1.3=#13024445
Serial Number
09:19:dc:0f:b3:d2:04:5b:6c:9e:3a:13:d3:e1:74:e4
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 7, 2022 - Jun 1, 2023
Subject
CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Issuer
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 11, 2022 - Aug 10, 2033
Subject
CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 2, 2019 - Jan 18, 2038
Minor OS version
1
Major OS version
6
Entry point
148328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Windows\Temp\a2a2bepz\common\xvdf_merge\xvdfmerge.pdb
ws2_32
getaddrinfo
getservbyname
ntohs
htons
htonl
getpeername
socket
shutdown
send
select
recv
getnameinfo
inet_addr
getsockname
ioctlsocket
connect
closesocket
bind
accept
ntohl
freeaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
gethostname
listen
rpcrt4
UuidCreate
kernel32
CreateThread
WriteConsoleW
GetModuleHandleExW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
RaiseException
InitializeCriticalSectionAndSpinCount
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
CreateHardLinkW
OutputDebugStringW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
GetDateFormatW
GetTimeFormatW
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsAlloc
TlsFree
GlobalFree
FindClose
FindFirstFileA
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFileTime
GetFullPathNameW
SetFileAttributesW
SetFileTime
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
GetDriveTypeA
GetDriveTypeW
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
FreeLibraryAndExitThread
GetOverlappedResult
CancelIo
WaitForSingleObject
CreateEventA
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
ExitThread
ReleaseMutex
CreateMutexA
Sleep
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
HeapSize
SetStdHandle
CreateFileW
DeleteFileW
DeviceIoControl
MoveFileExW
ReleaseSemaphore
CreateSemaphoreA
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
TlsGetValue
TlsSetValue
SetEndOfFile
ResetEvent
GetHandleInformation
SetHandleInformation
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
OpenProcess
TerminateProcess
FormatMessageA
CreateFileA
GetVersionExW
GetModuleFileNameA
LoadLibraryA
LockFile
LockFileEx
UnlockFile
UnlockFileEx
CreatePipe
CreateNamedPipeA
RtlUnwind
InterlockedFlushSList
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
CompareStringW
LCMapStringW
GetConsoleOutputCP
IsValidCodePage
GetCPInfo
SetEnvironmentVariableW
DecodePointer
FindFirstFileExW
GetCommandLineA
GetProcessHeap
SetEvent
GetStringTypeW
PeekNamedPipe
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
shell32
CommandLineToArgvW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LogonUserW
SetSecurityDescriptorDacl
RevertToSelf
InitializeSecurityDescriptor
ImpersonateLoggedOnUser
DuplicateTokenEx
CreateProcessAsUserW
GetSecurityInfo
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetEffectiveRightsFromAclW
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegCreateKeyW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
XVDF_files_merge
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=27412,
count=173, id=261, version=27412,
count=19, id=260, version=27412,
count=4, id=253, version=31616,
count=30, id=261, version=31616,
count=15, id=260, version=31616,
count=24, id=259, version=31616,
count=15, id=257, version=27412,
count=203, id=1, productName=Unmarked objects,
count=74, id=260, version=31629,
count=1, id=256, version=31629,
count=1, id=255, version=31629,
count=1, id=258, version=31629,
SOS_README.md
- SHA256 72bab8ad57ae20824c84aaf9fe2e0e305b2108286e066545e6bac14ac7af1450
- MD5 afdf90f86dd5c98ccee0be65cbb99f0a
- SHA1 dd66bbff9bcc51522b0985d0f42b34277fa3ae6d
- SHA512 bc06ebe3b83956aa78190b543134d89112bbf33dac89faad71830cf24a872aa1982ded9d03cb38b969727502d26b7b9154781940f0682d5a7c7d330531a137f7
- MD5 SHA1 SHA512
SQLite.Interop.dll
- IMPHASH 34df93b01d634fcb6a5390542276120d
- SHA256 0dcdfbad2b4fd598ee78682b3920e1a268b03bb47b5dc26fbb9050089368a043
- MD5 5810639d1477c0c33ddd1efe75256dbd
- SHA1 6a6149730e40fecd9c30534e8f806e310d03e1cd
- SHA512 f22368fcf5fe5495d0e318b692f163e8e6438735601132fe0d66158c8ae26e99453e8931388884ecfd998e42de3f98bbc9b10e89ff081609006b9805c1a40d9c
- SSDEEP 24576:W4QYrTvFVZfiPaD0Yfvpmy/tabrremrrD5tNdKksOLnvirpl7609abLvN:EYrTAPDYf1mD7KksOGrpFkbzN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5792
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\mistachkin\Documents\checkouts\sqlite\dotnet\bin\2017\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
OutputDebugStringA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetFilePointerEx
GetDiskFreeSpaceW
WriteFile
AreFileApisANSI
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
DeleteFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
CompareStringW
LCMapStringW
GetACP
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
DecodePointer
GetConsoleCP
GetConsoleMode
WriteConsoleW
advapi32
CryptDeriveKey
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptDuplicateKey
CryptDecrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_msize_interop@8
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=241, version=40116,
count=129, id=243, version=40116,
count=38, id=242, version=40116,
count=29, id=261, version=26706,
count=15, id=260, version=26706,
count=24, id=259, version=26706,
count=5, id=203, version=65501,
count=141, id=1, productName=Unmarked objects,
count=1, id=264, version=27038,
count=1, id=256, version=27038,
count=1, id=255, version=27038,
count=1, id=258, version=27038,
SQLitePCLRaw.batteries_v2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aebb3dbeda2b2eb0605a20acc126b50aca3795b066155292dad3666f730603e0
- MD5 0c9ba51b96a446e0fdce3810bf76fa45
- SHA1 6defb626766f10eeedae8dcf67c3f9b13be7534e
- SHA512 d74fe14562b39f74c4b3d1e1c0db95a77796e209d21006e5af4d82840febbeaf7ce6c2b15cb0622a4250890bb005ece3488190e00344ae2d569917c94e462bca
- SSDEEP 48:6kPbdHwQ4Bspt3ya8iRqYcbKNGeztNSClElgiNEpij4iuAO6CDV/ozfLsnOVjf/q:tR9MsziavRqYcfeztNSClElg0nOdVb+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SQLitePCLRaw.core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd9862b8fbfd400e8526aacd7bad012a7788f00ed13a3a9458ba3f20a6512257
- MD5 879b403dd3ec1d71623920b0ee2d1069
- SHA1 51d4ce115b2a57d58dbe42df31402934eb34463f
- SHA512 ec89881e811ff07dc89328019369711a80ead72a86ff9a9d3e55858dae89897d28dc847195128e2b15bd6402efcd4a7b62b986fc599bc9b00488fff086757fa3
- SSDEEP 768:xUS2u7++JE/4pXstBztMp0R0eNiNib1KgNsVr8EI5P3tOedVHAMxkET/:Zu+oqXstBqboiVQERedVxX
- MD5 SHA1 SHA512 SSDEEP
Digest
6e:d2:cf:20:ce:ab:46:3e:e0:f4:7c:fd:7f:3a:63:59:41:3f:c0:47:30:6c:70:97:71:b2:2e:ab:21:91:b6:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
50958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SQLitePCLRaw.nativelibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3210fe35503c5cee094f9c1b86710850dab15deb36ea53c266a9665e4ecb793a
- MD5 f7bd7cf71c917b7f05667945775b40e3
- SHA1 8140e79d3aee95ad338d292407e5c0acca99d494
- SHA512 6dcac6e463264c74370f5b3f2ded397cc3fe198e9a739fd7aae04348e149e205628d1496a71bcf65f6e843a7ff61f7cf60b6c4616e062c4e81c2c5b5c921261d
- SSDEEP 48:6fyiWa0CmSUgG6S3mUPIbAO2NlMrpidNtgTHL9hbmD03cDLsnOVo9ryyiii:x9a0fSK6S3ZMAOmUL9dosL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SQLitePCLRaw.provider.dynamic_cdecl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7f066394f6754b1a06dee90ec6f076d9bfcd07033cf6bc19a2af8baf746e8b2
- MD5 ddefd87d06e352815663d1be0dd33d72
- SHA1 d058fc451aa076dd39e32303e78ac9dbc3334cca
- SHA512 9e8df90322986a252247b0ce9f2faa8532f92fa52d821fc1cb46b2d63d89b67cf48d65d31a99998f5c5c75357bf168fc301894884243cab96f44266abba4fad4
- SSDEEP 1536:iUZbxdTL9g2M3KuHDSLLkOGYoH/spwJP:iUNxj5LFGYcP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SSCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 38ef895e3910c6e19ef0255093587840ce630bd614a060feb44150eff45dfbbd
- MD5 22e6f53e4ee30b78b0746e4b5672f2e3
- SHA1 073cfca6b4d9324777fc07228e04c74c23dc0ef0
- SHA512 33436eb0afc55f0a4445b979d6285f8bd332def68aebb474993a3273f608ae83eef551ad82b7e5428e50a6293df7e7eb4600f4a13ebb484b309ecd8aa5d07c30
- SSDEEP 3072:e6Wo0c4hdUwUFwh69UOdlIF2122PuFhwtnvXGRcns:3AUhE69UOdlIF2122PuFhw922s
- MD5 SHA1 SHA512 SSDEEP
Digest
e6:31:8a:e9:a8:cf:3d:38:c7:e4:3f:00:41:44:c3:6c:dc:11:47:1a:96:59:b4:3f:82:84:73:b2:d4:35:80:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
147134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Savapi.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d40df6a43346e5ebb7e6d52bc0bbc65354d8d2d8c5d4acc09d0cfcfba74437d3
- MD5 75b793d4c364c082c55625ffb5db69f8
- SHA1 f21de5183c531c50ed2627440d6b4aff97c10d0a
- SHA512 7b2fd2d95cf4cb918ce1c73a201b2f5ea8e23003f1c7678026e1a23d8ff4fb683b707b33f0e7e3b4cd5d53c1085e1645968da808f6b78181558d5b9e9ada6bee
- SSDEEP 1536:9ned8SoGyn1+JluF3X+4pF1bgHMbw8PWiIOZLvVOKZ1369Wxy:9ned8VGy33XVpfgsbw8PWiBR8E8
- MD5 SHA1 SHA512 SSDEEP
Digest
82:7f:0f:72:fc:fb:9d:54:c4:ab:d4:da:be:67:b0:d2:8f:f1:b5:01:34:4e:a6:eb:e0:7e:33:9c:88:55:f3:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
86542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SecurityService.deps.json
- SHA256 0e3511d21b5ae8e724322a16188558c78814558c1a20950c66e1e7fff5810ede
- MD5 d3da7acc157cb704aaa29c814100e142
- SHA1 bda1ce953f6e3f0f4c4bcef2d5905b5679b6e2d8
- SHA512 c5737b7cbcc7cf1208dce95ea0b66e43802bbb2dfb6e60787854431cc4f413c63e22769564057bf3d72ba391b68a0c2c30d3e9296d16546a86d52074d52124b9
- SSDEEP 3072:9O5DgP3el4UUt1YueccmnAH4RMwpRkgTf1yMGtHZqeNosl9S6r0giHa9b:9AiHm
- MD5 SHA1 SHA512 SSDEEP
SecurityService.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ddbd34135d6d4356887a7f996013d7e7a5ad63a4f5aa7990d160c2668d93ae7d
- MD5 cac3e97b3fd12cef84a41263016559b1
- SHA1 390d11c3ad94b61aad04a04f00d0da977fbb121f
- SHA512 614e5decbac6aa7976daded1635752b3eedf2402d074999068fbb0428330dde7d86661ae3b7355e13e9a685b0f5a1684cf43c7dc898c3105bf80b8d2a5d3c9d3
- SSDEEP 1536:6vCv8KSmur55VQg1p4Qqq3h08HC3HbwElGwYBlCaxC:6D8q3W6C3HbwElGfre
- MD5 SHA1 SHA512 SSDEEP
Digest
f2:76:eb:92:96:51:ed:6e:33:7a:42:de:4c:bd:ef:11:f2:e5:83:a1:9b:59:60:7b:3c:34:64:6a:0b:7f:69:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
62382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SecurityService.exe
- IMPHASH 0e4978c6d7358363a563494a824fabf2
- SHA256 393a4cf8bf0709d5ba956af454a5fff5dd89fa6541a3ce7138d4a7e7454120d2
- MD5 290fb31b70589b9f2f2dd115c1d0438a
- SHA1 99689b00694074083d90afbd38709e7fb8739a41
- SHA512 f341c0ca42ebc302cac5a4c3202b5171f6be0c5847ba061bc5689bfd520428b8748d47f34efa633ecb9508fb59bfa2672d9b5a5b64a40c27c9313699c620c22c
- SSDEEP 6144:tQPq1nKLOxCM4A2XwL/vUkXVXXCXXzXXXAXXXUXXXPXXHXXXHXXX3XXXXXXXTXX8:thl0MwU/ICJs8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:1b:0a:35:dd:14:fc:f4:b3:77:25:36:76:47:b5:f3:bb:2b:61:a9:57:b7:57:42:7c:c8:72:20:86:7a:8c:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB
Chains
Oct 31, 2023
Digest
9f:1b:0a:35:dd:14:fc:f4:b3:77:25:36:76:47:b5:f3:bb:2b:61:a9:57:b7:57:42:7c:c8:72:20:86:7a:8c:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB
Serial Number
33:00:00:aa:30:3f:cd:59:83:f1:84:31:64:00:00:00:00:aa:30
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 30, 2023 - Nov 2, 2023
Subject
CN=Protected.net Group Limited,O=Protected.net Group Limited,L=Larch House,C=GB
Serial Number
33:00:00:aa:30:3f:cd:59:83:f1:84:31:64:00:00:00:00:aa:30
Issuer
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 30, 2023 - Nov 2, 2023
Subject
CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:91A2-966C-63FB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2d:be:3c:b7:0a:b1:90:80:be:00:00:00:00:00:2d
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2023 - Jun 14, 2024
Minor OS version
0
Major OS version
6
Entry point
74032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb
kernel32
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
GetTempPathW
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
OutputDebugStringW
GetModuleHandleW
GetCurrentProcessId
Sleep
RemoveDirectoryW
DeleteCriticalSection
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_get_initial_wide_environment
_register_onexit_function
_initialize_onexit_table
_controlfp_s
_exit
__p___argc
__p___wargv
_c_exit
_initterm
_initterm_e
terminate
_errno
abort
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fflush
_wfopen
__stdio_common_vswprintf
fclose
__stdio_common_vsprintf_s
_set_fmode
__p__commode
fread
fseek
fwrite
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsicmp
strcpy_s
_wcsnicmp
_wcsdup
strcspn
wcsnlen
memset
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
_set_new_mode
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
setlocale
__pctype_func
___lc_codepage_func
_unlock_locales
_lock_locales
_configthreadlocale
___lc_locale_name_func
localeconv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_time64
_gmtime64
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=260, version=30034,
count=13, id=259, version=30034,
count=76, id=261, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=26213,
count=163, id=1, productName=Unmarked objects,
count=13, id=261, version=30140,
count=1, id=258, version=30140,
SecurityService.runtimeconfig.json
- SHA256 202001a334948c50b6754226e1d935ef79b42e8b51c7c2311f5b86d4c3401acf
- MD5 1bc39e80d6d10935c1e3c9503108e508
- SHA1 a5272c88b3cff15e52f1f1ac348284fb962ec875
- SHA512 5c7a59f20016e42f002585cad1998f50de5e22e7486344177fd61feb18f4d9130dc84e7d9c925034f3b3454310ff4e608ceff3b829ad3c8572803bba17c9dbda
- MD5 SHA1 SHA512
SharedDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e68e4eb5823a32b73fb0eb592d4b9f337fcb4047d13f563516d913f482bebbff
- MD5 f5dc0973ee6141bb59abe4608b8c1392
- SHA1 ab32a70cb5d8ae0b4ec4377e70491721253c6d37
- SHA512 5c4e3849d9aee870d5584d35d20ef4fce7512ee1d1b8949727e31a72ff43f335e5fe448f382c49a354b91ce7fc75b823180ebcf37fae9282144c171cc0195bbb
- SSDEEP 3072:iQE2ZTVSljTS5qfqiQScZXcuDfYhBSiRFHprWQljrdIDhq+n7:P+YCLFJrrK
- MD5 SHA1 SHA512 SSDEEP
Digest
8c:28:df:b3:aa:c6:6d:0e:d5:08:13:ed:9a:e9:22:88:64:9b:fc:ec:1f:65:d9:32:e6:a7:a7:d6:8e:fc:57:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
204238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
191KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.AppContext.dll
- SHA256 76b3757d6a5da7d268a412f342ce0997b2649978504f25daeb9190266a4686ce
- MD5 97057f8b94f3ef7bfdf76bda971d69ed
- SHA1 b4d80b317b7ca2d32879305faabf7d49af4fb7ec
- SHA512 6fff3c4bdb29e7a82f9868bf0d5120ff26a1a7ab8bfd9ab5c2231315d4444ee2aaac2d484326dedf78e384e1ebd4f5985dc41afe1509a0c11e44cf8774f273ed
- SSDEEP 192:ixW+usWtOPGxVCdkveWvcuyjS7HnhWgN7aMWhteGxgV8FGecX01k9z3AK/V2pA:iW+usW/VCdk37HRN7LnHR9zH/wA
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ba:40:50:c8:ba:8e:0a:c8:41:e6:73:78:49:f7:64:6a:1a:d3:fb:77:88:a7:81:8b:c5:b0:60:14:70:e9:a7:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.AppContext.ni.pdb
System.AppContext.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Buffers.dll
- SHA256 8e4f4a2a7e7a389f86004ee0b0dcff9e99f0375cd4ae8b1e3f751626fc633973
- MD5 ee51a763ea8cd7a3115ecb3c99a5544c
- SHA1 a8b0bf1ba791f0ad38b92d8893a8d3f6f9656b8e
- SHA512 f6b6232a453242d4856b420556f5567ed71ce85c8d23f9ad3f4a2cf0d3534721d124caa07d7de6f2efc192aa3b4dcbd7b03cbc23702e5fb823cb59301c8af520
- SSDEEP 384:kWYdhWBn6Xdo5d7HRN7rCDeZR9z4emA9u:gyrJ+DU9zHmN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:07:37:42:da:a0:2b:2a:a6:b0:ec:cf:fc:8a:5d:86:8c:df:21:dc:ae:d7:ef:79:9f:6e:21:88:dc:7d:9c:b9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Buffers.ni.pdb
System.Buffers.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d3910d8782594fed0a1542362ac0af0189ccbbe78bb084a75759245b0fbb77bd
- MD5 f92060a47c375aa93f21dbc0aa18f908
- SHA1 34642be2d85691828482d6b7b78b1f0cb2b387a9
- SHA512 fb73612565bb43981a11e12dd89477e5cc70c1392c3948a6d5a44e4d9b3d59fe5ee9723cf21cb7cd121cd7933c347201ba3adf42317c77b3c2dd652f4130350b
- SSDEEP 3072:Rcr0PWG/8ybZnOckimh1OoFDiKNpXcMpHIX/eTnUlIbEKYk/qcRt:RsVSoiUyeTnglkfR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
175838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Collections.Concurrent.dll
- SHA256 86bd69a2f0fc3736d94deb5aa3e695a2b99d692c743f7f2b43e8ddf199ae6eb6
- MD5 34c497eda61e2f73726dc57562e96b7b
- SHA1 0e1d04c8d1609a3d9a8d3aa18fb46779f1806a64
- SHA512 dddceb67b4fce4a1b59aa6187d63b80c44587d7a60ebcfd3a08220e7c1ccf98c3a1006b6d42fb2c2f2219020a1c675ddff69e4e5b2fe86abcb1935c4880b6116
- SSDEEP 3072:e4UhTsJCh/g90Mhy2NDO2OlCVQrrFaUSBik2zRR4RCKyhRsmPSb3Tec+hZ0MQJ6c:pUhrZYO2wFaUSBirYUA6cAZ02lHf1Mbf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:bd:1e:6c:54:54:05:61:b4:f4:25:20:2c:72:0f:f7:57:d8:dc:9b:af:ed:c5:04:d2:10:17:b3:71:dc:96:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Collections.Concurrent.ni.pdb
System.Collections.Concurrent.pdb
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Collections.Immutable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3c73145b2a78a6a37abbf428f2ec82fbd92840d207f0c03a66252a22b632bd01
- MD5 5f7aca1f4c6723b9a616d58523183c7b
- SHA1 d19ad439d779be30c2d8efef93fb4e30bb506bfe
- SHA512 54623d1b5d6e555fb284d082bdd0e8be6b6101a0fd329c8d5b9eb15055ff9c69ecb66bc41a89ea91460f4d28a0bf6eabad22638ffd618811a43134c21a6cdf01
- SSDEEP 3072:fuEBOblJax1oIu4WLuFgoZuptFwVYXu1xmb4Y6yqKcpFcfHCTESAg/qMxTHxQJ:fu5IVu4WqFgoZuptFwVYXgG6p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
172974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Collections.NonGeneric.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f7f125366baea508eba4f5c58db2b796bca77f1ddb7ef58d9cbb41f48552817c
- MD5 e5149c5a1b021247b8eb3102dd12c37e
- SHA1 d3ff95fee15ef11276f04228079df0aa6bb36ce3
- SHA512 972926f98a286776faa228bcc0f4348ce10b027a93aba942c70950dbf81d1bb97f82c00e773a24b008429e801eb3d78c4dcd8b7144c40c3585b741cd23cc5eb3
- SSDEEP 384:+wk8s5hYkV4K9H++aJ4Z98CPYQEW0wXV9R5WqKj02T6acdzkGX2qyaB/nutgNEgC:FQhY+R9HKj/Ytxy4YgNEgVcZ6XWoMS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Collections.Specialized.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dfce971806b56567a816b8364fa0880679dbd81c1024c135eeccff3c9ccfecb6
- MD5 f765dcc06acb0405773428bdf129f8dd
- SHA1 a8ab97da616c4a6b029751be3707c8fd5b062ea2
- SHA512 0176e3112796f04ac8865aa62047e50d243917282860d057c1bc4ce8a7c58ca24f1286629358b66dd0a67fe1c0c2aa5319735d1dbe60d8c6e75ac04e1e8df01d
- SSDEEP 384:Tkg0Ugm2/MzgtSWeJDoycZIDz6KpDCqCBJ2i6c7bsaaBWk9j38x5iCaM7W8xaqK6:IgPtMDyZ95CBJ2POKOs3jPvwV+GJ7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Collections.dll
- SHA256 f1bf608e71fd2b229b7f2f43aca213858b5fadc79a388fbce3dd125bf003a205
- MD5 9b63ce723dfda91347901c0475e65430
- SHA1 6074f7e122ee6ad2f236600e70bccf2997e798d2
- SHA512 6597c9a7e25b6ba77950fe01db912a1d270d4b34c3245397265c7edd4eacfa0094b499cc167132253b271e5badb6f0376222dfff6446ba84219559f51ea24410
- SSDEEP 6144:MtXwIIhqhvyiMZa+lXOd5iS6L0ivTKLbnfsr0:5Iii+XOsNTKLbd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a9:d3:ed:27:8e:71:63:44:c9:28:2e:c0:c2:2a:94:1f:a7:41:d1:58:89:eb:c8:83:cb:66:c9:5d:40:44:ab:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Collections.ni.pdb
System.Collections.pdb
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
261KB
Virtual Size
261KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.ComponentModel.Annotations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1c9ca64fdf263d84d52fa4b2b1594a400b57a873139439c065625ff8e2a21a5e
- MD5 30b1666571a3852105649cba73c55121
- SHA1 9fce126661b79cf304ab3990751f45bb11c2b3bc
- SHA512 cd82b3674d85587ea2fe0ab82af0a57bcbec55455ca87ad364164b491d9b8cd94cb1526d14997d5a53592f30c7aa22365a024ff83820fe6f0f3e3a8e4137ee1d
- SSDEEP 1536:EYva02E5II96J0OsHPLljEPOtJg9yVGGBuA:M02E5IILfPLhEPOtK9yVNBx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.Composition.Registration.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d9424f2fefcf665694aea12e2cb7ff7fbc7196049af90caa0e43cbd1563f436
- MD5 aff4faf177f73d0e257b544538bddcca
- SHA1 268bffd8f5da2603dba26733a9611bb5befd0cc5
- SHA512 c70e8144915e39ce020fb47aed98a471178f5639e43cd9075973e520116403af6f6e56bc5ee52646eed879dddc206a6a8faec1a4ae5e39da22c18abcd4e695fd
- SSDEEP 768:VtXB8spyLLVCd1vnDb1ZscSLVZ/VYxMCii/9EDvn:V5GsQLarR9kvZk/o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.Composition.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3d47555080c369692813fcf34e70b01642e4960d3b8048c448ca939a9e1ab30
- MD5 f84d96a9698df9c7e48813376c2fc81f
- SHA1 7eb3c012e2c53520dfd2086a8a7915ad919c28a8
- SHA512 3d73af67e314729ff3d57070fa0af5e7045847aa912d2173a0b156da590358e6b52154c6b7d32f10d1cba56fa8bcdfa68e69d89e15d1b6f25bba16b102c5b8b9
- SSDEEP 3072:mjrq86pK+9H9eaeaXXGUsnNjwaFmmgDX/cOoW6xVTIcXbjy1oPv1Cp7CEQtktCsf:mjrF6pK+977nmO56QcXvVHqhptCsayB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
263406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
249KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.DataAnnotations.dll
- SHA256 b9a9a982e1b48977cd6ec751e818bb10f21547eed609c0614a6da3997417928a
- MD5 ac924580d865d2df33df0f6b74652e3e
- SHA1 e12e1c03479c1daeaf10b4536db2f3dea3be87a0
- SHA512 c41dc2d0cf942dfa748cefd99b5d204a5952a91aad5134024348a8602c21bbe7198e32e1bcb58974f0ac6a467d1d2245ad0744cc70f093d56b02bf9335e80456
- SSDEEP 384:MWuSQW9LglJeIeGXxnM4d6Stue7HRN7Pwd7EHR9zcq:5/WtjPO7Ex9zf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1e:11:86:c7:d8:76:32:43:07:5e:72:4d:ca:4e:0a:59:e7:60:79:2e:90:8c:99:f3:f2:e7:9b:3e:64:08:f3:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ComponentModel.DataAnnotations.ni.pdb
System.ComponentModel.DataAnnotations.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.ComponentModel.EventBasedAsync.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89a2d921f2c2203e3eb295acee96b3215e6306e30d0ee1a39150daf868b507f2
- MD5 d8de0d9fcda718426d3072f4052c6485
- SHA1 fab9768c697a6c4e6f9428f851b33e8203b57b99
- SHA512 4707755be9fcee8615a3feba2012a098fad609fc838f3a6296d04f60830ca9ca8f6cc82e39f3f80219749707ce819110a86bf752106e1bd7122bc2ead456b8fc
- SSDEEP 384:NBymWyiIAYmu2ZUQ5JRD5dN8+RbZ4jJwVJugzp05WvbnW:NE3u8UkTNzOctd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6101264a84dcdaaa463ae65876495d7ad10d7f03161b4d1244cb880441ab178e
- MD5 387448bf92f46e5677c8d2d714680326
- SHA1 a9c69ec20d71a053f1a4bb420941b3e4c2806a4c
- SHA512 d2185de7191013ab47f843bffd8fb4b6c1a1633e73b09da145bbc74c55fc9e63a241a23d7b4f8957603489fceb7f67537dc2594bbf4061f0dfc3006695919dcf
- SSDEEP 384:zwA+OR5hINt75/v+8Di4LfxwoEr0nR1C1ipH5w96qtWnoOW:zw2R/et7k8mHoEQiCnY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.TypeConverter.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f43a2bb016e6876ff787cee39884471b500fa0a5261735e9e16e85542af8cfeb
- MD5 b8283cbf4a540b91b92ee5cd218c2630
- SHA1 0c3efa24fa62d4e0aa3835e1cd4d4009b3b292c4
- SHA512 3f3fed446cc85845d6d73fa38ceea14c50b749a8b2339f0a8bc8777db2b643ef9f3b5821594bb68093428e38bac0e14fdfd535d1691823b9d6dcf334016a9731
- SSDEEP 6144:ZBxLwZHK1PcEwy8bSAmcxKOTeNcB00hxVjrrKcC:aRIbwy8bnwNcBhPf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
264334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
250KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ComponentModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a15a39aa1df6a921085bf47cf85183cbff7b6e94cfc7d1ab478195167782babd
- MD5 0b18c6343b9cac4158936fe51c0ee660
- SHA1 404bd6c558e9b8abb3692a3071d2b38c2e50e45c
- SHA512 6097c234fa0fe44285d15bf3e3d38f7ad1079626c3c73578aca6a0d84c550259556a69a2185dc210046ba0b63086c4c22e035b67ce15a6d81a206bef0e5f75c7
- SSDEEP 48:6mFo6KQ+TuoY3LlciVcdDf3D+O8gOFF+IvYSPbDzDseDSyWFZWOTW0KRQW3aWE5Y:Fo6KQ+XKFV8+A+FxvYSPbDzDmW4syWE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Configuration.ConfigurationManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d9629ced6b319b38524a7058e66a0f190452d1a24dc615fd66f8c4317c9ad894
- MD5 5294941977402f5a9f85d3075feb5870
- SHA1 84a98acbfe206f02e04035bd2df17cbcb629af20
- SHA512 4721307125dd61cdcd6a56b490596d2ee0a0f117abf477be6926a0124544d3d5147fc6c10d9ccb33bb41a3676374fd3ecb3b0b4098359715c2dacb59f2cc1f8b
- SSDEEP 6144:hn1wmsacaTpNltGDafOsdV0Z8oApKK1sPTdokGH5OTNWLOdqJJQN9NtxwP9SGcio:d7staTpNjG+fOsdV0Z8oApKK1sPTdokr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
370974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
354KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Configuration.dll
- SHA256 329ebd13feaa6a484a272ff7da93a00557afa61847799485d9cf101a77a35366
- MD5 b3d9f7e6c869474cac528fb820c2bcd6
- SHA1 bc9a6d99e6a9e193665c386392798372202f09ee
- SHA512 9a758f942a49da19433e697787d1cb98e438779c37d8f5791342d19ec004aeb34a13d07aac692e05ccf27060a55864808daee10e1d31303a6a63da8b5683f9fc
- SSDEEP 384:4WvE6WnTXTSv/fTNRvGZYdf3zyP/weDgnJedQMyWuk7HRN7EAFHDeZR9z4Ot2n:WMQknz8FVFHDU9zLkn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:e9:a8:9e:dd:b3:15:dd:b7:77:64:7e:73:95:2b:fb:c4:df:c6:98:12:95:8e:cb:e4:ed:d2:9f:ee:7c:99:26
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Configuration.ni.pdb
System.Configuration.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Console.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e5dc9c6ea31e667413ebcfde4ea5ef6e1e1e6296b1698e717924becdc3d7064
- MD5 c2efc291f336ded197a1957c0478bb8e
- SHA1 b088d2f3a130e71438a307276727c9c295c5792c
- SHA512 fd3c75964bb960ae234abef12f14fe0ee0ff342ff9d96396e25be1176e47f90a4bdec994f1f438c404caaabf3497c327363f062e4b875e4b9e80d54e3b64dc87
- SSDEEP 768:QDqXT/HhpokAfpJoAe+otGtmxbsIxSRZaeqJsB8N7LrNJJeKm5VyBAMxkEZ:J/kkuoAe+4BsbUJsB8BpeKm56x1
- MD5 SHA1 SHA512 SSDEEP
Digest
96:fa:c1:79:93:02:de:f7:e8:5f:da:ba:ec:9d:51:0d:ba:ef:fd:28:88:26:20:d3:46:ef:4c:5b:1f:44:d2:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
68478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Core.dll
- SHA256 66bd8ef96f1ca8c3578e3b8e6ee2a7564b79c08c893d0639c9e3d79f29779f3d
- MD5 347aa3e63d9daf15be3f5fde2cd2c971
- SHA1 51d76c9d8d94ae8b329080217e91a8ab90033342
- SHA512 966b231192e2b04e8e56153c037dcf17c01878bbd5b92b3e5dc141d09025f613b2ccc7bac9a7ac5309d04a6ca3d2593e851a479246381a500cc1d8948e62a7ae
- SSDEEP 384:VWXdhWxxkVVOU1CXtlB7ksmopBFXLwJjd0uQRz2+gqXPRRD185ddOXJuquh7HRNb:0W/bB7ksmopBFXLwJjd0uQRz2+gqXPR8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d5:b4:49:c5:77:da:0a:af:ac:12:83:0e:0b:7f:83:27:15:8b:d9:08:e2:37:15:bc:8c:f8:de:c4:e3:be:4a:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Core.ni.pdb
System.Core.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Data.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc63f1a6bf5eb643facc49a9741cbbb881ce13ebc1672c25feb5017516d9f12d
- MD5 949867e3df037992b6f6df7b91aaabaf
- SHA1 104622ae7b3abdd5d79bf7cbeae9001f00403aea
- SHA512 2f16ef2fbdc62f59b576003b6118d66aa9e8ee471a1140eca2a5893a1f70bfee5f22141147060e49c02e101e17371c99b0a49b0fa5e61904044b998991b21081
- SSDEEP 12288:iYmCxNCYK16zj4t6qsGjGvMaQ0aW3miUgnKq4MCBubAlX/IRNV:XpfCYssGGMDW3mifKq4vBPX/IRNV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
959790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
929KB
Virtual Size
929KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.DataSetExtensions.dll
- SHA256 ebf0cb220bec0ebdafb2b3aadd2feaa0b315903b66f438e10022e97cdf40b122
- MD5 cf0fdfd68fd31c3cd54c095b968a3b83
- SHA1 7d65f542a217df807f75766c5bbef2137aa2ef60
- SHA512 55ea61cef71c30302aa9c7b0943ae99b3ffc2c8cdcf4d428a96c646557081568048c5519627c42b2c9f2cf8d59dfbc3844885e56b698162d6e9a81b7d3e5f986
- SSDEEP 192:XARWa+sWapV/xkjbPOdVyeWvcuyjS7HnhWgN7a8Whd4N+KD1Y6uHX01k9z3A3rRZ:XARWa+sWgkOdVc7HRN7cO3DeZR9z4rRZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f7:5f:d1:e4:d6:12:7e:7d:e7:57:17:ab:20:6c:95:17:57:5f:41:e1:9e:d5:99:d6:56:71:6d:32:5a:fd:83:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Data.DataSetExtensions.ni.pdb
System.Data.DataSetExtensions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Data.Odbc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e4ed82f8cff2b194c223b7cae7dd67a54f433fa27e895ec216c57576659ca7cc
- MD5 17219622e80e5992fd7f44efc3fc0ef2
- SHA1 3902c70670f0bbdb6fc58c7dc84cf92d9ea47e31
- SHA512 62defd5445bb88705bb8af9b5ca3e920af0472b075f1f5cc05b564e2010e3d185b54528cf16f5f3b198a5b712cdcb969314915be032ed0040c3424cc3a0cb294
- SSDEEP 3072:qYoi4nfyAqFhVsTvhN4AtfAS7bCXEi/aMeNOhw6F0NYfpfNs1ObOF/Ai6u80/tL:aqAqFhyNn/CUijwZN+f+1XF/Aiz8M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
256270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
242KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.OleDb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2ec6f1fa47ea95e42820119bdea16416dbc99ccf9993e8c572b65e2cf13eb71c
- MD5 696b0771a3e4563dba4f2dfe142f3a61
- SHA1 5d110f65b56140d1a4f71f18162bedd02e04ad46
- SHA512 953adfd1aa41477f07cdd821d5c9de6afcefad7062a1bfd41dfc5054f37048511b3db2dd17cd21576065287fa44f59c7f3dcb437f426d77c7a28d61a71485a26
- SSDEEP 6144:ovZNPlrF7urbtYC/Hx4rPHM37FJ5lKcVrmj3y1UYcf:mNPlhtC/HC7Mb5Rr+yy9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
351310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
335KB
Virtual Size
335KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SQLite.EF6.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d76c1b7aaa70c319d5802505214ec734ecbaed9f8e9776168e25ff0808c4185
- MD5 4f428be996d234e1e66b4651d5850f8b
- SHA1 4444f6b6e5fc3b117abfbc097358932a72986532
- SHA512 302ef1ebc733d716150470a37c21fc8037b0ce2404a98d73b94c84f0c015e69a1c3249d887605ce577671c20d6c5011be6e3d5510a774dc46f2e214115fa5491
- SSDEEP 3072:AruAaoTvRdmltzgAHVwIn6KP8sPBsq+4uZ4AIa2r:AruAaoT3mlhDVwA6KP8s2q+1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
189870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SQLite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 27869ae8706d91d81e29b669e8140abd8b6bcd0c8df18e70fcc7d6ecec9469e6
- MD5 3a3dc6f0ff7b9d8311b62243f45119f1
- SHA1 13ad0df5d3914bf4529cbe424275cfdefcf16aec
- SHA512 031c7ec34f07499f94cea63b09dc53cb3515a139cc60c0544c76be8fd6f9211f53a7daf927b5d1487abbdf945ac51ecd8e8d82b48a706c6a21173276d6b45c0a
- SSDEEP 6144:vA3IUiJWeZ4idh2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5i:43IV6FNFaFeFOFwcGF6cmFWc0FWc8cIO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
343KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.SqlClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa4c1ff23369da57b5629fcac7ab9a9dc1729d57d709c4f8773dd78dcc35c2b2
- MD5 f40298c4e892964b837b3d8b61a5c103
- SHA1 e0eafd79653a53eeb3498087a4bcedeef7f11046
- SHA512 eab8793ed77e0f87a7236e30946275b53d383f291a49582cb795fbd774e042d31dd241ab4fbd8e7cec0ef62197a9c86775d3b76a126c9f85a1a4a8bb43a70bfb
- SSDEEP 12288:CI9KWOF/4G3Hd2tiy0FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFHFtFVFx:h9KZstvubhtSNzDW7kPu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1017150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
985KB
Virtual Size
985KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Data.dll
- SHA256 4c080437275d09e0d0ccbeaaaf6bb6e9098444b47297fab1ccd1a1ca4c85292a
- MD5 ea3dc441ae295b4f6fdd6aa01fee2411
- SHA1 23475b7bf62c9f222f6c2c1c420593ea45f77c9f
- SHA512 11914e4f87c40416509ff6c1eaa91f5eaf57c1b36ad7622b989985389f2d406da2a27e7965998edbca02e635dcc0a6d3e8b2e8f2686d9c7b6775443ffdd2a57f
- SSDEEP 384:/WisCWum1j2Sux4ZQodPcq59oZd7VEXjQ7HRN7iV7EHR9zcbik:yKmC4ZQoBXTkiV7Ex9ze
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6b:bb:71:3b:0b:d3:73:f9:75:cf:65:25:75:07:9c:e7:c0:1f:fd:51:83:3f:14:1e:05:ac:e0:93:78:8b:c1:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Data.ni.pdb
System.Data.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 94cbe7ce7868e6f134c193017992091ce4d2b3e976272e4f55f74b4d34e31dd6
- MD5 c5f8f18779df6ba0854b7673cf7d08cf
- SHA1 2db5a071cdbbb08966d64f2e5b6aefb48914f5b7
- SHA512 ff0357685c6ed1b6ded84f5fae5db99d6672567c67ea4ccb598094dbfba565e4348fb3274fd3bec350fe81a3ae36bc358a82dd50b3dcd5be5693189e0409f1ea
- SSDEEP 192:+tO4/UFga/GtLbrc7/ciqteUCiGA+yQjxiCWOHW:qv/UFH/iLbrw/ci8CiGA+z9iCWOHW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.Contracts.dll
- SHA256 9c292b4d80503530430658410cf41fcc73ca598510522a985a0af0dfd5553aef
- MD5 ca01cc510c6eeb820119263487a0f31a
- SHA1 a260cbad4557c5ed85b8d9fe44910d2eb27c67b7
- SHA512 9c272c57de1f62f7e9c43714b893f08887e86f6ef6c5f048571ca342dcc097254902f901a6fe4d83485f46d1319a4c0ed89d6973fc68e1387453827cc54d8c3e
- SSDEEP 384:cW6NhWJdxtdMn7HRN7kwYmfWojR9zDw4M:6WQ7PfWoF9zO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f0:4c:54:aa:d9:07:0c:47:f1:a2:76:11:06:de:8b:11:6b:15:cf:d7:4c:03:29:fc:86:66:77:c4:f1:4e:84:96
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.Contracts.ni.pdb
System.Diagnostics.Contracts.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.Debug.dll
- SHA256 ff3ce0f75423aae99fe0783ce99ae67508a3ab257ade509a8cdc0770bb97c0fc
- MD5 5c4209fc9564a5aedfd35682fbd99ca1
- SHA1 27f028d41cf905d0371c71e7e0b09fbf939264d7
- SHA512 1f6099afe1d03f0761381d5597120036dae4794789ea60f1cef232cb161d70f73c5614b48205983040b0166e5a05c09447a1c17c893828fe7db5c04974fc98c9
- SSDEEP 384:VW2tRWMBdMi5dL+7HRN7jg8M8/fi/GR9zZ8BGi:Z9BdpzSVMufiC9zuGi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
81:fb:63:18:0f:f9:29:79:c0:16:e0:f4:8d:4d:ea:51:0a:7a:d2:c9:23:44:4e:6e:8d:0c:0d:6e:26:83:58:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.Debug.ni.pdb
System.Diagnostics.Debug.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.DiagnosticSource.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6befd0c09a36dcaeb688a5ef89e991187167e2153f930bf09e6acbc9c59f897
- MD5 bcfa0edc100106536e6104f183307c63
- SHA1 3052823d30795cb08147eff4686bc58325ca4fe4
- SHA512 46a16abed798d67071212ce011a9c251c6d715978c715f140679873176d33df4b8daa090a7a9c99a40ac086ca951df1de744d2fc1ee3d4f0d74d495e253cc01a
- SSDEEP 384:wQ79vkYm7EQz96oVsqM3ZN+MCTjprGDkTB1MqAYMjN96pXb5TtYQFtJTG/hULWfy:rcc3NqMpBm9qD2B1MeCAL5pJtWpkJtp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
46398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.EventLog.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e585a43846e5817c72a48778759232e2e9328af4bc6ad7f04804a11f3918a19
- MD5 d975f4a3de1da0f9f44e44fefddcef83
- SHA1 f2f9d4bc23c7d49832f49b5d080e6758a2bcd0bb
- SHA512 819596d1438a7ce211470555f36e254e9752864170aed6535605afe148511527f339b9f900962f98a70219ca71e130e48cd9c743a9c0dc20a8b0e26a602986da
- SSDEEP 3072:vmG55WbsGpZbUBjlEkmsmWOSupk7xkbZo:+GLWbsEZbUJGuOSy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
125022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.FileVersionInfo.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d53a32399ddc0a04e9b7d48864c5fd0df340747504827d65a863eba3169cb160
- MD5 53c1b501125cde723c149a981275466f
- SHA1 e08cc61e4dd50ab6c274df4dbfbe5031167be391
- SHA512 0ca14eda2fb53a5bc7aea7f57cee07dcfb3db09b13c721dbbe743a83d596ee9e1be458736a62381da9cffa46f2d0da93ffdead1ce6ce7984a5aed38d650bb1af
- SSDEEP 192:8Y7E5VhLH10l7c1bRSjB2biWqehQN9NZFdA1GZnJxB+hxexZtWaWdsVqW:Ij5g7cE2iWq5Fq1G7xsAqaWdsVqW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.PerformanceCounter.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad428d16cdae6b76e9802b1dbd9d8f16df55d782477410675db1d847e5d3fe95
- MD5 093e29a3ad69fa2e61eb0909cb300289
- SHA1 e6401e509da0247a2c3d56f78fea9b76c2e33404
- SHA512 f6bafbffc7fc0e0d1890a061f0e06798706a4cd48d7ac569d875cc31bef1ac2ddf60eb32dea69c9829decd23f5ed11ede24fe50ba5884937907497dd3bc3b056
- SSDEEP 3072:qSVBqd9rzX3B2aXilGPbvkuaSlbAp/7cRy:xBqPX0ibv0obiY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
120382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e935a1a089e4ef56fbba1bf4ba4745790555cd83db8cce1110850211db11bbef
- MD5 1e5c97d7b9b2db167fb2e6175bdfd281
- SHA1 bedea0137eea277691216b1c7901eb9e43bbb451
- SHA512 a60adcf02c9a5b690c4081c11692382b55082c8caf5cdcca666e6fe0dd4a3a31d6ed4de0ecc129bf8693df1df0c4bfa86ea89f84566181508224aee6bd7cd566
- SSDEEP 3072:oHHfPYA20yta6TE+joo+2Id4p9z9b3771PtqNh39hQ:ozAD9b3771PIfnQ
- MD5 SHA1 SHA512 SSDEEP
Digest
b9:64:2f:e4:d6:15:80:ae:ed:32:20:ab:53:89:be:54:07:c0:18:52:f2:3e:22:20:fc:27:6d:d8:37:d6:1a:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
110974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Diagnostics.StackTrace.dll
- SHA256 669e9c108229b377ad55e11d5cf9cc6d033446ed197b55d6182ea8b513b86905
- MD5 0290c1b9f1a55e5a1692d0e1271e960f
- SHA1 0c91a85b97d8144f04271d21022a514766630e74
- SHA512 3c9fa67bb229cd318e030024de4e391643579e2c0413da9e8af30326bcdc5a17094f0966d68bda33725609c02d5d668c0538780a12e72052996ed691d3ce1655
- SSDEEP 768:c/F+r8slu8kXZwQ39Rm4t7WHa0Nvxug9zutd:c/F+r8slEXTqvx1zutd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d7:3f:bd:cd:35:ae:a2:b6:7b:e1:2e:50:e2:bc:3e:e9:35:b9:6e:9b:08:c5:2c:eb:b7:c7:0e:79:f4:35:3f:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.StackTrace.ni.pdb
System.Diagnostics.StackTrace.pdb
Name
.data
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.TextWriterTraceListener.dll
- SHA256 b4dc72c1254a16af4ff47ebea502d03b28d03c72302ceacf5993c05a0bc3ac6e
- MD5 d638a282b89c495d9c2b896287a6bfcd
- SHA1 e5c92ba20dcb1101db432a5ceb29a3cb51af257d
- SHA512 2452a1b4263bc4235c4a2e076cb8c279ded0ed4ed6bacdf8c0d6175cba68414effb2aaa947cf941da1ed42858d209ad33382df3b8136f85e89670fe87b0cc8bf
- SSDEEP 768:D5Q8MVdREB7Jeq2ZqOklRyNbv3pgPYgjcq3l9zU:D5id6B7Jn2ZqOkl8bqPoqHzU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a1:b0:d5:2a:ca:3a:b9:8f:a9:7e:fa:d3:13:b5:49:dc:08:86:8c:10:bb:2c:df:b1:25:90:2a:cb:35:16:03:26
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.TextWriterTraceListener.ni.pdb
System.Diagnostics.TextWriterTraceListener.pdb
Name
.data
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.Tools.dll
- SHA256 3fa65d869a931e705cbe1e2b9b12ae6b15520db0719129311dbe4376fbfb7fa5
- MD5 630b7d2500dd8107264d2c9253fa2956
- SHA1 45fb7c9334f9e1c1a196a860945ad0e631ddbf82
- SHA512 2a27e56bad0577f681c078e82f99b6daab988b349fdd9e90356f5e0436b7ac0ba54894139befd9eb93d7390a1b2f3df7204599975e59de862817bc649390d063
- SSDEEP 384:dWQ3DWCALOv4dzD7HRN7UAm8QtR9z/wR3+:xqMY/jQP9z23+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
dd:39:04:19:30:b5:28:0c:ff:bc:db:44:a2:f9:c4:04:b8:65:91:8f:ac:02:2a:a4:c2:55:d3:54:52:0e:8c:57
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.Tools.ni.pdb
System.Diagnostics.Tools.pdb
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.TraceSource.dll
- SHA256 3911650b7663fa60e4f2d4710fded59030bc35834d7c6e70db1d36c12cf71927
- MD5 c88cd34a9ec7d7bfe34133e1cd5a4801
- SHA1 3391e707bd482a7caf85ed8a546c1e88d543640c
- SHA512 d21db07f9f0cf2be2d39cef58348f03f5214cb82903d0c96bfa3a8cd7f1eaca04442ad14b5fd1347b9bb80ec9d2462a96553d344124796f31c70d2118daf5934
- SSDEEP 1536:RWg9Fs/6PNmJElBQz0L+gEPEQq3zvlhBco54syFu2U2E/AOKuauaaK0ckrwpySoL:RWos/6PNmalGWb/3ckrEcj/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
50:b0:00:6d:1f:bf:17:6a:dd:70:62:e1:65:e6:28:5a:2c:b9:09:b3:3d:fd:36:61:b1:a4:39:9a:e1:d0:6b:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.TraceSource.ni.pdb
System.Diagnostics.TraceSource.pdb
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Diagnostics.Tracing.dll
- SHA256 2d4d885ae11d80c2499dc83c4e884a749cb64f95b297ad9ba0b5389f29fb79bc
- MD5 3a0a716a5f848904872914343df34f16
- SHA1 e0970e5720442204acfddb2ea0b24de59b4241da
- SHA512 3d854b60438adda193d50529b091b1b4d0441bb5aba48a6402fa2c3a8cb36d455c48326db4634c52df2a902986e36b7da1d06d32732cd488d3b5ef1bf7160739
- SSDEEP 384:cWbmEWu3+ysGUPk6d/JcnE7HRN7GxLkGER9zRReO:8wqGUPkWCngGF+9zDeO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:f4:48:c1:83:97:21:f5:0d:94:33:9a:b7:9b:59:be:6b:ee:16:af:69:06:58:fb:8a:4c:55:f2:ab:d2:99:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.Tracing.ni.pdb
System.Diagnostics.Tracing.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.DirectoryServices.AccountManagement.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3492d44d9fb05b07c0c7302b85dab9dffbe522085ded93ff8868ed6bf5e162f6
- MD5 cbd45c5b94ff14408bc443e7b95181eb
- SHA1 6e06d9ee36f29adb10a6b12f1425454a48956f96
- SHA512 0f9edd0436adfb3ed3b4f4a835751395dc76cd1f220b415d76e99255f40c2ae053c07e3e90b330a46ca7e3161b101a9d6bb92b85efac8782e2a334b4ca9ae2af
- SSDEEP 3072:db3kNZ2FXU2URLoegkGLKu1FjRr+MpjzzZOQIjNE7wS8Ww8jwN2klRZ2cT8z1N7y:KNmq3GL/RIgLw4wNPfZLEN7RkkWd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
270494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
256KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.DirectoryServices.Protocols.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5705a01705fcd05fab4fa91d3fe35338898cf6bda8375dd6e172dc8d84969648
- MD5 3e30539f7b5718887d8886433cdedf6b
- SHA1 5b84bdeb9f807d150ead048bba680fc511693b3e
- SHA512 74269c9e22705c0fe14b3f6994b63a3f1404d66980ee5721ace10c0a4b301cdf615be8e537a4cf03702a1e03951f10264562aadac0891ff31e477d62fc781657
- SSDEEP 1536:oKvEDLCIyyxV9rCF4Da48YLpOTwaUrHZ8ujD4nX5IW7keDfIV9sCgY+YQ:GmIyyxVI6npHL3IIW7keDfIVHgY+R
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
122654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.DirectoryServices.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d176f4579c03fdf4660353153b20e2063f348b6becb9b073449cc5c1ec5ae745
- MD5 e61418e77cf4b0b77ab3d808efb73548
- SHA1 94e6bdea7f1c4317f721b611169d9ccf6c239699
- SHA512 76c02a5efbd26d63e049e5d1cd077de74dbc06eb19d39d997089dbc3c0478e00a13548f1e38121b9e4aaa55ee987bbc27607f8f8042ef7b0b04cadb0caca1d89
- SSDEEP 6144:RjhaX6w8sb/fgViR6RX89IhrIXalKupWE97SDN2qavbbUPlMYaf:7aX6w8sbEa6O9MIKQc97SDNzal
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Drawing.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b676ff6768017fbf330587af4af00f08202dd0fe6d8b42ee91a833a320d81270
- MD5 2ef2f0ce051aa32bb7b6c2a7c2368b2a
- SHA1 a52555856df1d36b042480fca79769c8ec9b10cb
- SHA512 05b7119233e9441684462227ba6a3ff4f6794dbfa8e4242510c886e08e54ff89cec2bfa78f6fe845fe9b150ae68ce6479aadd3e10ea7959dd04756bd591f5eca
- SSDEEP 6144:7np7x0ZMTCHziS9t74/jGbPvxsPdBmBvhqqWy31:7BqMmHdEKHx4BUd31
- MD5 SHA1 SHA512 SSDEEP
Digest
24:39:a6:fa:67:09:bd:bb:e7:d7:c6:c3:2f:86:3e:1b:f8:e0:49:f2:64:03:bf:fc:74:58:40:93:96:b9:82:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
409502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
392KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Drawing.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04a476dd96439238ed5dc55ed9f20c398a1137d78a2114eeb9c8c9de0e827b64
- MD5 16a050bc879bbf76a0d551b33d2a65b0
- SHA1 c838d9fd10cfb8a92f0e9a34eb8f391abc100d11
- SHA512 d09b542f398261c18a34ad5591a510522d8dba00d0ac810e0ddc6384acd3938e8921fd00605d7dc5f4dc6fccccf8d2eabab7f52a42d855ab39b2b97d266b67be
- SSDEEP 48:6ZZtI1Lyw59vXwlZMJ7suoMXq+IvBD/DgvM9VZiIDXZWOq85lbT5WDXEg:MA1zXQW7suQxvBD/DgvGfbWWBWY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Drawing.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0ba7867b6531edc491d6c7fac8b2e15645769cc74d05414a41e46b71da9336ca
- MD5 7f9c4333e71b39c53c460ee3b0f91bda
- SHA1 3d98ca7ea66103d86c45557a139bb50d46ad503c
- SHA512 b00ea3eb03e83c1e6b7a3cfa518cc870270a422cdc07b28e4d37870e1fe4b1837e6efa92285f28781de05855ad2c533773ff1c311fa7f9903ac446b70ecfcab6
- SSDEEP 768:v5RbmqzJjVi6diWO4w8BWNSjo9puuBcAOUF83Oew9MyT5jBrnF7a33W9AP+SX:v5Rbh6k4/NVpuu+jPPw9T5j6+SX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Drawing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22f2d62131936595ca34d0606add4b0a8539baece15fd13413f008fb4ee0b0ee
- MD5 9148b038a5d96921b2c18184720c1fc8
- SHA1 436edd5ef5a7f521f779fe84913488337aec0193
- SHA512 b2353594720cbf00baccdd1f5ce0f7440b7bbeadbf1e464f1195ff73422dbd4af4f64eb3e64b35d4b68d71efef1e7970aa7d8a7b837e765fd04bb0f21d1944ca
- SSDEEP 192:/vKy9nPOqgcm+3GbNLe7VYrYxrgjsC/DVVx9r5LWrtW:ayxPOqgcF3Gde7VYrYOjT/Jf9lLWrtW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Dynamic.Runtime.dll
- SHA256 02691fbf19e669f9f15fb6c57f8c8fe565952345bd23f8eb79acf3489c7aa6c6
- MD5 e42b0abbe713da1f9d5ff21883c760cb
- SHA1 3370c376fb512dbe39cbed36d13cd11dca826d02
- SHA512 8eb130cfec7381f36b408108b3bb9bea27c8c786b3fdd1a0e8ef997616e1f33a9da63b2643f4af95d6dfa3978cd8968035ed0e7b41ac88b2e814150a482431cf
- SSDEEP 192:ci4MWsh1WRDgpxBAcx+dEteWvcuyjS7HnhWgN7aMWhsMHxgV8FGecX01k9z3AKIa:AMWsh1Wy7BAK+dEd7HRN7NHR9zHIxN3q
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e2:95:bb:9b:f4:70:d3:ca:58:4f:ad:2e:ba:6d:06:cb:30:74:cd:17:68:33:63:e8:61:56:f2:0b:da:ac:c5:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Dynamic.Runtime.ni.pdb
System.Dynamic.Runtime.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Globalization.Calendars.dll
- SHA256 973d89ac235160df9128d10f5a5bee2d131ad7debb148f5774c2579d97b3c4e0
- MD5 053d592bb5251b2f15a3391223c9e167
- SHA1 db768f758582f9c43c00ac4e66612bad76a4b539
- SHA512 5ac7ef2bfa825dddeb085a8ae17c936b71240d69d36a8395db856ee436da1b4e751a7750a81e8707a269cbcb7b1b26e57bb24db6daa06db28965c77636400473
- SSDEEP 384:3RqXWDRq4sRqm0RqsWFsudWfdL7HRN7niR9zR6E:hqKqNqmuqE9XO9z9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2c:e8:17:09:32:26:56:04:11:58:c7:d8:f1:fb:c7:67:98:78:c5:3a:89:07:20:a9:30:5a:b2:55:41:d9:67:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Globalization.Calendars.ni.pdb
System.Globalization.Calendars.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Globalization.Extensions.dll
- SHA256 bd41ec1b117416b3abce7867c9aa3927f7b52114bbd3a979c6fa60d0fa3f49b1
- MD5 2b51e34e537d25bf22e0a865d37ba277
- SHA1 56bfbb6a8f6b065a24876c9a469163c832e8772a
- SHA512 cb553dfab531eb766fe470f753d758acc13baaac77d52f49f052debc2d549c080d608da1b1afda55966c9c864dc187f1a75acafe0dfb8dbdf28e6a112cd28f43
- SSDEEP 384:ERPWYRgPRp0RkWGZ4d83Y7HRN7hE3X+R9zusroD8wmWP:+NypusZf8aXi9zuSGP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ba:b6:e3:eb:b3:d8:5f:a3:84:e9:ce:6f:dc:bd:c9:2c:0a:57:ee:81:64:b6:e7:33:37:d3:67:da:24:13:87:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Globalization.Extensions.ni.pdb
System.Globalization.Extensions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Globalization.dll
- SHA256 ea40b3d97d8f582e4b1dfb4425adb0f0682e3cbba03e6d27ba6afacfa7408c13
- MD5 4a00c73a2b8f7bd5bd2349bf189306f9
- SHA1 f86d3eeb69fe26974f5156cc35e5209300702b18
- SHA512 84a3f7027e93200324d60b4d854b09a3a374e802d99ffb7fe9ae8cf797c90e155597b5d17f2dd2c64c69096f64bc6ecd25ec502dee170b00ec47f00be24fa8b4
- SSDEEP 384:SRLWdRM+RA0RAW9RZdVX7HRN78eHR9zHm4:A03AuXR9r8ex9zG4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
15:30:16:60:6f:48:eb:8b:ec:15:39:4c:73:c9:2c:ab:1d:64:bf:dc:39:ba:94:43:4c:9f:df:a8:40:33:85:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Globalization.ni.pdb
System.Globalization.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.IO.Compression.Brotli.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09362f89d15733cb65f3306b3fd280aa95694d1dfccf16b6c31ade1163f36ad0
- MD5 ad0ff61576e77443c96aed460f540d5f
- SHA1 f42abb6f6524404b25d6454efe15289f26285482
- SHA512 b12726e120daa1d6292a14ae2228952d2ca9b800dd94cb6e9b0d37280980a348bbb680fee04c3aee29c35a342c28df7d877dce2d480b68e1d84fef931cb322ba
- SSDEEP 768:JOCKEExaQEWggXySafnx1knop76fkgRabAaREX2wzH:JOCKYTWhySafxunop76NabRcVzH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Compression.FileSystem.dll
- SHA256 6b3632355c4ec32e4edc8fd6b6e655d47b8547876660557675153f3e50b54b21
- MD5 ddbb9f0ce12046992cd06dec451e03a4
- SHA1 e0702efc5e7ee7afd7d6dfba92962bece91ee808
- SHA512 28b71a65207359eef8b3294e0396103803e4f27cd589222e5f3889ce17478615391498991a22d3d631695a02c4c863dd3ae0b2bc7e9d4c9747b290dd0afff35e
- SSDEEP 192:EBWu9RWcxiUd4jgDeWvcuyjS7HnhWgN7aMWhnM2MxgV8FGecX01k9z3AKSVl:8Wu9RWgHdMgb7HRN7w7VHR9zHSv
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
60:82:4c:9b:40:26:67:73:a0:9b:38:8a:3e:24:7d:8e:ba:a4:ab:c7:bf:20:fa:c4:77:0c:cd:f8:7f:1b:0b:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.Compression.FileSystem.ni.pdb
System.IO.Compression.FileSystem.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.IO.Compression.ZipFile.dll
- SHA256 146171b2d8ba7c6cfc1327e26e4017b08693af5514263203db60d9c43e13914a
- MD5 6258cea236def9f37ce76d19cb8b045b
- SHA1 969302144f452946ee6a9eb70a4a53b7f9866e99
- SHA512 cbe8c0e73f567ed250d0db936e325fa1a66576e30ce765f027c2c87f32cacad4c51f5a9bbb4bfc1ea3b3cdeec97ba3dc5b300dd7df084f03aaa0016c9aab5b96
- SSDEEP 768:lB5FuK2wuCRWMkRWUWZF4scL/ftDqybuLtn6K9zw:lBfuOpajbuLtnXz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:3f:cd:af:d6:09:4b:36:c9:c3:5f:bd:1a:8a:ee:7e:bd:9d:45:af:e8:3b:f5:2a:8c:09:66:cf:c3:fc:0e:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.Compression.ZipFile.ni.pdb
System.IO.Compression.ZipFile.pdb
Name
.data
Size
512B
Virtual Size
508B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.IO.Compression.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e273d82c08d82bc194535807a505cb2a6c08c95df8913f8210a407c8738c75d3
- MD5 e839f0aa073273aa6a75889f19ec1623
- SHA1 ff171b601e43e5c249331519fefa5bd527ed95fd
- SHA512 9a7b22102b81f03b503729beeec7a8d29f0ab22bf37a7dca43b4fc0ffe01c7d0738e14b5589f5f95fb98228266c8597aa8454820f52830aebb443e6ad17c991b
- SSDEEP 1536:YMCGc6zkuPVlA82ELFQ2eRu51DjrHF7YIfb7J9qf7cLesNA:RcWkuHN26Ruu51DV7YIfbd9qf7+ru
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.FileSystem.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 53de97b178a02fbad05d27658fbbd38146b4938b41075933dddf1b27248cd410
- MD5 3a7a81d6e9b39b18fb00fa9a958ced06
- SHA1 f09026d6d6b2c616ac0bc48a9fe2f3c8cc15f444
- SHA512 9f67c566009cc5276107e752d8b80c6dd2593db3c0a73676d47cba140b32f3ae441d0e3d7f7cb333b3288a1be34b530bbc31fa6c44ed159e1486a70e4d8b7894
- SSDEEP 768:6wI/QAgtb29dMKu3IfgpX3Ba1bvxTXpv0oZDS5ZNCV+AMxkEo13:6wI/QAmpXAbvx10+25ZNCOx81
- MD5 SHA1 SHA512 SSDEEP
Digest
47:bf:dd:7e:34:db:dc:93:ab:15:72:ca:4d:b3:ee:13:b3:c3:f1:99:2d:05:94:0e:ce:c1:75:0d:af:82:18:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
40286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.FileSystem.DriveInfo.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a65c92649a9ed0944c455a33507f0f7fc177a9f52d10aa9a5adc4c56433bf1f
- MD5 895c7d821f04ae51a07cb5fb0dd4f42b
- SHA1 4b24d8f1f9019cd753f490650f95482f3144620f
- SHA512 e9df8d55deee4b0b4b31ec9e4b174bda88f7672592f0b943f40513722ed102bf9f590083829414ca63d9596edaf630f76b68b4b8a8016d8144f30b06b165f13e
- SSDEEP 384:xeVCHWl2Yd5zwNyAQbr9DFoV5vyGIRj2bWsX0WURlW:xAfTJr9DWNej2g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.FileSystem.Primitives.dll
- SHA256 008d12100f44bd8322a0253bd9791a9df3ac5b3924d704e7db98e3e8749489e5
- MD5 104033f493d5e199b3bfd82180b277f1
- SHA1 f0e05b304cb65a377f71a0ae68dbc9172685e05f
- SHA512 bb8f7d37d005a59bdc47eee727404a5d818f605e5045b8552ee0adb07b87f577aaca6ed61b0eb1141971f051f435ac4101c506c7d55ac4bf35bc67510363a406
- SSDEEP 192:eW/pNW8gXYViOxEdnX6eWvcuyjS7HnhWgN7aB+Wh8+c/EH+BEg7X01k9z3APD:eW/pNWUEdXE7HRN72SjR9zw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:f2:b0:a3:c5:50:65:6e:80:34:1a:21:17:bb:70:55:c5:32:34:fa:c3:09:37:50:2e:b6:4f:83:8e:aa:80:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.FileSystem.Primitives.ni.pdb
System.IO.FileSystem.Primitives.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.IO.FileSystem.Watcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e32173739da64884e502d3ecc24de44913ee19ed438b6cb82c8cf7e8ae9e1ac2
- MD5 801a9b0c3b35e89f7ff62ad5923f131d
- SHA1 4f499b81efd19cb5f3be001776651126a8d8dcc5
- SHA512 c7781a432003af0b77b6fc8349062e0ef09f276a7723f78519844ce24557224f4ed2b51498e82d5aeb7a201c1f01fcf1be860259ea333121fdf42f01a0b78fa7
- SSDEEP 384:DNKlvFUu2U7ojkK1f4jfljl2Yd5ziNQ2ZQX4zPigfWvSAvUcn1NPtrt6MEq8LADw:Al28wkvfl7fgZQXR86vyADJ8HI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.FileSystem.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99beba5759b0c7af236fe633cdbe377f736586ae703c2ef29c6735e8d78f9710
- MD5 6033fb3a387e6214cb1fbd9b137cbb42
- SHA1 25ef3aaa32dec1b5c1d55bede164048642a22981
- SHA512 6eebf4eb5ec2f3421bd1adb2ba5dac45d0a294c5384fefbba8333b3f692d691cd99d996b9ed71f05c0112a2f20e68d6b8da664fe198d9676946fb7921fb8a36b
- SSDEEP 1536:EJOhhAge4IwnsVpA2J5/sw4q4gMYQpZRHav61NAaQJJZA09M+UM/UYffbGi2gOW9:EJ0hAP4IwsXrcOzJJZh9M+iY3bGinCu9
- MD5 SHA1 SHA512 SSDEEP
Digest
02:45:25:4a:7a:99:3f:46:f7:0e:4f:57:4c:35:63:4b:49:c0:7b:79:27:8c:5a:9d:f9:9a:11:e3:b9:92:c9:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
91582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.IsolatedStorage.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a66211216f3d68a6efeaf0263f2f24c553e901dd5d9313aba680de28048baf0
- MD5 53160f475a0b060b0129385c1bc813ac
- SHA1 e636b9ee8cecd8413a6ff47bc6c8b777e4ed81cc
- SHA512 c7894bad5bf669683dd1a533af8abb4a6b6e4f7e26bf0b09685b863b4fa26d58f45b93f3b245b8abb6a7353e086acf68411c3746e0516bc5169887c2d9227943
- SSDEEP 768:011x1A1Q0p7A78fvnTEYaHeWDI7eQGKJ+:C0p7AOsStGM+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.MemoryMappedFiles.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2df35c86f91788c9829f8f75502a5f2c7f014a93d3ff6f36cec510bcac5b8234
- MD5 744fee1c3e2cf893150fc14428642991
- SHA1 eda7d8fbeb06452bb80bf8ddfbe8cd85a67e15e3
- SHA512 8a2ae3d9d535d80cfa5b24599a348f5200097eb2f17a6fc9c7d5231936e10630271a6ef8dac6fca932084343e736325e0cb0effaa866556104233f3e2f2cc0f0
- SSDEEP 384:S49jUQtDgBRFULvnAQ2Yd5zbgNw9v2/+d6dKoJ8Li/QqkCMwW5WP/uhxWV/LW:SO5tDbLfPm+d6co2G4IMwHb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Packaging.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 64e1c57c8d441c2b3b98bb662742099165889644da55f281e2cc24888d2be8fa
- MD5 941e3abc504d50131bc31e6bc58f22c5
- SHA1 8fd7b3df32037cad841c22ad85ae86cab7e6a0f7
- SHA512 b4680552ec4fd12d9302b549e2460b2f1499217af489ca4efffe67797d5a5c7b223ce688fdc1e19b087dd4b9a88b037db915ca9f7e7567f2010fa1deb7cf4ee3
- SSDEEP 3072:qLNQmGkt4A59NzpHXHOQDAFWS6NpU3HEN:q5QmGkq29NzRZJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
103KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Pipes.AccessControl.dll
- SHA256 ac6e45f9daedafd4c0fc8cf2e9efa3fd9222c74939678140d08288692ebe92e3
- MD5 9173e9bed16968efe8f7c4a886049f02
- SHA1 5c20f947aed3336349967f609c78738babe28a26
- SHA512 6fb3912486df8e50da163ff13549de5bdf049e220dbe01d582c7339f6fdc0707704c38d8a5acde1beffdd8310d68c2d39c897b8ddcadc3bd451ce8baea91a232
- SSDEEP 192:MW+q4WbBSxHdLdeWvcuyjS7HnhWgN7aMWhbx6IVnKaQwP7yX01k9z3ABNtqMSvS:MW+q4WN4HdLN7HRN7A6zaHeR9zgNp
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d2:26:2b:f8:7c:a6:b8:62:e3:45:fb:4c:72:0a:1d:bd:1e:00:e7:15:88:07:e9:25:6a:23:df:6d:d0:89:99:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.Pipes.AccessControl.ni.pdb
System.IO.Pipes.AccessControl.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.IO.Pipes.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f2cb16dbf131b595ac2daaea6abd5f39609c9b37e772f4f177771788545e3528
- MD5 215b7d58dc533a4c300181fefb629be1
- SHA1 0cbf9c6647fcfc1f34056873125b1a18e5dcfd53
- SHA512 54cb54b70235298bf71dd9dc4b2c923b00d5ff3742211509f525899b090a0fe491a3b72643567a91f44c8fec28bba96d57d17406fe6ebd64a66d5d43eb10c8a6
- SSDEEP 768:lhs3o27tiKh2Zfkb4Vf/MdcQSe9tH2Kmp1Ha6MNJmLywxVyAMxkE4:bs3o278Zfkb4RMdW3KmaJmGwxWxM
- MD5 SHA1 SHA512 SSDEEP
Digest
c1:8f:f0:1e:1b:83:df:df:92:48:b9:8e:a7:2e:01:6c:19:45:71:98:a4:1b:77:d6:de:2f:df:00:70:00:97:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
59742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Ports.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8b4697b44efbacc69dea47d1b7321fb8ca230157df46ed235a0f40aa60f3294a
- MD5 cf8254f4b70ff0ef644554c5322003ef
- SHA1 f1db876c3803f8d03eafbd7e56e215bba05d7dc3
- SHA512 8b9beba9f022a3773629be717f34b106d784287c699291c00e827d1ac130fb5e2c586abd4711fd41131f9b6bb4a07d476f53fe7a7768acecc7beae5792b676f8
- SSDEEP 768:UE1ikiHVWVpYmHqXs6Un11fF+8Sn60X7mnKT0AKi9BH6BraCgBzZJuxfG:R2WVn1/M60oeDHmafBzZsxfG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.UnmanagedMemoryStream.dll
- SHA256 422998cf85d8d8e1b298f444bb2803ed842080b50bbf190fd72426bff9e6ba9b
- MD5 cd4e2781a48b1ee742aafdd4a3d72a08
- SHA1 731afcacf8231c3a8310c4dabea05c596eb17ef4
- SHA512 92f0b6cff18debc4f0e87b3234764f3a1ce9da443b0aeac04c878bd9846cc0f1449c713f11ec8de75ee3e4da93ec74e0c054726c8d97f3a723f5b5d89b793302
- SSDEEP 192:kWjVZWY9pwPEpPxddWzHeWvcuyjS7HnhWgN7aMWhZ3xgV8FGecX01k9z3AKaVm2:kWjVZWCwcfddsv7HRN74GHR9zHaH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f1:eb:e1:5a:73:8e:7f:06:d4:11:fa:44:b5:31:56:b4:67:87:8b:6e:0f:9e:1a:d3:a9:28:51:9d:5c:c4:4c:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.UnmanagedMemoryStream.ni.pdb
System.IO.UnmanagedMemoryStream.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.IO.dll
- SHA256 5bc93b530f357667a2f2b8b13b47e80320d8782f642ebb747137910674125b35
- MD5 8ace2d6fd91112ac6dca9914bc4afffb
- SHA1 3ff6b44edf62c9164b243e3c585a47ba4b5663f9
- SHA512 b89e8fc4d5ca8628e6e4235a0390ccadeb19e1321379805a4d3e2802d00b19c827fde26c35dcdc65e6d3b04509d71654d9769892fcbb08da3d6e78500c1c2b69
- SSDEEP 384:AW2eMWGz833hdDI7HRN7UhROpg8M8/fi/GR9zZ8B+:R4zSjsUhQnMufiC9zu+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d7:eb:62:e2:c3:e0:3a:4a:07:a3:2b:ee:fb:ad:18:b6:0b:1f:be:00:a7:aa:a6:0c:31:60:ad:12:e3:15:b5:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.IO.ni.pdb
System.IO.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Linq.Expressions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 258b767748e2691ff3e82c6b89ce7dbdf3b035891a0e41766cbe91f179bb0eb9
- MD5 70b144811fe4f21067f9c7b3d20f605c
- SHA1 1dd8bc5c194a8efca892b8add2ff777ae79f9745
- SHA512 8f10ce2e9d8b9e7c3a1d6e840e3d4af4dde8dfe751018f56cf165d5901f66bc2e5aa975dcab5d4f7e407ae6adc74e74966e2ed966961ed34012940229f533a42
- SSDEEP 6144:UvBFsMm1bUIylLIOM/1rYUMzY5hBOTAfOPOUBSBYHNlJfISL:UJFsMmRCsOMtYPC6UOPOCxL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
546862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
526KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Linq.Parallel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 25cc15aef9c67413a2d551c8426c110f73e04845cfef2d27cca6cad5224a4adb
- MD5 91b9077d6aa53899b3a0068063081e36
- SHA1 ebee4b820159e69b88a068c2860dd6089d09a112
- SHA512 b9eaf3d88f06a03c876c429ac337df96626b5c7685fdd7384810a653ec5db29b75d9d4d9b3bc0ceea084377e7940b62232685e9e5b51f0ca3184b1cdb9a20f63
- SSDEEP 3072:YdTedrb/Lw/k36UIDvJ1AYro2rlyutytsf7LdBW:d4/K0BhlyutMa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
215262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
202KB
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Linq.Queryable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 71e59c2e83cbb97ade8ccd4a7fd019b6185b3ed6c257a0757cbd8adef55f240e
- MD5 ce101c7e9dc1d626d9ff91afc09046eb
- SHA1 c299217787421fd36f1db43e5bbfc361e9ab888d
- SHA512 649b2c8e55564b66be2038552d2c3bdefb3d28c6fc25ee0be53560c14b1639d77f97d798c0707a7621b3d5ab9ea1b898e258b5cbcbf4e1898bc26b692adae974
- SSDEEP 768:WjFL9MkIN2bACHMcpcLWC70XnxNM1I5Cvzi:WpqkIN2bz4WlXxNMm4vzi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Linq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 29b2f7958f6c7ce20a658f375af34bf2bdaada624757afd3fe2559e2e9b37aba
- MD5 dcfc8caf03a43639952445f7c4442ef1
- SHA1 a72e39cae0705b714f3b99d1f7864d7c89648045
- SHA512 3c0ef19e4ac2aca96f5fbc312fdff0a1a20f9a3c60c524cf827eae99f8a72fbb5fb5a1479c36a4a3e0c201cb1f60bdc965bdd9f40e0e262b947a9c39b888fd75
- SSDEEP 1536:dOA+EyGUSp6xpWLdXUXZcgleTiE50yTKy5Z/caUmztQ3CO1xgCdRRBeXbPNJT3:AA4TSJ2ZVkTiE5DTJz/cakfS+Rqj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
132894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 342015b3457ead575893f97ccb882e7cc2af932b582223d30771cce65d5308ab
- MD5 285ffb3fe6bc4eccefb054d3df9fc624
- SHA1 5edcbd41f0410efcbfb9a73063b34659f83f145c
- SHA512 dadc0f7f61521517f55a38c777887be42fef119445c043a6004262258260f170373de5cefe4a809602a5c1839137bf5599e187a92b761852891cc80537bc39e0
- SSDEEP 6144:4YLz4kuJ7BBTiVPDkoknzA7PDDyn+Z0q:4YLz45da7PDOn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
289694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Memory.dll
- SHA256 dbb7584e06a35b6045eeb156dedb5469ae5056dbb45bd689790355d60ec37eff
- MD5 6e439844aab932d1ff439b8c929e3f22
- SHA1 a9a3b6f2ab33b0003ece721e02a10acce32ab516
- SHA512 fd2dded613d2d394eb01c4197fb7fb0a0cb5e5289872f111fabaf3e665aa02c23fa19187a0371d5bc2743826b560e1fbfcf9ecef171ba61c75de2fc12429a49d
- SSDEEP 3072:JAcX8QifNc1Y1cWDOK/9yqkewgUF0fOC9NAgWajt1:6cX8X1sK/QqkwUyfJ8gP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f5:ee:d4:cb:6e:f2:ee:36:02:13:0c:91:ef:9d:3d:90:ea:15:b8:0e:38:2d:95:01:99:70:bc:6c:06:0d:6b:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Memory.ni.pdb
System.Memory.pdb
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Net.Http.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7e9cf29860d5887e1a17f071354def3ada4778bb1bf1806133375318058d7e67
- MD5 8f8b534f8dd6d2cdcd17ec87698746ec
- SHA1 d50165971f90818ce86f816c15c31744ee8b18b1
- SHA512 577545e89c757e9a5221f527dc7f96c15afb14c8050667e115b9eaa4ebe02e19d63f3ce112557b7a1913e2e6ac0a4d43b61533f2c9e5845dcc3a5f54de5d091d
- SSDEEP 6144:PINUrGH/LKugWDh1xHx0qYV60bA3nIwLfcZiv+RGacXhPzdaXjO69pD0eBp:PqUrGfS4HxHx0qE6083IwYCdwd0e3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
538622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
518KB
Virtual Size
518KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.HttpListener.dll
- SHA256 e48e82ea2942a1d81c43485ee482c9d84ad8d766e485578d7907122c4c4ec22f
- MD5 13209cbac19f5c803ad3332c5da0238f
- SHA1 3f7451603be3adea6052565276d0e6cadbcad7e9
- SHA512 9ad5c922788be6f6e0f2b34a27c0df54e248e022f29344b11ed8c72ce1c2d8f66a8937b0b79a4ad704cf9f28c71bae4331a21a2c086d4ac056c856383f8adf96
- SSDEEP 12288:RqbR16eYC5SSoqWqYzXj1ere51nTX1aLUpj5jT2Z:0oSofqYzZere51r1aLUpN0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cd:f1:df:a4:ca:6f:08:3c:35:ec:53:33:4e:92:11:24:b4:4b:21:35:e9:96:41:53:1b:c0:1b:b8:2a:e2:4e:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Net.HttpListener.ni.pdb
System.Net.HttpListener.pdb
Name
.data
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
525KB
Virtual Size
525KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Net.Mail.dll
- SHA256 e9e18d6028b22b4d31ee0190769cbcccede665cce4b1be8420d93e03c82bdd29
- MD5 af0cd503056c24b2b3d3b0e035633d14
- SHA1 7dd22a1050aa226cdfb287b78e313447cb51228d
- SHA512 6f7a99a36c36cbaee77544d1871844810c049351836ea5110db41b72f6df54126b77421054645568db2c810b735ff01df9f119160453d402f311eaa8d3ee12b0
- SSDEEP 6144:S5GM5Lt6SvLa3CkHpJ8kkiP6VO9qrUk3CLoAzzDji4tfOMPxBGtts3TBbJxmrK6V:AoPc2jaKfOMPxBGttIT4rPT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ac:df:97:8b:08:ae:b1:82:ef:70:de:df:97:4b:61:13:50:7e:f3:6f:23:0e:42:7f:fc:2c:c1:90:5f:dd:b6:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Net.Mail.ni.pdb
System.Net.Mail.pdb
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
438KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Net.NameResolution.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70ee5550a3c3c9ada5f408ba13b87afc01ade4635bc275df0710015e312df513
- MD5 b732780107b427015693069d38817b11
- SHA1 6e1ee51b77d74108adf22018ba362dfdc5fdd9cc
- SHA512 10ee6adae638170b87650afcc8759b0be747343743b9f3f6a3899cb136f13cab0c118e151e954580d651c87f9349c0f50d15b579b38c74ed9fdd6a30ba8b18fe
- SSDEEP 384:Joo9/aC8e6+EfoaUUW/8X6fGA5nnIZOgSsEXSNGs9qh9iDp8QngSTZODcKckcsb9:G2tEFUSKfLnn8OZiYs8aGQgSTZORD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.NetworkInformation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99d66492ac869d82aa7055bd1f6d6daa063db9241cfb9382765b1eba0ee38927
- MD5 4b5b4e112e427db047d580e8284c6188
- SHA1 d3ff9e666d3899726a6db6f5bdc66596c595be56
- SHA512 7cd1d7e6fda0056401654970a8423c359698d9e0c1e6e0750e7676b998e04d7edd334ccf8db648f22e43afa9b3950ce96bdb76c26508d6dbd4af9ce51c4090cc
- SSDEEP 1536:5mshbr5UXZfOzhpsTbk6oX6YixEVFI3X6kExPU:5m6rsfWs3k6oX6YqEVA6tU
- MD5 SHA1 SHA512 SSDEEP
Digest
a8:24:8e:43:85:85:b1:f7:55:2d:ba:53:29:0d:25:a1:22:9d:89:95:f6:20:21:a4:53:b4:c9:77:ea:40:b0:5f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
85182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.Ping.dll
- SHA256 ec784bfc140fba12eeb1b8f5a70b39e24a91762aab174c7248893a3b6e466c71
- MD5 897b496363f5180dbf97125fc6f0cba6
- SHA1 220b3976ca77ac937f76f3639a8c97e6e4ff64c8
- SHA512 ff545fed040d1b6d8f105d126ca0d138e4bf272c7df763b4e737f4c11b96ff5b05b133c302426001e4eb411cd46b91801949427b25102d972f5796b9d4f80c59
- SSDEEP 1536:LUtE8ZojpxJmacaun1V3Tf7DXmIHN/hLlQ1mYha+Mz23R:LVpxJfbun1VjWIHN/5W1zAd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ca:2f:49:1d:48:03:15:38:ee:f1:e2:3e:d8:86:27:39:7a:68:54:47:1e:50:41:da:11:65:fd:8f:da:a7:65:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Net.Ping.ni.pdb
System.Net.Ping.pdb
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Net.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e0a6ae20b1739644a6123d1dc4ed63918eeb64b8058c6b66d9acbd08bfa9663
- MD5 6690c7c1b22e54dd29edb93f716e2ae2
- SHA1 92784ad46f4a9810b6e1c433e73110fc39509877
- SHA512 1439435c61c06496fe72be63fb246f48665106b57f0d81f80985062f939494bdec2ca2fd6fd1ea5bd2d5ab156cd0a677865b2f0a4292b13651f1672f453a57ee
- SSDEEP 1536:vawAVSlfXA4rPikq509XQhMZF/mFhkU9KwLrcfMbox7:vabSlfQ9kqCAh2F/sOUqMa
- MD5 SHA1 SHA512 SSDEEP
Digest
ca:88:ca:37:67:41:bf:8b:7f:13:cf:2a:fb:70:b3:4d:79:b6:13:57:37:79:eb:35:20:cb:65:12:56:8a:3e:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
85166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.Requests.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ff7ef1283526ed727a3cc02e07687caddee28afce6e13441f0756ce1280cbdf
- MD5 e886c545c1c55e59685ebc0c9c297d81
- SHA1 434032be177fddaf02995e22f41d2755a084cfe8
- SHA512 77a7bee18916875883b04e606207ca6ef5558fd90f4407ef86374278a05247aa198f5e991720e818c93733bdf2fa410e12c13933aeeedcd1f3f683209406aa87
- SSDEEP 3072:A9FdHZiK4fD/Dstn2r/B+h96sngvQodcpDWGrTw2k:YIKafstn2bQSsgrcpA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
135822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.Security.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e9406714192fc391a99579298017066ec899b71954869a475ff345dff366285
- MD5 19d3a216bd7a232725f2988680a84911
- SHA1 d0c2d5298db79ea8566b8a4574a45d5f75a55c37
- SHA512 53e6646481d71e362985273a47f33a7c7689f288667a4e349d6763d4e2169eb8b8487e737e4e4d92979116c589b1dd7094bc057028d704282c1bb1c13b34243e
- SSDEEP 3072:ChJ3n0/B7wWUR+NyXg7trk7OpSA+6kGE2KgbqJfQLED9NTYIc6:4J30iPBqSzrf+LS9d3h
- MD5 SHA1 SHA512 SSDEEP
Digest
b8:4d:2f:8c:b1:8a:cb:63:98:5d:b7:2b:8a:ec:a2:2c:2b:81:f0:66:40:34:19:1c:fd:61:d8:ac:97:39:a7:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
231134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.ServicePoint.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c805e2477e4e7a6e34924ba5201d6305eaaaaed70b62017c45c362f7d9f8f6
- MD5 b11cfca2012430a64ef3b6399da33d28
- SHA1 835233232866588eaca8a9205db40ee1b579dced
- SHA512 a17fc736509a186c79e96cb00bb914f56f51cc36d08761d944afd9f1cd51a35b7adb2bf3dfe46d4279eae4bea709faf8e1d00b7c908746ccdf28d325b1f75603
- SSDEEP 384:FtN6w9evlPN1pxTTga2iyQz7fAJsiW+cCW:FtxOlPX9b
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.Sockets.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5bd1ecb6641d1fa55cc88071ea455b6df5f8df89df2b1c5497ab65c581dad310
- MD5 aa46a416dd7901c5afbff4f7cf6cd802
- SHA1 a3207f79dc4543c5ce2104d9ba193a2b947a3ad2
- SHA512 0956c1c46b6285a4e6206f5471afa9b845942f353b9ce8328be8c7cbae0b3605c6f8aca389011b62f568e7b59d6bc7be6a14c2234266a1d31727c31066daee11
- SSDEEP 3072:biq9PVTL6Ix1iTlUfUhTvnJkm9gulQcTiKEiK+PADfZwSEArRQoS+Knk2J96aU6:L9dTL1x1Mg0TvnJhgVkjPRVk2J5U6
- MD5 SHA1 SHA512 SSDEEP
Digest
a5:04:85:ff:5e:d1:f9:be:d5:62:aa:c6:4d:33:b5:17:cd:0f:b1:28:a3:ae:26:c1:04:ac:5e:2e:c5:49:95:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
198446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.WebClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 134a691633398fa66c598cec9e1e70685b23f3414878de0e109d7d24e1431644
- MD5 39721fd5f62a5f1c9c0dd8139ab740ab
- SHA1 6705bce547f5528abac8c1b2f528d321e1395e11
- SHA512 8cef3c30ede35357c479d44821974f8f751359b4c22263d56d5439653c951f7cfd0c6c741bb7a44f38c90430c9f2bd76455f9acf7a5e762e3dd8e7fcfdb5da07
- SSDEEP 1536:wOb+9zNGhv3BBBDzkVFUunU9Y3Bv4HWiocWz:6i8oY3Bv4HWis
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.WebHeaderCollection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c39b4e8ed6085f4598276241006b336de0a7f1b4656c58ddcf618404afe0e7ea
- MD5 8fb46a733e9cc705a7e8a20574bd04f9
- SHA1 c09491ffff7cfdc9957464289e52088eb5cef540
- SHA512 16ebd096e0970c573596d115b9d78a4f493585163a6c8ea1a516dc55d9db60494c86ad7e6891a632cd0d33540d464cb84ea5f3bc5998bf9653c278d430df4aff
- SSDEEP 768:Wi1zFHQTamoc9lj5XQq1AK1SB8SvbnrE:CamoclJ1fSm6nrE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.WebProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0c254228fda9d6c4869a39040ba95ae9a51265d5a7990083168b07251302ea04
- MD5 3f7ad35c9e024c0d7e97425a047e0b6c
- SHA1 ae0efa232c8f53bd478fad1247f897271ca7600c
- SHA512 de5875b4c5a62b482c4413bb706f7a1ec63c5efac0b049197d2d79d2cea271ebf882d53bc01c3c1c24defc142126c90eee56b6671aa86dacd63b625499d238aa
- SSDEEP 192:aVvCGwUTASSbEBch3Z4Gh6agWA3WprnW:gG94BmGGwarA3WprnW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.WebSockets.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4f8384d0a3cefe42ddc09030c281c14f7204ad2b82ce89a1f3efb80f63801f7c
- MD5 309109fbe4c44fa5c71af3e9fd266e2a
- SHA1 05453b93560911bdbcc6782750faf3d3f1156657
- SHA512 8f695b2796c3d3eea56ae4969053857f1368fcd9e7d6f9f436efcf6c56d2cdc0ea7f21264a014ac5277647cfcea63a6b0b2e8acdb551a1345c7c5383d49f760f
- SSDEEP 384:nSaqJtTMg5ynAw1KWEobT4pj1C1/fY0044koqB4sYcWqovaErmDg51EI111jUdaK:0oGIAwIjIZff9oqccWKEr3EpENWsVEV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.WebSockets.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 343e8f7d9bdbae163147781ee3d18e621d36358e512e1cce5b7733b9edefc3a8
- MD5 0ad34522f168f866d09b43ba0c3869de
- SHA1 6e2b3665e1cea39a75cf697d460a0f7214fdbd90
- SHA512 a55c73a0f8b232695df97e6d6123c96652fc63490e84368b7de9bf75888fc8d3eba4a4b1b6588322c717a5a9af5e356dee8570b8339d6f464ce03de007beb583
- SSDEEP 1536:Nk87cgAteFF6majUmKCHjYfbIpYDvlJnqSRw+:TY+TjdoYfbIpYDvlJnqy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Net.dll
- SHA256 2d76431b8c1836c217eb6fe840289b5bec6ae98f72e80ab657bd487be573c7e5
- MD5 c487a49ad997c54bdd1966260b54b545
- SHA1 029e74af432792b4d95817ede916d420bcc20d1b
- SHA512 fbd37e62e2f6e49c3d6058a34af817984eca0bdee0920abaf7af2b943748ddd8ead24f3fd16a8ff97d2ec4f6de7167dcf6c8d6919f4b9d7a378b5a6fb7e18f71
- SSDEEP 384:aWobV9WO313QglWK0dg1O7HRN7l6zaHeR9zgNO:m713261ibC9zH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
aa:c1:a3:33:26:1c:51:df:d7:e9:78:44:05:e1:8d:61:9b:32:9a:f2:c2:61:c9:39:9f:8f:63:de:77:24:7f:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Net.ni.pdb
System.Net.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Numerics.Vectors.dll
- SHA256 daf899631e7d2b6e5a8676bf4ca454ea3a59feac100a8bb1b207ea23f7628284
- MD5 6e03d9590582406ea0566f40a5d3c37e
- SHA1 c533c0c100089dc318b7bb51ef419d18b5b6dd02
- SHA512 20163b500d14d10b44394692c98f43ef2036c6f9067d5b8fec00d69aaa45226be32042060daddd3cf2c778c242eff7d49f75c636f626f0d21c9f79f657728f43
- SSDEEP 3072:XfuHmcSg4eGY3mIqKJDbtrrkYLFQw73XNbrj7562Ij4L:mHmcSg4eGchz1RU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
32:51:e7:b0:7f:82:53:f2:ad:5c:0e:4e:f7:ed:7f:d8:8c:c0:af:d1:d5:a1:71:0d:24:74:06:02:ae:fb:79:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Numerics.Vectors.ni.pdb
System.Numerics.Vectors.pdb
Name
.data
Size
512B
Virtual Size
484B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Numerics.dll
- SHA256 12eba928f088dec978f00b1347454afd6e417b338e54e4aee56d92bf328cde5b
- MD5 99134c6ce77dbd04a8b90475d7eccb1d
- SHA1 2bc6d296ac0e9ef48bb3b74c000f0e4d1d123db9
- SHA512 1ee73622dc0194fff68d91054843742364f8fcd1f934a0e742d3c7820c805f4cc519f1cc06d9533b432c13cf74d13ad944b7e40dd5d01b70c4d68fb58f6267ee
- SSDEEP 192:tWek6WSj0+d3p+eWvcuyjS7HnhWgN7aMWhp9MMBdRgjLX01k9z3AzsylH:tWek6WGd3pY7HRN7GleLR9zusylH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ae:56:f3:1c:b9:aa:f7:ec:1c:ac:04:ed:f5:93:11:e0:01:69:12:d0:77:32:0c:09:23:7a:7a:e8:6e:a1:ec:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Numerics.ni.pdb
System.Numerics.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.ObjectModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c035a4384cdf0c6b7f5c086f0c7c55158f1a216365ea775e6805152440c73513
- MD5 dc462d00352c359a0d975c786193ab82
- SHA1 f4a64dc0c845e8f1fa88e789da532b5c7ea93eca
- SHA512 1afc5c23e8a6386ccdf4167d722937b9a29d5975be9d3faf2dac3922024bfab608802f6731902e5ce9ca5edb3a2ba5a38301c97af68eb09aad3bc1546cd95386
- SSDEEP 384:XIjgf2esahsGrZpibree6YqeuT1Td25tNPGXrPpoZbARXLapa9a98ktPMGaHWlso:X12esaiyZp4+haPGXTOUAZ+HT1Wy7wp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Printing.dll
- SHA256 ceaeb79be44b248b44bb9c65cb775f39dd4438f4f19ab2b1d65ddc20870f02b8
- MD5 2f6247bf408a36601aeac1d9c61f2650
- SHA1 ead05e4ae65a2265867a1ea7f9dae90df1d05199
- SHA512 60b124a3f8ad4797bef1b0431293b593f4d1835db7f12aa3779c29e844d9a8206bd13af659fdaab1e7e16fc6ba37f7f8e9eaee38789f2f5f6a9fec0ab935bc62
- SSDEEP 12288:XAe3WKGayUNV0JERuxjoB/Jk40OnqVd3uy/9xXBA3ebo4a/:RiU/0J52Jk40OnqvTlxX+4a/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
76:66:67:b2:df:6d:29:02:e3:9f:48:aa:1e:7e:0d:94:ad:03:90:18:36:fb:6c:d1:10:71:23:ae:7e:55:e8:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Printing.ni.pdb
D:\a\_work\1\s\artifacts\bin\System.Printing\Release\netcoreapp3.1\System.Printing.pdb
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
819KB
Virtual Size
818KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Private.CoreLib.dll
- SHA256 9ce4d015b9350831a05fc43ca0230148efac40ad0f3f2e7483c5bf131cc458ce
- MD5 d7cf959f116b764db8a0d8d556b50925
- SHA1 dff30b342248adae4801d17e0310648dba4ea63d
- SHA512 d145561ea7d7312c81d59a56ee4f884fa8fe6ac82b6a2eff76c8ed09021fb16ab73722d800bab9318467798693c926b9a8c05c68e1441fa5c3bae2e1ae60a86c
- SSDEEP 98304:wuDmchAUU3w/8bzZ85eUL0FBUSiAkCH4BXFHLiKpdrQ:wotcg/SzH1BUSiA0X
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
83:59:f1:93:5f:9b:51:80:cd:1c:46:b7:d4:f4:8d:6f:5d:41:df:c1:d4:4c:ec:ee:75:fe:96:92:a1:88:61:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Private.CoreLib.ni.pdb
System.Private.CoreLib.pdb
Name
.data
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Private.DataContractSerialization.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 09b69203bb0daac0c4ac93c2f893d23e4d6094ec66135543509524f5631d3571
- MD5 b42c8007542aac0fef1855253d220b9d
- SHA1 415701bd5ca1e6c2b56775513505b302e6226526
- SHA512 98ff9f7c795081c32b7d1dd4f8dc5abf040ebd412afca7a977f50e38ec7d7ba3b6be46fc121b202a17fcd618d75ada6f06466a24bb790b203886b6dd3bbc0919
- SSDEEP 12288:vqPWD9DLWJh1GBWIkakMOQFnl3F/eda8VZQuRX1bZrYdISbfDYa6gNT3NIod4Yc9:v/RxX4XTrH/ynmvfv3URvObvR0O2lkLX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
760030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
734KB
Virtual Size
734KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Private.ServiceModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 83fd67d7d2e8e044a26d6135b95956e9aea8f4d075430cb05bd6bd8a84d3f0ad
- MD5 494ed53a8d6211fdd5320ed8b525e1f1
- SHA1 d2397e0b1c5ede5bac7a8bb63a5f6d65ed009108
- SHA512 a13e10fa36580de442d9cab85c16f1f3969becb50a024b8f31c75d6b5953c5a1719771cc7a676df92095ca087b5c4650391043958a0539674c1522477e1d2570
- SSDEEP 49152:jWNyY35MeyPAjzRi0HDBSRzTxLz5S2Br:jWAYpMJ0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2306014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Private.Uri.dll
- SHA256 14c68463ab43820e1c3948c47ec18ddaa43d7b92dac676559252e7d4ba820aa2
- MD5 933b4b3ff0a4ebc4bfd3965dbb14c04b
- SHA1 c9d81317e4ecfedba340c4e30a94f5fe3b7e4b15
- SHA512 02da3cec351a6c4ad2d45fc3baa1e335c5fdeb3ae36af071e45e410e24c66f23c55a50c4c833cd0d1ab23f35f5b09d56e30a852cd49fe0cb8059fe345c03c7c7
- SSDEEP 6144:D6n0hhQLAIN3TZ0b69lgbdTwdRiksjIwKtM33d+dCMfMPMhMpENpQxxHwugtvRmL:DFBG2w0aLiBJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
df:f5:e5:ea:0a:39:8c:e9:95:ce:20:0a:84:55:79:73:d2:03:e8:61:d5:f0:b6:7d:40:05:d8:8c:d5:eb:37:a7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Private.Uri.ni.pdb
System.Private.Uri.pdb
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Private.Xml.Linq.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 052da987d586b6aacd43052c7fe7bba4a2f5a6a826c0f9b7408b4c55147425d0
- MD5 08a50ffc3b27f22f7ff624d56a6cea26
- SHA1 ba77cba86e6eb375c0f4c1ab5784a96f9e912a49
- SHA512 ce612f7292397ed37eb620c51f1c80d49cd70a92beb90ff0c5feca9ec486b40a274b2d158850e1c64e51ed10e5e27baaf242cad2ff586bd7df5a591100662a6a
- SSDEEP 3072:B9/tzI+k4o0IIsXQSaPROlZIVz1SPEWm8Ki:lo4o4D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Private.Xml.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dbfe6d65aa70e30c0cc6a06b485ae9de48e362ee60d249a52820274fdb260f63
- MD5 77e1c05c3ba6cbc88053296beb5c7c9b
- SHA1 578ec73ae90456858975d57b7aea1796917db4eb
- SHA512 34f46753640c6dfd5eafd4a286887d34421449bc09c0c456239dac50cca2668076e993e438b9ad07423e8536f603304425187d67e4cca9565d3d9ec0e021e0af
- SSDEEP 49152:ESnsNtxn2m0+lUicJncwYqB2x4FhOvomo:ESns/xL0cU2wYqB
- MD5 SHA1 SHA512 SSDEEP
Digest
a7:ba:86:df:a8:c5:b6:cf:87:08:ec:00:0f:c9:c3:1f:35:77:9b:85:d2:d5:88:b7:3e:31:34:75:aa:3b:17:76
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3059470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Reflection.Context.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6b05773621a83cca542e4f38e2d2d44c5325e88b75ea43a0eed7df38521f4b9
- MD5 bee24da2f0c8eecba68a7cc8db032064
- SHA1 8f372aaf605c12b5d366d5165514db1cf746b8d2
- SHA512 0f6942b2b3d8bb3f104b5f95131142658571364c121173593741e2fbb3ccb602998e0cb6042cf4d2dbc09392d89cfd04889b32d5eec36d94abc4c1a1b152826f
- SSDEEP 768:/IvrtAhlwUmVDAPM2Dd8bhpCCxWbm3fsdlJJVLwK6OHf6BW0kXxHINkxnaG:/IvrfDchqSb7j7HfVxJcG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Reflection.DispatchProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bbfe484ea179575c0815c8303e7ca6b07d3b91f11bda053b01ff2268681150d2
- MD5 54fb3aeda26fe053ed3b0e5131d1ff97
- SHA1 9e4df1aec361f6c842d4eb942e93618a45452fa9
- SHA512 139468ecc83c37d30fee8ccc78b53255463b6ee59dc8cee9989b679df2d1fcec3831bb8a660ee816704a70ff9dc8cffd3a8d5a8f9b3cde56ecc767144dcb29e0
- SSDEEP 768:Juwrfz8RGcKkZ62WaFXLWCbPrz+g3LySe:Ew/kGcKslNikjz1e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Reflection.Emit.ILGeneration.dll
- SHA256 fea02e9917a29f1caef5387506583ed8d2c9f2d7c01eb5f7ad7fcd0da01a3804
- MD5 628bd7e0e3efb7172ccd55b66f615aab
- SHA1 9a312cd8062ed4f0c3ec21646c2fefc18c6aba3a
- SHA512 de3c370585ee4e66d1d9ccb77d80d12194d9224fdbc782251e087ad68df66a6f2906da9abfff381fb39d590cc42a288ec6d0dd4224064376f6e64624a9a1b04e
- SSDEEP 384:yCWV3DWg9g3dCS7HRN7iyle6zaHeR9zgNd7hM:yBBgM+iylaC9zEtM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7c:44:eb:17:09:65:82:ce:6b:a7:b0:b9:64:20:2d:0f:ed:c4:4d:31:01:4e:19:70:b3:d6:5d:e8:34:7f:a2:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.Emit.ILGeneration.ni.pdb
System.Reflection.Emit.ILGeneration.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Reflection.Emit.Lightweight.dll
- SHA256 143b6dd989b9b8b1166a941538d8bebc5404b9af8961791060ce1fe68a01bde5
- MD5 447a3f7a38834f4605828b22f7fbac52
- SHA1 c724b1dcb513fdf4f8dd91aa1b2967ab05988ee1
- SHA512 ec276b1ce26dbbd013b1572249d8f803829eedb8e9418e9ae1c5a2e141a350d20f9a34f0125c02c3821fcb4f2d6f18c2621e2312df4d49d45db713182b50291e
- SSDEEP 384:qVWxYV+W73+d1x7HRN7lE3X+R9zusrSWgusD:CTmVWXi9zu6by
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7f:35:9d:fa:07:b4:eb:ad:8a:95:43:4d:4d:36:4b:de:4e:99:56:98:3e:97:e0:bf:3e:f8:02:51:da:9c:75:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.Emit.Lightweight.ni.pdb
System.Reflection.Emit.Lightweight.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Reflection.Emit.dll
- SHA256 cf4013d5dcd32b6c39f964775e98a5513146b30da2317d4636fa4af4e151131a
- MD5 17408c5a752130433d3d6af8d2807e5c
- SHA1 a9d49188e8410741de610e795d0a64b73f0c2f31
- SHA512 c306f5f86f0ffc7e223a16f3fece29e97453e6bbcf732b09f027599437748c2e3c95f9757a45d2900733cd58261ed0cc8196fe632d7f7bb896583af3f2d7fa98
- SSDEEP 384:qLLW6MgWWursUwdPj7HRN7gzG50ZSxR9zZwc4UweB:IdUuf750Zi9zg8B
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a1:61:50:dc:45:03:55:df:52:59:8d:7b:e9:f9:53:38:05:6b:6b:3c:c8:5a:66:ae:c1:e9:76:a7:0c:75:f5:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.Emit.ni.pdb
System.Reflection.Emit.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Reflection.Extensions.dll
- SHA256 2d55789e85194ab4fec5de696b9bdc329505ad37e231ed84e81df7d449bb74cf
- MD5 e7dc57b5b650fb11b3045b1332228802
- SHA1 9c311afa635b0a20e7fde6254b727b5d029bd499
- SHA512 ba5f2503db4224883370a08d89925210c2d33b7b514f0698e1852e63215b11e09cbfa3522f9d851d29078102eadc5dcb52616b677ebb5d89d5d997f11364e4a4
- SSDEEP 384:MWK9BW3WdoNBE7HRN7gk6zaHeR9zgNb3l:a8dBggUC9zE
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
67:8c:87:1a:12:b1:76:ca:69:c6:5a:cc:03:3a:6f:ea:f8:d1:2b:c5:c2:23:72:f2:10:58:1e:9c:8a:fd:f8:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.Extensions.ni.pdb
System.Reflection.Extensions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Reflection.Metadata.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0f245089855c80a8721cdf9a27bfa3bdb05a0189dc3f02965223a8aedf86f282
- MD5 6af1e722cc4a9d95182aa2a424f2dac3
- SHA1 3643e6962fce9e22432ea7ae1ec2bc487c603c33
- SHA512 d0f425e157ee66c610d37f1c1945df4e79ca333ae421fb2e575327e8327944ce8a401a4a6d0107335d2a931e60fcdcb8e17c79c98795ec87f661336651a61de9
- SSDEEP 6144:ulyP5TcGa7o17Xg8ZldLTnCp6hvwAebPidk:ulw1TldLTnyNPw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
439838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
422KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Reflection.Primitives.dll
- SHA256 a40b9c13765d8d472b8efc72e7c3c096c4891d6a401d86bc2ae572d5c935ca86
- MD5 f06e221e71bee1cd85a4bab2204edd8b
- SHA1 993e991da4b157737570ef35804a21df698ddfed
- SHA512 6ac740b1e824a87454c0ea2bf9a705f03cefc083a61378671a7b2fb52c87eb36a113a97a214b762d16f09be048d839b737a558246993daf590075a8b50740f0b
- SSDEEP 192:9WSFZWK4lUjxrdHSeWvcuyjS7HnhWgN7aMWhOzSMMBdRgjLX01k9z3Azsyz0PvI:9WSFZWNlSrdH87HRN7tuleLR9zusywXI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:2a:ec:4e:af:69:4a:3a:95:cf:e1:a6:bb:00:e6:13:99:19:be:cb:63:37:e1:c1:b9:ca:d2:a9:e6:30:39:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.Primitives.ni.pdb
System.Reflection.Primitives.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Reflection.TypeExtensions.dll
- SHA256 5fc95a1f86ff697dc5014b63a5a83e1caa14e32c5f8338fda4d44f800ab6300e
- MD5 3e8f4b0637df5aecc3c5f3657670e57b
- SHA1 a8cab6969397ef22d62ba58c13af23ce8c735838
- SHA512 7214812d6eae65bf3112aa1b37df80688644bed47506435eb81c09ba1ea91a6953b277cdebb3f50ed4bccdc198414c3b1afcc8360d77d260e8899e1425fd2b28
- SSDEEP 768:S5kdbrDGaNPNmSux3UU4d7hIKeJoXE8Cpp6IXEUoyBp7p+yV2R1NIAG750Zi9zG:S5kdbr7NPHli2SAGNzG
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
63:33:66:0d:a6:0f:20:5a:3d:be:e3:03:ac:52:46:67:3c:bd:ee:33:b7:c9:18:83:2a:98:8b:62:ad:4e:36:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.TypeExtensions.ni.pdb
System.Reflection.TypeExtensions.pdb
Name
.data
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Reflection.dll
- SHA256 f942b4322db97ef98d5793f6065a749fafbd6ddceedc36293329529e0b0d48c9
- MD5 f47c4db395043d3067eeaaa9a1363b0f
- SHA1 af1680d600a7f297d072f822cd57e393e7cfa293
- SHA512 5f7ef9a1e92906a9028f3c120004211a5b6cf9892040f44cde5abf98545d3cd1d939dd2a0d2fd161e492c1a108f35f51a1bcde19e108e866c87eead590cc4f6a
- SSDEEP 192:UWhR1WdgbK4btExV7dr6eWvcuyjS7HnhWgN7aYWhHFVd1wqF9e+X01k9z3AeJX9w:UWhR1Wy6V7drE7HRN7q1/99R9z/V
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
66:e1:3a:85:d1:3b:06:25:b4:aa:64:ed:8d:65:dd:64:0a:8c:53:92:07:d6:5f:37:e0:c7:f9:f8:61:93:1f:ec
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Reflection.ni.pdb
System.Reflection.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Resources.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 62616f161c44c7ebf81096a1a988a03382390ebc584188ed850a86ae9132da0e
- MD5 32c8ed263f97917cad7006a047366338
- SHA1 1479c22419fe7665cc4190eca2fdd7b01b19faf6
- SHA512 959b600000a43dd1448940afae67a31f0922dc1186a1f881914dd11f25b6de46924aa406788ce79bdd2970c5706c6e0a3eb170bfd600f5405d2eb6a7d2aa4e49
- SSDEEP 768:3yfUxAAOW/XzXQmD6OSbt+tiTsos10MYhZTaiSrVzzxbv0U/TPYCDO:kUu9GoxanQe9tBv7y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Resources.Reader.dll
- SHA256 97bbd447452e22a0f6efaa7ae954e12972862d5f145f5ac5e6bd89a724004315
- MD5 db9be5a675c27c3372c3a4fe6e9d8ab0
- SHA1 3aea5e6da260603a0bc1fd7c5d88d11fab90309b
- SHA512 49867ce81552d45e8b8cd783ec40f5eee7d5ad41cafb964c518fa4df41ff9ce8330a58fe23e35df89ee13f37822a3bd87172588d6c92d6f22485db833fa4c98b
- SSDEEP 384:8W4iwWr3dHhK7HRN7MMmE3X+R9zusr7yKzMk:TZthmMGXi9zuiyuMk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
53:20:aa:cd:86:34:63:f9:45:4e:d8:04:a1:ec:f4:84:1d:82:ab:15:54:87:a4:26:5b:8a:ab:75:98:89:a3:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Resources.Reader.ni.pdb
System.Resources.Reader.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Resources.ResourceManager.dll
- SHA256 794aeb7db6dc66a2bcc6f4f008fd36fa85b845ee34a17608ae50866e2d8ec475
- MD5 4a6103f73c8d1d09f2cb9e3cdc36e8d3
- SHA1 10f1254be423afb56b69e9de283aa580440d5ed6
- SHA512 508f0a592b50a2cc95ee2c7a5ee2927dc0eecd1e7366b321ebfca27c428118266e191165ec1c2398e68316f24acc8d7fced69172ea676a5551e28dfd4b0e0402
- SSDEEP 384:bWV20WrZ9SdoF7HRN7HoTg8M8/fi/GR9zZ8B8j:vb9fBHaMufiC9zu8j
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:46:66:c2:92:d3:7c:ec:32:eb:57:b3:ab:56:f3:d7:3d:96:c8:5d:42:33:8a:db:a6:da:dc:4b:a6:6c:45:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Resources.ResourceManager.ni.pdb
System.Resources.ResourceManager.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Resources.Writer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b8642692a063153c1259ed3bd3da86f29e97a36e79464f89d5e41c75f1d2297a
- MD5 b5182580bed8747fce8e6da01b48a711
- SHA1 6bca497bc286bef465b7a213b99d32543960fe1a
- SHA512 1bb4c94ab69aff6f20449cd3ac2dfbef6ae4645f032180aabd4df87a2a4ec9e2e2b58c61e6c4802af708a2bd88254a271da5a520982b57d3528a9234259b308e
- SSDEEP 384:0vIToQKTFHRqVak0VzDhdFqmSj0QPuSOCWeMSW:0vIToTTFHRdv1qvV8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.Caching.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 53827519463567379b65ac781b0c3088910eb62d4519069a0b138209ab840463
- MD5 ba1e94ef700f2aa38291e841394f139b
- SHA1 422f5514e43624f9d4292898a0d95166dcaf2889
- SHA512 1c32be97b2b407ddad30b2f8c7d91518d77b28572e52313f72e4d3239383f12cb94759c23e3fa357eb4d1c7f242a47b67635f9f7d53ddc80a5d7cbeb98a1a23f
- SSDEEP 1536:3jxDkeE3sMiZpRjp5TxySpovQIlZkUaVuH+usRr:l4eHMiZpRj/TxVpo4IlxaMH+umr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.CompilerServices.Unsafe.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2ca3f57881e415d61a43100a8ea77e69d983f9d1de14971381d240a1e21b3370
- MD5 b37ee0006a7af7ea6019953bc6a61b78
- SHA1 ea2cb754391e2708065dd4cfcd87188de4015aa5
- SHA512 005bd3670bcb0f848bbdbdf673980a2f086c2844b0f7db72c400487d67cabfd80922d0ba09b93623ad942ea057132146e4869844d7fa2c9086b5b0b4b7c408e1
- SSDEEP 96:zHnzzY24ZxcE0+B7xvOuKDPbqDwWgdhWE:v01V97xLAWgdhW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.CompilerServices.VisualC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5dab8eee6f0a678e2ac77070dfdc69f6e69710097411b636106b3dd43e636305
- MD5 9a8eaa5b280e82638af452ebd25f78c2
- SHA1 984d46c36fc3f65266930fffffc5634eb04ebba8
- SHA512 190e66d9187031a7d059367e99f1b719b411a8bc03798ec06a75459284fdd4f234f28fe87330500ad42caa272f9b50a28b27ab41e6989a31283a1788e452e40f
- SSDEEP 48:6EmSILXKd0w4GExkvf/UQUKVdJKGXBZLxObGP+Iv3H1HuKqP0DzDVQxc8mZWcJL0:bNfEiMKVdXzxv3VHuzP0DzDjWsO8WE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.Extensions.dll
- SHA256 f52450c3184f1657de8110428f92930f0ee4acba19c030573bf72fe2f30b8499
- MD5 4ebe62c159d77fe4f61e33f9770d5934
- SHA1 74ceb072d4db9160e8e02bbee0a9540a47dd791f
- SHA512 13404234a035523ca3867681a5cb926b8df3db3030e49d170db816a4fc4919e13d7f42d288d7b6c791c850bea0f562edcf5aebd6be0f8e779fc3f9e966e43e93
- SSDEEP 3072:+O4/RerJ2UiL9ebKKKn3MJmlc74vVJDS+FP1ihB8EkdqVCVvgYSJf9XF:Z2Sw1Znn3x5XSkykdOCBgY49V
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
14:a1:1a:fc:43:15:7e:49:65:9e:4c:9b:cd:a9:4b:e7:c5:bd:74:8f:d2:d5:88:02:aa:90:98:e6:5d:d8:1e:8a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Extensions.ni.pdb
System.Runtime.Extensions.pdb
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Handles.dll
- SHA256 220235cf56edb06973c7c234b03a242f0dd3aa01032222ef295c798d589c68b8
- MD5 f5d7e2631a4d8005681c499790e78c57
- SHA1 66604e689fe487539a95e9967fb9906f28a492c2
- SHA512 6de423361c8a7a034d7d6878a3415e163a2c1c71abc09bb39076e71a9ff7d0ea4f1c36a342d1d99083ea2e8636ebfe968742428977fb5e4ff9db0a21e33d02ac
- SSDEEP 384:JIWAtRWZCkYdsw67HRN7x172vH3rPR9z/GE3:OLksWa3l9zr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ed:c8:7b:8e:92:98:a4:33:a6:44:cd:93:ed:97:c7:fb:76:04:67:2a:0e:86:2b:c3:ee:ef:b4:cd:ef:99:ed:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Handles.ni.pdb
System.Runtime.Handles.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.InteropServices.RuntimeInformation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c95905d412d406cbb9ef03536cd6b83a474b1d630187ae0b85d483df6aec38b
- MD5 c199b752c2fd8153b1f3bb3ae1d0dbdb
- SHA1 8be64ddf412ed4ef3988562c0e2a5903febe2ea7
- SHA512 7116db56f6da057c6b9e5462c3b06331c96b52659de7df7bf09297822ae7f1d9eca4ba76456ec7e5d01e28183a2a80f173ad62e9eb653782a281bc2accc420da
- SSDEEP 192:a9g05Og2uPPUxRiAz4umIskSxc3+piQYWHXDW:c5xV3XO7mIQc3+iQYWHXDW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.InteropServices.WindowsRuntime.dll
- SHA256 5cb4242180d7f0e6e5f2148fbfe8e1f5e0e796ea0151648f6990bd2ba3ddc9b9
- MD5 339e490c340e20e9b763cb2e3ce44fff
- SHA1 0cd8d1aaaa95a1b1fe942e41177f1988c3245168
- SHA512 a28e7837cbadf3b9dd0b7efd67d4b18156aaa59f76488c0c8016882701ce73e4e60e0cdea41254ac1c3be3baf00828385969cc97cee9be908e8dc5fdf347fb56
- SSDEEP 192:BW2yQWr3p0q+Uo2zCx+dhOJeWvcuyjS7HnhWgN7aMWhi90MMBdRgjLX01k9z3Az2:BW2yQWP+FoI+dhOJ7HRN7YleLR9zusy+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2e:20:e9:b4:d6:b3:5b:cc:1d:82:9c:4c:9b:f2:57:92:ca:3f:d9:da:ec:fb:c8:7f:65:94:9c:2d:a2:78:0a:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.InteropServices.WindowsRuntime.ni.pdb
System.Runtime.InteropServices.WindowsRuntime.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.InteropServices.dll
- SHA256 458fd4466f84acbfa5a84cf9a403ec8ed2dda111fe985523a3d51081a3e63b24
- MD5 b57f607811243f83f754a6bf8908ea69
- SHA1 f1d7286352ae7c3d69aa30ff190a5fde8ffd8b96
- SHA512 cd3b375174940b4e8a13aa7184911789d4d6c67f01f02f7f085c0a27c94309bf7231515784e06bfea21e84c903cf318f42c542c9eb8cbccf3f67f451d47081be
- SSDEEP 768:u+XO81UgyABoc9R1xnL+jxYNfkIMADBQAYgMQPzYKhuLdibn6K9z:u+e81HyACcaXADBQP4f0RibnXz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f7:82:59:e5:fe:8d:bb:c4:40:67:06:1d:3a:2e:96:cb:f9:6e:13:fb:dd:e1:a9:db:46:f8:ff:48:c4:f7:f4:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.InteropServices.ni.pdb
System.Runtime.InteropServices.pdb
Name
.data
Size
1024B
Virtual Size
612B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Intrinsics.dll
- SHA256 6ce5ead1e4819e5ad89096c854b771a4871889bc99d30390622e76d6f76e99db
- MD5 a4e941e6c7db06ce5bf1681ac107c1f4
- SHA1 33abf5f6c201adc05f404ba7f50107762a8c2b35
- SHA512 9db864a06c48885a4f21776cfe42d47b20edc5a6d6dbed38407e3c6c3bfade2b9670ce5ef59275d12275c0b9816750520482c4c884c152350276499ff4b44935
- SSDEEP 192:5Wmu8WK3XKXd0sueWvcuyjS7HnhWgN7aB+WhK3cH+BEg7X01k9z3APDWP:5Wmu8WuOdfI7HRN720LR9zwiP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
73:b2:10:c2:e8:6b:8e:ce:a1:e7:28:85:9b:e5:89:da:31:00:15:91:83:e0:16:c9:a7:da:41:2f:63:8b:94:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Intrinsics.ni.pdb
System.Runtime.Intrinsics.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Loader.dll
- SHA256 488e674e338ee83eceb170e8eed9dcc642107497525a93899a45e7b7361a7212
- MD5 0fe7d237ca3d177478dc6ea208452639
- SHA1 d675e3c84b15848b9181a5fc2777e8ae09c81ec8
- SHA512 59c8ce0e7b4cc8ffccc613983360d1896ee70354ee3e9a5c26d9842e85e9afae542fe0f44b630376e12f6cc4fa6ca2357107cb68e7b84ff89490678d731c32d3
- SSDEEP 384:XW59xWP0pd117HRN7yE3X+R9zusrJiHsF:g+09xJXi9zuhMF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f8:19:1b:3b:03:d0:b5:54:1d:f7:9a:a4:68:37:35:ac:e4:34:3b:5b:ed:4b:53:2b:84:e5:76:ef:dd:a1:de:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Loader.ni.pdb
System.Runtime.Loader.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Numerics.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aadc9d0970fe22d1cb9b8b3356b569398ad035ceb8c766170eaab776f7c03a4d
- MD5 197c856f8ff7cab7036fbda26fda048b
- SHA1 585e7aecedad5e9832a006a26a8ba05d834ed2a3
- SHA512 c979c5a758e8e1d18aa897a6924786a592c4293f1cc25adc509251f6ea205c6bd5c28c2e6cb958a51e187d6789ded1936f16691b089309e6ff9a5434d02c50cb
- SSDEEP 1536:pymq/xtRguiMPUY86M+VmbMMfVzoxqtH8FKp4ihXEx7R:pC6uiy+6M+VaMMfVzoqcryXm
- MD5 SHA1 SHA512 SSDEEP
Digest
8d:11:42:b9:d1:d8:d5:41:72:b8:6c:8a:af:1a:54:bb:e9:28:90:c5:75:2c:89:48:d8:7a:61:ab:09:43:b6:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
68238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.Serialization.Formatters.dll
- SHA256 cab5210a66f89d054e31a4204467c3f384c1fa2d308dade5344577c7369f9828
- MD5 e593f58dea6a2a5ea87c4a05178e3306
- SHA1 a718d75bd070227daf4611c684ed0a4dae60c372
- SHA512 ac1b4adc0c793b1ca5bfd47d68ee92d77be0c53eade54e25b845846458b376c25b66fc23342e065d019aafc303b388f7bbb7fedfa73645b93ac49477d2331850
- SSDEEP 6144:Wpxkk+J54F0rhL8O0QsvN+LLIOFfqIVPTAvPHJU:Ak14DdN+LLIbiqPHu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
80:d4:a1:f1:35:dc:1d:88:c9:55:9a:a0:02:c7:0d:38:d7:97:e6:92:dd:a4:b4:64:d1:b7:c1:a5:12:c3:4c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Serialization.Formatters.ni.pdb
System.Runtime.Serialization.Formatters.pdb
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
253KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Serialization.Json.dll
- SHA256 03cffd90eb6c909adfb24eb1b017aaa6e752765aa232d154e7668f4f0fcf5b00
- MD5 f0e4bf6c66891eb5255a95d251f23e00
- SHA1 f05c447926d29f8a7dfcfdbc9aa22592205d1761
- SHA512 ae8f4ab4d104c122ad7a29a476237cbb08ee3f7a7119788a7e3589c5b3a714ad5c9a0266f56b6e375aa89bef0acf84b15a2d8771b5a8550c1565d9fd9a8f4dca
- SSDEEP 384:XVWbuMdBuWS+pDdED7HRN786zaHeR9zgNL:XWxdBCIS/8C9zi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
73:f3:6b:4b:8e:02:f6:e5:da:c1:37:d9:89:63:00:f1:e0:c0:71:b3:25:0f:e5:39:75:de:b5:78:69:3d:93:5d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Serialization.Json.ni.pdb
System.Runtime.Serialization.Json.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Serialization.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 40055cbf3662422998e9052106562383c634c1c7be21b2e7ea5c10c1a4b74522
- MD5 b1ac878b1603bc42deb8f1202f4ce38e
- SHA1 9e565041902fee54b889cfed6ea6459e92fdc9c6
- SHA512 ad6698ef7818b7f6ac4d34ebf1035819b4d61cb8f3c2fa6b8b12e8fbe4daacfef05e2e383f1b00900c8ee34bf57a5d9c587ef70ed5de9e5b596c53c796edfe61
- SSDEEP 192:mlUBfukRLycfxxsy7z+9B+N8VkOzCfCkNFoNkHHDawxMPVyYQ3Gx2HWFIuJBcW:aALyeKh9BnkO2akXJHHD5MqC2HWFIuJD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.Serialization.Xml.dll
- SHA256 be6577e9a5c0b5912fff18e6980f091baba819c07489244ff6e71af818f5dba0
- MD5 da0ce89fbe65aad22491dfcda27b3932
- SHA1 1044b5ae24cae2e5024e85ee23c0352b258995bf
- SHA512 73805aaa93e103c0ae23462737a40e64653708f5a0265f273da1ba363f0d26e2594420ef0da97919e94a3f0f27fc0e17b540e4594f566597814ad9317e9f9042
- SSDEEP 384:mMWsBLBBXWfRlmI8NXYdc27HRN77HR9zHOttS:miNBB0RlmI8NX5a7x9zua
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c1:d8:e0:c4:61:1d:00:f5:9a:b4:f5:7e:54:9d:19:01:d4:b3:6a:1e:dc:45:e1:ba:fe:2c:03:70:02:38:60:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Serialization.Xml.ni.pdb
System.Runtime.Serialization.Xml.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.Serialization.dll
- SHA256 33485af8118d494ca489a89f8f2e21c3759ea0317ea6c8a5fe541338f5c3d1f8
- MD5 b932a7eff5de419f286a7325cc0befa6
- SHA1 e3aa45ebb2ffec8c1681134f54d0f533d541c899
- SHA512 6708fa3eec64a927145dd5bd174902f5c612700f0fdf782e577a7a7dcfb07256d3a43098aa9415cf038baac840194fa43ba0865fd451c49520e45efc4f6f64dd
- SSDEEP 384:RLWgM/4BAWCDNDj8N0dZT7HRN7pU6zaHeR9zgNaJ:RP84BQDNDj8NqP2C9zP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4a:36:8c:0e:37:90:2d:11:d1:62:2b:5c:07:74:93:06:ff:b1:0e:10:a3:70:f9:c5:13:1f:b2:71:e6:13:b4:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.Serialization.ni.pdb
System.Runtime.Serialization.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Runtime.WindowsRuntime.UI.Xaml.dll
- SHA256 d7ba2132369c971fd9e5aa47be4f378f6030b42bcd73669bd7d09e7a0aec6347
- MD5 d309bd3de14a64e331408b0be88d098a
- SHA1 98b40667de331481624b3d964738b012c9f21e00
- SHA512 b25abb1cd779ec823e71511360dee34b27765480e1982eb1e37ab727c0bb59b97323d5524e76244c8e2e27f8fb6e1893b006ea2c1e25ccd7133a12a0c7a80f0b
- SSDEEP 1536:XN7kr3y4KvS8oFRHVX2eh1Hnxpo/8qJm6Ea5z:XNgzzKvSVFTdB7Kr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
97:ce:0c:36:cc:9f:1c:dc:09:79:1c:03:ef:bb:e1:b0:85:09:61:f4:9f:f3:ec:25:f1:77:52:75:92:e8:94:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.WindowsRuntime.UI.Xaml.ni.pdb
System.Runtime.WindowsRuntime.UI.Xaml.pdb
Name
.data
Size
1024B
Virtual Size
740B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.WindowsRuntime.dll
- SHA256 1eab2a5ea074dec1a6ead80d1361a9fd4317e1cd334672c9d877cf49ccfe5730
- MD5 56edd7e41e06bea54a9259aaff12168b
- SHA1 4f6439904a1ce70d806ad1016a2c6bce72718a62
- SHA512 e21f42d166fb5a62b2ea1dcf92eb60b910c5a3ccc2426c2d0d47491805371206ba04032de661277cdc479ea9064fff8a0e61835a69388b976a2724a8a831b339
- SSDEEP 6144:Mf6YoWGxeGMc2fDu2WFLz7mXDaRTKlTOZPwnPqP7fPi+ubbrze2vQQZm5tMnf:QW2y6THrzC0f
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d3:9a:47:da:51:e4:10:e5:da:cd:e2:4f:c5:92:41:96:9b:b2:07:b3:1a:25:79:d9:74:b7:fb:fc:a0:a6:0b:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.WindowsRuntime.ni.pdb
/_/artifacts/obj/System.Runtime.WindowsRuntime/netcoreapp-Windows_NT-Release/System.Runtime.WindowsRuntime.pdb
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
279KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Runtime.dll
- SHA256 9e1b4b18ea91fee6a83957212e2c33ca1b332d56726e45482e00dc28d82e4444
- MD5 64b6db4e5edc35b1f0f4f8661b1bb5e8
- SHA1 816f75651ce029b26284796f1436e229e06da9f3
- SHA512 219d8163df984415d580737dc23720f1b2d64b4ebb03ee40a5aef94b50e5b6b2ce206cf307d58dd9690ef021ca9df1cdb35380256bfce637212f4695b57032e3
- SSDEEP 768:1xGYe544b916CVbYLNn9vYAv50o2+XURlaUIx9z7m:1xGYe544b91ifZ0ofERlnIjz7m
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cf:7d:96:ee:69:25:64:79:68:75:8c:c6:bc:24:f5:0f:b7:38:5e:bf:fc:d2:d7:88:e8:a8:ba:c0:70:18:ee:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Runtime.ni.pdb
System.Runtime.pdb
Name
.data
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7ce09376a9b66e23f1566a77a3f6327f08365fe10f887d349754b427a5f48f57
- MD5 c868b7b695fd2bee34bc2795827a7b46
- SHA1 928c996e6074f4e5e457048a98a7251f76a6d004
- SHA512 410c5d404390743de89a8934fc1d65d3eafde2f4b72e774cc02511859e219b6f2c5cabe6260d067b93f699858bba0e77444de652a72fa263898d2c16522d9227
- SSDEEP 768:bSCeWMIdeSynI5v4jganXhhUESHbCupCupsWBkyDR5yzXbREKucEyYvAu7tiayOs:XOSy+Og8nUvpB7KzoAuEWHyQ+cAR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Claims.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a89235d45ec5c580d55c38be3b77f7fc73213e566d63dbc036d5f6a6e7e7b6de
- MD5 0e5656d6538cf7f0286836ad02e5c22e
- SHA1 da92d7516015fbc7b9e2756b86ef9329ac7acf9a
- SHA512 188aeba2cf98c0d03e8a32bd325f02ffad92c259875a9b83513c75dc42a73f84e380282f08a4c1525f8b1a2ea7a3ba7d3fb0a4253a3228dd6bb8bc7a3265cd2b
- SSDEEP 768:OQ9wLspB+iMgvW4Tsiozu7bSw75Axl3OQwQ7rzUU3q2bP6nD:OQ9wc+DgvW4Tsiozgbh5AXOQwQ7rzUUs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Algorithms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d7e3cd19c9c38982fdb7d345eec2951b47a12b80491b152580c4016aaf2ebd83
- MD5 a38502388b46281d03cbc7d0be0df0e4
- SHA1 54a114a0339f9a77ff6f948ea0af1b488c455172
- SHA512 a9ac4fcb06a1c75ba8a4e9294c5e858f33eeb161292508fce2cc38366755b3f376637cfd7920955b757d9a13dd2db18c71fc7a9f4719422f2bb5846cb930cdf0
- SSDEEP 3072:VSfXxEah7CQCE16utmq1j60BJjM6zyOz3XyOUPxnEhG4kOuZd8cYIhpn6lqOEcc1:aKmHmqW6dz3rUPxXQ+pc193U
- MD5 SHA1 SHA512 SSDEEP
Digest
e1:88:d6:a3:fe:32:7e:51:43:83:44:ea:ea:62:ad:4a:35:5e:c8:04:a4:4d:a5:06:90:62:f2:1e:9c:6d:9c:af
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
230862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
217KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Cng.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 643e1cb8fc16d1267926f66a6bd89c899044d84468a250f6fa56c6d92eb2f207
- MD5 6597bbf8e129be4e2352297bfb245ff6
- SHA1 398dcb8a9108c2ae946581f6349c5b6a6549b639
- SHA512 f73a919dadf9ef23d5731865a6d007d41d5db9acb73f631317146cbad4953e1e8d0f9a5df0455cec1c0217efbe6edd8888f32a7196b5e73e3165ba24ce023f41
- SSDEEP 3072:6hxnwABgSgQguptbia3KOAGixWgXhG4kOuZGTc/py7pgvPco+7:6hxna8O3OmxXcpWpz3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Csp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a9ae1a4c697236fb6a9e46b66e1a14a7b60110a83ee80ea641b5808c5c9ba9f
- MD5 40d546a58e8392bcedf356ddf917b1d6
- SHA1 f018a1c76e1c4fa5c7eafbca6f47c1e6eb6fdabc
- SHA512 68e77532768a21d39e0dd7083dbb2c1251e3e397d819ee3f95a72da0d22b88cc37021888ad15ae10db82583513497efd889506223056e3716c84d75add141cde
- SSDEEP 1536:WCJ4Re75Ko5/1UUjDH0CeM/hWRRR8HxE5mTUQ3WO0lDt0ig:3JTU+UUHH0rWwmUQ3WzDt0ig
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Encoding.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4092f04906e3ad585fb8defb60dbbd2e1ea6574ac885948370600d0d4d558748
- MD5 c44b46d68b9360efccd51360c5efba29
- SHA1 7149dcc6ae7c34cc52699cae1cade7dd36d5f9f5
- SHA512 f8c37f51bbb0141ba409d816c79f1807b6235ab658c3f74c0ef2ddfa550504ac66207b84dc62c1fb9c327e4aeaf6a518d6fb6b85c44ce5cf8bdd6d2eb95816d9
- SSDEEP 768:UuSboZ+0NaJDr68JWuJVy/NcsvZl8dS/:2bS+waJf6eWsoc4l84/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.OpenSsl.dll
- SHA256 497e1c7d7f02b4d534be4084873ba80b051b935212d36aefec83c6cd6a40e2b3
- MD5 37beec6e6ee2e9d4128e855578bc8c22
- SHA1 8a6b7fe922f32846ccf353a328a2b61cadc95894
- SHA512 79127813b66d282a8f5417cd1d4823d53be8dce711d9017905ca6881376eecd200fd76be5454d89965452dfe8c50c3609ee2a02cd7875508d8f2ef8c3396bf88
- SSDEEP 384:2jy9WAmlijWWb1IxNfHiRZGJ7MTsPQ7vz8zlPKU4WagQqIfLDUBtjSmY7HRN789r:2jmn1I6RZ+agQqELDUBtuV8jC9z9K
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
86:84:5e:99:93:c7:b8:2c:70:66:97:b2:2d:39:fa:13:1f:46:8d:8e:a7:d6:62:68:94:90:ad:f1:f0:99:42:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Security.Cryptography.OpenSsl.ni.pdb
System.Security.Cryptography.OpenSsl.pdb
Name
.data
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
556B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Security.Cryptography.Pkcs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 48250c7249b9dfeffc6d87450dc086586d986af22728a7902e91340f747266a9
- MD5 2751a3e9dcb2d59ec23b3399144e384f
- SHA1 d0f4ed9de306f0343fa826ac00d1c63537c7be0d
- SHA512 b77cb8de7bf3ad96bd2a5aafe16898ebbe3d66b587e3e15bd5b9c2d941e7f9aa4de0ca6f4ee61b095a0921e51ba12c1253d6c95018f810d00c37e66ce9adf1d9
- SSDEEP 6144:RKDJrX4NXwVVLEBL/AEm8qwF/FWnU5QEgETM2Y2FYCRqAijSj2yxlMWcAGWRhm7:INrh0GJyxncAjI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
283022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b22a67cd325e1f4a4e1b59519a23e0852c0a8d1e05ed0caaf0b378a09403dcf
- MD5 99d88e5e28b5bfe0df8c35eefa90c06b
- SHA1 879eb9a9e56b7f1df35539a580a6baa82368c17c
- SHA512 0adec8daa8e7e72539c324bf33efa7cf120daeb23905dac4ff2429528ad3ed561b181eb7e7daf70d6f832bfb335d3bd22839fc3b28277b4b2f6391f81d25c094
- SSDEEP 768:ZSMr7aKPsay1SS3ObXcSNgHgbEA050FKhBzXb+0aXVfAMxkEQ:Fr7aKPnSOFb+50FyR+04xxc
- MD5 SHA1 SHA512 SSDEEP
Digest
37:c0:d0:cc:38:26:f0:80:d0:51:99:72:be:33:94:8f:92:f9:ee:76:98:5b:a1:67:36:45:31:82:2f:eb:d2:1c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
46526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.ProtectedData.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1768b5b1b181aa32dea75961f6e101ad53d7f955e79ad4527d0f4cb2ee5b16a
- MD5 5468e9d3b7e8fa1b6dd4f089f5d3b995
- SHA1 6ed6314272b6d423d3ebad99beabe6268bdc7588
- SHA512 9d0466e8ede0dfabb5ebd49d2d4f250f653329eadc6b7792a62a5e46568cf3c85252f8ca57ca3f5f4007317fb292e6e04e90adadde1a7b88a1b7febf65c58f87
- SSDEEP 384:D1RGUsBEtrS9B9SwYnq0iQBNqPWAgZ6jEW:D3n1y9j0q0HY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.X509Certificates.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 edaf16ab027878bfc46a236017ec02aa2a5d107458b5f0243742aba82aa06959
- MD5 0618942ca628d87a2f5acdef59d5f63f
- SHA1 8d3087cdd271aab64cdbb44db7d9a24ea0fb26a3
- SHA512 8618c6f0f8c215112f406cab110e5bef1649a34e1dfb53e4943fd4920b929af1df9510db5dcbd6d23fb4c2e36438f3864ac3e9c206573e288efdf957f6c18640
- SSDEEP 3072:JhxfjoxQMMyEW6+zGGoNWJhpPP6KPqJBmfbWxU9ZvZFXbWGyQVBufo8SrOzRkOux:JT7oxQ0EW6+0QpiBmDqGeQjufiU7rqk7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
185902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Cryptography.Xml.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f51e84959e39b24e71e5439fc4daf57b31ab1f09d80e6782a9766668ad77ce4
- MD5 372e7871a9928b27522252ba7b286a52
- SHA1 f8e88da036bff12203ba5e13a138d9645b72dd65
- SHA512 e008de243bec5597eaa50cf120f95c9a28dd5c354cd72693a537e1c0cceb25fa4985c100d7b9fcc022ef3ca7408d6222c004b5be9d7ed2099d37a86242ba2274
- SSDEEP 3072:mrHIx+Npb3ikJFzUVqQbBE+qN358trq6KF2IDFSKZI5sAF93iUee6KQRvXDzVsSy:oIsjHKqQLocsAF93fee3uE5d8bO58
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
156958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Permissions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78835b8707b4cd259036c433412b1686acfdd858e39f003cc7f881bdf213f952
- MD5 8777398255b941a954d48ecf8b78e2ee
- SHA1 8378428d9979aab355c91e768a66cf927a60b51a
- SHA512 c75be5d2b0918eded3b83c6d0de1f9fb6cfc80b9048426e87baf381133a782c7cc2526c3cef1d26c5ce28cb4395519906de558f60ad3363078125cb8e411f75e
- SSDEEP 1536:16fkxbt06VjqfCwDGV4B27OXWBiha+F6Xn:n7gCtV4B2ymBiha+F6X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
84686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fe964cd7d8778f39f72a5cde81e80052770fd9633c9cafc53c5253832386f545
- MD5 3a25b04b46da74e0af05b71574d0ac97
- SHA1 992104a3aa3bbd94a22cb16e9e86fdfd51e686c3
- SHA512 21d27296d1de1596f36bf9f810ba00dcf7bd4f4deb5511b7ac6aaf98ff1cd11550c52ae14b93e65e39c591a25491eb5f33e464512831fccc8b3aad8d482f660a
- SSDEEP 1536:CS8Pfa0roJWDggldpxv1MVx9haS6mMqd:CS8PS+1Xdbv1uRMqd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Security.Principal.dll
- SHA256 3b6b0520402df1a0543118c78c82435b61bf9111b2824fd31e59a3fe67e69e03
- MD5 ce0388e8f0d85d7c601e246e5985966e
- SHA1 bfbc0e729b85ca27e4de3f0903022a1716201689
- SHA512 730ed920fced564e28404d2733b963b29b9210806fcfde0b73accd06cd4225ece06f9dca2d06d2fe9b8f350db85ec30249964d82c49cddd4e8f3e54451403473
- SSDEEP 192:KjWVU6IWddwBbxEdTXVeWvcuyjS7HnhWgN7aB+WhV+hH+BEg7X01k9z3APDQ:YWi6IWb2EdTV7HRN72pR9zwc
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
91:a6:2c:6d:05:94:dd:84:8d:77:b2:95:86:3f:d3:88:63:1d:6d:8c:97:ce:2f:a1:c8:a4:09:8d:7c:59:30:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Security.Principal.ni.pdb
System.Security.Principal.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Security.SecureString.dll
- SHA256 762dd98815885030474f9d327c34f9f35978de4918ad51d0ff167f64947910b0
- MD5 f5c40794c808da71de1c4e1ab4faf16c
- SHA1 fc614bdc2bd9a4cbc91a3bbf92346fc0fea4b499
- SHA512 c628480c5c1935b44d03a6532d1881dd8a800fc1f9ae6b53c858cf3b9fb0f945e24f3a65e1b1a0b1a5e1ab1ca9077ef790a912b67f1644c5b01a6d92f88ff222
- SSDEEP 384:oW1iwWiXdEs7HRN7w6Z6zaHeR9zgNpdzw:OkaY9/C9za8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b8:13:50:bc:e6:93:db:ed:5d:a4:9d:59:31:83:e1:4f:2c:87:94:8a:3f:1c:14:46:b4:b9:1e:4c:36:a7:17:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Security.SecureString.ni.pdb
System.Security.SecureString.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Security.dll
- SHA256 b623c4a5e0d96b3ff3945db3e5bb8d235b3b0c2f6d23b8636bd68bb72fdc9e2a
- MD5 ca27405a8a1dd64467867dd9e703d039
- SHA1 0f6d2a2a6daf160182afa73140321200069fb68b
- SHA512 019962fdf434d7bcaadb739ff35b300dd3c125ee9b31f4f60e475c80fc2b02a0b0b9012fbb6da0a0aad9dd5f65be07cddf0c4b965b0d7a8da1c915a77134a9bc
- SSDEEP 192:j3Ws2EWENXHku3jDvupZFiVyJEVoxh0JxUd3FmPBeWvcuyjS7HnhWgN7aMWhlNyY:j3Ws2EWGUJh0TUd3A57HRN72iR9zR+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:80:c4:e0:21:78:6e:4c:89:a4:5d:15:08:f4:f0:9e:30:9e:63:80:02:7f:6d:60:97:b3:ce:97:55:fc:e4:79
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Security.ni.pdb
System.Security.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.ServiceModel.Duplex.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78ac27f0813479dca9092c1160e699a22d3e4a322448d0efcf68ca1762a37730
- MD5 118ee20f1160428ec506f9fe57c80225
- SHA1 69649b52167fadf1c94005fa8f6d9ae9f0a84962
- SHA512 8efbe1fd607236bc9d9e4ba05cde426e6b49c5fe73267b018a439db7824bf24077fbb2f68b9f1a03386f0e7b2f1f4031c52e95f7ee9d2587b95254ac5fed2648
- SSDEEP 48:6zZCK4FZAcedQiwcw0+IvvWqwWk2zDmDYDCJ851ZWx0kK/mh05WxfG:QiFZvexvvamDmDYmMW5zOW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.Http.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e5ee987c419900517173a5ce5b4215396faa8fbcad7c5d45a7699dfc6fb8f174
- MD5 3708250f24df059d4814a560aa348a25
- SHA1 fd9da7f8cc293513e7add9e7dd62ef6ba9074a03
- SHA512 430567a2603a96a9d68094f93abcc7bb75ec0363b46d13e045c32858b465bcb39471d0967dc800839546d4932e8173a85c02b53809de5e008b127389acad5523
- SSDEEP 48:6Odu829ordYliXlbdjmiDpDBsgn+Ivddk2zDmDYDFQ0LZWHPKUTe5WxfG:F29kdB19pFxvkmDmDYHWvHT+W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.NetTcp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 093704aded9db781a65a234b7e8fbff649e112599056115ae5120b5e2b194559
- MD5 41cedc634a584887a57ca22be8b29b3f
- SHA1 eb1c0c22cd6b447c6814f24f5895a3c52a2be93e
- SHA512 57f5ef0a95b2e0fcf4cd29be381628b29f4b52b430ad4b573c2241d61124df81cba5dd76e2c4ad16a59c6897025ffba63aea0625f36cab8d1ba971a33bca1066
- SSDEEP 48:6WmcGlj0HGPML9uiwbdaXmiyBy9wBTUtJH+IvvWqHk2zDmDYDaJ8MQZWxBhKGP0H:xSteQ89GEXazt0HxvvOmDmDYekWRrWW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9d10f481254515208b78209309db31a804f55c742a45aa843fde4e7ed3e02341
- MD5 8757fa6120b249a4dabf41f1e86c1a88
- SHA1 090aeb4e0e18393df97a6daf6bb2ea7c4e512349
- SHA512 69c515ced32a8539907523e63372fcbeaee1433fcf6a2578f894bf61c474920498951f3e60cf3e7af5a5044edf3b926a20d3cd7062f447e4a41d326a8bb30efc
- SSDEEP 192:bInSbiz8GdMhb+MSpDosKB630mkj/LBemSZfyxdZQWvhEW:MSbiE+3pUsKmCtemLdZQWvhEW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.Security.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dba1d155da566afc2bf4d131f47f6e770374b7f2d5e6679e978cf5ee099bb73b
- MD5 99a41bbee6e343283929baf92b1eddac
- SHA1 1e174d3b47efabbd683cc6577a8ed6e77d42bfbe
- SHA512 41064b29dbdc320a4b7f53d39dacc8faa864059a6dd114ede610427ac7aa2c73a15e7bf11193d6d026bf3ff0dc237e410001c8c048f5899ca8baf9b570dc99c4
- SSDEEP 192:v/KM3MAmvXbTFeFF8A8ei6DRb6xamW1NgW:v/cJGF8A89/amW1NgW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.Syndication.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 48d6d299813cad6fece7bfa7a2674404750be32dfa541cabacb1b9502b7fa11c
- MD5 42aa1719a875f869c067ada18f516934
- SHA1 4e3724a54926395370bbde2bc9d0363c23dfe9b1
- SHA512 1c1df8fd476d513ce019e5ffb0a872cf420e0668e547d276b87d3bcc8b997d07958b0301d5bb575e59e2b279c78d45426b11d6387f9158c93cc81f6dbdfd3e32
- SSDEEP 1536:ec269zaeQhBxhgBtYkc9d9Cnic1zALtHijSQqi25H8wy4ze:lp9zvMJVLlCic6LtH2F9Ye
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceModel.Web.dll
- SHA256 7f0f6b6db85fcc9739cf3256a0bc20574842f3e7f833b4e64cd45faa7e4e5a45
- MD5 52b3c9e708baeac9d218001b93e1cef5
- SHA1 4554ff7982595d29c9526029870e596ecd045fbc
- SHA512 a90734f6ae0ab78805614d9899e1f0137280b4e02a41789c55e8aa8f21fbf2333c35c2298465b84c3b83344917bf63fa7943143959c143f15b7a02880b10ec04
- SSDEEP 192:RjWGlouWZb/Ndix6beWvcuyjS7HnhWgN7aMWhMVOxgV8FGecX01k9z3AKDVrK4oD:1WyouWh1dix67HRN7LHR9zHDtK4s
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
88:1a:8c:d5:36:dd:7f:29:1c:fe:89:65:33:81:5c:52:91:64:31:b2:84:96:be:db:f2:b3:a8:d8:b6:25:72:bf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ServiceModel.Web.ni.pdb
System.ServiceModel.Web.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.ServiceModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2ddfc838ba2ff3f30118a557f47a9fa8483a36e0f639e016715bda0474008712
- MD5 faabbb1dded66aac765f0e75e816e1a7
- SHA1 25641af23c12c660853315a0244f2186e92cd1c3
- SHA512 3a71ce89c17a5cdaa41d761f179eaef8ad62cc3dd74e07a1eff21a64fd4929c9e02c511de046397c02d91449e4ef35edea8da571d4c91d1834ad8d0e5d1e6a5e
- SSDEEP 96:YYApLV9qWUVobHI6GsQdJwaGfVl6EffsfJ4fYYQqJiNQpmDmDY2WsV4W:fA30WUybHIjsyjy63IQqJiNQp9WsV4W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceProcess.ServiceController.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1fb83e4a791c8e25c12a91ecb99646b53e7b61fd26ca8af7b843e85548c9c81c
- MD5 07f6b753e85bb69e38d866e5fd428aa5
- SHA1 074b4652f8bc5389fe56f2d6f3a614ffb27bb704
- SHA512 9e6f67180422197acb49cd6a05bfd54ab3153cf9ff4dfb3eed89c7ed0e9e8931a192990cdb5d6e7880fae45257340c80e177dc122083c01cfd1ac9743fe512cf
- SSDEEP 768:B7I92ID1ClMzGiz44Jk4G2ssT9Gry+cRb/6OOd7biXCRVHAMxkEh:K9pBSAn24usTJb/6Vd7biXCRxxt
- MD5 SHA1 SHA512 SSDEEP
Digest
b8:0c:85:b8:d1:63:d4:00:77:3b:f4:e8:db:96:4c:49:2a:7f:45:d0:0d:90:b6:a4:54:fb:b0:e6:3b:ef:7a:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
55598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.ServiceProcess.dll
- SHA256 49fa12bee017d82a95f0cdc2267b06588ce8f592774dcfbbcd68cfcadf5b4ab0
- MD5 baff65fe62f0297fde0ca86c1a45a52b
- SHA1 2707c063ab78c88326276fe72f401c59ce5b4bb2
- SHA512 8a3dd74a52585f284f869d44e964df9327f968986aa6d03fa2b6fa763b87cd9e0979404a89c06441b135154fd72d2dfb73cad58768246ae3bc9ee75ce0c08ad5
- SSDEEP 384:4pWniilpCWto7ydboKJs7HRN7GiR9zRBsk:bzo7NKCf9zfsk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b8:36:67:a1:87:bd:1d:e7:0a:50:91:53:3f:40:7d:00:60:94:4e:52:91:10:2a:2b:1c:b0:56:de:ab:91:2d:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ServiceProcess.ni.pdb
System.ServiceProcess.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Text.Encoding.CodePages.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6cd6df23521771e17e24dab563dc5816403f87c86e5c0948320aca5cdf18e271
- MD5 d1f3cbca19f67eb146480b577b931fcd
- SHA1 acfc89c89166d1c588ecfc281ded70d5aa439d21
- SHA512 3026ff16006257672dde064a330885408229eae6d37cd126c7c6a7ce7b6f63e65a087f0cf3331772a77dbae2f0cb66065369908e462a49fb4d0f19ac87b68495
- SSDEEP 12288:CkMzb7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rVr:Cnz9km6k/IwRYbiBeKGCar
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
731646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
707KB
Virtual Size
706KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Text.Encoding.Extensions.dll
- SHA256 c2c9f41c1be3596afb8eb4fce6e21867917a14351d2ab01faf9d81395f6c976a
- MD5 97841b84d7abdc787982ef00e8e8cb50
- SHA1 0b49222bd54cd700709ebda224df72248c85cf27
- SHA512 0a07c2df770f569702c2a2fb8d26faa0fa62d1b8b83be003433f2f60e2ce366fc8393cf5d1337d136797fc28eec9753e609acf5c5a223ea1b012162153024ddc
- SSDEEP 384:bW6Y+WB1YdWq7HRN7nyv6zaHeR9zgNNHY:Ch1BGiC9zgHY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
54:66:18:eb:66:0a:20:b2:0b:7d:63:90:50:a3:d9:ce:56:16:1b:f5:9c:72:fb:f6:de:eb:41:8d:02:37:85:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Text.Encoding.Extensions.ni.pdb
System.Text.Encoding.Extensions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Text.Encoding.dll
- SHA256 d2e860bf41fba3b7aa9641e2121adef6a797353b31e7d14a581d250436669fa8
- MD5 f6171bd56f8697584d4df2a4b3866ae1
- SHA1 62afd05f2f293dafbab3a2aa3c039b057cfab6cc
- SHA512 8e3139a36ebb37a722837148da9d1858082966ae986f57a30a9a118d83022e1cf08521d385f4f0582ade74ee1e18ba63dcd9c9647b5bebb2f32be32672b5df31
- SSDEEP 192:dWfE6Wzz6tAPxod2ICveWvcuyjS7HnhWgN7aB+WhVyVH+BEg7X01k9z3APDl:dWfE6WIiodfC37HRN727yqR9zw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
30:7e:bc:8d:3e:4c:c4:01:e8:f1:0d:23:1c:62:37:41:5e:a1:78:c3:92:f2:dd:ff:2f:1d:00:d4:8e:38:1c:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Text.Encoding.ni.pdb
System.Text.Encoding.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Text.Encodings.Web.dll
- SHA256 b3507c7ef158f6c8b53ae24067c0f47cebca9c8c809021952d0e7eb8b13ebd54
- MD5 d77768c5b136738822dc17848759c273
- SHA1 74030398f47c2fccc1b7ea397f14b7c5fb9c8f44
- SHA512 987ea9241fc320cb246f1b8347ab99248642dafc718a83c5e00dfc17ac9668bae35cf6c26f90b45c9ffa5654ed88f52803f41ed8c75090fe8194abb2b7f07010
- SSDEEP 1536:73bNf+9ecUx1HmrxYtr3C6C32wY9LGJ+rkyEb3kamFiDx48JPFT4smz:73/cUxdyx2bCx32x9CXyEb3kamFiD2q2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9e:8b:8f:b3:4a:32:09:30:f0:88:15:98:61:b6:c0:f2:57:df:50:b2:fe:0a:5b:95:2d:0b:34:b1:9c:37:28:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Text.Encodings.Web.ni.pdb
System.Text.Encodings.Web.pdb
Name
.data
Size
1024B
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Text.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cac807ba6fac5a4143b0a566af8b74837063c6d5f7d6ff768152e7894bc066b0
- MD5 48112a26c30f6ab0e3147c19781f9a95
- SHA1 f74bdc8fedd5155b6f6b05396d4d71761420104b
- SHA512 a151b2356def8e14e30a22b08e604fbf63d45edac819ed972924c2f636768c01a4f75e72d911c2d96515098357c1d54d03600d949c87e90a69fcf6ad314a68b9
- SSDEEP 6144:nBB++WYqyNCGEaJlUySNkpWHqup6McVsBDp0iTb57ZVjn7:vnWkNCGEaJlUySNkpWHqup6McVsBDp06
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
274654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
260KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Text.RegularExpressions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 68c3d90e812ba3f85abaf3115b16a836eaff05938665ad08fcec8dcbe4ebb025
- MD5 1a822027278537f978cf44375324f409
- SHA1 38db67968997a1dbe8ee62bc57d75e05cff915b5
- SHA512 88196e22869dd5d159befc3d4615e7ea576fc8e85c1c3c50be6a0b9e36d17881d1fd5f371b85d27d5075e1a0c2da3f48bf758e7d8b672a5da33d58223eaafac7
- SSDEEP 1536:fw9A2ayyLmGHrlTtX8+uXRbXSUkCse0RWVgeUXTgR1PwJbYFAZToJLWubqaPTfC5:fctnn2d6vRP2bYGZEHb5LfCc0
- MD5 SHA1 SHA512 SSDEEP
Digest
6f:04:da:b5:85:a4:1f:0c:39:20:1c:2b:25:44:2a:3f:00:a3:84:9b:50:08:6c:e3:f8:b6:2c:68:06:ec:22:68
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
142430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
131KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Threading.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3dbc176f20cb9dcd3a66c4d45d7b473d7ddf5945fecc5b3a824e511f4296563d
- MD5 6d46a78535c08c1cc0b2bb1743f2e978
- SHA1 2b6dcec3e8f8db4a61ea6c388853220ad5ebb445
- SHA512 3a08b5cf784d9b1e927d68096a8e961744b3d48d845ed757e4c5c786f6e932d124470d8f56c62ba75b74cceae77f4239f0d302d0c0bf9f89bf17298d9e96cc6a
- SSDEEP 384:/fMqUkBijXUNf5Rf5Rf5b99exHy8qqO6YXWJWArpW:/fn0Q59j3e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Threading.Channels.dll
- SHA256 0772931ecddc0f337c8702ddab477e37f72d779a225a4cc147067d23a5542f14
- MD5 4681fd45a6a89eb8440962b37bd343f9
- SHA1 dfe9f5e674bfba072e4f5b469f55773093457e7f
- SHA512 fdf2ac6a72d2e8c7a6777a7ab08349877b876694af90af79db344558d2d9c2b86bbd0537cb1ae6ebf3035624428881760d9fc3d852b59644a8d5fb817487c0aa
- SSDEEP 3072:GavmC4BFA1dzOA4LChe7W5TehDq/7j4lnqM:4mbQCqW5ehyM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e5:db:f0:04:b8:1b:b1:a8:ed:9c:89:b9:19:58:d9:6d:18:69:9b:1b:08:1c:5a:23:3d:fd:ca:02:a4:df:76:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Channels.ni.pdb
System.Threading.Channels.pdb
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Threading.Overlapped.dll
- SHA256 f9c7b710fc12daab8851a6b7dac3a44283269283765a991e7d740b8309c49104
- MD5 69302840464fd65d319287c61c6a3cc3
- SHA1 3b880344c5e371f3cdfd266686854d94a580ce7a
- SHA512 827f4921d08137f3f165ccb14a18e2b7c197977009b65ddef6473d8e47859d6d6b914c43ad6e6d2b158c8a31635554f43dfa1f416051739cc0f9303a444a78c7
- SSDEEP 384:tWcSAWfHiH+zHgcqHVdA7sgH/HJTHd7HRN7+diR9zRh:c+coGN+M9zj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0c:30:2a:9d:36:4a:f2:a4:03:ae:df:a6:a9:c3:95:bb:9a:88:f5:46:34:ee:c6:69:fa:eb:95:da:cc:1c:13:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Overlapped.ni.pdb
System.Threading.Overlapped.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Threading.Tasks.Dataflow.dll
- SHA256 07b35ebd9a0581ab44d458c53f13268e8aacb98763148f90b77f267400c6bbf4
- MD5 e7d3f3d33047878beefcac595ee8b1c6
- SHA1 c2fcfcf09b18aec9b9e4d77f57894720339befed
- SHA512 8da9059d3937e857682a766d9ae9cfcc9f7ea0638ba30e683226b5582fbcb333381f8f3e7f10c8d7b27944fba2166fc30b80ac72c349e589486c0b12fa10112a
- SSDEEP 6144:axyV+a0ZJ2q5BLeNp/1x1tBB1x12LAVYRkoq4mQb9y+Z1d+NNBWfxH+URr:9V+a0r2q5BLwoU6q4mQb9yY1mWfxegr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
10:b9:f8:3d:5c:7d:d3:88:4e:a6:11:fa:b1:a9:b8:52:60:68:e7:b6:47:e1:3d:b6:4b:cf:d2:17:ac:39:4b:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Tasks.Dataflow.ni.pdb
System.Threading.Tasks.Dataflow.pdb
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
381KB
Virtual Size
381KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Threading.Tasks.Extensions.dll
- SHA256 abd6518b314792fac1c281e61ebd9d0ffc654a7b9204cecd3fc5927641c5bbe4
- MD5 8755ebd05994248ed598bf950c089d58
- SHA1 382e2679a2db822d814742f6a67c1d655823b09b
- SHA512 69653bfd8687f82384ed24b21a64541be1e1165e1832a817d48b6da0c35b6d2a3559cd669cea4ea1482e707e5e62fd8d0b77707784ed99d7282f1cbea5480267
- SSDEEP 384:oWSiQWS0530k1ncm+43DdN8iT87HRN7CDciR9zR06Wu:RLqz4ls8l9zZWu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:84:34:7c:f4:8a:ae:d5:b8:3f:5f:12:c9:4e:54:2d:7e:91:1f:6f:c5:ab:31:ef:93:08:69:06:e0:88:a4:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Tasks.Extensions.ni.pdb
System.Threading.Tasks.Extensions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Threading.Tasks.Parallel.dll
- SHA256 af07e133114232ef98bb98348916ae7eec8c46ef2a1b12e572d2b728c76bb19f
- MD5 6dcbc3f77f425b548c5a9e7b2a47c38e
- SHA1 1f094ab1a99ca6a0743771429e8fea52cd60d9f8
- SHA512 19ec425392790c3f3eba4042e23afe0e019368df0b3206861bcf1a38023358d1ae6a685f99710983042d2fe6ffc6320053f8117ba8a34515c1e9335d7d64298e
- SSDEEP 3072:rMUvcVnLdOg9jBtt+a3rZNTYqUko0OEqojRf:8v3rZl7UkoSf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a2:bd:62:5c:f2:a3:94:3f:50:32:a8:71:65:e5:ed:45:70:fb:59:ce:2e:69:0f:5c:04:b5:d8:4c:39:4d:a0:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Tasks.Parallel.ni.pdb
System.Threading.Tasks.Parallel.pdb
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Threading.Tasks.dll
- SHA256 8d2942e975aaf6cf8217f65611b4f64b0dfa15e06fad1eb621d368f3e77fd1b4
- MD5 0dc41a0a77de30d1838cf6f183133089
- SHA1 dc0db3350fce11c3e742117816db053e72a61a23
- SHA512 3ff9968ca53c8e011d2c9a8ddb73d1457923961d16665ec72ebbc725c5aa456605727a74af7716b7ec22cebb06346b765ef0722525d6d66f99c6e7c9f84a8c0e
- SSDEEP 384:/9WH20Wza42T3/ZqvuJuFdPXwqTF7HRN7LmHR9zHFPb:Dxa4mYvKa9FKx9zlPb
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
fd:85:9c:3d:bc:b9:a0:3a:75:93:34:fa:3e:f6:dd:d4:21:09:69:93:d2:82:d9:69:b0:88:98:83:65:4b:a2:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Tasks.ni.pdb
System.Threading.Tasks.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Threading.Thread.dll
- SHA256 926e642b0b6cadfbc3a4cb11bb81454eed8adf50acbaf19385c2ca40decd40d1
- MD5 520073af46143bc7128f8b3a6de0a2b8
- SHA1 a9639dcf892633231b65552ef7c748feb9362435
- SHA512 aa086ba704a3f75a761af0e265271abcdd10fda6d66076c4462bd74eefc3987ecf42230dac6df05a0d56b79b8bf8664163dccc1ce87e05c5f4e5dd886932353d
- SSDEEP 384:YWc+sWRoGmJOIVd7sCTi7HRN7+UleLR9zusyRKG:vWcES++ed9zuQG
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ec:ef:fa:3e:f7:b3:ae:cc:99:58:25:de:0a:ca:2c:49:ea:4a:87:f6:12:46:39:98:e3:e9:8d:67:30:b2:df:a0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Thread.ni.pdb
System.Threading.Thread.pdb
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Threading.ThreadPool.dll
- SHA256 3358e61263af81d99e8995441d012a8f75ca8d5d35e8c7c3aa6685c89f52a691
- MD5 fa937c62a0c52445b021bdd6ede175f7
- SHA1 b91c8d10f971bfc9e12f846bd1be7cf29ae6c89a
- SHA512 9e1fc7726447611182ecddca0f578b657cfe2e9cc8f4685050f3edada8b4b28e619f81fcc343e1be4da4ba98aa8f6a823e3f82bd1ef5c0e6d0010479d7fa8d22
- SSDEEP 384:+WEKYWgs2ezNqTdmE4Te7HRN7XkGER9zRdStOD:NPzNT2X+9zytS
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
37:e4:ec:03:2e:e8:4a:15:16:69:49:b3:fd:0d:9f:0c:f6:68:29:98:ee:3e:c2:e8:fe:d5:8c:49:59:3c:88:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.ThreadPool.ni.pdb
System.Threading.ThreadPool.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Threading.Timer.dll
- SHA256 e3ccf9d37b3e20427067285f8588e28613ff705310da9eef67fa36e9da6ec8a2
- MD5 daf144d20e5066d5c95dccb158c88a97
- SHA1 366151dc10a7bb7a789d2eefbafa0df567e515ec
- SHA512 87e3f313be23e54f7821ac054cb1cf09ec0f01665d533406477abcca6e5ee50e70e6095d72c3ee405e0ff078f8ad98cf5fd355f2f46d78b01b20c332b199b517
- SSDEEP 384:JMWsh1W0Q6ZQuMdlLPT47HRN7+OOP5AR9zhwu9c3:KrQ7I+OOPO9zM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
55:eb:19:8f:53:44:17:33:d2:41:b3:d6:74:56:be:8c:c4:f3:7f:bd:77:51:20:db:fc:2c:0a:d0:ea:27:33:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.Timer.ni.pdb
System.Threading.Timer.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Threading.dll
- SHA256 7bce0d29f5456cd7455afbd97d71089c1802ed423ff9c9299cebef30978f3c62
- MD5 14407fd6873558448a79d6937dda51da
- SHA1 94f506b0d0109c62fd218b904d9366bbe50d8751
- SHA512 e0c56f4c35a8500f4515b2250cdab445697ab3f15fc59e33c991b962422569a0bd1bfa563b785d705f4554fdb0f8f32b12733321ee8046f65b95d00b326cc642
- SSDEEP 1536:1QaHb/K7uGqhVp6/DmoTduufAYh1/7X5Jc1FYz:1QaHb/K7uGqhVpiduaAYhxXgC
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
81:f4:de:3f:4c:8f:c9:b6:91:94:3d:7d:fa:d8:31:e2:d7:f9:49:d1:26:86:cb:61:3b:d2:bb:7d:34:54:c7:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Threading.ni.pdb
System.Threading.pdb
Name
.data
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Transactions.Local.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 abe8f895ad18cfd50fa1705f50855ca563a92d8bba6ad649f2bd39aab3930625
- MD5 e658b1851e7774c15a7069dd044bbed9
- SHA1 53124d5141719c688986d2a5aed0843f5e983b05
- SHA512 a67bf210a901b3b17fed576bf9ffae11faf9d66e2c102abb52225b257c392baefc31955bf98dde175308fd727c056e8c7567e71d409404a6c10df0145c14ee52
- SSDEEP 1536:PDL/bTpWRdA+me+dYQfXUg4Ud/5ACTynsdjFA1Zzf5XpK7EPBNIbkaezBdPY1Dq1:PnBe+dYQfXUg5/CGwaq81WNW7/pdQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
146590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
135KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Transactions.dll
- SHA256 b0b1767ee54ff87659839a260f1553d4cadc0ec402b121328c0918757ff5787f
- MD5 26bc0a5c83fbaa630d58e4c37b30c200
- SHA1 bfefb3fe6b366377b20806f24b1bf1d486e03d85
- SHA512 5903a91ee5f6308677c3f39afae26ddec90caa1a8b5fbf261097b3530a8733a78ef80bcb2b61ffb372ec740995197bd84be5cd458efce880c066f55d8a6f08b2
- SSDEEP 384:uWzRVWK3R0p1VhN3jSFhOYmblc8Nm+ylqQZxez7tOtydvA7HRN752rE3X+R9zuse:Fn3RUUVXi9zuT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:2b:3c:4e:67:2a:a4:26:12:fa:0d:e2:f4:1d:a9:2b:6a:7e:17:2e:93:9c:58:5a:b2:97:32:62:be:61:44:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Transactions.ni.pdb
System.Transactions.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.ValueTuple.dll
- SHA256 38d2f423a1aa49679bb8ca8dd29efda20573fb43d387373e96dbfe173cfdf7a7
- MD5 b1c7225340b294d227ed9ac1f6e6415e
- SHA1 06f19581321691f11ceb47cf68d1ecf26ac615d1
- SHA512 a079999aeb6ef1e29915e4fcfd0a86af14cef90b03cf6dbb5508c59b89732cb4cb97d98afcaaf4cb64d24c2b2aaf113aaa8bd30602e3f55df815f314563979d3
- SSDEEP 192:WWtvVWmWSaRVbHzdrSneWvcuyjS7HnhWgN7awWh9v6gqzGslX01k9z3Aelutcyy:WWttxW9RNzdrSP7HRN72kGER9zR6c3
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
18:47:e6:41:bf:ac:63:09:09:ed:c4:1f:f5:2c:b9:90:2b:b3:1e:bf:43:69:c5:8e:35:ff:4f:13:e3:c2:bc:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ValueTuple.ni.pdb
System.ValueTuple.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Web.HttpUtility.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e78eb3300d85ca6619670c01a7331403fac62b009eb1bb23e1df557602b24bf
- MD5 5452b0c5e2a0e6fd12f30e9db446a67a
- SHA1 4fd804bc62445073a3493b2d4afce8b39dcf69b8
- SHA512 06553acd0e0055600d1b4a02e357fb5d5dbc58dff5d821b1f128b2f2d02fcdbd4377a3f46b3fff0ebc748b2b96f3fe92d7bf002b8bfc767cb4f5134b48923c3e
- SSDEEP 384:gpS0d/GENeRBczn+am7ne53dOXvXhXQmtQKOWTL0BU1W:gpS0YGeRBI58eGXvXhXXS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Web.dll
- SHA256 609e02ad9d44a40a448b886acae4b593bd6e8ab34ba308e9da80e377a7401ef2
- MD5 ee3c4a983ef4ee5e709458bbfe276823
- SHA1 cfcdc2d90c5f6591d404a869120468ebb59ef97d
- SHA512 5fd35478021ead442e595ae95a35225e10952c909af461d250e03558d37c2e18fa7082d8fd18f3ff91b7748b6973460e86283115cf92cd8511f9d8db861cda5d
- SSDEEP 192:OWVboqWSl1uxKLd6teWvcuyjS7HnhWgN7aEWhaZc3KD1Y6uHX01k9z3A3TSVH:OWVboqWK1UKLd6d7HRN7j/DeZR9z4ex
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2e:81:59:8f:68:0d:21:4d:80:58:52:1f:38:58:b9:fc:08:f1:b7:69:14:41:22:5e:18:ac:0e:7a:7b:9c:c7:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Web.ni.pdb
System.Web.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Windows.Controls.Ribbon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fcb319f1e12b5082950402efc159ccaba132b32135294ae3883dfd0326cb2e9f
- MD5 359717d50a5029f8dbca072716138250
- SHA1 d43be955d0d7dc0fdcc2fc24b5764b5a9eb7eb0e
- SHA512 90b65f57e8b1af5f1cf239a83ecca6f6e3f024ea7b9e75b2b42dd2bb0b36ab93546c43fa5bc1331919e26128b6b0693f178041ab45a63feadf2a95e92d3be507
- SSDEEP 6144:KkPMVzklPsz+XpsdGwolRWvS616HJ6sPjdVsmx0eMaco1T3gh4mH:RCnsdlRYS616HJ6odmolm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
739758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
714KB
Virtual Size
714KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f5587ce58efdd95d3e07077b56ceb0a34f42613f10458138e4a446aedc7d3a5
- MD5 d22b23b27ea42e5cb673474bdfeb4177
- SHA1 fed248f1c6b4f9c726cc82d68b2f44f7d9597142
- SHA512 b06873684c7e30432ecf0981a997c168462039913a097375919da2329bdc16896e9dfb626c1564d6f331339ee46efbb78f36a2039c2f86b9ef751ff89beee0f6
- SSDEEP 768:Hj3LxxcKeREGN6fP3LLc88IjC9+SsfvecaHUX9FdtAXE:D3LcHEGAH3p2+Pmca0tTeXE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Forms.Design.Editors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75bdb451824e01c715f233f830238ade3e272be34c71bd7a2df7aa1b7efce2e6
- MD5 59a01daff776bbfbd979bde411b3f560
- SHA1 3c74c9b82065a232e281d90b8f822c9cf81d4cbf
- SHA512 ccccddea85489c9687b32f66f0a0db638243d739693e7a66fce67b4801053ecd01c8a52eabf00fbcd0018d9f5f0b60da3a5910d26814846675299f8651f90d9a
- SSDEEP 6144:/oor7kaW8zasL0f/8vVyrB/qPXwCoMGeTcaSe+:AYwJHwoMGAx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
252750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Forms.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ea9190a7c0b339365d03c0c48866746cf2ad3f0e7640ad54b80db954fd64d96
- MD5 9e214e42857781903f5be6b42ac89ddd
- SHA1 185c472431ca8c94ea9c49da9edd4a981a2a7cc6
- SHA512 22b545d8429f0317a75662bf3640fbd88d7587d4fa1a3bb0f79778e7d326b25ba23a8ea0213b43a962bf2b7f0a72105891f346f15fcd12c6f8bdb0743f0b9274
- SSDEEP 12288:ROmjjh9Dz6oJfvTmCQJTQhOs/hmjyMkpboHWwfpwVP2uwEO6pQ0qH2iZ4tb+:H6oJfvTmPT8O8MBfpwQh96pQGiyb+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3241438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Forms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a76af35171df472e387dc467956c6b056e19a43c1e0e09f89a1572628c54fedf
- MD5 ec5a7dc7bfbcab037901f174b52c7bd5
- SHA1 73a89e6046617a3af7ba724f92defb0365761a11
- SHA512 33548b655ea172de39c216e959f13db8aecea63780b4025b2235e097ecc99f732793548bb03b481203abf28905fc4f23a5dedd73591549c01699b6249a3d5ae3
- SSDEEP 49152:Ol0C6QHDwnGqQVp1nrXJNpjJFVoqFLN+AvDU/B8RbvQRRF:vC6QHMnHQBJLOILkRF
- MD5 SHA1 SHA512 SSDEEP
Digest
c3:31:d8:1a:25:0a:a5:36:f5:dd:cb:ee:ec:29:4e:a1:8d:00:23:2a:4a:09:90:69:76:dd:31:d6:21:b0:dd:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
6721134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Input.Manipulations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d030c8145d86fc3e2765c89765ea15cbb157c06c7faea155f26ed39e2e50cdfb
- MD5 21a4ed44f42411c0eabbcb9d557ffe75
- SHA1 72d6911b4a9e2c18f47c31bd036694edbe05aa10
- SHA512 e70e97002a9f447147535ffcda5ed9fc1942209e2bb95588551006692cf76b07204d33f906ec219ce2fa67ee574a44c910dd293ac6037260753a692e584f9600
- SSDEEP 1536:wOxN1JPd1h47Iyr59/ojWtU6HnoVn7xkVBzo:wSX1iEy9tkSm7xkVy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
55502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.Presentation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1e26e9e1dc838a2daa84ca5aa4102d0fa0e2b2003d0bb4f28265f18725e3b019
- MD5 b0026d4bc150bfcfaa635cce3c0274c1
- SHA1 554e69420dc20dacaf714627c67be5580d192835
- SHA512 7bccfa7e72fd89bbe2e020e83a241a1b2967d7c741cb83be95d25486e4a97d8e0097e88cf09fb80b16491ec0ffb55a4a7f793f03c54b684cb0be240acde88eb8
- SSDEEP 96:qVRdI0u2wyHw8PqkoidIuywtVjLm4Q+xGD/D6fJVbxNWBj:oRd5fSb+ztVjq43NWBj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Windows.dll
- SHA256 2c0db98ff26ed75ff5a0363d71437fd68f2aa32d07fe191ee3d5682d2e067f5a
- MD5 718ad855af94c8999ed3ef8d6c6bd425
- SHA1 12c6ef3b222cbfb39270733519857562fa2d0953
- SHA512 fb5d1f5af77d6c4beacf44dbc9d3168457419465f03c1420916512e57c4718967aa5b58b3ac665c54ab75d8c9fc5ab3a72c0be03d7b7c19d8f273ba3e662c30b
- SSDEEP 384:JWEBFW+TaVthkd6+h7HRN7NpFkGER9zRbH:fUdeF7F+9zB
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
46:1c:f8:3a:70:eb:6a:ba:61:54:18:1c:8e:6f:95:c3:bc:cb:7c:d2:da:82:6f:9e:10:7a:1e:9e:58:51:76:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Windows.ni.pdb
System.Windows.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xaml.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4c00761f3ae97b3925442e25654dba81a033e89a678109c276668202d12878b5
- MD5 0eafae3a741222c0c70c684f95ba0ca4
- SHA1 d637d064819f6e9c26c42646f3c20c113ebea664
- SHA512 9e669c28f9e242d409b167f4e16217ce40b6daced6bfee9b201f9596de748043631d6edf3b743253d36cef43314c006869d3944117b88239e07682bced0a9dcd
- SSDEEP 6144:Ab8SCbASWB+aBFCuWBSF2lj68Bk5YCzS3PDQspzSPQc//fNcuVYuBXbt:AlWn2/SAGFGSrpzSPQc//fM+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
570062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
549KB
Virtual Size
548KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Xml.Linq.dll
- SHA256 ba4fceca075f4bc010a20506237f939903f4b0dd39fc707cc2ac9678bef88bce
- MD5 992c84a8940aa608d19b3d8a7de37250
- SHA1 1408d2e802e482b028e0a74893b76f24050b0e35
- SHA512 673bac1579366398faf5a620e664b72f51d567692a729ea4c5d1a1c93b1e62149c5d2bf31cef9da23a571c95074a438cfa1aafd97693ddc35bcff1d536c342be
- SSDEEP 192:VW1DfW8LOmaPdgQy3eWvcuyjS7HnhWgN7awWhLnje6gqzGslX01k9z3AelJH/l:VW1DfWzdgFf7HRN72gkGER9zRL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
95:5b:fd:52:2d:1c:18:93:9d:39:70:cc:bf:fd:b6:8f:48:11:8e:83:d5:0a:62:eb:c8:ce:9c:21:a4:05:f8:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.Linq.ni.pdb
System.Xml.Linq.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.ReaderWriter.dll
- SHA256 e5d1bc0eca4b452c6bf1ac792c9296397d8dc072195147cb66413748c12e3318
- MD5 b9e09b548bdb184b83a5588f598bc4aa
- SHA1 5aad884ec792fc88fd610663aac11adf3fc7de13
- SHA512 a8b4cc181d15638c5e82c28b51d23631780395ff5945de6ea25547498a7f43fbcf3c12b0877b5bbbb60d08e42aa3f63306396047919bb9f626eca9df7e6234f1
- SSDEEP 384:BW1b3Wd5q5xK67ex4FCJjaYlhd00bPAXXN7HRN7bG50ZSxR9zZwcW:sPLeaYlPbPAH5650Zi9z+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
59:c4:b4:ca:4c:7b:0b:f3:54:6e:41:99:1a:cc:ab:f6:56:b0:12:1f:c2:b8:78:1b:d4:85:fb:30:54:fb:f1:d5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.ReaderWriter.ni.pdb
System.Xml.ReaderWriter.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.Serialization.dll
- SHA256 fc6423505981d34502ec151c12e462dd87614167a7652f1cdec3964ac41757fe
- MD5 f3e53f561f28a72396d8880b5fd43061
- SHA1 e6600eb8b032ed4b45aae94d0b16a92e316079ac
- SHA512 886000f017296a211de5dd020c0ec0529f5fc483231e2391506e56a23961ada65b0f8d05b48e5ba2160ae0ed11c3c3bd014e222cdf903111a24368e3ef04ea0f
- SSDEEP 384:CLW7M8EqAWLdNKf7HRN7+oW72vH3rPR9z/G5s2:CkPEqtKj+a3l9zo
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
78:be:1e:a0:d0:d8:cf:da:f7:15:2e:57:51:b3:dc:4f:dc:dd:6c:2a:10:9b:8b:25:71:34:ea:f9:15:0c:e4:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.Serialization.ni.pdb
System.Xml.Serialization.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.XDocument.dll
- SHA256 a284999ea5a18a713ce7f63565bb8c089d70b261de5b9835825e37b295b510e3
- MD5 0bbaf643f66860420adf5ebb16fad642
- SHA1 27221e1ed6c03613792ad6c14b3446902d624b4c
- SHA512 c0ab539ba2018ba06aee3050724ab0be2e463b7b63b227d544fa4f415dad624ae3f938872983be28deb31ae81f6e0cd10db71acaa8d1492c0fc90d2aa37a1132
- SSDEEP 384:lW/0KWRuodx67HRN7A0G50ZSxR9zZwcCtmX:lFuOWm50Zi9z1
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c5:ed:3a:9d:bb:9d:0f:02:1b:0f:91:dd:ec:42:f3:7a:5d:92:a7:a9:7e:aa:99:57:c8:94:a8:21:2c:f3:c2:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.XDocument.ni.pdb
System.Xml.XDocument.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.XPath.XDocument.dll
- SHA256 8ba41be47a40f344928c92181640b5db841fb325500e3fbf772e3cf4ce78d056
- MD5 85df03f8eea82a8997ae5d5e7216f516
- SHA1 c7651ce2617239ad1fb2efc0d7afdf586a6e4309
- SHA512 62d2d220d9e1ae36c5c88af9740ccce186548deda39089a9c7703b8a4855ef3d24666608d2ba5b8a97a6779ac75d5286c667fa8380a12e49d4c2cc8a026d50d9
- SSDEEP 384:YAW0V5WWVNxd8USh7HRN7fxRmuTcR9zDr22:YIdVNyFpRmuU9zm2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
76:9f:b2:fa:13:19:ba:4a:9f:83:4e:37:66:9a:e4:94:cd:7e:5a:1a:18:65:d9:f6:84:60:a7:09:c3:59:74:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.XPath.XDocument.ni.pdb
System.Xml.XPath.XDocument.pdb
Name
.data
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
System.Xml.XPath.XmlDocument.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5aef6270411213995e83fc1c886c2545ae7f69d3f484f0320a7ca373f66a95b7
- MD5 f9b0a48e6992380cc8bc1125ee3b7df1
- SHA1 4eb18e5115c8be53a61bf8a7092c479917c1ce37
- SHA512 db762dfe8d4724416dc5924e3d1aa1f7685aa20788a8bb30b8b2135265a03281182adb730bb122364676088bfe6cc2f19deade4bcb53f4943b2e60182a57c88c
- SSDEEP 1536:Y951R5MZ7fQMgXB0ldID4y3tZ8CA3859UJHjQJZF0f43RahBXuLNaR:wjD7XSldIDl9ZjAvBjgZF0fThBsNm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Xml.XPath.dll
- SHA256 fb076cbc2c2998fdf3fb59c1a8a3ee7bbebf9def922466f8f200b93076263ca4
- MD5 fd7b5de88e17c734cd46495addd2e9b5
- SHA1 6bdfff284a9039ad0baf1c01ed5a1b16465ad9b5
- SHA512 2f67c81c64d1d5b99d2c36bbfcff87eec7c22a70c744dba1e67a8040464db883aa0a5ccd268aac15803bbded3a309c4ca7b5d04415c7fcb6e8e3e2d6ab476ba2
- SSDEEP 384:IWBaYWVizBS6dTF7HRN7J2Jk5+R9zusoz9Q:6ABSqB0Wg9zu59Q
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ff:a5:50:ae:7f:b9:61:40:40:02:17:9c:c7:0a:4f:cc:c7:53:5b:0b:eb:15:94:2c:dc:ee:30:fa:61:72:6f:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.XPath.ni.pdb
System.Xml.XPath.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.XmlDocument.dll
- SHA256 a5f438c4e21d1739df9595a0a9fb064de2b74fea35755a74633cca5f875d4dda
- MD5 b4fedbf764780b7dce28da95a420d697
- SHA1 4941b0a0e9511694b5d27cda36877b4dad89cdad
- SHA512 55200562f072f04acd2c9e03fd0b8ce379e329e9e7435d8d0d97864712ea4f774ff1b92bbef30b3856fbdf7ea80323dad4738ce6f36baef642b75ed4914303c2
- SSDEEP 384:piWe/LWruwzdQ927HRN7/6zaHeR9zgNr1:QkteaBC9z81
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
47:a8:9a:5b:f9:fd:7b:43:08:b9:7b:73:b9:21:6e:28:f8:10:df:d6:47:12:84:89:fe:1a:2d:73:2d:4a:53:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.XmlDocument.ni.pdb
System.Xml.XmlDocument.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.XmlSerializer.dll
- SHA256 38019b08132f45e928cebdc0312a0aeba3f71572192a682f207e43bb860048e6
- MD5 c89966f292c5e6b479c2b3aad9c8cd86
- SHA1 836c1db80dfbfab4453df6d7eb01f82ee7c3d5f4
- SHA512 6ee43e72c97263423c415af8e013595ffa35fdd41c4e992913b69280d86a4af4b28ed3b8996cf873c135aee0c0dd1ce0ccc2ea47be09641307cd91bcc3a35574
- SSDEEP 384:BWpKYWXweSdFssdjLhrz7HRN7zwYmfWojR9zDw4VI:lRweaFsUN7ufWoF9zU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b0:89:b1:13:b0:7b:d0:33:fb:c8:08:92:25:f2:d6:a9:f9:fe:5a:a2:20:ca:b6:6d:7b:ee:9a:89:d0:dd:b6:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.XmlSerializer.ni.pdb
System.Xml.XmlSerializer.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.Xml.dll
- SHA256 ac8617f3ea708d5c8ccd5801030713ea7366a80f99ee0f4bab74212e98ba917b
- MD5 29619d04b8d76177ac3aa6531850d780
- SHA1 74663ff0da33fee097e640efe61ea7ac3ef5c0c4
- SHA512 2b7769ba99166d5eaf56142ec495c2f39c5b9bbc56bf115ecb73b82c18b2421fa722c8293666de337d3d28f599e21778a30944e04a5d42f8eb3b8c37056a3469
- SSDEEP 384:4WKbjLWE5q/7A8bhUVGfbho9SdI2Xi/7HRN7GXdg8M8/fi/GR9zZ8BSX:wkO2tSDGXLMufiC9zuSX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6d:5a:64:60:58:dd:bf:74:a8:9e:8a:c2:f1:16:ce:20:fe:53:db:2a:18:9a:00:1c:c1:9c:36:02:a1:92:e9:b3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.Xml.ni.pdb
System.Xml.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
System.dll
- SHA256 f0336b00407efd004cc5f7a8d47ceb16bbb89d1edadc951ef090f5c97e4f3f26
- MD5 693e8bd37b77003f5be42ae1bbe8ee16
- SHA1 7e8e04c3419e2f73f686b21c8380eb8cd0f560c8
- SHA512 03948a81c406d3c800ab1580e78aa698e8aa61f49e1a147a6bfaa3b2bf688f7dc472e2f80cba497acc2dbc866a3291c709373239dd2579c0a94f0aa21ef440f8
- SSDEEP 768:4Ul1eiS4RNB5JVbOd502zq1SntVRirQDdwmbWkkt7/P71C9zDi:4EeiSn5jzCyMkamvc7/P5eze
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
PE Signature issue
Digest
de:8b:02:ad:7e:74:b8:4d:12:c1:f5:1f:42:19:75:a7:cd:73:9c:37:88:cf:31:97:88:76:35:0e:42:e5:a7:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ni.pdb
System.pdb
Name
.data
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
SystemToolsWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 891d80bfc25e80de19ec819e9a4d3059d40a22a259fd349a6c2f5aa1492bf352
- MD5 beff09abb00b97ab6c7b6190a772280d
- SHA1 a1f9a9f65d94a701057761e1d21c2c2a266ad93b
- SHA512 235224d4eeb91ae50236ff7f8a43e10ebc6f1ba2437dee6d47937c1511f97c8692ee3a86d83f2532fe6b876a5996a1b53730998c311580a36cb3056086fd7937
- SSDEEP 3072:d9YlhCe0JX4H2bGvanFGSJOG8YrqYLUF4Iw2YtCgm4WbIVmH/WGc+FWIwQz:dXY2V/OFYrNUF4Iw2YAgmFbnWG1wId
- MD5 SHA1 SHA512 SSDEEP
Digest
8a:ae:14:6f:7f:3a:e8:94:38:bb:6c:0b:84:5b:8f:51:ce:6f:db:1e:ed:1f:a6:de:73:3d:77:74:26:ce:22:42
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
268574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TotalAV.exe
- IMPHASH 0e4978c6d7358363a563494a824fabf2
- SHA256 1228ead05883abee346299ed08de684c7438af548b4a527dffe469777fb00987
- MD5 cccaf3ebad69beb64c9973de315074ac
- SHA1 7bfb588c11d01b58559af45a5560cf9b65633069
- SHA512 2697992b45a58845d782e9f31b485bc65130d3bf55e618ea13195e47e6492907a77c46ebe596f9851280b8d7fec6b429329c71d8884796ba18203a349b9a199f
- SSDEEP 49152:cJfYKsQo90WwGOZMV7cpDGT+vdI/EDplyDYVv1Yu1Idz1XUoxV4DQvHYxUTpUMYi:iol
- MD5 SHA1 SHA512 SSDEEP
Digest
0a:9c:7b:e0:f0:a5:f1:ff:48:36:76:33:69:23:b3:06:53:04:80:98:8c:45:14:7f:bf:24:68:04:71:ae:da:13
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
74032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\Release\apphost.pdb
kernel32
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
GetTempPathW
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableW
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
OutputDebugStringW
GetModuleHandleW
GetCurrentProcessId
Sleep
RemoveDirectoryW
DeleteCriticalSection
CreateDirectoryW
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegGetValueW
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_initialize_wide_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_get_initial_wide_environment
_register_onexit_function
_initialize_onexit_table
_controlfp_s
_exit
__p___argc
__p___wargv
_c_exit
_initterm
_initterm_e
terminate
_errno
abort
exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
fflush
_wfopen
__stdio_common_vswprintf
fclose
__stdio_common_vsprintf_s
_set_fmode
__p__commode
fread
fseek
fwrite
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsicmp
strcpy_s
_wcsnicmp
_wcsdup
strcspn
wcsnlen
memset
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
_callnewh
_set_new_mode
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
setlocale
__pctype_func
___lc_codepage_func
_unlock_locales
_lock_locales
_configthreadlocale
___lc_locale_name_func
localeconv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_time64
_gmtime64
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=260, version=30034,
count=13, id=259, version=30034,
count=76, id=261, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=26213,
count=163, id=1, productName=Unmarked objects,
count=13, id=261, version=30140,
count=1, id=258, version=30140,
Trinet.Core.IO.Ntfs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4f750952c56bc9800cf7436c90ef983dcec12b5d156223522c9c2156d59b12c5
- MD5 bea773dcb85e63a9bade222269c62367
- SHA1 1572e3baa0c7d7335222acd435cab3616dc08c10
- SHA512 a9c592a8675c96df544d20a0d0c004614789e034a2add26515fb4974d8c7caa98c018e92cb6e6df682f0f6e01c01e2d23395313b3564ef34315f0b4dab0ef1a0
- SSDEEP 384:3/t4aXdbHz7ipPW3IflQolQrGk26qtT70P0Oqh/rpv82kSGpBEx1Nh9NBI:3ui36+gZQr46YhhzZ6E1n9NBI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\netstandard2.0\Trinet.Core.IO.Ntfs.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UIAutomationClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 df0dd3fa1a3463a0e94a44b70bd9fa9f4e4e91ca7a9e0229ac86442614c42268
- MD5 f9115542337c422922173108f35f6a98
- SHA1 fee4b41a513c3061f4bb040f26c9af39f0c7de96
- SHA512 b3d29a436582f86aee4c204fbe814a8d934a45e265e0144ca8e209e269dbf554bae281164cf687bce777547c67e20bc7052210e3335b8e1ba30176da53da53dc
- SSDEEP 3072:/xzMMxHE3EOEoubXNz71FDxQFzkF1jp6V9epr:ZDeUXpNz1r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
165310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
153KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UIAutomationClientSideProviders.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fe614bc0fc3a928c692aa9a124ad23df2e8340589812128dadd175a5a7aa16ee
- MD5 774dbd0432c038e0cd1f12bd9815b406
- SHA1 dde22f173c178920b0c680d59ac692ec12170395
- SHA512 f14f72318203e126ff0e1d97e6d5d27e37dbaf1961246cb5022032fd80e44cce1b4c7bb015291d6e9ac614c4defb3a379d9b1d71c359b9a158e977040a235fd8
- SSDEEP 3072:PL5BrEdf+eZQE0YmCf0vl0okcdl0LUowsZGdmVWVDQpTZS40V1l2KrKrhrar6rKz:PEJ0YmvvGc70LxWxQpfdPNRpYEl4C14
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
347438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UIAutomationProvider.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1f1cd0d5ecd1b5cba7f0e13c47201368f1e2670a274f51ab3a6f6352b5472988
- MD5 c38441a8d1c6af274c9dcaa36371ca37
- SHA1 67d327632db75839da87a85859452943e8fdc83c
- SHA512 c280c3d75d1d083337465a60c6ae1a1833039b925eac5066ffe423706cddbcf3dd66e61aad782829edcf59d160df963d5e5977726f12a4b64d7845ef1a532b07
- SSDEEP 384:wL7o5TJ+EREt4EidWtchSNSzuOKyyXXkdYLwmT7FiypOUnMeXeHAQIjDZBv0gAxy:wwTTut44cK8WwYnMRH/P4iw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UIAutomationTypes.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6b78e5d676aafef787cd80e53d346e00d32d4c4b5f538b2bb4bf73aecd4fb44
- MD5 ac463388a5bd074e0c5f78faedae7a3f
- SHA1 aa76fbb442eaa382551166d24ca7c484b9815235
- SHA512 91703a92529ef366de0d13a0621fa0a6ef96d19144d33156b79472e0e28fbb79c00603e245daaabf73848190f04c3b13d4e1dbdb316c7037633c64f714aa80b5
- SSDEEP 3072:U7QRqWWx7zg8vpLB1B9aO73uz3Vfa9/xoEviy0gVQZLnIJLTjtcXBtecZ5c:UsRP8hGUuzcPpviyJ+ZL1R
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
206158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
193KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UiPath.CoreIpc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2b825223319529860a85edb1267dde625f11719beb70b64a3f4794811ef74dde
- MD5 5478941a84114d61b7e0d58fd1a9ea18
- SHA1 3f33fc1d6bb6b3db0cd6a94db659b72c93c252af
- SHA512 16f81df471e8c52e88d19010a0c3e26235b25cd79b59337fc52f145189ddeea7c11c21711d66e4345b793172920e7110806156e7a4ebf4459842e8bdb3391f63
- SSDEEP 1536:tWUHRIc4tcqG5X6gfG7ZJF4RGnXNYm4qjH5hojdHMZFwp9f/LZMMxPu:tWUHucqG5XLfoJWRGnXNYnqdhojdsLyR
- MD5 SHA1 SHA512 SSDEEP
Digest
d2:f1:a0:33:35:0b:6c:9a:bb:5d:fd:04:27:14:d4:69:37:2a:ff:4f:af:ae:dd:f6:24:14:51:c8:f2:47:6a:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
81502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilizr.Native.Win.dll
- IMPHASH ad0a365cdf6eb2218bc4df6249f04c4f
- SHA256 6eaf5cca444970d80abc62e95dc2deec1bcc4d6945e8d1b463c0ba40d50d43a7
- MD5 ade3eb76f24c6c0296452433d35ed54a
- SHA1 6bd0976acbebc0dde8d21c118b687991a2e1dcfc
- SHA512 7c92157e5fa82215d4f259b3db953ddfe7850dd16ad263265d0ca5f31a64f5532b6786157a7b7643c8e7033f0f4630b7c13de233ec7d1ed4675ebf402b59d964
- SSDEEP 1536:GK/FIJj6Koetvoji3ILIXRQmYiYO5ILtFaaewHVXHHSwsW87cdB171k+waU50Zmy:Gd6KoEYLIXRNILnXHHwqB171k+waU50N
- MD5 SHA1 SHA512 SSDEEP
Digest
87:64:07:d8:3f:ef:87:a1:2c:44:cb:8b:9c:53:f7:2c:b6:3e:46:54:06:eb:ae:0b:bc:82:1f:d9:51:48:87:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
10318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Utilizr.Native.Win.pdb
kernel32
MultiByteToWideChar
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
GetFileType
GetStdHandle
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
WideCharToMultiByte
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
WriteConsoleW
shell32
SHGetKnownFolderItem
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
oleaut32
SafeArrayCreate
SafeArrayDestroy
SafeArrayUnlock
SafeArrayGetLBound
SafeArrayLock
SysFreeString
SysAllocStringLen
SafeArrayGetUBound
NativeGetRecycleBinItemNames
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=140, id=261, version=30795,
count=20, id=260, version=30795,
count=37, id=261, version=30034,
count=15, id=260, version=30034,
count=20, id=259, version=30034,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=96, id=1, productName=Unmarked objects,
count=3, id=265, version=30145,
count=1, id=256, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
Utilizr.NotifyIcon.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 671bd4aad1a91b134c2fd4e1c4a48a82d667d936a49a60b4c41de2552d9fa868
- MD5 1e3feed90d5602cd617ab521ac90212f
- SHA1 45f96effea4fee95c2ffc733724e42a988d70ede
- SHA512 1b792747d6b8086d25828b22a329367bc59172b23297daa235436e0591fde5cad3738169f6a3c8eecdde18d88c2eb00ea2965b631bad2dd09c01c3a5247f0685
- SSDEEP 768:hM3egafC584bnXoklRjg3f98BZ4UdnRpVxDdp:Ahaz99SBrp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilizr.OpenVPN.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81322aeeef6a98186dceb13ea714194feff82bc2d33b5c42409d45f912fe1a11
- MD5 3bba1a6b2a0a573013004def7d072f85
- SHA1 15899568a637f3ec4df7f7bd1b23b9edf02aaa9a
- SHA512 53205b4fb7d54d0aab67141d6209b6e8f9cf2974cddd7ca0f5f6eb95184760d89af6b628652ee49483f3ba7db59e6aa67294cf483af91a7ec74c2609e2053a49
- SSDEEP 768:fPdHr9+OJdTM4Pzk4fCHQjhVcHtB10mq4hOl01jF1H7:f19M47zjhVcHtB8W1f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilizr.Ras.dll
- IMPHASH d57f33daabde0c29d7e55211428722d6
- SHA256 80927555d953ce14fb8b22ade23ee4b534b9e6b63a85939a3f41ef6553de7e6f
- MD5 bda74b0b910ef7f8ca46d50ecbcf69a5
- SHA1 467cde529a82b6a5e7f52049eb3b6326cf0f195c
- SHA512 f8f537ce90b16294e0577127016ddfda1c3d232ebf0a84c1e7c821793cbd47550f26027f9e5715667f572e00c1a683c7f6570579c2e9289deaf37da1ad9faaa8
- SSDEEP 3072:kNa2Dukzm3oJ+z3jUa+VhPqbb73PJ58+LfF7eE4+rGzdS/:gaiJ+z35+Vlq37R58wA0rGzdi
- MD5 SHA1 SHA512 SSDEEP
Digest
15:a5:b0:26:e7:37:7d:00:24:c8:b2:ef:42:ee:bb:16:65:f9:be:5a:d1:ce:82:04:76:dc:66:d6:c6:37:2b:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
7441
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\Utilizr.Ras.pdb
rasapi32
RasGetEntryDialParamsW
RasGetConnectionStatistics
RasGetConnectStatusW
RasEnumConnectionsW
RasDialW
RasGetEntryPropertiesW
RasHangUpW
RasSetEntryPropertiesW
RasEnumDevicesW
RasValidateEntryNameW
kernel32
RaiseException
DecodePointer
WriteConsoleW
CreateFileW
CloseHandle
HeapSize
GetStringTypeW
SetFilePointerEx
HeapAlloc
GetProcessHeap
HeapReAlloc
GetLastError
lstrcmpiW
HeapFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
SetStdHandle
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
RaslibAbortIkevVpn
RaslibConnectIkevVpn
RaslibCreateIkevVpnDevice
RaslibDisconnectIkevVpn
RaslibGetIkevVpnStatistics
RaslibResetAbortIkevVpn
RaslibSetLogCallback
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=137, id=261, version=30795,
count=20, id=260, version=30795,
count=30, id=261, version=30034,
count=16, id=260, version=30034,
count=20, id=259, version=30034,
count=5, id=257, version=30795,
count=93, id=1, productName=Unmarked objects,
count=4, id=265, version=30145,
count=1, id=256, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
Utilizr.VPN.RasSharp.NetCore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b9a3b0d0348b33271caaac006b2205d0128a246d74086d230501e53ec907732
- MD5 2958f26b0902352fc73b3816efad4e4a
- SHA1 38b9d9a075dc9fd24c9b18baf2068f3f67daead4
- SHA512 f993ad41614986e72310e10b414c3e232c4bc6e3f55ff1d15d4df731224063dbcf55ead14d57724ca39f75b9df60e34d4de3211ccfbb5d7d9895faab51364bac
- SSDEEP 384:3hTHdFRhpKlYZTRXufg9IMXbMB4/BR2xOujSsDUs3j81eTv:3rTXKl8TRtIMXItGa73jw4v
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilizr.VPN.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1cdc1133f8003c020ab7e2d9393a76eb11d3f9bb3e11f7fd55aef39d0f4800a
- MD5 cf81d3cae034b4dad84060ef063e5765
- SHA1 86e72fc9699b7674d503fa6268eae4a65e821e45
- SHA512 2841ab2b445b180097112ebab21dc8554284c360d42d8c534e813bd2aa8e1d72a1815a5325d47558873489e444260870d811ad277477b111fff2e1d35246d5c2
- SSDEEP 768:Yk4hrfcxRwxOb1bAEpUnhwL7fcAvL2NNNx4eOmw2u10mHUFWHMqoVW0AAMxkE:p00Rxahuftv12u1FpsqoMhx
- MD5 SHA1 SHA512 SSDEEP
Digest
02:d9:1e:81:98:70:c1:fc:17:20:d3:d1:a2:88:b4:7f:29:fa:d8:24:ce:d2:5a:b2:0a:b3:c5:5a:1e:53:1b:9d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
47246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilizr.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1caebda591a0931781de7f1295a931f1ea1c7c99bfc27d1eaa9e9e7c385bffe4
- MD5 34405f7bc238783edff4f7d27d5db5c0
- SHA1 9054362111e4fe721bbd41fa0e58c871d2edb2a9
- SHA512 82eb90e8492cae875dfcab66acb3c95fe1ec67a627e9585c6d1fba0bdfb5abe0936a5eb2cd132be3ddd49e5e5490141271c35436040c882bccbef7f4c06af350
- SSDEEP 6144:HBFP1rPm67HkkbDlbiJridY5G8GCKklSR7zGjJ6nwaaGb5lo96kF0b1c84PmMiuT:X1rPh7HLDlbiJlq7zA6nwP6vJwmMiuT
- MD5 SHA1 SHA512 SSDEEP
Digest
64:36:15:a3:66:37:3c:2c:f4:58:35:70:5b:89:e7:7b:c4:5e:ef:ea:54:f0:a1:18:24:a1:11:f1:7f:c0:2d:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
416542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
399KB
Virtual Size
398KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilzr.WPF.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 69465cb04f9d591f2fbeac213b9e4c2ca61b3f17f2e537528ec48b1205ef591b
- MD5 263efe529fce04baa4860e5114aa847d
- SHA1 132451c90e386912941b95d74f709679acfc4a74
- SHA512 a7c83396cf84f0ca0bd7e1fab10a57b998016ffa73af7466ecc10b13ecc711473c0567125217b99f74de311296b54d4f841a248ab6571fa835e8e7926cd99892
- SSDEEP 6144:3RiAfD+ApbwQJk/8DHJi5RGOJHhboz51vDHUnoARrYvwV5j3Mm:QAaANSMoHTBboz51vDHEj3Mm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
406142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
389KB
Virtual Size
388KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Webshield.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8b29bd93b6e919f7098f0eacdc66d72ed25b3e9472e3c61a17ae5cb43419b8c6
- MD5 61de4c9a5119a54f7c114817b2cc362a
- SHA1 3f3b0776526746bad4775482ad17c20821f99ce1
- SHA512 a6b6bfc70a1cb7fd810dbf4b320eff94beefe2a8f1846e7acc709ed92cbe9d6b5b750782ef189608a2e44011cbd5924fc34a088fbefab17fe8c1dab61b00be6b
- SSDEEP 768:XZyVmVFGwsjrgrqqnt1mkfX6dup8VgGzrJeHhYpFSmudok+n:XydvFkfX6VJedm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WindowsBase.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f6d8283bbc65f2e5d101b6465a80b130060e27ed304301aefac5e370b4ee74c
- MD5 d1ba0f8dcdb06bbdb31b92f21557aa92
- SHA1 41d096383c3334429ecf27309c496142c09b59bd
- SHA512 811b671d4d7271e682d5f94a0e1605784866f27545abe9dbe6fe10bc2a8a80240b15dbc9949f3bcba056fabca402707c732f32488f60d11029863073a350331c
- SSDEEP 12288:TyIB++WPyR0vkXLDywcEvmNA08m7J9dQQVsbKBCTRc8g9sgD9VMuVGdLlESOLWQT:GIa6eC2wBmNA8J9dQQpdquOpXRwXSfy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1052206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1020KB
Virtual Size
1019KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WindowsFormsIntegration.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bc138863ad0bd5ad76cbe133e6091e774c875e02cf070653eaf10dde099c299
- MD5 0a90d6f7745945ac8b4ab943117a2997
- SHA1 3bfc301f7c1fe06d24ae75792985ce0ff96d0b5a
- SHA512 63825e8a0a5f085b9b513d14e8e3103921f2cf3a0250cea3bfcb03bc2e562543c89cb5ea92bb4bf12cf0b885dbf5248203ea59500bc0ef55788f2bae1498e346
- SSDEEP 1536:HA4yZgAOFEDPIptdL8a9ZlrmmMeIUGMp/zWtDxVf8oTIA4999rjrl5qT0B98KuJl:HDy6AHQ99rBIUGMp/zW5xVfD4999Tl5k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
api-ms-win-core-console-l1-1-0.dll
- SHA256 24b07028c1e38b9ca2f197750654a0dfb7d33c2e52c9dd67100609499e8028db
- MD5 aabbb38c4110cc0bf7203a567734a7e7
- SHA1 5df8d0cdd3e1977ffacca08faf8b1c92c13c6d48
- SHA512 c66c98d2669d7a180510c57bab707d1e224c12ab7e2b08994eb5fd5be2f3dee3dbdb934bcb9db168845e4d726114bce317045027215419d3f13dcfa0f143d713
- SSDEEP 192:aBgW1hWi7u7jCjdks/nGfe4pBjSYpP4W5RKTt3E2sVWQ4GWc6CT7yqnaj/6g6dyh:dW1hWLam0GftpBjhFm3S4xltZEU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
78:01:8f:1a:1e:e5:e3:d8:12:34:d0:63:8c:e3:c0:73:5e:2c:98:83:9a:54:39:85:48:6f:ed:ce:f5:13:0b:2e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
1f:1a:e3:ca:4c:2a:c2:0d:00:a4:8c:51:18:6b:d2:53:27:5d:be:bb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-console-l1-1-0.pdb
AllocConsole
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
WriteConsoleW
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-datetime-l1-1-0.dll
- SHA256 c64b7c6400e9bacc1a4f1baed6374bfbce9a3f8cf20c2d03f81ef18262f89c60
- MD5 8894176af3ea65a09ae5cf4c0e6ff50f
- SHA1 46858ea9029d7fc57318d27ca14e011327502910
- SHA512 64b31f9b180c2e4e692643d0ccd08c3499cae87211da6b2b737f67b5719f018ebcacc2476d487a0aeb91fea1666e6dbbf4ca7b08bb4ab5a031655bf9e02cea9a
- SSDEEP 192:fW1hWiH+49Cjdks/nGfe4pBjSY285a+W5RKTt3E2sVWQ4GW2TwE9qnajuZDAJaaj:fW1hWZ4wm0GftpBj8m3SLwwlUKTf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
af:2c:95:94:4c:b1:1b:99:46:db:28:c1:f2:10:db:14:7b:5d:6a:8b:30:76:fc:f3:a3:cc:f0:15:b0:ba:a6:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
1c:49:85:91:05:43:17:cb:f1:63:7f:31:a2:21:c8:d3:38:1c:0d:59
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-datetime-l1-1-0.pdb
GetDateFormatA
GetDateFormatW
GetTimeFormatA
GetTimeFormatW
Name
.text
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-debug-l1-1-0.dll
- SHA256 7e4cba620b87189278b5631536cdad9bfda6e12abd8e4eb647cb85369a204fe8
- MD5 879920c7fa905036856bcb10875121d9
- SHA1 a82787ea553eefa0e7c3bb3aedb2f2c60e39459a
- SHA512 06650248ddbc68529ef51c8b3bc3185a22cf1685c5fa9904aee766a24e12d8a2a359b1efd7f49cc2f91471015e7c1516c71ba9d6961850553d424fa400b7ea91
- SSDEEP 384:uW1hWcFm0GftpBjOQElEm3SQalndaYhppz:llVijElEXj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e7:92:28:8a:ca:d5:86:28:22:34:3d:dc:71:26:1f:9d:a6:2d:8a:4f:4c:5c:6f:29:5a:3e:64:d1:ad:e3:1b:51
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
6f:d7:34:01:66:da:08:66:42:62:d4:44:cd:4d:29:4c:c7:3b:16:68
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-debug-l1-1-0.pdb
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
Name
.text
Size
1024B
Virtual Size
539B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-errorhandling-l1-1-0.dll
- SHA256 f8e3b45fd3e22866006f16a9e73e28b5e357f31f3c275b517692a5f16918b492
- MD5 d91bf81cf5178d47d1a588b0df98eb24
- SHA1 75f9f2da06aa2735906b1c572dd556a3c30e7717
- SHA512 93d1b0d226e94235f1b32d42f6c1b95fadfaf103b8c1782423d2c5a4836102084fb53f871e3c434b85f0288e47f44345138de54ea5f982ca3e8bbf2d2bea0706
- SSDEEP 192:cnmxD3jW1hWiRcvHCjdks/nGfe4pBjSYrteMMPiW5RKTt3E2sVWQ4GWCxMfqnaj9:cn4W1hWiQim0GftpBj9eXm3SR6lPp/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b3:bd:7c:32:14:8c:fe:34:06:44:f9:bb:b2:e3:0b:5f:a3:a0:72:57:55:36:7c:38:4e:ec:57:3e:06:0a:70:ca
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
9b:f6:ae:be:57:bd:40:80:95:1a:31:a9:b5:23:73:64:80:3d:61:7c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-errorhandling-l1-1-0.pdb
GetErrorMode
GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Name
.text
Size
1024B
Virtual Size
710B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-file-l1-1-0.dll
- SHA256 1d1c11fc1ad1febf9308225c4ccf0431606a4ab08680ba04494d276cb310bf15
- MD5 eefe86b5a3ab256beed8621a05210df2
- SHA1 90c1623a85c519adbc5ef67b63354f881507b8a7
- SHA512 c326a2ca190db24e8e96c43d1df58a4859a32eb64b0363f9778a8902f1ac0307dca585be04f831a66bc32df54499681ad952ce654d607f5fdb93e9b4504d653f
- SSDEEP 384:Y6PvVX7W1hWC1m0GftpBj4xm3SBvlmTwhsH:jPvVXeTVic1i
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
00:c4:35:21:a2:04:3b:c9:c5:7f:4d:4b:6c:da:d0:38:aa:75:92:91:c1:c5:66:86:8f:32:c8:78:79:05:e4:74
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
6d:7c:e4:74:3d:15:aa:58:38:90:db:48:88:42:62:88:c5:8a:8a:8e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l1-1-0.pdb
CompareFileTime
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DefineDosDeviceW
DeleteFileA
DeleteFileW
DeleteVolumeMountPointW
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLogicalDriveStringsW
GetLogicalDrives
GetLongPathNameA
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-file-l1-2-0.dll
- SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
- MD5 79ee4a2fcbe24e9a65106de834ccda4a
- SHA1 fd1ba674371af7116ea06ad42886185f98ba137b
- SHA512 6ef7857d856a1d23333669184a231ad402dc62c8f457a6305fe53ed5e792176ca6f9e561375a707da0d7dd27e6ea95f8c4355c5dc217e847e807000b310aa05c
- SSDEEP 192:Y+W1hWifcvHCjdks/nGfe4pBjSYA89sX5W5RKTt3E2sVWQ4GWFuLOgVqnaj6uDp6:Y+W1hWoQim0GftpBj7sIm3SFOslD16hP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9d:8c:97:81:85:48:aa:1d:d4:f2:e3:3e:90:c1:c6:db:8f:cb:ab:59:89:3c:de:f2:e9:8e:7e:b7:37:31:4c:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
c7:5a:78:70:ff:34:aa:28:49:4d:2c:57:ae:ad:99:8b:9a:85:88:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l1-2-0.pdb
CreateFile2
GetTempPathW
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
Name
.text
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-file-l2-1-0.dll
- SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
- MD5 3f224766fe9b090333fdb43d5a22f9ea
- SHA1 548d1bb707ae7a3dfccc0c2d99908561a305f57b
- SHA512 c12ea6758071b332368d7ef0857479d2b43a4b27ceeab86cbb542bd6f1515f605ea526dfa3480717f8f452989c25d0ee92bf3335550b15ecec79e9b25e66a2ca
- SSDEEP 192:FZkW1hWiecvHCjdks/nGfe4pBjSYo3Vq34W5RKTt3E2sVWQ4GW2rOqnajd2siD+k:MW1hWdQim0GftpBj4VuFm3SWlg+0mw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7e:ce:c2:e0:6e:f8:7f:0a:cf:3a:5b:44:ba:ed:d5:c2:a1:a7:dd:90:87:4e:3e:15:a0:56:c5:06:b1:c7:85:cc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
78:3a:91:1b:dd:8f:2c:2f:d3:a3:7d:86:9c:dd:87:9c:03:05:b4:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-file-l2-1-0.pdb
CopyFile2
CopyFileExW
CreateDirectoryExW
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
MoveFileExW
MoveFileWithProgressW
ReOpenFile
ReadDirectoryChangesW
ReplaceFileW
Name
.text
Size
1024B
Virtual Size
893B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-handle-l1-1-0.dll
- SHA256 dba84e704ffe5fcd42548856258109dc77c6a46fd0b784119a3548ec47e5644b
- MD5 18fd51821d0a6f3e94e3fa71db6de3af
- SHA1 7d9700e98ef2d93fdbf8f27592678194b740f4e0
- SHA512 4009b4d50e3cb17197009ac7e41a2351de980b2c5b79c0b440c7fe4c1c3c4e18f1089c6f43216eaa262062c395423f3ad92ca494f664636ff7592c540c5ef89d
- SSDEEP 384:4W1hWypFm0GftpBjTnom3S4tOlDCEY5kD:zvViFoUtQ1Y5kD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b3:29:82:a9:07:32:c9:dd:95:e1:2d:ac:d6:88:12:65:ad:a0:ed:14:92:66:ef:2a:89:ad:c4:c7:fc:e2:c4:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
3f:32:f2:4a:32:77:c7:b4:c2:76:97:8f:6b:5c:71:99:fe:4e:c2:0e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-handle-l1-1-0.pdb
CloseHandle
CompareObjectHandles
DuplicateHandle
GetHandleInformation
SetHandleInformation
Name
.text
Size
1024B
Virtual Size
607B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-heap-l1-1-0.dll
- SHA256 535e9d20f00a2f1a62f843a4a26cfb763138d5dfe358b0126d33996fba9ca4d1
- MD5 ff8026dab5d3dabca8f72b6fa7d258fa
- SHA1 075c8719e226a34d7b883fd62b2d7f8823d70f1a
- SHA512 9c56ff11d5843ba09cd29e3bc6c6b9396926c6a588194193ba220cfa784b770ab6756076f16f18cfea75b51a8184a1063ef47f63804839530382f8d39d5cf006
- SSDEEP 384:nEleW1hW59XRm0GftpBjywVpm3SJflndaYhp6a:uADVig69F3
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0a:fd:cd:0d:02:b1:73:f7:b5:2d:8f:6a:60:f9:7e:2b:7b:8b:52:af:9a:68:ed:d3:51:2e:5a:ab:37:70:1d:f5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
47:78:05:72:78:49:45:96:58:01:fb:ef:6b:52:d2:51:0b:ee:77:b8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-heap-l1-1-0.pdb
GetProcessHeap
GetProcessHeaps
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapSize
HeapSummary
HeapUnlock
HeapValidate
HeapWalk
Name
.text
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-interlocked-l1-1-0.dll
- SHA256 4997fda5d0e90b8a0ab7da314cb56f25d1450b366701c45c294d8dd3254de483
- MD5 cfe87d58f973daeda4ee7d2cf4ae521d
- SHA1 fd0aa97b7cb6e50c6d5d2bf2d21d757040b5204a
- SHA512 40eb68deb940bbe1b835954183eea711994c434de0abbdea0b1a51db6233a12e07827ad4a8639ae0baf46dd26c168a775ffe606c82cbe47bae655c7f28ab730b
- SSDEEP 384:l5iYsFqW1hWfsngm0GftpBjWfshFIvgCcm3SHlg+0Ix:loZngViwfsh6gxfx
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
43:ba:ca:fd:b1:e3:f6:6e:41:1d:89:2b:d7:34:51:5c:30:ee:5f:90:5e:49:24:67:2e:ba:88:36:5c:1f:63:55
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
7d:aa:52:4d:98:7c:0a:aa:11:33:5e:75:9f:40:7b:a8:bf:cd:77:cb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-interlocked-l1-1-0.pdb
InitializeSListHead
InterlockedCompareExchange
InterlockedCompareExchange64
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedFlushSList
InterlockedIncrement
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-libraryloader-l1-1-0.dll
- SHA256 2dd4ebaa12cbba142b5d61a0ebf84a14d0d1bb8826ba42b63e303fe6721408df
- MD5 0c48220a4485f36feed84ef5dd0a5e9c
- SHA1 1e7d4038c2765cffa6d4255737a2a8aa86b5551c
- SHA512 e09951785b09f535340e1e6c256df1919485b4dad302b30d90126411cc49a13807b580fa2fcd0d6f7b64aac4f5b5ea3e250b66035a0e2f664d865408c9b43d48
- SSDEEP 384:b+g4vuBL3BmW1hWZ1m0GftpBjLOoZm3SNvVlgCopp3y:b+YBL3BdOViUyRv4Hn3y
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b7:67:8f:9d:8b:64:26:b6:50:45:14:4d:a8:58:14:21:d7:75:1d:4d:bf:90:46:16:10:01:cd:8f:aa:b0:1f:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
8b:9a:c0:f8:b6:9e:4a:89:bd:33:82:f4:99:5f:54:27:0d:38:0c:62
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-libraryloader-l1-1-0.pdb
AddDllDirectory
DisableThreadLibraryCalls
FindResourceExW
FindStringOrdinal
FreeLibrary
FreeLibraryAndExitThread
FreeResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
LoadResource
LoadStringA
LoadStringW
LockResource
RemoveDllDirectory
SetDefaultDllDirectories
SizeofResource
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-localization-l1-2-0.dll
- SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
- MD5 23bd405a6cfd1e38c74c5150eec28d0a
- SHA1 1d3be98e7dfe565e297e837a7085731ecd368c7b
- SHA512 c52d487727a34fbb601b01031300a80eca7c4a08af87567da32cb5b60f7a41eb2cae06697cd11095322f2fc8307219111ee02b60045904b5c9b1f37e48a06a21
- SSDEEP 384:9OMw3zdp3bwjGjue9/0jCRrndb5W1hW54wm0GftpBjvTNvwm3SBMltZ2m:9OMwBprwjGjue9/0jCRrndboUFViZ2Vu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cd:fd:93:90:2f:62:5a:8c:a9:17:2f:38:d4:53:83:78:49:3d:28:7e:b0:0a:13:5d:81:27:49:1e:b9:b1:32:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
b5:c8:23:76:1e:eb:6a:89:52:d9:4d:5c:c3:0f:e6:f4:1e:ae:05:15
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-localization-l1-2-0.pdb
ConvertDefaultLocale
EnumSystemGeoID
EnumSystemLocalesA
EnumSystemLocalesW
FindNLSString
FindNLSStringEx
FormatMessageA
FormatMessageW
GetACP
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetCalendarInfoW
GetFileMUIInfo
GetFileMUIPath
GetGeoInfoW
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetNLSVersion
GetNLSVersionEx
GetOEMCP
GetProcessPreferredUILanguages
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemPreferredUILanguages
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadUILanguage
GetUILanguageInfo
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetUserGeoID
GetUserPreferredUILanguages
IdnToAscii
IdnToUnicode
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
IsValidNLSVersion
LCMapStringA
LCMapStringEx
LCMapStringW
LocaleNameToLCID
ResolveLocaleName
SetCalendarInfoW
SetLocaleInfoW
SetProcessPreferredUILanguages
SetThreadLocale
SetThreadPreferredUILanguages
SetThreadUILanguage
SetUserGeoID
VerLanguageNameA
VerLanguageNameW
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-memory-l1-1-0.dll
- SHA256 ec573431338371504b7b9e57b2d91382b856aabf25d2b4ad96486efb794c198e
- MD5 3940167ffb4383992e73f9a10e4b8b1e
- SHA1 53541c824003b0f90b236eda83b06bec5e1acbf5
- SHA512 9732acaa4db773f4f99f423d9feaebb35c197bbd468922348e0ad086f7131d83f6d9714dc7d375183e7cb8920cfe37f3da19b0041a9063cc60abe183375b1929
- SSDEEP 384:tbtW1hWwDzDm0GftpBjQxY8m3SSlPpT2R:OzViiDqp2R
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
64:4f:5f:ec:c3:70:6b:7a:33:e3:79:1e:12:71:74:34:cc:ae:40:40:69:68:37:bd:70:72:ef:23:dd:3c:42:93
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
a2:3c:79:d1:08:d2:8d:fa:b7:08:c5:8a:92:d2:bf:a3:fd:67:ba:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-memory-l1-1-0.pdb
CreateFileMappingW
FlushViewOfFile
MapViewOfFile
MapViewOfFileEx
OpenFileMappingW
ReadProcessMemory
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WriteProcessMemory
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-namedpipe-l1-1-0.dll
- SHA256 dbd788b1c5694d65fa6f6e2202bfabb30adf77eb1973ceb9a737efb16e9edae2
- MD5 990ac84ae2d83eeb532a28fe29602827
- SHA1 0916f85cc6cc1f01dc08bdf71517a1dc1b8eaf78
- SHA512 f0e4705a6890b4f81b7d46f66ca6b8ee82f647e163bce9ecad11d0bbd69caf4ff3c4f15e0d3f829c048b6849b99a7641861e6caf319904d4d61a6084f10da353
- SSDEEP 192:DW1hWBuI2WksSrCjdks/nGfe4pBjSY7ecjkUA/W5RKTt3E2sVWQ4GWZ0MVqnaj6f:DW1hWQ3szm0GftpBjH2Wm3SPAlD16h9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
23:ae:39:00:e6:ae:18:b5:f8:c4:39:3b:d7:95:df:b2:08:60:73:9f:ba:1f:88:80:da:eb:c3:6b:43:4f:06:74
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
34:5d:e5:e5:a8:b7:2e:25:0c:f3:dc:e6:42:b3:13:ba:db:54:fb:35
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:70DD-4B5B-4568,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:d8:e4:75:f9:45:6f:48:f7:ae:00:00:00:00:00:d8
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 2, 2017 - Jan 2, 2019
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-namedpipe-l1-1-0.pdb
ConnectNamedPipe
CreateNamedPipeW
CreatePipe
DisconnectNamedPipe
GetNamedPipeClientComputerNameW
ImpersonateNamedPipeClient
PeekNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
Name
.text
Size
1024B
Virtual Size
913B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-processenvironment-l1-1-0.dll
- SHA256 9f1f26794fd664e0a8b6fbd53bfca33dcf7b0dc37faf3eb7782bc38dff62cd8c
- MD5 0c700b07c3497df4863c3f2fe37cd526
- SHA1 f835118244d02304de9eb3a355420ba9d0bd9c13
- SHA512 8042dbd9e80e33e41993887b0289e143e967544389500ada9296b89bda37bb26918e4f370f8a1bdab8faacc4e0a6980794d6a3b5320e170ad4ef751384c9f0a8
- SSDEEP 192:qHW1hWinluZCCjdks/nGfe4pBjSYUe0DFtct2W5RKTt3E2sVWQ4GWMZ6k8xL9qnP:qHW1hWRFm0GftpBjqt2m3Sn6R5lUKT4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5f:79:ef:1d:94:3a:28:42:c9:3d:20:bb:e8:62:53:50:8f:8f:79:1e:fe:80:80:e2:9a:b9:88:3c:28:4f:51:02
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
d1:6e:99:7e:0a:cf:c6:7b:4b:69:75:5d:08:cf:69:e1:7e:f2:43:83
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processenvironment-l1-1-0.pdb
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStdHandle
SearchPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetStdHandleEx
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-processthreads-l1-1-0.dll
- SHA256 4f187f1b4b14763360c325df6b04d3ec3cc6d2cecc9b796bc52a6c7196b0b2cc
- MD5 1dda9cb13449ce2c6bb670598fc09dc8
- SHA1 0a91fe11b9a8321ca369f665a623270e5ac23176
- SHA512 4e106c8a52033352c91b65cf65ec459de764c125136333a2f4ba026efdde65f3f71b1f6f11e4c580150ac8a9779825ba5e2af0e14df999a198cfe244e522c28d
- SSDEEP 384:Sfk1JzNcKSIdW1hWuQim0GftpBjuksUm3SlSlDCE4E:pcKS1/fVi4Uy14E
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2f:da:90:4d:d6:ce:cf:1c:30:ab:54:fb:28:86:0f:ae:c8:fb:3a:e8:be:53:f0:42:94:4e:9d:9e:c3:14:19:3c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
38:89:85:fc:bf:3f:6e:91:48:3f:d5:20:49:5b:3a:bf:21:d5:7a:52
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processthreads-l1-1-0.pdb
CreateProcessA
CreateProcessAsUserW
CreateProcessW
CreateRemoteThread
CreateRemoteThreadEx
CreateThread
DeleteProcThreadAttributeList
ExitProcess
ExitThread
FlushProcessWriteBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetPriorityClass
GetProcessId
GetProcessIdOfThread
GetProcessTimes
GetProcessVersion
GetStartupInfoW
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
InitializeProcThreadAttributeList
OpenProcessToken
OpenThread
OpenThreadToken
ProcessIdToSessionId
QueryProcessAffinityUpdateMode
QueueUserAPC
ResumeThread
SetPriorityClass
SetProcessAffinityUpdateMode
SetProcessShutdownParameters
SetThreadPriority
SetThreadPriorityBoost
SetThreadStackGuarantee
SetThreadToken
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UpdateProcThreadAttribute
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-processthreads-l1-1-1.dll
- SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
- MD5 95c5b49af7f2c7d3cd0bc14b1e9efacb
- SHA1 c400205c81140e60dffa8811c1906ce87c58971e
- SHA512 f320937b90068877c46d30a15440dc9ace652c3319f5d75e0c8bb83f37e78be0efb7767b2bd713be6d38943c8db3d3d4c3da44849271605324e599e1242309c3
- SSDEEP 384:NS8DfIelW1hWu4wm0GftpBjBFm3SzlJrI:NSLecfFViRTs
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
56:2c:25:6c:9d:a9:0a:3c:ab:98:f6:67:6b:55:d8:f3:82:39:31:90:c8:62:16:44:1b:23:f6:43:77:30:f5:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
9d:ea:4a:07:4e:a9:ca:3c:27:4a:3c:c3:43:34:1d:c5:26:39:e6:49
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-processthreads-l1-1-1.pdb
FlushInstructionCache
GetCurrentProcessorNumber
GetCurrentProcessorNumberEx
GetCurrentThreadStackLimits
GetProcessHandleCount
GetProcessMitigationPolicy
GetThreadContext
GetThreadIdealProcessorEx
GetThreadTimes
IsProcessorFeaturePresent
OpenProcess
SetProcessMitigationPolicy
SetThreadContext
SetThreadIdealProcessorEx
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-profile-l1-1-0.dll
- SHA256 f941c232964d01e4680e54ab04955ec6264058011b03889fe29db86509511eba
- MD5 cedefd460bc1e36ae111668f3b658052
- SHA1 9bd529fe189e0b214b9e0e51717bdf62f1da44ea
- SHA512 2c845642b054bc12c2911bfe2b850f06fecafef022180c22f6ffd670f821e84fcad041c4d81ddadb781ddb36cb3e98dfe4eb75ec02b88306ef1d410cbb021454
- SSDEEP 192:DgW1hWiIOuDz7eCjdks/nGfe4pBjSYpRrW5RKTt3E2sVWQ4GWN/VWkqnajTWOwCd:DgW1hW7DzDm0GftpBjem3SShlgCopp2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
36:ce:a9:d1:a1:79:ef:9a:99:f7:17:f2:06:55:64:c8:8f:ec:83:c2:33:b7:11:fd:d7:89:95:b7:c3:64:af:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
5b:3c:1a:8b:f2:0a:e4:63:15:a2:1b:3b:00:54:09:c5:f7:f2:c7:f4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-profile-l1-1-0.pdb
QueryPerformanceCounter
QueryPerformanceFrequency
Name
.text
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-rtlsupport-l1-1-0.dll
- SHA256 966a38ed7034f8d355e1e8772dfc92f23fb3c8a669780ed4ac3b075625d09744
- MD5 65fc0b6c2ceff31336983e33b84a9313
- SHA1 980de034cc3a36021fd8bafff3846b0731b7068e
- SHA512 f4ebc7a6d12ae6afa5b96c06413a3438e1678b276b1517da07d33912818fc863b4d35cb46280f12cf90e37bc93e3ab5e44ea6f75767a314c59222b7d397e5b6a
- SSDEEP 384:A6uGZW1hWZ4wm0GftpBjfNDm3S3xlgCoppl8uOf7:wGIQFVi3DsHnlVOf7
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c8:c8:c2:cf:b8:4e:cc:05:89:3b:a3:4b:50:a0:d6:81:27:c9:48:9f:1b:e2:46:4e:ca:91:0f:15:07:88:12:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
f0:77:4d:4d:1f:01:e9:6b:f2:cf:96:cf:a9:2d:b3:7f:c2:d7:4d:2a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-rtlsupport-l1-1-0.pdb
RtlCaptureContext
RtlCaptureStackBackTrace
RtlUnwind
Name
.text
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-string-l1-1-0.dll
- SHA256 339966ae75675a03f628c4ddd5d3218abb36cbcf6ddce83b88c07336d732b8ae
- MD5 e7a266dd3a2a1e03d8716f92bede582d
- SHA1 d4b97ce87c96de1f39fea97cca3992d292b2c14e
- SHA512 31168663fd71b901b1b9152ff288d4e1567003e5fcd1f1c9dfe36d26d2eb16b0932ec8cd34833dab25531f768a01de45c2483f92d4e79f92a89389c02bc05156
- SSDEEP 384:EyMvlW1hWBYBm0GftpBjnmm3SC1lDCE9xt:EyMvcNViYm19xt
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d0:c3:94:fb:5b:b7:25:2a:1e:07:11:83:b1:63:0a:93:cc:29:8e:7b:16:e6:21:e1:e2:0d:e5:85:04:85:a2:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
41:45:7d:08:bb:e9:93:df:35:44:b8:20:69:8f:04:66:14:95:d9:6b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-string-l1-1-0.pdb
CompareStringEx
CompareStringOrdinal
CompareStringW
FoldStringW
GetStringTypeExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
Name
.text
Size
1024B
Virtual Size
754B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-synch-l1-1-0.dll
- SHA256 cc76a4e82e0e0cd08df3bb8f5ad57142305e0f666cc32599d76e363d0b43efcb
- MD5 c1dcdb0fabc8ae671a7c7a94f42fb79a
- SHA1 99355912d7a7d622753b2a855cae4f5a4e50146f
- SHA512 6d92e7520aeebfe60aab43d6616b76a2dd385edcaa217db60003a0c0cbcb0e367063d240e38a19d0b8bee2f2e7d4b982c4f08c8e9ccf34c7f670cb49f6561fff
- SSDEEP 384:rdv3V0dfpkXc0vVa7W1hWf1m0GftpBjum3Su5TlD16ho:rdv3VqpkXc0vVaewVi4a5l
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2d:f5:22:84:1c:25:3f:6c:9d:51:6e:b5:80:cd:e5:1a:60:57:f9:de:69:2f:d3:fd:b6:5a:1e:bc:e7:e9:6a:50
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
63:bb:37:03:dc:c2:3a:ff:fe:88:77:de:4e:57:ce:7d:4a:c8:33:11
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ba:6a:36:de:1a:ad:bd:3c:1f:00:00:00:00:00:ba
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-synch-l1-1-0.pdb
AcquireSRWLockExclusive
AcquireSRWLockShared
CancelWaitableTimer
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateSemaphoreExW
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSRWLock
LeaveCriticalSection
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
ResetEvent
SetCriticalSectionSpinCount
SetEvent
SetWaitableTimer
SetWaitableTimerEx
SleepEx
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-synch-l1-2-0.dll
- SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
- MD5 6e704280d632c2f8f2cadefcae25ad85
- SHA1 699c5a1c553d64d7ff3cf4fe57da72bb151caede
- SHA512 ade85a6cd05128536996705fd60c73f04bab808dafb5d8a93c45b2ee6237b6b4ddb087f1a009a9d289c868c98e61be49259157f5161feccf9f572fd306b460e6
- SSDEEP 384:DtZ3UW1hWxDzDm0GftpBjEILkm3ScrlPpU9:n0ViIQxi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4b:fb:31:6b:fb:ab:16:71:db:ab:01:04:73:51:ce:7c:46:23:ad:cb:9d:bf:e4:9e:e2:11:22:a4:b8:cd:93:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
99:f4:e2:aa:40:53:a0:1a:eb:76:a7:89:ae:04:44:c4:3b:71:68:2d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-synch-l1-2-0.pdb
DeleteSynchronizationBarrier
EnterSynchronizationBarrier
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitOnceInitialize
InitializeConditionVariable
InitializeSynchronizationBarrier
SignalObjectAndWait
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
WaitOnAddress
WakeAllConditionVariable
WakeByAddressAll
WakeByAddressSingle
WakeConditionVariable
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-sysinfo-l1-1-0.dll
- SHA256 f94210b39cdc812beb7342a47e68673ea2116d0ad9266fcf8d7cedaa9561fc38
- MD5 887995a73bc7dde7b764afabce57efe7
- SHA1 363fd4e7ad4a57224e8410154697df5e8629f526
- SHA512 d088eb1c6958774e20f0e2884136b4e2b978efd16f557dbc55e64011abbce0768054f7e6d881c110182824143a39101fdae273ed614738aa7ba5c727b27f6677
- SSDEEP 192:4Lv12KIMFAW1hWBATVCEmCjdks/nGfe4pBjSYeXwfFzW5RKTt3E2sVWQ4GWURDPV:4LN2NW1hWavm0GftpBjtfFam3SvrlJrV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
57:a9:6b:9b:b3:a9:d7:19:ee:c9:3f:19:48:7a:55:62:fb:69:71:c5:3d:91:fe:e6:d4:67:aa:69:01:70:77:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
b5:77:64:1a:5b:2d:70:49:d9:5e:e4:17:a8:f7:98:8b:a7:f5:8f:4f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-sysinfo-l1-1-0.pdb
GetComputerNameExA
GetComputerNameExW
GetLocalTime
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetTickCount
GetTickCount64
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalMemoryStatusEx
SetLocalTime
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-timezone-l1-1-0.dll
- SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
- MD5 c9a55de62e53d747c5a7fddedef874f9
- SHA1 c5c5a7a873a4d686bfe8e3da6dc70f724ce41bad
- SHA512 adca0360a1297e80a8d3c2e07f5fbc06d2848f572f551342ad4c9884e4ab4bd1d3b3d9919b4f2b929e2848c1a88a4e844dd38c86067cace9685f9640db100efb
- SSDEEP 384:rWW1hWv4wm0GftpBjgpm3SSP9lndaYhpwe/:ReFVi02vZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
67:35:00:8b:0e:3d:24:43:61:28:fd:99:c1:81:a4:d4:aa:2e:82:99:d2:67:27:49:7b:f9:79:99:cd:de:26:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
78:03:56:c4:15:66:e4:ee:ed:d9:e5:a4:bc:02:16:44:28:25:a2:71
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-timezone-l1-1-0.pdb
EnumDynamicTimeZoneInformation
FileTimeToSystemTime
GetDynamicTimeZoneInformation
GetDynamicTimeZoneInformationEffectiveYears
GetTimeZoneInformation
GetTimeZoneInformationForYear
SetDynamicTimeZoneInformation
SetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
SystemTimeToTzSpecificLocalTimeEx
TzSpecificLocalTimeToSystemTime
TzSpecificLocalTimeToSystemTimeEx
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-core-util-l1-1-0.dll
- SHA256 34c5dee6d566252c0ceb7d9a21e24d5f297af2b26c32e0c7808bbd088aa9a6a9
- MD5 29e1922b32e5312a948e6d8b1b34e2d9
- SHA1 912f54be8438f45e1562a47294091d522cd89356
- SHA512 837cd03ee0195dc94bab0662ff3b8cd1be2dedd8a3254318d25dfea6e88d07211186fa367f41ab864560e10a22220deb3ed05ccf82d60ac80c71dfed08afbea3
- SSDEEP 384:dW1hWxDzDm0GftpBjDNtfm3SXl4aRGW6acyjR:0oVitL2GjR
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d0:0e:b7:5a:65:1e:9b:bd:09:fc:95:29:0e:83:9d:65:3f:5b:c2:37:d0:70:54:23:9e:f3:bf:dc:2c:10:83:29
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
d0:8c:e9:f5:b1:5d:d9:eb:91:51:f9:0f:2c:c4:17:15:04:51:4c:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-core-util-l1-1-0.pdb
Beep
DecodePointer
DecodeSystemPointer
EncodePointer
EncodeSystemPointer
Name
.text
Size
1024B
Virtual Size
553B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-conio-l1-1-0.dll
- SHA256 a95b1af74623d6d5d892760166b9bfac8926929571301921f1e62458e6d1a503
- MD5 a668c5ee307457729203ae00edebb6b3
- SHA1 2114d84cf3ec576785ebbe6b2184b0d634b86d71
- SHA512 73dc1a1c2ceb98ca6d9ddc7611fc44753184be00cfba07c4947d675f0b154a09e6013e1ef54ac7576e661fc51b4bc54fdd96a0c046ab4ee58282e711b1854730
- SSDEEP 384:tW1hWv4wm0GftpBjp+m3S1ZXlndaYhpt1:k+FVib+ZvN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e0:98:8a:0f:b5:85:21:2a:4c:7f:b0:c7:bf:07:42:35:a0:48:87:da:d8:a1:02:2e:39:5b:45:ef:79:1d:3e:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
dc:7f:be:ee:70:52:ba:ad:5c:69:dd:8c:b2:8a:2d:b4:3b:72:12:af
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-conio-l1-1-0.pdb
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
_cgets
_cgets_s
_cgetws
_cgetws_s
_cputs
_cputws
_getch
_getch_nolock
_getche
_getche_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_putch
_putch_nolock
_putwch
_putwch_nolock
_ungetch
_ungetch_nolock
_ungetwch
_ungetwch_nolock
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-convert-l1-1-0.dll
- SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
- MD5 9ddea3cc96e0fdd3443cc60d649931b3
- SHA1 af3cb7036318a8427f20b8561079e279119dca0e
- SHA512 1427193b31b64715f5712db9c431593bdc56ef512fe353147ddb7544c1c39ded4371cd72055d82818e965aff0441b7cbe0b811d828efb0ece28471716659e162
- SSDEEP 384:FuyhW1hWF4wm0GftpBjErIm3StlndaYhpFeD:4cFViUIbi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8d:a7:76:c4:c6:f5:cd:7a:4c:9e:0f:01:75:35:55:73:32:a5:1f:21:95:96:82:5e:96:32:9c:59:13:5a:8f:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
49:f8:c7:c9:dc:a2:e5:42:6d:03:6f:5d:76:82:cf:72:ff:d2:8e:e5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-convert-l1-1-0.pdb
__toascii
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_ecvt
_ecvt_s
_fcvt
_fcvt_s
_gcvt
_gcvt_s
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_itoa
_itoa_s
_itow
_itow_s
_ltoa
_ltoa_s
_ltow
_ltow_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wctomb_l
_wctomb_s_l
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
atof
atoi
atol
atoll
btowc
c16rtomb
c32rtomb
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
strtod
strtof
strtoimax
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
wcrtomb
wcrtomb_s
wcsrtombs
wcsrtombs_s
wcstod
wcstof
wcstoimax
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wctob
wctomb
wctomb_s
wctrans
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-environment-l1-1-0.dll
- SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
- MD5 39325e5f023eb564c87d30f7e06dff23
- SHA1 03dd79a7fbe3de1a29359b94ba2d554776bdd3fe
- SHA512 087b9dcb744ad7d330bacb9bda9c1a1df28ebb9327de0c5dc618e79929fd33d1b1ff0e1ef4c08f8b3ea8118b968a89f44fe651c66cba4ecbb3216cd4bcce3085
- SSDEEP 192:4rW1hWiSu7jCjdks/nGfe4pBjSYC69poCxW5RKTt3E2sVWQ4GWmEsSC9qnajuZDW:AW1hW6am0GftpBjtBQm3SzSKlUKTT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
28:c1:a4:2b:1d:91:ea:be:3a:d3:3f:5c:90:ea:09:b4:05:5f:5a:c5:92:7f:1d:e5:82:9c:8b:3a:b3:ce:5d:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
e3:ab:0a:72:3e:e1:d0:34:5f:22:81:e5:aa:fb:a5:b4:12:e6:93:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-environment-l1-1-0.pdb
__p__environ
__p__wenviron
_dupenv_s
_putenv
_putenv_s
_searchenv
_searchenv_s
_wdupenv_s
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wputenv
_wputenv_s
_wsearchenv
_wsearchenv_s
getenv
getenv_s
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-filesystem-l1-1-0.dll
- SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
- MD5 228c6bbe1bce84315e4927392a3baee5
- SHA1 ba274aa567ad1ec663a2f9284af2e3cb232698fb
- SHA512 37a60cce69e81f68ef62c58bba8f2843e99e8ba1b87df9a5b561d358309e672ae5e3434a10a3dde01ae624d1638da226d42c64316f72f3d63b08015b43c56cab
- SSDEEP 384:Cq6nWm5CZW1hW9YBm0GftpBjVem3SuPvlg+0Pd:T6nWm5CIhViDeKPmd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4f:bb:d0:ab:a0:f5:83:f3:48:6d:e9:4a:b5:28:2f:6e:35:8d:ce:a2:e8:b8:f0:f1:17:80:78:f5:a8:86:a9:cb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
01:38:64:ee:29:b6:ac:ca:90:af:a5:85:c6:5f:83:b9:16:59:07:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-filesystem-l1-1-0.pdb
_access
_access_s
_chdir
_chdrive
_chmod
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_fullpath
_getdiskfree
_getdrive
_getdrives
_lock_file
_makepath
_makepath_s
_mkdir
_rmdir
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_umask
_umask_s
_unlink
_unlock_file
_waccess
_waccess_s
_wchdir
_wchmod
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfullpath
_wmakepath
_wmakepath_s
_wmkdir
_wremove
_wrename
_wrmdir
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wunlink
remove
rename
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-heap-l1-1-0.dll
- SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
- MD5 1776a2b85378b27825cf5e5a3a132d9a
- SHA1 626f0e7f2f18f31ec304fe7a7af1a87cbbebb1df
- SHA512 541a5dd997fc5fec31c17b4f95f03c3a52e106d6fb590cb46bdf5adad23ed4a895853768229f3fbb9049f614d9bae031e6c43cec43fb38c89f13163721bb8348
- SSDEEP 384:XY3eBW1hWqvm0GftpBjtzsxm3SKulndaYhp6s:zQzViATv
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
47:ef:42:8b:ca:b7:de:34:29:47:8c:f4:03:4c:b1:bf:45:5b:d9:0f:5f:8a:e9:30:47:eb:83:ac:dc:59:a2:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
df:a8:71:5e:de:27:0f:ab:bc:5f:46:c2:d2:b8:8b:bb:64:45:ce:00
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-heap-l1-1-0.pdb
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_callnewh
_calloc_base
_expand
_free_base
_get_heap_handle
_heapchk
_heapmin
_heapwalk
_malloc_base
_msize
_query_new_handler
_query_new_mode
_realloc_base
_recalloc
_set_new_mode
calloc
free
malloc
realloc
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-locale-l1-1-0.dll
- SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
- MD5 034379bcea45eb99db8cdfeacbc5e281
- SHA1 bbf93d82e7e306e827efeb9612e8eab2b760e2b7
- SHA512 7ea6efb75b0c59d3120d5b13da139042726a06d105c924095ed252f39ac19e11e8a5c6bb1c45fa7519c0163716745d03fb9daaaca50139a115235ab2815cc256
- SSDEEP 192:lW1hWi6+49Cjdks/nGfe4pBjSY38yMsW5RKTt3E2sVWQ4GWbGBfqnajE49dRX3tK:lW1hWa4wm0GftpBjlWm3S7dlPptZA
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c4:9e:7c:72:02:bd:96:0b:21:f1:d5:4b:83:e8:0a:83:ee:1b:ad:36:75:78:a1:cc:50:6e:70:b5:77:2e:5c:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
55:40:1f:9c:58:bd:a7:92:7e:cc:54:e0:c5:0c:36:47:a3:91:9a:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-locale-l1-1-0.pdb
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__initialize_lconv_for_unsigned_char
__pctype_func
__pwctype_func
_configthreadlocale
_create_locale
_free_locale
_get_current_locale
_getmbcp
_lock_locales
_setmbcp
_unlock_locales
_wcreate_locale
_wsetlocale
localeconv
setlocale
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-math-l1-1-0.dll
- SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
- MD5 8da414c3524a869e5679c0678d1640c1
- SHA1 60cf28792c68e9894878c31b323e68feb4676865
- SHA512 6ef3f81206e7d4dca5b3c1fafc9aa2328b717e61ee0acce30dfb15ad0fe3cb59b2bd61f92bf6046c0aae01445896dcb1485ad8be86629d22c3301a1b5f4f2cfa
- SSDEEP 384:jOTEmbM4Oe5grykfIgTmLmW1hWSsngm0GftpBjGm3SAlD16hX:lEMq5grxfIndCngVis5
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b4:81:a9:e2:bf:77:48:ad:a2:83:51:23:75:b7:75:be:1d:a6:6a:78:f5:17:6a:b4:45:b0:03:89:ec:c9:a8:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
4a:5d:3e:6b:77:5b:7a:3e:d6:e5:62:4f:2e:9f:4c:b0:f8:3f:d1:b5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12B4-2D5F-87D4,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bc:0b:2e:1a:7b:8a:b1:c7:91:00:00:00:00:00:bc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-math-l1-1-0.pdb
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_FCbuild
_FCmulcc
_FCmulcr
_LCbuild
_LCmulcc
_LCmulcr
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__setusermatherr
_cabs
_chgsign
_chgsignf
_copysign
_copysignf
_d_int
_dclass
_dexp
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_except1
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_finite
_fpclass
_ftol
_hypot
_hypotf
_isnan
_j0
_j1
_jn
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_logb
_nextafter
_scalb
_set_SSE2_enable
_y0
_y1
_yn
acos
acosh
acoshf
acoshl
asin
asinh
asinhf
asinhl
atan
atan2
atanh
atanhf
atanhl
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosh
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
erf
erfc
erfcf
erfcl
erff
erfl
exp
exp2
exp2f
exp2l
expm1
expm1f
expm1l
fabs
fdim
fdimf
fdiml
floor
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
frexp
hypot
ilogb
ilogbf
ilogbl
ldexp
lgamma
lgammaf
lgammal
llrint
llrintf
llrintl
llround
llroundf
llroundl
log
log10
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
lrint
lrintf
lrintl
lround
lroundf
lroundl
modf
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
pow
powf
remainder
remainderf
remainderl
remquo
remquof
remquol
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
sin
sinh
sqrt
tan
tanh
tgamma
tgammaf
tgammal
trunc
truncf
truncl
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-multibyte-l1-1-0.dll
- SHA256 a6b83b764555d517216e0e34c4945f7a7501c1b7a25308d8f85551fe353f9c15
- MD5 19d7f2d6424c98c45702489a375d9e17
- SHA1 310bc4ed49492383e7c669ac9145bda2956c7564
- SHA512 01c09edef90c60c9e6cdabff918f15afc9b728d6671947898ce8848e3d102f300f3fb4246af0ac9c6f57b3b85b24832d7b40452358636125b61eb89567d3b17e
- SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXLNW1hWOXRm0GftpBjVm3SKlDCEIy:2ZKrZPmIHJI6abVi/Q1Iy
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d8:52:c0:6f:2f:9c:98:18:86:30:8a:4f:cc:7b:47:bb:64:84:85:b0:d0:fd:f3:bd:51:04:4b:16:74:d1:82:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
c7:51:bf:93:d9:26:4a:9c:a3:a1:6e:e4:b6:51:e0:90:12:1b:56:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-multibyte-l1-1-0.pdb
__p__mbcasemap
__p__mbctype
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-private-l1-1-0.dll
- SHA256 dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
- MD5 3d139f57ed79d2c788e422ca26950446
- SHA1 788e4fb5d1f46b0f1802761d0ae3addb8611c238
- SHA512 12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765
- SSDEEP 1536:g0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPL9VG:XjDe5c4bFE2Jy2cvxXWpD9d3334BkZnI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
17:e8:a5:1f:4e:4f:ea:b3:1a:b1:27:a3:ba:d9:af:1d:b5:79:ea:1e:70:b1:d5:0d:86:a6:69:9b:bd:b7:68:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
24:d4:41:f4:86:c6:03:42:bf:9f:07:10:9c:5d:60:bb:45:58:ff:72
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-private-l1-1-0.pdb
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__intrinsic_abnormal_termination
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_o__CIacos
_o__CIasin
_o__CIatan
_o__CIatan2
_o__CIcos
_o__CIcosh
_o__CIexp
_o__CIfmod
_o__CIlog
_o__CIlog10
_o__CIpow
_o__CIsin
_o__CIsinh
_o__CIsqrt
_o__CItan
_o__CItanh
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__Wcsftime
_o____lc_codepage_func
_o____lc_collate_cp_func
_o____lc_locale_name_func
_o____mb_cur_max_func
_o___acrt_iob_func
_o___conio_common_vcprintf
_o___conio_common_vcprintf_p
_o___conio_common_vcprintf_s
_o___conio_common_vcscanf
_o___conio_common_vcwprintf
_o___conio_common_vcwprintf_p
_o___conio_common_vcwprintf_s
_o___conio_common_vcwscanf
_o___daylight
_o___dstbias
_o___fpe_flt_rounds
_o___libm_sse2_acos
_o___libm_sse2_acosf
_o___libm_sse2_asin
_o___libm_sse2_asinf
_o___libm_sse2_atan
_o___libm_sse2_atan2
_o___libm_sse2_atanf
_o___libm_sse2_cos
_o___libm_sse2_cosf
_o___libm_sse2_exp
_o___libm_sse2_expf
_o___libm_sse2_log
_o___libm_sse2_log10
_o___libm_sse2_log10f
_o___libm_sse2_logf
_o___libm_sse2_pow
_o___libm_sse2_powf
_o___libm_sse2_sin
_o___libm_sse2_sinf
_o___libm_sse2_tan
_o___libm_sse2_tanf
_o___p___argc
_o___p___argv
_o___p___wargv
_o___p__acmdln
_o___p__commode
_o___p__environ
_o___p__fmode
_o___p__mbcasemap
_o___p__mbctype
_o___p__pgmptr
_o___p__wcmdln
_o___p__wenviron
_o___p__wpgmptr
_o___pctype_func
_o___pwctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___std_type_info_name
_o___stdio_common_vfprintf
_o___stdio_common_vfprintf_p
_o___stdio_common_vfprintf_s
_o___stdio_common_vfscanf
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_p
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfwscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsprintf_p
_o___stdio_common_vsprintf_s
_o___stdio_common_vsscanf
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o___timezone
_o___tzname
_o___wcserror
_o__access
_o__access_s
_o__aligned_free
_o__aligned_malloc
_o__aligned_msize
_o__aligned_offset_malloc
_o__aligned_offset_realloc
_o__aligned_offset_recalloc
_o__aligned_realloc
_o__aligned_recalloc
_o__atodbl
_o__atodbl_l
_o__atof_l
_o__atoflt
_o__atoflt_l
_o__atoi64
_o__atoi64_l
_o__atoi_l
_o__atol_l
_o__atoldbl
_o__atoldbl_l
_o__atoll_l
_o__beep
_o__beginthread
_o__beginthreadex
_o__cabs
_o__callnewh
_o__calloc_base
_o__cexit
_o__cgets
_o__cgets_s
_o__cgetws
_o__cgetws_s
_o__chdir
_o__chdrive
_o__chmod
_o__chsize
_o__chsize_s
_o__close
_o__commit
_o__configthreadlocale
_o__configure_narrow_argv
_o__configure_wide_argv
_o__controlfp_s
_o__cputs
_o__cputws
_o__creat
_o__create_locale
_o__crt_atexit
_o__ctime32_s
_o__ctime64_s
_o__cwait
_o__d_int
_o__dclass
_o__difftime32
_o__difftime64
_o__dlog
_o__dnorm
_o__dpcomp
_o__dpoly
_o__dscale
_o__dsign
_o__dsin
_o__dtest
_o__dunscale
_o__dup
_o__dup2
_o__dupenv_s
_o__ecvt
_o__ecvt_s
_o__endthread
_o__endthreadex
_o__eof
_o__errno
_o__except1
_o__execute_onexit_table
_o__execv
_o__execve
_o__execvp
_o__execvpe
_o__exit
_o__expand
_o__fclose_nolock
_o__fcloseall
_o__fcvt
_o__fcvt_s
_o__fd_int
_o__fdclass
_o__fdexp
_o__fdlog
_o__fdopen
_o__fdpcomp
_o__fdpoly
_o__fdscale
_o__fdsign
_o__fdsin
_o__fflush_nolock
_o__fgetc_nolock
_o__fgetchar
_o__fgetwc_nolock
_o__fgetwchar
_o__filelength
_o__filelengthi64
_o__fileno
_o__findclose
_o__findfirst32
_o__findfirst32i64
_o__findfirst64
_o__findfirst64i32
_o__findnext32
_o__findnext32i64
_o__findnext64
_o__findnext64i32
_o__flushall
_o__fpclass
_o__fputc_nolock
_o__fputchar
_o__fputwc_nolock
_o__fputwchar
_o__fread_nolock
_o__fread_nolock_s
_o__free_base
_o__free_locale
_o__fseek_nolock
_o__fseeki64
_o__fseeki64_nolock
_o__fsopen
_o__fstat32
_o__fstat32i64
_o__fstat64
_o__fstat64i32
_o__ftell_nolock
_o__ftelli64
_o__ftelli64_nolock
_o__ftime32
_o__ftime32_s
_o__ftime64
_o__ftime64_s
_o__fullpath
_o__futime32
_o__futime64
_o__fwrite_nolock
_o__gcvt
_o__gcvt_s
_o__get_daylight
_o__get_doserrno
_o__get_dstbias
_o__get_errno
_o__get_fmode
_o__get_heap_handle
_o__get_initial_narrow_environment
_o__get_initial_wide_environment
_o__get_invalid_parameter_handler
_o__get_narrow_winmain_command_line
_o__get_osfhandle
_o__get_pgmptr
_o__get_stream_buffer_pointers
_o__get_terminate
_o__get_thread_local_invalid_parameter_handler
_o__get_timezone
_o__get_tzname
_o__get_wide_winmain_command_line
_o__get_wpgmptr
_o__getc_nolock
_o__getch
_o__getch_nolock
_o__getche
_o__getche_nolock
_o__getcwd
_o__getdcwd
_o__getdiskfree
_o__getdllprocaddr
_o__getdrive
_o__getdrives
_o__getmbcp
_o__getsystime
_o__getw
_o__getwc_nolock
_o__getwch
_o__getwch_nolock
_o__getwche
_o__getwche_nolock
_o__getws
_o__getws_s
_o__gmtime32
_o__gmtime32_s
_o__gmtime64
_o__gmtime64_s
_o__heapchk
_o__heapmin
_o__hypot
_o__hypotf
_o__i64toa
_o__i64toa_s
_o__i64tow
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__isctype
_o__isctype_l
_o__isleadbyte_l
_o__ismbbalnum
_o__ismbbalnum_l
_o__ismbbalpha
_o__ismbbalpha_l
_o__ismbbblank
_o__ismbbblank_l
_o__ismbbgraph
_o__ismbbgraph_l
_o__ismbbkalnum
_o__ismbbkalnum_l
_o__ismbbkana
_o__ismbbkana_l
_o__ismbbkprint
_o__ismbbkprint_l
_o__ismbbkpunct
_o__ismbbkpunct_l
_o__ismbblead
_o__ismbblead_l
_o__ismbbprint
_o__ismbbprint_l
_o__ismbbpunct
_o__ismbbpunct_l
_o__ismbbtrail
_o__ismbbtrail_l
_o__ismbcalnum
_o__ismbcalnum_l
_o__ismbcalpha
_o__ismbcalpha_l
_o__ismbcblank
_o__ismbcblank_l
_o__ismbcdigit
_o__ismbcdigit_l
_o__ismbcgraph
_o__ismbcgraph_l
_o__ismbchira
_o__ismbchira_l
_o__ismbckata
_o__ismbckata_l
_o__ismbcl0
_o__ismbcl0_l
_o__ismbcl1
_o__ismbcl1_l
_o__ismbcl2
_o__ismbcl2_l
_o__ismbclegal
_o__ismbclegal_l
_o__ismbclower
_o__ismbclower_l
_o__ismbcprint
_o__ismbcprint_l
_o__ismbcpunct
_o__ismbcpunct_l
_o__ismbcspace
_o__ismbcspace_l
_o__ismbcsymbol
_o__ismbcsymbol_l
_o__ismbcupper
_o__ismbcupper_l
_o__ismbslead
_o__ismbslead_l
_o__ismbstrail
_o__ismbstrail_l
_o__iswctype_l
_o__itoa
_o__itoa_s
_o__itow
_o__itow_s
_o__j0
_o__j1
_o__jn
_o__kbhit
_o__ld_int
_o__ldclass
_o__ldexp
_o__ldlog
_o__ldpcomp
_o__ldpoly
_o__ldscale
_o__ldsign
_o__ldsin
_o__ldtest
_o__ldunscale
_o__lfind
_o__lfind_s
_o__libm_sse2_acos_precise
_o__libm_sse2_asin_precise
_o__libm_sse2_atan_precise
_o__libm_sse2_cos_precise
_o__libm_sse2_exp_precise
_o__libm_sse2_log10_precise
_o__libm_sse2_log_precise
_o__libm_sse2_pow_precise
_o__libm_sse2_sin_precise
_o__libm_sse2_sqrt_precise
_o__libm_sse2_tan_precise
_o__loaddll
_o__localtime32
_o__localtime32_s
_o__localtime64
_o__localtime64_s
_o__lock_file
_o__locking
_o__logb
_o__lsearch
_o__lsearch_s
_o__lseek
_o__lseeki64
_o__ltoa
_o__ltoa_s
_o__ltow
_o__ltow_s
_o__makepath
_o__makepath_s
_o__malloc_base
_o__mbbtombc
_o__mbbtombc_l
_o__mbbtype
_o__mbbtype_l
_o__mbccpy
_o__mbccpy_l
_o__mbccpy_s
_o__mbccpy_s_l
_o__mbcjistojms
_o__mbcjistojms_l
_o__mbcjmstojis
_o__mbcjmstojis_l
_o__mbclen
_o__mbclen_l
_o__mbctohira
_o__mbctohira_l
_o__mbctokata
_o__mbctokata_l
_o__mbctolower
_o__mbctolower_l
_o__mbctombb
_o__mbctombb_l
_o__mbctoupper
_o__mbctoupper_l
_o__mblen_l
_o__mbsbtype
_o__mbsbtype_l
_o__mbscat_s
_o__mbscat_s_l
_o__mbschr
_o__mbschr_l
_o__mbscmp
_o__mbscmp_l
_o__mbscoll
_o__mbscoll_l
_o__mbscpy_s
_o__mbscpy_s_l
_o__mbscspn
_o__mbscspn_l
_o__mbsdec
_o__mbsdec_l
_o__mbsicmp
_o__mbsicmp_l
_o__mbsicoll
_o__mbsicoll_l
_o__mbsinc
_o__mbsinc_l
_o__mbslen
_o__mbslen_l
_o__mbslwr
_o__mbslwr_l
_o__mbslwr_s
_o__mbslwr_s_l
_o__mbsnbcat
_o__mbsnbcat_l
_o__mbsnbcat_s
_o__mbsnbcat_s_l
_o__mbsnbcmp
_o__mbsnbcmp_l
_o__mbsnbcnt
_o__mbsnbcnt_l
_o__mbsnbcoll
_o__mbsnbcoll_l
_o__mbsnbcpy
_o__mbsnbcpy_l
_o__mbsnbcpy_s
_o__mbsnbcpy_s_l
_o__mbsnbicmp
_o__mbsnbicmp_l
_o__mbsnbicoll
_o__mbsnbicoll_l
_o__mbsnbset
_o__mbsnbset_l
_o__mbsnbset_s
_o__mbsnbset_s_l
_o__mbsncat
_o__mbsncat_l
_o__mbsncat_s
_o__mbsncat_s_l
_o__mbsnccnt
_o__mbsnccnt_l
_o__mbsncmp
_o__mbsncmp_l
_o__mbsncoll
_o__mbsncoll_l
_o__mbsncpy
_o__mbsncpy_l
_o__mbsncpy_s
_o__mbsncpy_s_l
_o__mbsnextc
_o__mbsnextc_l
_o__mbsnicmp
_o__mbsnicmp_l
_o__mbsnicoll
_o__mbsnicoll_l
_o__mbsninc
_o__mbsninc_l
_o__mbsnlen
_o__mbsnlen_l
_o__mbsnset
_o__mbsnset_l
_o__mbsnset_s
_o__mbsnset_s_l
_o__mbspbrk
_o__mbspbrk_l
_o__mbsrchr
_o__mbsrchr_l
_o__mbsrev
_o__mbsrev_l
_o__mbsset
_o__mbsset_l
_o__mbsset_s
_o__mbsset_s_l
_o__mbsspn
_o__mbsspn_l
_o__mbsspnp
_o__mbsspnp_l
_o__mbsstr
_o__mbsstr_l
_o__mbstok
_o__mbstok_l
_o__mbstok_s
_o__mbstok_s_l
_o__mbstowcs_l
_o__mbstowcs_s_l
_o__mbstrlen
_o__mbstrlen_l
_o__mbstrnlen
_o__mbstrnlen_l
_o__mbsupr
_o__mbsupr_l
_o__mbsupr_s
_o__mbsupr_s_l
_o__mbtowc_l
_o__memicmp
_o__memicmp_l
_o__mkdir
_o__mkgmtime32
_o__mkgmtime64
_o__mktemp
_o__mktemp_s
_o__mktime32
_o__mktime64
_o__msize
_o__nextafter
_o__open_osfhandle
_o__pclose
_o__pipe
_o__popen
_o__purecall
_o__putc_nolock
_o__putch
_o__putch_nolock
_o__putenv
_o__putenv_s
_o__putw
_o__putwc_nolock
_o__putwch
_o__putwch_nolock
_o__putws
_o__read
_o__realloc_base
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__rmdir
_o__rmtmp
_o__scalb
_o__searchenv
_o__searchenv_s
_o__seh_filter_dll
_o__seh_filter_exe
_o__set_abort_behavior
_o__set_app_type
_o__set_doserrno
_o__set_errno
_o__set_fmode
_o__set_invalid_parameter_handler
_o__set_new_handler
_o__set_new_mode
_o__set_thread_local_invalid_parameter_handler
_o__seterrormode
_o__setmbcp
_o__setmode
_o__setsystime
_o__sleep
_o__sopen
_o__sopen_dispatch
_o__sopen_s
_o__spawnv
_o__spawnve
_o__spawnvp
_o__spawnvpe
_o__splitpath
_o__splitpath_s
_o__stat32
_o__stat32i64
_o__stat64
_o__stat64i32
_o__strcoll_l
_o__strdate
_o__strdate_s
_o__strdup
_o__strerror
_o__strerror_s
_o__strftime_l
_o__stricmp
_o__stricmp_l
_o__stricoll
_o__stricoll_l
_o__strlwr
_o__strlwr_l
_o__strlwr_s
_o__strlwr_s_l
_o__strncoll
_o__strncoll_l
_o__strnicmp
_o__strnicmp_l
_o__strnicoll
_o__strnicoll_l
_o__strnset_s
_o__strset_s
_o__strtime
_o__strtime_s
_o__strtod_l
_o__strtof_l
_o__strtoi64
_o__strtoi64_l
_o__strtol_l
_o__strtold_l
_o__strtoll_l
_o__strtoui64
_o__strtoui64_l
_o__strtoul_l
_o__strtoull_l
_o__strupr
_o__strupr_l
_o__strupr_s
_o__strupr_s_l
_o__strxfrm_l
_o__swab
_o__tell
_o__telli64
_o__timespec32_get
_o__timespec64_get
_o__tolower
_o__tolower_l
_o__toupper
_o__toupper_l
_o__towlower_l
_o__towupper_l
_o__tzset
_o__ui64toa
_o__ui64toa_s
_o__ui64tow
_o__ui64tow_s
_o__ultoa
_o__ultoa_s
_o__ultow
_o__ultow_s
_o__umask
_o__umask_s
_o__ungetc_nolock
_o__ungetch
_o__ungetch_nolock
_o__ungetwc_nolock
_o__ungetwch
_o__ungetwch_nolock
_o__unlink
_o__unloaddll
_o__unlock_file
_o__utime32
_o__utime64
_o__waccess
_o__waccess_s
_o__wasctime
_o__wasctime_s
_o__wchdir
_o__wchmod
_o__wcreat
_o__wcreate_locale
_o__wcscoll_l
_o__wcsdup
_o__wcserror
_o__wcserror_s
_o__wcsftime_l
_o__wcsicmp
_o__wcsicmp_l
_o__wcsicoll
_o__wcsicoll_l
_o__wcslwr
_o__wcslwr_l
_o__wcslwr_s
_o__wcslwr_s_l
_o__wcsncoll
_o__wcsncoll_l
_o__wcsnicmp
_o__wcsnicmp_l
_o__wcsnicoll
_o__wcsnicoll_l
_o__wcsnset
_o__wcsnset_s
_o__wcsset
_o__wcsset_s
_o__wcstod_l
_o__wcstof_l
_o__wcstoi64
_o__wcstoi64_l
_o__wcstol_l
_o__wcstold_l
_o__wcstoll_l
_o__wcstombs_l
_o__wcstombs_s_l
_o__wcstoui64
_o__wcstoui64_l
_o__wcstoul_l
_o__wcstoull_l
_o__wcsupr
_o__wcsupr_l
_o__wcsupr_s
_o__wcsupr_s_l
_o__wcsxfrm_l
_o__wctime32
_o__wctime32_s
_o__wctime64
_o__wctime64_s
_o__wctomb_l
_o__wctomb_s_l
_o__wdupenv_s
_o__wexecv
_o__wexecve
_o__wexecvp
_o__wexecvpe
_o__wfdopen
_o__wfindfirst32
_o__wfindfirst32i64
_o__wfindfirst64
_o__wfindfirst64i32
_o__wfindnext32
_o__wfindnext32i64
_o__wfindnext64
_o__wfindnext64i32
_o__wfopen
_o__wfopen_s
_o__wfreopen
_o__wfreopen_s
_o__wfsopen
_o__wfullpath
_o__wgetcwd
_o__wgetdcwd
_o__wgetenv
_o__wgetenv_s
_o__wmakepath
_o__wmakepath_s
_o__wmkdir
_o__wmktemp
_o__wmktemp_s
_o__wperror
_o__wpopen
_o__wputenv
_o__wputenv_s
_o__wremove
_o__wrename
_o__write
_o__wrmdir
_o__wsearchenv
_o__wsearchenv_s
_o__wsetlocale
_o__wsopen_dispatch
_o__wsopen_s
_o__wspawnv
_o__wspawnve
_o__wspawnvp
_o__wspawnvpe
_o__wsplitpath
_o__wsplitpath_s
_o__wstat32
_o__wstat32i64
_o__wstat64
_o__wstat64i32
_o__wstrdate
_o__wstrdate_s
_o__wstrtime
_o__wstrtime_s
_o__wsystem
_o__wtmpnam_s
_o__wtof
_o__wtof_l
_o__wtoi
_o__wtoi64
_o__wtoi64_l
_o__wtoi_l
_o__wtol
_o__wtol_l
_o__wtoll
_o__wtoll_l
_o__wunlink
_o__wutime32
_o__wutime64
_o__y0
_o__y1
_o__yn
_o_abort
_o_acos
_o_acosh
_o_acoshf
_o_acoshl
_o_asctime
_o_asctime_s
_o_asin
_o_asinh
_o_asinhf
_o_asinhl
_o_atan
_o_atan2
_o_atanh
_o_atanhf
_o_atanhl
_o_atof
_o_atoi
_o_atol
_o_atoll
_o_bsearch
_o_bsearch_s
_o_btowc
_o_calloc
_o_cbrt
_o_cbrtf
_o_ceil
_o_clearerr
_o_clearerr_s
_o_cos
_o_cosh
_o_erf
_o_erfc
_o_erfcf
_o_erfcl
_o_erff
_o_erfl
_o_exit
_o_exp
_o_exp2
_o_exp2f
_o_exp2l
_o_fabs
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgets
_o_fgetwc
_o_fgetws
_o_floor
_o_fma
_o_fmaf
_o_fmal
_o_fmod
_o_fopen
_o_fopen_s
_o_fputc
_o_fputs
_o_fputwc
_o_fputws
_o_fread
_o_fread_s
_o_free
_o_freopen
_o_freopen_s
_o_frexp
_o_fseek
_o_fsetpos
_o_ftell
_o_fwrite
_o_getc
_o_getchar
_o_getenv
_o_getenv_s
_o_gets
_o_gets_s
_o_getwc
_o_getwchar
_o_hypot
_o_is_wctype
_o_isalnum
_o_isalpha
_o_isblank
_o_iscntrl
_o_isdigit
_o_isgraph
_o_isleadbyte
_o_islower
_o_isprint
_o_ispunct
_o_isspace
_o_isupper
_o_iswalnum
_o_iswalpha
_o_iswascii
_o_iswblank
_o_iswcntrl
_o_iswctype
_o_iswdigit
_o_iswgraph
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_iswxdigit
_o_isxdigit
_o_ldexp
_o_lgamma
_o_lgammaf
_o_lgammal
_o_llrint
_o_llrintf
_o_llrintl
_o_llround
_o_llroundf
_o_llroundl
_o_localeconv
_o_log
_o_log10
_o_log1p
_o_log1pf
_o_log1pl
_o_log2
_o_log2f
_o_log2l
_o_logb
_o_logbf
_o_logbl
_o_lrint
_o_lrintf
_o_lrintl
_o_lround
_o_lroundf
_o_lroundl
_o_malloc
_o_mblen
_o_mbrlen
_o_mbrtoc16
_o_mbrtoc32
_o_mbrtowc
_o_mbsrtowcs
_o_mbsrtowcs_s
_o_mbstowcs
_o_mbstowcs_s
_o_mbtowc
_o_memcpy_s
_o_modf
_o_nan
_o_nanf
_o_nanl
_o_nearbyint
_o_nearbyintf
_o_nearbyintl
_o_nextafter
_o_nextafterf
_o_nextafterl
_o_nexttoward
_o_nexttowardf
_o_nexttowardl
_o_pow
_o_powf
_o_putc
_o_putchar
_o_puts
_o_putwc
_o_putwchar
_o_qsort
_o_qsort_s
_o_raise
_o_rand
_o_rand_s
_o_realloc
_o_remainder
_o_remainderf
_o_remainderl
_o_remove
_o_remquo
_o_remquof
_o_remquol
_o_rename
_o_rewind
_o_rint
_o_rintf
_o_rintl
_o_round
_o_roundf
_o_roundl
_o_scalbln
_o_scalblnf
_o_scalblnl
_o_scalbn
_o_scalbnf
_o_scalbnl
_o_set_terminate
_o_setbuf
_o_setlocale
_o_setvbuf
_o_sin
_o_sinh
_o_sqrt
_o_srand
_o_strcat_s
_o_strcoll
_o_strcpy_s
_o_strerror
_o_strerror_s
_o_strftime
_o_strncat_s
_o_strncpy_s
_o_strtod
_o_strtof
_o_strtok
_o_strtok_s
_o_strtol
_o_strtold
_o_strtoll
_o_strtoul
_o_strtoull
_o_system
_o_tan
_o_tanh
_o_terminate
_o_tgamma
_o_tgammaf
_o_tgammal
_o_tmpfile_s
_o_tmpnam_s
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcrtomb
_o_wcrtomb_s
_o_wcscat_s
_o_wcscoll
_o_wcscpy
_o_wcscpy_s
_o_wcsftime
_o_wcsncat_s
_o_wcsncpy_s
_o_wcsrtombs
_o_wcsrtombs_s
_o_wcstod
_o_wcstof
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstold
_o_wcstoll
_o_wcstombs
_o_wcstombs_s
_o_wcstoul
_o_wcstoull
_o_wctob
_o_wctomb
_o_wctomb_s
_o_wmemcpy_s
_o_wmemmove_s
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-process-l1-1-0.dll
- SHA256 707c9a384440d0b2d067fc0335273f8851b02c3114842e17df9c54127910d7fb
- MD5 9d3d6f938c8672a12aea03f85d5330de
- SHA1 6a7d6e84527eaf54d6f78dd1a5f20503e766a66c
- SHA512 0e1681b16cd9af116bcc5c6b4284c1203b33febb197d1d4ab8a649962c0e807af9258bde91c86727910624196948e976741411843dd841616337ea93a27de7cb
- SSDEEP 192:hRQqjd7hW1hWif+49Cjdks/nGfe4pBjSYr+c24QLW5RKTt3E2sVWQ4GWw899qnaP:hKwW1hWZ4wm0GftpBjh24Jm3SwlUKTw2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:69:7b:ab:9a:ae:0c:c5:99:03:98:6e:77:1c:b4:69:99:f6:4e:22:88:ec:f0:57:6c:07:86:4a:90:1a:41:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
3c:c9:27:de:6e:c2:16:2c:63:ea:3d:66:f4:ba:30:5f:e8:f5:3b:24
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-process-l1-1-0.pdb
_beep
_cwait
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_loaddll
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_unloaddll
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-runtime-l1-1-0.dll
- SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
- MD5 fb0ca6cbfff46be87ad729a1c4fde138
- SHA1 2c302d1c535d5c40f31c3a75393118b40e1b2af9
- SHA512 99144c67c33e89b8283c5b39b8bf68d55638daa6acc2715a2ac8c5dba4170dd12299d3a2dffb39ae38ef0872c2c68a64d7cdc6ceba5e660a53942761cb9eca83
- SSDEEP 384:Lb7hrKkW1hW54wm0GftpBjGOm3SdWlmTwhctW:LbNrKn8FVinhZW
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0d:da:f7:91:ec:8c:d6:bc:9c:d3:ca:0b:d3:34:13:64:97:35:9e:df:bf:b6:c0:ad:59:ce:3e:f1:fe:f3:42:e8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
38:d0:bb:ce:4f:3b:91:fe:01:52:6f:59:bb:69:68:62:c4:4a:78:c4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-runtime-l1-1-0.pdb
_Exit
__control87_2
__doserrno
__fpe_flt_rounds
__fpecode
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__pgmptr
__p__wcmdln
__p__wpgmptr
__pxcptinfoptrs
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__wcserror
__wcserror_s
_assert
_beginthread
_beginthreadex
_c_exit
_cexit
_clearfp
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_endthread
_endthreadex
_errno
_execute_onexit_table
_exit
_fpieee_flt
_fpreset
_get_doserrno
_get_errno
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_pgmptr
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_wide_winmain_command_line
_get_wpgmptr
_getdllprocaddr
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_query_app_type
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_seh_filter_dll
_seh_filter_exe
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_invalid_parameter_handler
_set_new_handler
_set_thread_local_invalid_parameter_handler
_seterrormode
_sleep
_statusfp
_statusfp2
_strerror
_strerror_s
_wassert
_wcserror
_wcserror_s
_wperror
_wsystem
abort
exit
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
fesetenv
fesetexceptflag
fesetround
fetestexcept
perror
quick_exit
raise
set_terminate
signal
strerror
strerror_s
system
terminate
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-stdio-l1-1-0.dll
- SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
- MD5 d5166ab3034f0e1aa679bfa1907e5844
- SHA1 851dd640cb34177c43b5f47b218a686c09fa6b4c
- SHA512 8f2d7442191de22457c1b8402faad594af2fe0c38280aaafc876c797ca79f7f4b6860e557e37c3dbe084fe7262a85c358e3eeaf91e16855a91b7535cb0ac832e
- SSDEEP 384:/ZpFVhHW1hWxgYBm0GftpBjMm3SNlndaYhpn3p:boEVi6DBp
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
06:6a:c5:48:de:6e:e8:ec:f5:6d:b2:e4:7d:c8:0f:e8:50:a7:f5:6b:6e:95:33:49:2d:a2:ba:7c:d7:ae:f3:0f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
cd:d6:f2:d2:ca:df:e3:a6:28:86:42:e0:c0:2c:cc:ac:55:18:39:38
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:2137-37A0-4AAA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:6e:76:d0:4d:3d:fe:a9:65:00:00:00:00:00:c4
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-stdio-l1-1-0.pdb
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_chsize
_chsize_s
_close
_commit
_creat
_dup
_dup2
_eof
_fclose_nolock
_fcloseall
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_flushall
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_ftell_nolock
_ftelli64
_ftelli64_nolock
_fwrite_nolock
_get_fmode
_get_osfhandle
_get_printf_count_output
_get_stream_buffer_pointers
_getc_nolock
_getcwd
_getdcwd
_getmaxstdio
_getw
_getwc_nolock
_getws
_getws_s
_isatty
_kbhit
_locking
_lseek
_lseeki64
_mktemp
_mktemp_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_putc_nolock
_putw
_putwc_nolock
_putws
_read
_rmtmp
_set_fmode
_set_printf_count_output
_setmaxstdio
_setmode
_sopen
_sopen_dispatch
_sopen_s
_tell
_telli64
_tempnam
_ungetc_nolock
_ungetwc_nolock
_wcreat
_wfdopen
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wmktemp
_wmktemp_s
_wopen
_wpopen
_write
_wsopen
_wsopen_dispatch
_wsopen_s
_wtempnam
_wtmpnam
_wtmpnam_s
clearerr
clearerr_s
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
freopen
freopen_s
fseek
fsetpos
ftell
fwrite
getc
getchar
gets
gets_s
getwc
getwchar
putc
putchar
puts
putwc
putwchar
rewind
setbuf
setvbuf
tmpfile
tmpfile_s
tmpnam
tmpnam_s
ungetc
ungetwc
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-string-l1-1-0.dll
- SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
- MD5 ad99c2362f64cde7756b16f9a016a60f
- SHA1 07c9a78ee658bfa81db61dab039cffc9145cc6cb
- SHA512 9c72f239adda1de11b4ad7028f3c897c93859ef277658aeaa141f09b7ddfe788d657b9cb1e2648971ecd5d27b99166283110ccba437d461003dbb9f6885451f7
- SSDEEP 384:jiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWS4wm0GftpBjwwO5m3S9lJrm:j6S5yguNvZ5VQgx3SbwA71IkFhbFViWs
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4a:f7:b2:a8:7c:0d:32:af:2c:96:ea:a5:fe:83:44:27:53:a1:05:26:3b:78:e6:6e:92:ce:a4:2c:39:01:4b:09
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
15:fc:7d:e6:b7:e4:21:f5:f7:05:fb:44:ff:49:64:30:bf:80:c9:40
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-string-l1-1-0.pdb
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__strncnt
__wcsncnt
_isalnum_l
_isalpha_l
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_memccpy
_memicmp
_memicmp_l
_strcoll_l
_strdup
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_wcscoll_l
_wcsdup
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctype
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
mblen
mbrlen
memcpy_s
memmove_s
memset
strcat
strcat_s
strcmp
strcoll
strcpy
strcpy_s
strcspn
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strspn
strtok
strtok_s
strxfrm
tolower
toupper
towctrans
towlower
towupper
wcscat
wcscat_s
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsspn
wcstok
wcstok_s
wcsxfrm
wctype
wmemcpy_s
wmemmove_s
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-time-l1-1-0.dll
- SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
- MD5 9b79fda359a269c63dcac69b2c81caa4
- SHA1 a38c81b7a2ec158dfcfeb72cb7c04b3eb3ccc0fb
- SHA512 e69d275c5ec5eae5c95b0596f0cc681b7d287b3e2f9c78a9b5e658949e6244f754f96ad7d40214d22ed28d64e4e8bd507363cdf99999fea93cfe319078c1f541
- SSDEEP 384:iUW1hWQ4wm0GftpBjddQxm3SLDlD16h1S:eRFViexn1
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b3:78:0a:48:f4:90:dc:4c:3c:d4:1c:48:df:dc:fe:5d:ff:e8:28:d6:07:53:5e:c7:ef:a4:6d:6f:ed:cb:95:44
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
a2:ab:93:be:71:e1:28:d5:c7:c0:87:3a:24:66:31:da:b0:d7:78:b3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:0DE8-2DC5-3CA9,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:bb:b6:77:24:71:4a:20:00:20:00:00:00:00:00:bb
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-time-l1-1-0.pdb
_Getdays
_Getmonths
_Gettnames
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__daylight
__dstbias
__timezone
__tzname
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_difftime32
_difftime64
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_futime32
_futime64
_get_daylight
_get_dstbias
_get_timezone
_get_tzname
_getsystime
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_mkgmtime32
_mkgmtime64
_mktime32
_mktime64
_setsystime
_strdate
_strdate_s
_strftime_l
_strtime
_strtime_s
_time32
_time64
_timespec32_get
_timespec64_get
_tzset
_utime32
_utime64
_wasctime
_wasctime_s
_wcsftime_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wutime32
_wutime64
asctime
asctime_s
clock
strftime
wcsftime
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
api-ms-win-crt-utility-l1-1-0.dll
- SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
- MD5 70e9104e743069b573ca12a3cd87ec33
- SHA1 4290755b6a49212b2e969200e7a088d1713b84a2
- SHA512 e979f28451d271f405b780fc2025707c8a29dcb4c28980ca42e33d4033666de0e4a4644defec6c1d5d4bdd3c73d405fafcffe3320c60134681f62805c965bfd9
- SSDEEP 192:UfHQdurW1hWiSuDz7eCjdks/nGfe4pBjSYp2VZGW5RKTt3E2sVWQ4GWO3uDVqna9:UfVW1hWKDzDm0GftpBjYLm3Sy5lD16hC
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:29:f2:b0:ff:a2:cf:91:b1:6c:4e:69:19:d2:b2:7d:bb:36:1d:90:42:5c:d9:2e:5f:9b:17:27:0c:99:8b:ca
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
f9:85:fe:cd:4a:c1:4c:f2:60:3c:23:21:01:f5:0d:02:73:c7:f3:f1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
api-ms-win-crt-utility-l1-1-0.pdb
_abs64
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_lfind
_lfind_s
_lrotl
_lrotr
_lsearch
_lsearch_s
_rotl
_rotl64
_rotr
_rotr64
_swab
abs
bsearch
bsearch_s
div
imaxabs
imaxdiv
labs
ldiv
llabs
lldiv
qsort
qsort_s
rand
rand_s
srand
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=256, version=25711,
count=2, id=260, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
avira.managed.remediation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aa29dbc7d98ed50bcc56b057f877b9e0dc1c38af62a87993576295da65a68967
- MD5 cbfe8189d00825dc1ffbb123cd0d235a
- SHA1 f1fcf30f996ad41fbf1564065437e2e45456e179
- SHA512 5efd02f7770d611d12372096727b2d7839d1e101482fb1e7dd6dbc088b1aa3773d09613c8331e2d2c8e824c803130ba03f801065edb1950f93dc04af6b6a086c
- SSDEEP 384:qNxFtMyMG0NPmP8NPHZKO2Lx4ZXK7I9ZgoW5X:0xPMyMvdNPHZgl7QRUX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
avira.managed.sdk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f875895c08f07bcb4816e5b5b52d1004ef0f26ffc81dc6a0f6dc43c5a77aaf7
- MD5 6ecd66884c2033bea3db38a866538776
- SHA1 23d1d5795e4f06c249527677f51a25084ad1da68
- SHA512 ef95e273d70f08ebb6727ad027d0c890ac6f8f07aaf550b6efe04a11219e8c9bfbbf2fbf292545638d86051d7bd0545e4d5dcaa8b33c1e162aea0c13eb1ca160
- SSDEEP 768:aTVGLzrueC2m9h0QnmgemjP4DkysZj3Mtd3zyY5CiIH:aTsLzxC2mrySy47MtFyP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
avira.managed.update.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 56f9b75353fdfc424eb57e438e49c247dfc111f1494319e2336086588ce47330
- MD5 4e509553baec78324665c02e52632f0f
- SHA1 460baa72abce39d6bf6341f410af02d0aef2c9fc
- SHA512 5b8f5b94d158770eb39091d9d1a688b117431c092e7e22bdce5f8f5d54290d8b600a4c720fce673c8789bb68cf9a9bf2a430d8e75b3efe6d20022d511143f917
- SSDEEP 384:0oG1uXYsh/QUZP9dM7EeulBEFhUjvCvnmikzCveXn8AObfSiHdXD:vGz8zZF0ulBEFhUj6/V12XWOIdT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bins/subinacl.exe
- IMPHASH 2eaf7681cf60327cff49f2244e0aa8b4
- SHA256 371cd9c35282843d572a3186975cc749e425fd4eeae1bb93a9b0cf20c22a9dc8
- MD5 7bd591f56af173edc8ca01bd62df6eac
- SHA1 43e88cd5cee3b9c66de428c84501d8660ea0586b
- SHA512 b88d0c26a6f17d7b2d5483fc9a54002ea9fe26eabf10e5385ce4a13d81db5d7e8421d09bb5eaff453a6f5a210d547cf625fef74d209b2b5f0031621e9796366a
- SSDEEP 3072:W856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOi:Z56+Aq4WBTWpSqXhpeEioU2UJ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a3:06:29:c2:59:10:a9:3d:2f:3a:60:9f:38:a3:30:d5:8c:9e:a8:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Chains
Oct 19, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Serial Number
0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 13, 2014 - Jul 19, 2017
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
2
Major OS version
5
Entry point
254419
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb
kernel32
WriteConsoleOutputW
FormatMessageW
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentThread
GetConsoleScreenBufferInfo
GetStdHandle
SetLastError
MultiByteToWideChar
WriteFile
WriteConsoleW
SetConsoleTextAttribute
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetFileInformationByHandle
CreateFileW
DeviceIoControl
GetCompressedFileSizeW
GetFileSizeEx
GetComputerNameW
WideCharToMultiByte
OpenProcess
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
ExitProcess
ExpandEnvironmentStringsW
GetCommandLineW
SetConsoleCtrlHandler
ReadFile
GetLargestConsoleWindowSize
GetModuleFileNameW
FreeLibrary
FileTimeToSystemTime
FileTimeToLocalFileTime
QueryDosDeviceW
ReadConsoleW
GetSystemTime
GetTickCount
SetConsoleActiveScreenBuffer
LocalFree
SystemTimeToFileTime
SetConsoleScreenBufferSize
CreateConsoleScreenBuffer
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
mfc42u
ord861
ord800
ord540
ord535
ord3658
ord823
ord538
ord2836
ord825
ord2910
ord858
ord5446
ord6390
ord2099
ord5436
ord6379
ord4199
ord5679
ord4273
ord6279
ord6278
ord5706
ord1863
ord5826
ord3722
ord542
ord802
ord5597
ord6563
ord3898
ord2036
ord5830
ord2440
ord537
ord2756
ord2755
ord2810
ord940
ord925
ord922
ord941
ord942
ord924
ord536
ord4197
ord927
ord4124
ord4272
msvcrt
malloc
wprintf
_getch
wcsstr
_wcsicmp
wcsncat
sprintf
wcschr
_wtoi
__RTDynamicCast
iswprint
printf
_c_exit
_exit
wcsncmp
swscanf
wcsrchr
towupper
_purecall
wcsncpy
wcscmp
fclose
_wfopen
_setmode
fread
fwrite
fseek
swprintf
free
__CxxFrameHandler
_CxxThrowException
_XcptFilter
_cexit
exit
__winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
wcscpy
wcslen
wcscat
_controlfp
msvcirt
??6ostream@@QAEAAV0@PBX@Z
?cout@@3Vostream_withassign@@A
msvcp60
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@XZ
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z
??_D?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
??1?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
advapi32
SetSecurityDescriptorGroup
RegGetKeySecurity
GetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetAclInformation
GetAce
InitializeAcl
AddAce
RegConnectRegistryW
SetNamedSecurityInfoW
SetSecurityInfo
EnumServicesStatusW
OpenServiceW
RegSetKeySecurity
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
MakeSelfRelativeSD
GetSecurityDescriptorLength
SetKernelObjectSecurity
QueryUsersOnEncryptedFile
QueryRecoveryAgentsOnEncryptedFile
FreeEncryptionCertificateHashList
ConvertSecurityDescriptorToStringSecurityDescriptorW
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
PrivilegeCheck
LookupAccountSidW
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorOwner
GetSecurityInfo
AddAccessAllowedAce
InitializeSid
GetKernelObjectSecurity
GetSecurityDescriptorControl
CopySid
GetLengthSid
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
AccessCheck
MapGenericMask
DeleteAce
FreeSid
EqualPrefixSid
AllocateAndInitializeSid
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
IsValidSid
LookupAccountNameW
ConvertSidToStringSidW
RegEnumKeyExW
RegQueryInfoKeyW
OpenSCManagerW
LogonUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
LsaFreeMemory
LsaClose
LsaQueryInformationPolicy
LsaOpenPolicy
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
netapi32
NetShareSetInfo
NetApiBufferFree
NetWkstaGetInfo
NetGetAnyDCName
NetServerGetInfo
NetUserModalsGet
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
winspool.drv
ClosePrinter
EnumPrintersW
GetPrinterW
OpenPrinterW
SetPrinterW
clusapi
CloseCluster
CloseClusterResource
ClusterCloseEnum
ClusterResourceControl
OpenClusterResource
ClusterEnum
ClusterOpenEnum
OpenCluster
ole32
CoInitialize
CoCreateInstanceEx
user32
wsprintfW
samlib
SamSetSecurityObject
SamLookupNamesInDomain
SamOpenUser
SamOpenAlias
SamOpenGroup
SamOpenDomain
SamCloseHandle
SamEnumerateGroupsInDomain
SamEnumerateUsersInDomain
SamEnumerateAliasesInDomain
SamFreeMemory
SamConnect
SamQuerySecurityObject
ntdll
RtlInitUnicodeString
RtlNtStatusToDosError
shell32
CommandLineToArgvW
Name
.text
Size
274KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2179,
count=4, id=15, version=3310,
count=2, id=4, version=8450,
count=1, id=77, version=2144,
count=29, id=93, version=3310,
count=297, id=1, productName=Unmarked objects,
count=15, id=95, version=3310,
count=20, id=96, version=3310,
count=1, id=94, version=3310,
count=1, id=90, version=3310,
cachey-bashi.netcore.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9be51e9fbffff4fcc7b6e50d214809f27dde875ad3c3b94961ce46c67cf253f1
- MD5 4882fa6dc7bdb4591967d65dd08e0437
- SHA1 4c9ea0e2b4c03bfc62d35adc3003d41c5c33839a
- SHA512 eddeadd43369d5b03ebd4b6b98063f28e09f0895d4b42d4ab9e81e3adf3f098402449a6b95469bce9ffc228f74216bac066f90805510eb40fca44abdb6c6569a
- SSDEEP 384:WshHZppWYoM/aCQFrS9D+gFOIdGqGedGPryhtp/C+XYHGqtsSMJE39PNj2oqIeYW:Ws9ZNoMiC4rQPdG1kkc/C+omqtO7IeYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
clrcompression.dll
- IMPHASH 1dc31de28c38c94cf081a786f0ef0ce1
- SHA256 bac1f0fd328051c956b95714b5498acd1be6707130be500a9188829a740a186f
- MD5 6cd5a2b4d0a555bbb94858e64659111c
- SHA1 b5ddcbd91bbe232cf7e7ba5dcf0b75e80dea41ef
- SHA512 4a47fab547e185f022d90eaf6d587ad1bf78f248e5cd467081c957cfe2ae3ab1e451b2fa94cc076cb66e2753dba577f2489a1fca14f2075afa9dca371b623f61
- SSDEEP 12288:vOCcyRJ25Yk2Bik2v3fF47gZ1DottjcEhTZ56AHhly88UXTw05nmZfRt8:vOzyRJ25Yk2Bik2v3fFCgTUnc6TP6AAa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
bd:de:30:4b:8b:fe:43:ec:25:2f:08:d4:52:31:d9:b5:0b:6b:e4:73:09:47:2c:f4:c6:7f:62:f2:30:95:2c:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
248992
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\native\netcoreapp-Windows_NT-Release-x86\clrcompression\Release\clrcompression.pdb
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-math-l1-1-0
log2
_except1
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_execute_onexit_table
_cexit
_configure_narrow_argv
exit
_initialize_narrow_environment
_seh_filter_dll
terminate
_initterm_e
_initterm
api-ms-win-crt-string-l1-1-0
wcsncmp
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_
Name
.text
Size
248KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
457KB
Virtual Size
457KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=26213,
count=55, id=1, productName=Unmarked objects,
count=29, id=261, version=26706,
count=13, id=260, version=26706,
count=13, id=259, version=26706,
count=45, id=264, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
clretwrc.dll
- SHA256 03a286bfc61bb4e6cef1cad40043bb9f161e5810b5ac56f81e6d0a7533f3d3e6
- MD5 3a0d7de8c93cb55a2b694066d52908db
- SHA1 9b54438352427d94fad53a0a8310a415d8b8d70b
- SHA512 7f6b68347a445b114b2a358629c58c35e83c661733376e779d1453d481ebb0ffac6d697e7d2083b38182d67d48a1662cd2bd31480ab0dda350bd1cba5709f5eb
- SSDEEP 1536:5NopyV7oPFArm7larFdZqRXqFn4Kn3EOF2wyOtfUDdFbz:Xonmrm78dZqRXqGKScfUDT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7a:86:b3:06:0a:72:3f:b5:c7:4e:e6:2c:b9:87:08:f2:d4:c0:65:04:d0:b8:ff:38:ad:fa:fe:6b:59:12:99:1f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\clretwrc\Release\clretwrc.pdb
Name
.rdata
Size
512B
Virtual Size
300B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27048,
count=1, id=258, version=27048,
clrjit.dll
- IMPHASH a0aa19c8566cbd21b4879ca7daf0d648
- SHA256 520ef22ad5cdc40025f8964d0cefb39b0c88cec4e0f7d49863f004887adecc95
- MD5 a873ebf8b135192456bb47edffa641c9
- SHA1 533375c44d5f0ed5a194975817972ca5e2e646ab
- SHA512 c8a46a050530287451101ebe89b2ee4149d3d3402127c78be5b201d8a66c1b2c3adbdf33f7fc866008e8d4920a24635719baa1c172c84089afeb8019c76c8f17
- SSDEEP 24576:9FyE2xhxLypEes7c8cEoxqjzmwAgoJvFLpFWwp77svVJWS0o8Iy4r:9FyX7esxcEyqj6Vd74vVJ7y4r
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c7:8c:5f:3a:99:97:29:24:39:17:65:43:ba:41:6e:43:e3:e3:b1:be:29:6d:20:46:ad:9b:03:ff:54:89:51:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
683504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\jit\standalone\Release\clrjit.pdb
kernel32
TlsFree
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetACP
MultiByteToWideChar
FormatMessageW
LocalFree
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
GetCurrentProcess
TlsGetValue
GetFullPathNameW
LoadLibraryExW
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetLastError
GetCurrentThread
QueryThreadCycleTime
HeapFree
HeapAlloc
GetProcessHeap
QueryPerformanceCounter
QueryPerformanceFrequency
WideCharToMultiByte
OutputDebugStringA
DebugBreak
RaiseException
DisableThreadLibraryCalls
oleaut32
SetErrorInfo
user32
LoadStringW
api-ms-win-crt-math-l1-1-0
_libm_sse2_cos_precise
_fdopen
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
ceil
floor
_except1
_isnan
_CIfmod
_finite
_copysign
api-ms-win-crt-stdio-l1-1-0
_setmode
_fileno
_dup
__acrt_iob_func
setvbuf
_wfopen
fseek
fclose
__stdio_common_vsnwprintf_s
ftell
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_errno
_cexit
terminate
_initterm_e
abort
_execute_onexit_table
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscpy_s
strcpy_s
strcat_s
strncmp
wcsncmp
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
getJit
jitStartup
Name
.text
Size
949KB
Virtual Size
948KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=26213,
count=9, id=257, version=26213,
count=196, id=1, productName=Unmarked objects,
count=28, id=261, version=26706,
count=16, id=260, version=26706,
count=23, id=259, version=26706,
count=98, id=270, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
coreclr.dll
- IMPHASH 67af7c652fb00d16aa20d360e9e2cfa8
- SHA256 d8877ba978e5ffb733026d15fc6e7b60862c8c43ad04ca3e5b663b6dcc7dd6bc
- MD5 fdb0d51a8c7ad31a75001ec87efc2039
- SHA1 264a5dd57656841987f6f73d2b15290340049ad5
- SHA512 590d8d45c59cd42ba0d0be068baf5d339228f6ff38f7282909679f3a2ea3f25f5110c072276888c986f020bbddeef48b69917900e7c94bcaa22bc3d0d6c978c1
- SSDEEP 98304:HpgECqGbaRzV9hf/qHzhSDru9FuBkCRpYwovo8NjlZefX2:HpgEpGmBUHzmuLykCslo8N5Z02
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
26:4d:32:55:1d:c9:2e:da:a7:fb:25:2a:c0:ca:b1:a1:f6:40:74:67:33:72:8e:20:2c:85:1d:5d:db:05:28:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
1019312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb
kernel32
WideCharToMultiByte
FormatMessageW
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
FreeLibrary
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
RaiseFailFastException
CloseHandle
GetSystemInfo
VirtualAllocExNuma
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
SetThreadGroupAffinity
GetSystemTimes
GetProcessAffinityMask
GetCurrentProcess
SwitchToThread
FlushInstructionCache
GetCurrentThread
VerSetConditionMask
VerifyVersionInfoW
TerminateProcess
IsWow64Process
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
CreateProcessW
GetCPInfo
WaitForSingleObject
CreateFileMappingW
GetFileSize
GlobalMemoryStatusEx
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateSemaphoreExW
OpenProcess
GetModuleHandleW
GetTickCount
SetConsoleCtrlHandler
CreateThread
GetTickCount64
GetLocaleInfoEx
GetUserDefaultLocaleName
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SleepEx
GetThreadContext
SuspendThread
ResumeThread
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
Sleep
CopyContext
SetXStateFeaturesMask
FlushProcessWriteBuffers
LCMapStringEx
QueryPerformanceCounter
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
TlsSetValue
TlsAlloc
SignalObjectAndWait
SetThreadStackGuarantee
ResetEvent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExW
SetFilePointer
ReadFile
GetCommandLineW
GetProcessTimes
WriteFile
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
GetStdHandle
GetConsoleOutputCP
GetLogicalProcessorInformation
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMemoryResourceNotification
GetActiveProcessorGroupCount
GetActiveProcessorCount
InitializeSListHead
InterlockedFlushSList
ExitProcess
TlsGetValue
RtlUnwind
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcessorNumber
ReadProcessMemory
OutputDebugStringA
SetEnvironmentVariableW
GetCurrentProcessorNumberEx
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetLargePageMinimum
VirtualUnlock
ResetWriteWatch
GetWriteWatch
SetThreadAffinityMask
IsProcessInJob
QueryInformationJobObject
GetSystemTime
MapViewOfFile
FlushFileBuffers
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
EncodePointer
TlsFree
GetACP
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetFileAttributesExW
GetFileAttributesW
IsDBCSLeadByte
LoadLibraryW
OpenEventW
ExitThread
HeapReAlloc
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
CreateFileW
LoadLibraryExW
SetLastError
LoadLibraryExA
MultiByteToWideChar
QueryPerformanceFrequency
GetLastError
advapi32
SetKernelObjectSecurity
AdjustTokenPrivileges
LookupPrivilegeValueW
EventRegister
EventWriteTransfer
EventWrite
RegEnumValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateGuid
CreateStreamOnHGlobal
CoGetClassObject
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoGetContextToken
CoGetObjectContext
StringFromGUID2
CoReleaseMarshalData
CLSIDFromProgID
IIDFromString
CoTaskMemFree
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
oleaut32
VariantInit
SysAllocStringByteLen
SysStringByteLen
SetErrorInfo
LoadRegTypeLi
SysAllocString
GetErrorInfo
SysFreeString
SysStringLen
SysAllocStringLen
QueryPathOfRegTypeLi
LoadTypeLibEx
SafeArrayGetVartype
VariantChangeType
VariantChangeTypeEx
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetLBound
VariantClear
CreateErrorInfo
VarCyFromDec
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
SafeArraySetRecordInfo
SafeArrayAllocData
SafeArrayGetElemsize
SafeArrayGetRecordInfo
user32
LoadStringW
shlwapi
PathFindFileNameW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
api-ms-win-crt-string-l1-1-0
strcat_s
strcmp
strlen
strcpy_s
strnlen
_strnicmp
strncpy_s
wcsncpy_s
_wcsicmp
isalpha
wcsncmp
isdigit
strncmp
towlower
wcscat_s
wcsnlen
_stricmp
iswspace
strncat_s
wcsncat_s
iswascii
iswupper
wcsncpy
wcscpy_s
_strdup
towupper
api-ms-win-crt-stdio-l1-1-0
_flushall
_putws
__stdio_common_vswprintf_s
__stdio_common_vfwprintf
__stdio_common_vswscanf
__stdio_common_vsprintf_s
_wfopen
fputs
fclose
_wfopen_s
fflush
__acrt_iob_func
__stdio_common_vsnwprintf_s
fopen
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_errno
_configure_narrow_argv
_initterm_e
_initterm
_crt_atexit
_cexit
terminate
_invalid_parameter_noinfo
abort
_controlfp_s
_execute_onexit_table
_register_onexit_function
api-ms-win-crt-convert-l1-1-0
atoi
_wtoi
atol
strtoul
_wcstoui64
wcstoul
_ltow_s
_itow_s
api-ms-win-crt-utility-l1-1-0
bsearch
ldiv
qsort
api-ms-win-crt-math-l1-1-0
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_CItanh
__libm_sse2_acos
__libm_sse2_asin
_libm_sse2_tan_precise
_except1
ceil
floor
__libm_sse2_atan
_libm_sse2_acos_precise
__libm_sse2_sin
__libm_sse2_pow
_CIsinh
_CIfmod
_CIatan2
_CIcosh
_libm_sse2_sqrt_precise
asinh
__libm_sse2_atan2
cbrt
ilogb
acosh
scalbn
fma
atanh
log2
log2f
scalbnf
acoshf
cbrtf
__libm_sse2_cos
atanhf
modf
_copysign
ilogbf
fmaf
asinhf
_isnan
__libm_sse2_exp
__libm_sse2_log
__libm_sse2_tan
__libm_sse2_log10
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wmakepath_s
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
CLRJitAttachState
GetCLRRuntimeHost
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
65B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
645KB
Virtual Size
645KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
212KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=260, version=26213,
count=15, id=257, version=26213,
count=431, id=1, productName=Unmarked objects,
count=36, id=261, version=26706,
count=18, id=260, version=26706,
count=26, id=259, version=26706,
count=6, id=259, version=27048,
count=400, id=270, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
dbgshim.dll
- IMPHASH 00f465c788682fb5c56632d6cd17ef2f
- SHA256 23d45e43b4e54b12dc7f8029ae785e6a2a666e94b0b749c878502cd89ce4b50d
- MD5 25527d0dc8c76052d6af0062809b19db
- SHA1 9743537cf72993b29cc01e98c535b01e3448707d
- SHA512 b8e596d004b40122eafbc0425383fda061b5c27c892260631bb77aeb79b25316b86ca57c443d3c0494484ce3ed0329882588a418e0773559a06a2a2566a7041a
- SSDEEP 1536:sAlEPSl7UXlsxueJNcyjqCIW4gHyStZi1IXgO41muCQutLn38qdxv5MRNe7H04d2:sWwU7I04m3ZXwMV3L5MPeo4dx4SKBFx
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9b:e4:9d:33:94:09:24:44:9d:33:19:3e:95:61:41:6d:2d:54:72:78:56:f8:8e:db:d2:d0:19:11:0d:8e:6d:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
53776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\dbgshim\Release\dbgshim.pdb
kernel32
HeapAlloc
HeapFree
RaiseException
GetACP
LCMapStringEx
MultiByteToWideChar
IsDBCSLeadByte
FormatMessageW
LocalFree
SetLastError
LoadLibraryExW
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
GetSystemTimeAsFileTime
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetProcessHeap
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetSystemInfo
TerminateProcess
IsDebuggerPresent
EncodePointer
InterlockedFlushSList
LoadLibraryW
MapViewOfFile
CreateFileMappingW
K32EnumProcessModules
FreeLibrary
CreateProcessW
GetCurrentProcessId
ReadProcessMemory
GetFileSize
GetProcAddress
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
ProcessIdToSessionId
CreateEventW
OpenProcess
DuplicateHandle
UnmapViewOfFile
ResumeThread
OpenEventW
GetCurrentThreadId
WaitForSingleObject
K32GetModuleFileNameExW
WaitForSingleObjectEx
GetCurrentProcess
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
user32
LoadStringW
advapi32
CopySid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorSacl
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
ole32
CoTaskMemFree
oleaut32
SetErrorInfo
version
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcscat_s
strncmp
wcsncmp
strcpy_s
wcsncpy_s
wcscpy_s
_stricmp
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
abort
_errno
_execute_onexit_table
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
calloc
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRCreateInstance
CloseCLREnumeration
CloseResumeHandle
CreateDebuggingInterfaceFromVersion
CreateDebuggingInterfaceFromVersion2
CreateDebuggingInterfaceFromVersionEx
CreateProcessForLaunch
CreateVersionStringFromModule
EnumerateCLRs
GetStartupNotificationEvent
RegisterForRuntimeStartup
RegisterForRuntimeStartupEx
ResumeProcess
UnregisterForRuntimeStartup
Name
.text
Size
74KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=26213,
count=27, id=261, version=26706,
count=17, id=260, version=26706,
count=10, id=259, version=26706,
count=13, id=257, version=26213,
count=198, id=1, productName=Unmarked objects,
count=31, id=265, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
driver/amd64/LICENSE.txt
- SHA256 fa8e8f02f81de56cbf470b91de1f6fa69c3b39a996c6e1f057df6212324cc564
- MD5 747025499b4a05d19a0e3431c634cdc0
- SHA1 c93725625c81fef7ff8663bdc5d5df501a3586a4
- SHA512 2b4eb9ef2ef7dd28fa0b30f268c1ed53130ad79686a1f785ccaa925a3015eb1617fde45ffe14068a08ac2ceea34579aa07f0199da57ca057783d193759bf8b49
- SSDEEP 384:Pq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0lx2:PzuVLiY+rTZo0lx2
- MD5 SHA1 SHA512 SSDEEP
driver/amd64/OemWin2k.inf
- SHA256 a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707
- MD5 b6aada0cbed06889053a05b66f146979
- SHA1 823025f02b355b37df7d7657b0f2b4d3584891a5
- SHA512 9f8a6b0ad5ae4ea4c14043d663fd5aca2f1884ece0975b13c0533eb93103eb89120c1884121d71c8f9d09f5d210926fdba3b29fc6cf87f601bbc0f359c31d4ad
- SSDEEP 192:nr8tW9yCTi394vlQdqKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGZdUWo3DcNSj6jvKFkinuEQTXvzaZ
- MD5 SHA1 SHA512 SSDEEP
driver/amd64/devcon.exe
- IMPHASH ce4a5cfcfb0452b87e013f07f4d59f9c
- SHA256 118e04049f21d272c8005e1e746248a4654b305a41b29e5c735231d2b83bbaa6
- MD5 9ab7634bb81f326d489e453c358ae8ea
- SHA1 5ea9dfa805f1ae952cb3b66712126ac9c3c985c0
- SHA512 c90ab0182709cbf9ea2ba58565fcc6c72b52bc500b5f16a7eba1f107350550725f0ba40bf64102e9e0c8fdc347e0833f67a8bfe4779b3654d0e7d42f7b8bb74d
- SSDEEP 1536:EP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WO:EePOYe4bu1epDh8RWO
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3f:4a:34:d7:f1:29:71:aa:cf:ff:c3:17:27:f4:15:7d:33:16:41:c0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Chains
Oct 19, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Serial Number
0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 13, 2014 - Jul 19, 2017
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
1
Major OS version
6
Entry point
29456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
devcon.pdb
advapi32
OpenProcessToken
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownExW
RegCloseKey
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegDeleteValueW
RegSetValueExW
kernel32
GetCurrentProcess
FormatMessageW
lstrlenW
GetLastError
CloseHandle
LocalFree
GetDateFormatW
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
GetProcAddress
GetFullPathNameW
FindFirstFileW
GetFileAttributesW
FindClose
FindNextFileW
GetWindowsDirectoryW
Sleep
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
msvcrt
wcschr
_wcsicmp
towlower
_wcsnicmp
fputs
__iob_func
wcsrchr
fputws
?terminate@@YAXXZ
memset
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wprintf
??2@YAPEAX_K@Z
towupper
??3@YAXPEAX@Z
iswalpha
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ole32
CLSIDFromString
setupapi
SetupScanFileQueueW
SetupDiGetClassDevsExW
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiClassNameFromGuidExW
CM_Reenumerate_DevNode_Ex
SetupCopyOEMInfW
SetupDiSetDeviceRegistryPropertyW
SetupDiGetINFClassW
CM_Disconnect_Machine
SetupDiBuildClassInfoListExW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Get_DevNode_Status_Ex
SetupDiBuildDriverInfoList
SetupDiGetDeviceInstallParamsW
SetupDiOpenDevRegKey
SetupDiSetSelectedDriverW
SetupGetStringFieldW
CM_Get_Res_Des_Data_Size_Ex
SetupDiEnumDriverInfoW
CM_Free_Log_Conf_Handle
CM_Get_Device_ID_ExW
CM_Get_Next_Res_Des_Ex
SetupCloseFileQueue
SetupDiGetDriverInstallParamsW
CM_Get_Res_Des_Data_Ex
SetupDiOpenClassRegKeyExW
SetupCloseInfFile
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupDiDestroyDriverInfoList
SetupOpenInfFileW
CM_Free_Res_Des_Handle
CM_Get_First_Log_Conf_Ex
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
SetupDiGetDriverInfoDetailW
SetupDiGetClassDescriptionExW
SetupDiClassGuidsFromNameExW
SetupDiOpenDeviceInfoW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
user32
CharNextW
CharPrevW
LoadStringW
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=176, id=1, productName=Unmarked objects,
count=64, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
driver/amd64/tap0901.cat
- SHA256 b8913d43b03ecf24f466b7bd5046b0c35ec9c43620d10ce3d5dd6538356a85a8
- MD5 e0762d9f662614cdc930e211884e9443
- SHA1 8016a500b268f2263aa26996f92cad4a9bfe153d
- SHA512 618fbf5488f2eeba35b46e4eeabb901b40be20bd9447d49920ad22a9adb23d6dd366556430e24005543bd2ee501848ff7b24bcebf7b15b8ee8543091b73bb449
- SSDEEP 192:JLdBt9jnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJ8y4r:rhjnYPL+StZsZZvjJ8P
- MD5 SHA1 SHA512 SSDEEP
driver/amd64/tap0901.sys
- IMPHASH 741e65dbed0bdb03af558a33e0336da1
- SHA256 89cb62e73fbd0500a8b811a632602c504753777313d7e424cca68f1619b55211
- MD5 54cb62322b7b1210cb317c4462691b10
- SHA1 728cccf1e337641cfe06df85aaa667270c2f540f
- SHA512 b9dec2e015659ccd9683ef504f6a912f55e41e87d0d9c698670b1b2db358a1f4997fcc112cf04e850d7b226582a3d234b57ad68b4afd9cff9c9df63b5f2c08fd
- SSDEEP 768:JIOPCr6ghD8JTbddDChKSfl4FUFqa0XFC1bRbq0FlCbxG95ux7hqiyc:acCr6gYTb/DoBfi60a0XFC1UP+5ux7jV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
68:e4:62:d0:04:58:56:db:19:4b:bd:8b:f5:13:6c:ca:bf:05:ed:40
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Chains
Oct 19, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Serial Number
0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 13, 2014 - Jul 19, 2017
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
1
Major OS version
6
Entry point
41520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Samuli\tap-windows-github\src\amd64\tap0901.pdb
ntoskrnl.exe
KeBugCheckEx
KeAcquireSpinLockRaiseToDpc
KeRemoveQueueDpc
RtlCreateSecurityDescriptor
IoReleaseCancelSpinLock
ZwOpenFile
RtlFreeAnsiString
ZwSetSecurityObject
IofCompleteRequest
ZwClose
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
RtlFreeUnicodeString
KeReleaseSpinLock
KeInitializeDpc
RtlUnicodeStringToAnsiString
MmMapLockedPages
RtlAnsiStringToUnicodeString
RtlUnicodeToMultiByteN
__C_specific_handler
ndis.sys
NdisMRegisterAdapterShutdownHandler
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisTerminateWrapper
NdisMDeregisterDevice
NdisMDeregisterAdapterShutdownHandler
NdisMSetAttributesEx
NdisInitializeWrapper
NdisFreeMemory
NdisMRegisterMiniport
NdisCloseConfiguration
NdisMRegisterDevice
NdisMRegisterUnloadHandler
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisMSleep
NdisOpenConfiguration
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=135, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=38, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
driver/i386/LICENSE.txt
- SHA256 fa8e8f02f81de56cbf470b91de1f6fa69c3b39a996c6e1f057df6212324cc564
- MD5 747025499b4a05d19a0e3431c634cdc0
- SHA1 c93725625c81fef7ff8663bdc5d5df501a3586a4
- SHA512 2b4eb9ef2ef7dd28fa0b30f268c1ed53130ad79686a1f785ccaa925a3015eb1617fde45ffe14068a08ac2ceea34579aa07f0199da57ca057783d193759bf8b49
- SSDEEP 384:Pq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0lx2:PzuVLiY+rTZo0lx2
- MD5 SHA1 SHA512 SSDEEP
driver/i386/OemWin2k.inf
- SHA256 8892d224ae879cc35ffe216691fc6ba3266d88b6239838f7d38b3a4ff4ad74b6
- MD5 35589b966c65a52a1c95791bbcd80543
- SHA1 d65994dd38de0e1971f8c99a048c46acc284e8bf
- SHA512 ece01e898527ae2ce3039457ea1823bda6351871900c1a7a20057ff3250e33ed8ed216af3318edaa1c3825c17d348dee06078e946d10332e87af8ec45795fd5f
- SSDEEP 192:nr8tW9yCTi394vlFKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGcWo3DcNSj6jvKFkinuEQTXvzaZ
- MD5 SHA1 SHA512 SSDEEP
driver/i386/devcon.exe
- IMPHASH 4a8b1b3af5ed6b972156a2972693a918
- SHA256 f228844f92969a6c88ec6b9168815c259881f436f3188f9b038eb0b1dce08bbf
- MD5 d0006c3ec1f8b894e41667355b088448
- SHA1 8c478cd72bd52bec1283fed9186a9d07a58a084c
- SHA512 85424d30cd0607cae58ec1b9053ba6b2f087e148ad6ba029ddcabc4ff33fc97d3a6dddb0f49e5a39cfbe011ae2f9b165ba0490ed9365f081afdf4ab0c15b3c4d
- SSDEEP 768:ggEuhGUsQ9Z7lVQpjagwpKsQt2IJU1evxHs4gZWkbqc:t1/9ZisQtBU4xHeWY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4d:32:a9:b6:bc:ff:ee:65:9b:b0:12:c5:5f:79:50:25:94:1b:f0:55
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Chains
Oct 19, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Serial Number
0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 13, 2014 - Jul 19, 2017
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
2
Major OS version
5
Entry point
21009
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryW
GetFileAttributesW
GetFullPathNameW
TerminateProcess
GetModuleHandleA
FreeLibrary
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcpynW
FileTimeToSystemTime
GetDateFormatW
lstrcpyW
lstrlenW
GetLastError
GetCurrentProcess
CloseHandle
LocalFree
FormatMessageW
QueryPerformanceCounter
msvcrt
fputws
fputs
_iob
??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
towlower
towupper
iswalpha
_wcsnicmp
_wcsicmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcscmp
wprintf
wcsrchr
advapi32
OpenProcessToken
LookupPrivilegeValueW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
setupapi
SetupDiClassGuidsFromNameExW
CM_Free_Log_Conf_Handle
CM_Get_Next_Res_Des_Ex
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data_Size_Ex
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Reenumerate_DevNode_Ex
CM_Disconnect_Machine
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiBuildClassInfoListExW
SetupDiClassNameFromGuidExW
SetupDiGetClassDescriptionExW
SetupDiOpenClassRegKeyExW
SetupDiGetDriverInstallParamsW
SetupDiSetSelectedDriverW
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupScanFileQueueW
SetupCloseFileQueue
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiOpenDevRegKey
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_Device_ID_ExW
SetupDiGetDeviceInfoListDetailW
SetupDiOpenDeviceInfoW
SetupDiGetClassDevsExW
SetupDiCreateDeviceInfoListExW
CM_Get_Res_Des_Data_Ex
CM_Get_DevNode_Status_Ex
CM_Get_First_Log_Conf_Ex
user32
ExitWindowsEx
CharNextW
LoadStringW
CharPrevW
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=15, version=2179,
count=11, id=93, version=2179,
count=109, id=1, productName=Unmarked objects,
count=13, id=95, version=2190,
count=3, id=96, version=2190,
count=1, id=94, version=2179,
count=1, id=90, version=2179,
driver/i386/tap0901.cat
- SHA256 825cc3efc86cd13fa1bda7d0413d5ca8b208c3a18834ef02637834352ef386fc
- MD5 7f49202c5a71e1dd7c85923a5dd45764
- SHA1 7e8c115faad3ab2cc53ecfc05cf09e8eabfbffa6
- SHA512 62497068c4ed428772ac6236c1383540cf7c48a7ee20b06e0b0e873c51fe69718969ab218f953001403d2e2170e7f29cd84947722e15f55985863a2e79d66d63
- SSDEEP 192:XPC9NdKnYe+PjP+bkNsG3dZubh9ZZ3xN5BdFJqTqnG:fgKnYPL+StZsZZvjJMqG
- MD5 SHA1 SHA512 SSDEEP
driver/i386/tap0901.sys
- IMPHASH 7bc0e747b3ccfdebdacc897735028b04
- SHA256 c43a60e16a011622a963cb93264c7e1365a10fce8c43d5c4fad895880af4dd91
- MD5 a23d03a5eb0b221bcd33d98ff30e4dbf
- SHA1 9da49918647cf25bcae9538ebf60833d0a3488ea
- SHA512 77e9c8e1cd4d7670a9439d006f45ddebb62a33ab4aa7999cf9a0536bd9ae860a0d1a2c7ff50f5e0e50345b7c64619761fa545d10657b6f8fcc31db6d593aea41
- SSDEEP 384:lfMsa/mI7L1ypn49O1U1dLn3kDPQXDg8rvfCVUR4KYRGcdq3zhZPvZDsr3549F4o:l09UUPL3sQXDg6iiWA3LZem4L9qDEI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6e:03:12:b3:2a:4f:df:48:c0:cc:8f:e1:86:58:a2:d0:73:7c:c2:03
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Chains
Oct 19, 2015
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=GZ Systems Limited,O=GZ Systems Limited,L=Central,C=HK
Serial Number
0a:2c:ca:f4:d3:dd:3c:72:8b:1d:b1:35:5c:e5:fd:ac
Issuer
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 13, 2014 - Jul 19, 2017
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 11, 2011 - Feb 10, 2026
Minor OS version
1
Major OS version
6
Entry point
22495
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Samuli\tap-windows-github\src\i386\tap0901.pdb
ntoskrnl.exe
RtlFreeAnsiString
memcpy
KeRemoveQueueDpc
KeBugCheckEx
KeTickCount
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
KeInitializeDpc
MmMapLockedPagesSpecifyCache
MmMapLockedPages
RtlCreateSecurityDescriptor
ZwOpenFile
ZwSetSecurityObject
ZwClose
KeInsertQueueDpc
IoReleaseCancelSpinLock
IofCompleteRequest
memset
RtlFreeUnicodeString
RtlUnwind
RtlUnicodeToMultiByteN
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
ndis.sys
NdisMRegisterMiniport
NdisTerminateWrapper
NdisMRegisterUnloadHandler
NdisMSetAttributesEx
NdisMRegisterAdapterShutdownHandler
NdisOpenConfiguration
NdisReadConfiguration
NdisCloseConfiguration
NdisMRegisterDevice
NdisMIndicateStatus
NdisMIndicateStatusComplete
NdisMDeregisterDevice
NdisMDeregisterAdapterShutdownHandler
NdisMSleep
NdisFreeMemory
NdisAllocateMemoryWithTag
NdisInitializeWrapper
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
896B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
128B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
994B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=42, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
e_sqlite3.dll
- IMPHASH 3c733b5675643aad72c3f03ebfb1a5b6
- SHA256 9877f703ce3fb9669d656d24726159b616b2df25522225bf41bfafe89954c58a
- MD5 1aa2fb5e420379a7a50cd650232c6a08
- SHA1 e9bb12599f60032a160a00a04203bd73680940cd
- SHA512 f908c146cc7299815424debe4d40643864ce442eb30adf148ce05dc2f48e8a9db0697943af55b1c5260f5341ebce57cd804a7b19e71b66510bac085a3f800a59
- SSDEEP 24576:FNtiWRtuKKPAq5NY6VxFKolweGUbqf9CTfO3eo2:FNttRtuKQ/V7cejNpo2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
797392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetTimeZoneInformation
CompareStringW
LCMapStringW
DecodePointer
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_may_be_corrupt
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
Name
.text
Size
826KB
Virtual Size
826KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=26715,
count=144, id=261, version=26715,
count=19, id=260, version=26715,
count=3, id=257, version=26715,
count=129, id=1, productName=Unmarked objects,
count=30, id=261, version=26504,
count=15, id=260, version=26504,
count=23, id=259, version=26504,
count=2, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=256, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=255, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=258, productName=VS2019 v16.2.3 build 27905, version=27905,
hostfxr.dll
- IMPHASH a667f7519ae9b5f0c5661223222badfa
- SHA256 26ed6778f4d368df211d035b548fa9b3d22976def5055d33c0f2a2d7086ed54a
- MD5 36e668a570def150bc37c64bcc824af5
- SHA1 c475d9bbfbf8e71197c06d86515cb84d06be0ff8
- SHA512 cf728f060688cc2a19186f029ecbe2f11c68dc56ed12e2759af0b21a74ef69d1a6f40d777efed4eb32b581acdee5bd5c668339c928556987dbf1cdb2533143db
- SSDEEP 6144:+2Iga52hQloNLV11Tt24BqxDPr9VQRQawQ57rEnInqb3huPLCYbNX7jrSxgU:bI+hQloxE+Qa97AnR3hMLCYb9SOU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ab:06:dd:58:aa:47:9d:2c:4a:a9:37:f5:73:26:18:82:88:c0:13:3b:4d:b0:64:d2:44:21:4f:98:c8:72:ce:b4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
225328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\fxr\Release\hostfxr.pdb
kernel32
GetCurrentDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
CloseHandle
GetLastError
InitializeCriticalSection
GetEnvironmentVariableW
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
OutputDebugStringW
EnterCriticalSection
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RtlUnwind
RaiseException
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
LCMapStringEx
DecodePointer
EncodePointer
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetCurrentThreadId
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitOnceComplete
InitOnceBeginInitialize
FormatMessageA
LocalFree
GetStringTypeW
advapi32
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
_errno
_crt_atexit
_initterm_e
_cexit
abort
_execute_onexit_table
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initterm
_initialize_onexit_table
terminate
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
calloc
api-ms-win-crt-stdio-l1-1-0
_fseeki64
ungetc
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
fsetpos
fwrite
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
__acrt_iob_func
fputwc
fputws
_wfopen
__stdio_common_vfwprintf
__stdio_common_vswprintf
_wfsopen
fseek
__stdio_common_vsprintf_s
setvbuf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
_wcsdup
isupper
memset
__strncnt
strcspn
iswspace
_isctype_l
wcsnlen
strnlen
wcsncmp
_wcsnicmp
towlower
strcpy_s
islower
_wcsicmp
api-ms-win-crt-math-l1-1-0
ceil
frexp
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
___lc_locale_name_func
_free_locale
___lc_codepage_func
setlocale
localeconv
_lock_locales
_unlock_locales
__pctype_func
_create_locale
api-ms-win-crt-convert-l1-1-0
_i64toa_s
_ui64toa_s
_i64tow_s
_strtod_l
wcstoul
_wtoi
_ui64tow_s
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64
_time64
hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value
Name
.text
Size
243KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=260, version=30034,
count=14, id=259, version=30034,
count=77, id=261, version=30034,
count=2, id=253, version=23601,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=26213,
count=210, id=1, productName=Unmarked objects,
count=29, id=261, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=1, id=151,
count=1, id=258, version=30140,
hostpolicy.dll
- IMPHASH e459434b524faf87b6a14cf00c22215b
- SHA256 1f81009336fed33b50bf187d70a16929f4d1b4f78b4d1e16bbbf7f6a87ec5bb1
- MD5 862514252dc75f2275445ca4798eea1f
- SHA1 6241c1ef41b521a7766a87732382e0c940c96dee
- SHA512 b070c5a4d4d649da59df88ef0030f74a7e1096da21f27fccb72d3027e7b9cc87193fde695b32419982249b8e7fce7d5fea679a6c085a4605a09bfdd976a26a7d
- SSDEEP 6144:YYDZt7+PjyNcLRAToe+rshxF7c7W656McOUvdgaROgjNojQ66O6hom0b+NQG/:zt5NcLRAToe+rshxFO56VM6Dh2s/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e4:4f:0c:b9:97:16:18:93:3a:70:8e:fb:7e:50:ed:82:0e:17:eb:43:fc:f1:a9:fe:5c:2d:e2:a7:4a:5a:55:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
220208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\hostpolicy\Release\hostpolicy.pdb
kernel32
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
CloseHandle
GetLastError
InitializeCriticalSection
GetEnvironmentVariableW
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsWow64Process
GetModuleFileNameW
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
OutputDebugStringW
EnterCriticalSection
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RtlUnwind
RaiseException
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitOnceComplete
InitOnceBeginInitialize
LocalFree
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetStringTypeW
FormatMessageA
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
advapi32
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_register_onexit_function
_crt_atexit
abort
_cexit
_errno
_initialize_narrow_environment
terminate
_beginthreadex
_configure_narrow_argv
_initterm
_initterm_e
_seh_filter_dll
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
ceil
frexp
api-ms-win-crt-string-l1-1-0
isupper
memset
_wcsicmp
__strncnt
strcspn
iswspace
_isctype_l
_wcsdup
strnlen
wcsncmp
_wcsnicmp
towlower
strcpy_s
wcsnlen
islower
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
free
malloc
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
fclose
_get_stream_buffer_pointers
fread
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
__acrt_iob_func
fputwc
fputws
_wfopen
__stdio_common_vfwprintf
__stdio_common_vswprintf
fgetpos
fseek
_wfsopen
fgetc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_lock_locales
_free_locale
_create_locale
setlocale
__pctype_func
localeconv
___lc_locale_name_func
_unlock_locales
___mb_cur_max_func
api-ms-win-crt-convert-l1-1-0
_ui64toa_s
_ui64tow_s
_i64toa_s
_strtod_l
_i64tow_s
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64
_time64
corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload
Name
.text
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=260, version=30034,
count=14, id=259, version=30034,
count=79, id=261, version=30034,
count=2, id=253, version=23601,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=26213,
count=216, id=1, productName=Unmarked objects,
count=25, id=261, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=1, id=151,
count=1, id=258, version=30140,
installoptions.jdat
- SHA256 dd723d37ef9d85b28d2183484b7fc1acef76e7113719ecb9b74c0791e57de6be
- MD5 dd3ae3168a12ad7f0dc03648dc46eb7a
- SHA1 86d9b32fbd9b77a7b9c80f9d53be88799aaf0bfc
- SHA512 833a10f34cbb5fa2209b4dd55c72fe46c8d82ad6652bfd3574dff4f00ade746f172aaa0ecf8c6e5926785d240c1bd50882521a4e4ea973d50dab6b1a5072840f
- MD5 SHA1 SHA512
lib_SCAPI.dll
- IMPHASH 916a383506048c69ca2577373c760d2b
- SHA256 c9c36cdff0af9c858c5633adc89730fd7172becbdaf86e4acb0fadfdb872ffab
- MD5 b52d13d0b5d62993e2dc9aab06c0b2d0
- SHA1 160ccd201b856f14971a0b33c10a0bff13092da0
- SHA512 e98e2340fcc216dacad07766a59db43f73c634ab8b36dd4330835d847164b24bd999bb2a3b74f40dd8099304680c06e54fc4d8d50113e77848d6800599efad5d
- SSDEEP 6144:BwLwULisgBW4p3DqsjuvA+BIAOVrIIqVh:BwjxGW4p3DKIfDqn
- MD5 SHA1 SHA512 SSDEEP
Digest
ae:87:23:8d:29:7a:73:7d:47:3a:33:ad:95:a8:61:11:63:c5:b4:b6:ef:94:39:2b:82:19:6b:16:41:d5:9d:05
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
31025
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jenkins\AppData\Local\Jenkins\.jenkins\workspace\WindowsAV\SecuritySuite\Release\lib_SCAPI.pdb
wintrust
CryptCATAdminAddCatalog
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
kernel32
HeapFree
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
ReadConsoleW
DeleteCriticalSection
GetProcessHeap
LoadLibraryW
GetProcAddress
SetFilePointerEx
GetFileSizeEx
ReadFile
SetStdHandle
CreateFileW
DecodePointer
MultiByteToWideChar
GetConsoleMode
GetConsoleOutputCP
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
EncodePointer
WriteConsoleW
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteFile
advapi32
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
CloseServiceHandle
ole32
CoCreateInstance
_amswscInit@20
_amswscMarkAuthenticationRequired@0
_amswscPrepareUninstall@0
_amswscRegisterRemediation@12
_amswscShutdownProtectedService@0
_amswscUnregisterRemediation@0
_amswscUpdateStatus@8
_amswscUpdateSubStatus@12
_getIProductName@8
_getIProductState@4
_getSecurityProviders@12
_getTestProduct@4
_registerAsProduct@8
_registerAvProduct@8
_scapiAddSecurityCatalog@4
_scapiSetProtectService@8
_unRegisterAsProduct@0
_unRegisterAvProduct@0
_updateAsStatus@8
_updateAvStatus@8
_updateAvSubStatus@12
Name
.text
Size
154KB
Virtual Size
153KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=164, id=261, version=30795,
count=15, id=260, version=30034,
count=22, id=259, version=30034,
count=71, id=261, version=30034,
count=23, id=260, version=30795,
count=11, id=257, version=30795,
count=104, id=1, productName=Unmarked objects,
count=1, id=260, version=25203,
count=4, id=265, version=30145,
count=1, id=256, version=30145,
count=1, id=255, version=30145,
count=1, id=151,
count=1, id=258, version=30145,
lib_SCAPISharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4f3694e8b0960a7b1e6cb6ffdd6b143e7f9c6dbe0275eff9197059a60d4ee877
- MD5 9dd1c2259075e1b604c2efc50f2a7db9
- SHA1 765d2bab983ebb74ff9f956faed22c99211795b2
- SHA512 5605cce8a54ffc4067e09a06420e33146eddc4ccee81bf02c56bff8943d7e6daf47fe92f329de9d03804dcafa5a319d038900dbbab674163951a489c9ce760a8
- SSDEEP 384:PJYKB/NQHizcYdNKs9IUntTq9Q9aZzHoNZsHLIEAM+o/8E9VF0Ny3Y:P60/SHizcYHK6PtbQVpAMxkEO
- MD5 SHA1 SHA512 SSDEEP
Digest
b5:5e:69:21:c6:20:32:f3:fa:e5:f1:1b:d8:32:42:f8:72:7d:63:08:cf:20:2d:79:a5:1f:71:fe:50:08:e6:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
18062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
libcrypto-1_1.dll
- IMPHASH 840d1b19809c82962b8c90c5984d27e8
- SHA256 34f14e8ac45755105a464dc4e93014c1e9778cd88e57463df8cf83f0db820411
- MD5 f77ebf3bb87a6b7e6fc52071609cd88e
- SHA1 d41ce9a2f1dc351ac0adcb45030a86043dc79128
- SHA512 e043669989e28c4b7179e765bd65ae25a16d71bb76467faf812ff7078b228b676e16d64b6dfebb480f78e2a131b6cbbc8715a7cafa2bed5c7863ec5835c9ddf2
- SSDEEP 49152:RqLV4BJ3u/v45t9XVM1CPwDv3uFZjkQSHE:sLVwJeo5t9Xa1CPwDv3uFZjk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1772622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libcrypto-1_1.pdb
ws2_32
getaddrinfo
listen
sendto
recvfrom
WSASetLastError
send
recv
shutdown
socket
setsockopt
ntohs
connect
closesocket
bind
accept
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
getsockopt
getsockname
ioctlsocket
getnameinfo
freeaddrinfo
advapi32
CryptCreateHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
bcrypt
BCryptGenRandom
kernel32
SetFileAttributesW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
OutputDebugStringW
SetEnvironmentVariableA
GetTimeZoneInformation
SetEndOfFile
GetFullPathNameA
GetFileAttributesExW
GetCurrentThreadId
RtlUnwind
HeapSize
LoadLibraryExW
GetModuleFileNameW
GetProcessHeap
GetDriveTypeW
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
FormatMessageW
GetSystemTime
SystemTimeToFileTime
GetLastError
SetLastError
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetVersion
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
CloseHandle
FreeLibrary
LoadLibraryA
LoadLibraryW
GetModuleHandleExW
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedExchangeAdd
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
InterlockedExchange
HeapFree
HeapAlloc
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
AreFileApisANSI
SetConsoleCtrlHandler
HeapReAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
GetCommandLineA
GetConsoleCP
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CreateSemaphoreW
FatalAppExitA
Sleep
SetStdHandle
FlushFileBuffers
SetFilePointer
SetFilePointerEx
FindFirstFileExW
ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
ADMISSIONS_free
ADMISSIONS_get0_admissionAuthority
ADMISSIONS_get0_namingAuthority
ADMISSIONS_get0_professionInfos
ADMISSIONS_it
ADMISSIONS_new
ADMISSIONS_set0_admissionAuthority
ADMISSIONS_set0_namingAuthority
ADMISSIONS_set0_professionInfos
ADMISSION_SYNTAX_free
ADMISSION_SYNTAX_get0_admissionAuthority
ADMISSION_SYNTAX_get0_contentsOfAdmissions
ADMISSION_SYNTAX_it
ADMISSION_SYNTAX_new
ADMISSION_SYNTAX_set0_admissionAuthority
ADMISSION_SYNTAX_set0_contentsOfAdmissions
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_ITEM_get
ASN1_ITEM_lookup
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_bind
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_lookup_ex
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_read_ex
BIO_meth_get_write
BIO_meth_get_write_ex
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_read_ex
BIO_meth_set_write
BIO_meth_set_write_ex
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_read_ex
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_log
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BIO_write_ex
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_is_current_thread
BN_BLINDING_lock
BN_BLINDING_new
BN_BLINDING_set_current_thread
BN_BLINDING_set_flags
BN_BLINDING_unlock
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_secure_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_abs_is_word
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2binpad
BN_bn2dec
BN_bn2hex
BN_bn2lebinpad
BN_bn2mpi
BN_bntest_rand
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_recp
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_dsa_nonce
BN_generate_prime
BN_generate_prime_ex
BN_get0_nist_prime_192
BN_get0_nist_prime_224
BN_get0_nist_prime_256
BN_get0_nist_prime_384
BN_get0_nist_prime_521
BN_get_flags
BN_get_params
BN_get_rfc2409_prime_1024
BN_get_rfc2409_prime_768
BN_get_rfc3526_prime_1536
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_6144
BN_get_rfc3526_prime_8192
BN_get_word
BN_hex2bn
BN_is_bit_set
BN_is_negative
BN_is_odd
BN_is_one
BN_is_prime
BN_is_prime_ex
BN_is_prime_fasttest
BN_is_prime_fasttest_ex
BN_is_word
BN_is_zero
BN_kronecker
BN_lebin2bn
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_recp
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_mul_reciprocal
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nist_mod_192
BN_nist_mod_224
BN_nist_mod_256
BN_nist_mod_384
BN_nist_mod_521
BN_nist_mod_func
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_options
BN_print
BN_print_fp
BN_priv_rand
BN_priv_rand_range
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_reciprocal
BN_rshift
BN_rshift1
BN_secure_new
BN_security_bits
BN_set_bit
BN_set_flags
BN_set_negative
BN_set_params
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_to_montgomery
BN_uadd
BN_ucmp
BN_usub
BN_value_one
BN_with_flags
BN_zero_ex
BUF_MEM_free
BUF_MEM_grow
BUF_MEM_grow_clean
BUF_MEM_new
BUF_MEM_new_ex
BUF_reverse
CAST_cbc_encrypt
CAST_cfb64_encrypt
CAST_decrypt
CAST_ecb_encrypt
CAST_encrypt
CAST_ofb64_encrypt
CAST_set_key
CBIGNUM_it
CERTIFICATEPOLICIES_free
CERTIFICATEPOLICIES_it
CERTIFICATEPOLICIES_new
CMAC_CTX_cleanup
CMAC_CTX_copy
CMAC_CTX_free
CMAC_CTX_get0_cipher_ctx
CMAC_CTX_new
CMAC_Final
CMAC_Init
CMAC_Update
CMAC_resume
CMS_ContentInfo_free
CMS_ContentInfo_it
CMS_ContentInfo_new
CMS_ContentInfo_print_ctx
CMS_EncryptedData_decrypt
CMS_EncryptedData_encrypt
CMS_EncryptedData_set1_key
CMS_EnvelopedData_create
CMS_ReceiptRequest_create0
CMS_ReceiptRequest_free
CMS_ReceiptRequest_get0_values
CMS_ReceiptRequest_it
CMS_ReceiptRequest_new
CMS_RecipientEncryptedKey_cert_cmp
CMS_RecipientEncryptedKey_get0_id
CMS_RecipientInfo_decrypt
CMS_RecipientInfo_encrypt
CMS_RecipientInfo_get0_pkey_ctx
CMS_RecipientInfo_kari_decrypt
CMS_RecipientInfo_kari_get0_alg
CMS_RecipientInfo_kari_get0_ctx
CMS_RecipientInfo_kari_get0_orig_id
CMS_RecipientInfo_kari_get0_reks
CMS_RecipientInfo_kari_orig_id_cmp
CMS_RecipientInfo_kari_set0_pkey
CMS_RecipientInfo_kekri_get0_id
CMS_RecipientInfo_kekri_id_cmp
CMS_RecipientInfo_ktri_cert_cmp
CMS_RecipientInfo_ktri_get0_algs
CMS_RecipientInfo_ktri_get0_signer_id
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_set0_password
CMS_RecipientInfo_set0_pkey
CMS_RecipientInfo_type
CMS_SharedInfo_encode
CMS_SignedData_init
CMS_SignerInfo_cert_cmp
CMS_SignerInfo_get0_algs
CMS_SignerInfo_get0_md_ctx
CMS_SignerInfo_get0_pkey_ctx
CMS_SignerInfo_get0_signature
CMS_SignerInfo_get0_signer_id
CMS_SignerInfo_set1_signer_cert
CMS_SignerInfo_sign
CMS_SignerInfo_verify
CMS_SignerInfo_verify_content
CMS_add0_CertificateChoices
CMS_add0_RevocationInfoChoice
CMS_add0_cert
CMS_add0_crl
CMS_add0_recipient_key
CMS_add0_recipient_password
CMS_add1_ReceiptRequest
CMS_add1_cert
CMS_add1_crl
CMS_add1_recipient_cert
CMS_add1_signer
CMS_add_simple_smimecap
CMS_add_smimecap
CMS_add_standard_smimecap
CMS_compress
CMS_data
CMS_dataFinal
CMS_dataInit
CMS_data_create
CMS_decrypt
CMS_decrypt_set1_key
CMS_decrypt_set1_password
CMS_decrypt_set1_pkey
CMS_digest_create
CMS_digest_verify
CMS_encrypt
CMS_final
CMS_get0_RecipientInfos
CMS_get0_SignerInfos
CMS_get0_content
CMS_get0_eContentType
CMS_get0_signers
CMS_get0_type
CMS_get1_ReceiptRequest
CMS_get1_certs
CMS_get1_crls
CMS_is_detached
CMS_set1_eContentType
CMS_set1_signers_certs
CMS_set_detached
CMS_sign
CMS_sign_receipt
CMS_signed_add1_attr
CMS_signed_add1_attr_by_NID
CMS_signed_add1_attr_by_OBJ
CMS_signed_add1_attr_by_txt
CMS_signed_delete_attr
CMS_signed_get0_data_by_OBJ
CMS_signed_get_attr
CMS_signed_get_attr_by_NID
CMS_signed_get_attr_by_OBJ
CMS_signed_get_attr_count
CMS_stream
CMS_uncompress
CMS_unsigned_add1_attr
CMS_unsigned_add1_attr_by_NID
CMS_unsigned_add1_attr_by_OBJ
CMS_unsigned_add1_attr_by_txt
CMS_unsigned_delete_attr
CMS_unsigned_get0_data_by_OBJ
CMS_unsigned_get_attr
CMS_unsigned_get_attr_by_NID
CMS_unsigned_get_attr_by_OBJ
CMS_unsigned_get_attr_count
CMS_verify
CMS_verify_receipt
COMP_CTX_free
COMP_CTX_get_method
COMP_CTX_get_type
COMP_CTX_new
COMP_compress_block
COMP_expand_block
COMP_get_name
COMP_get_type
COMP_zlib
CONF_dump_bio
CONF_dump_fp
CONF_free
CONF_get1_default_config_file
CONF_get_number
CONF_get_section
CONF_get_string
CONF_imodule_get_flags
CONF_imodule_get_module
CONF_imodule_get_name
CONF_imodule_get_usr_data
CONF_imodule_get_value
CONF_imodule_set_flags
CONF_imodule_set_usr_data
CONF_load
CONF_load_bio
CONF_load_fp
CONF_module_add
CONF_module_get_usr_data
CONF_module_set_usr_data
CONF_modules_finish
CONF_modules_load
CONF_modules_load_file
CONF_modules_unload
CONF_parse_list
CONF_set_default_method
CONF_set_nconf
CRL_DIST_POINTS_free
CRL_DIST_POINTS_it
CRL_DIST_POINTS_new
CRYPTO_128_unwrap
CRYPTO_128_unwrap_pad
CRYPTO_128_wrap
CRYPTO_128_wrap_pad
CRYPTO_THREAD_cleanup_local
CRYPTO_THREAD_compare_id
CRYPTO_THREAD_get_current_id
CRYPTO_THREAD_get_local
CRYPTO_THREAD_init_local
CRYPTO_THREAD_lock_free
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_run_once
CRYPTO_THREAD_set_local
CRYPTO_THREAD_unlock
CRYPTO_THREAD_write_lock
CRYPTO_atomic_add
CRYPTO_cbc128_decrypt
CRYPTO_cbc128_encrypt
CRYPTO_ccm128_aad
CRYPTO_ccm128_decrypt
CRYPTO_ccm128_decrypt_ccm64
CRYPTO_ccm128_encrypt
CRYPTO_ccm128_encrypt_ccm64
CRYPTO_ccm128_init
CRYPTO_ccm128_setiv
CRYPTO_ccm128_tag
CRYPTO_cfb128_1_encrypt
CRYPTO_cfb128_8_encrypt
CRYPTO_cfb128_encrypt
CRYPTO_clear_free
CRYPTO_clear_realloc
CRYPTO_ctr128_encrypt
CRYPTO_ctr128_encrypt_ctr32
CRYPTO_cts128_decrypt
CRYPTO_cts128_decrypt_block
CRYPTO_cts128_encrypt
CRYPTO_cts128_encrypt_block
CRYPTO_dup_ex_data
CRYPTO_free
CRYPTO_free_ex_data
CRYPTO_free_ex_index
CRYPTO_gcm128_aad
CRYPTO_gcm128_decrypt
CRYPTO_gcm128_decrypt_ctr32
CRYPTO_gcm128_encrypt
CRYPTO_gcm128_encrypt_ctr32
CRYPTO_gcm128_finish
CRYPTO_gcm128_init
CRYPTO_gcm128_new
CRYPTO_gcm128_release
CRYPTO_gcm128_setiv
CRYPTO_gcm128_tag
CRYPTO_get_ex_data
CRYPTO_get_ex_new_index
CRYPTO_get_mem_functions
CRYPTO_malloc
CRYPTO_mem_ctrl
CRYPTO_memcmp
CRYPTO_memdup
CRYPTO_new_ex_data
CRYPTO_nistcts128_decrypt
CRYPTO_nistcts128_decrypt_block
CRYPTO_nistcts128_encrypt
CRYPTO_nistcts128_encrypt_block
CRYPTO_ocb128_aad
CRYPTO_ocb128_cleanup
CRYPTO_ocb128_copy_ctx
CRYPTO_ocb128_decrypt
CRYPTO_ocb128_encrypt
CRYPTO_ocb128_finish
CRYPTO_ocb128_init
CRYPTO_ocb128_new
CRYPTO_ocb128_setiv
CRYPTO_ocb128_tag
CRYPTO_ofb128_encrypt
CRYPTO_realloc
CRYPTO_secure_actual_size
CRYPTO_secure_allocated
CRYPTO_secure_clear_free
CRYPTO_secure_free
CRYPTO_secure_malloc
CRYPTO_secure_malloc_done
CRYPTO_secure_malloc_init
CRYPTO_secure_malloc_initialized
CRYPTO_secure_used
CRYPTO_secure_zalloc
CRYPTO_set_ex_data
CRYPTO_set_mem_debug
CRYPTO_set_mem_functions
CRYPTO_strdup
CRYPTO_strndup
CRYPTO_xts128_encrypt
CRYPTO_zalloc
CTLOG_STORE_free
CTLOG_STORE_get0_log_by_id
CTLOG_STORE_load_default_file
CTLOG_STORE_load_file
CTLOG_STORE_new
CTLOG_free
CTLOG_get0_log_id
CTLOG_get0_name
CTLOG_get0_public_key
CTLOG_new
CTLOG_new_from_base64
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_get0_cert
CT_POLICY_EVAL_CTX_get0_issuer
CT_POLICY_EVAL_CTX_get0_log_store
CT_POLICY_EVAL_CTX_get_time
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
Camellia_cbc_encrypt
Camellia_cfb128_encrypt
Camellia_cfb1_encrypt
Camellia_cfb8_encrypt
Camellia_ctr128_encrypt
Camellia_decrypt
Camellia_ecb_encrypt
Camellia_encrypt
Camellia_ofb128_encrypt
Camellia_set_key
DES_cbc_cksum
DES_cbc_encrypt
DES_cfb64_encrypt
DES_cfb_encrypt
DES_check_key_parity
DES_crypt
DES_decrypt3
DES_ecb3_encrypt
DES_ecb_encrypt
DES_ede3_cbc_encrypt
DES_ede3_cfb64_encrypt
DES_ede3_cfb_encrypt
DES_ede3_ofb64_encrypt
DES_encrypt1
DES_encrypt2
DES_encrypt3
DES_fcrypt
DES_is_weak_key
DES_key_sched
DES_ncbc_encrypt
DES_ofb64_encrypt
DES_ofb_encrypt
DES_options
DES_pcbc_encrypt
DES_quad_cksum
DES_random_key
DES_set_key
DES_set_key_checked
DES_set_key_unchecked
DES_set_odd_parity
DES_string_to_2keys
DES_string_to_key
DES_xcbc_encrypt
DH_KDF_X9_42
DH_OpenSSL
DH_bits
DH_check
DH_check_ex
DH_check_params
DH_check_params_ex
DH_check_pub_key
DH_check_pub_key_ex
DH_clear_flags
DH_compute_key
DH_compute_key_padded
DH_free
DH_generate_key
DH_generate_parameters
DH_generate_parameters_ex
DH_get0_engine
DH_get0_g
DH_get0_key
DH_get0_p
DH_get0_pqg
DH_get0_priv_key
DH_get0_pub_key
DH_get0_q
DH_get_1024_160
DH_get_2048_224
DH_get_2048_256
DH_get_default_method
DH_get_ex_data
DH_get_length
DH_get_nid
DH_meth_dup
DH_meth_free
DH_meth_get0_app_data
DH_meth_get0_name
DH_meth_get_bn_mod_exp
DH_meth_get_compute_key
DH_meth_get_finish
DH_meth_get_flags
DH_meth_get_generate_key
DH_meth_get_generate_params
DH_meth_get_init
DH_meth_new
DH_meth_set0_app_data
DH_meth_set1_name
DH_meth_set_bn_mod_exp
DH_meth_set_compute_key
DH_meth_set_finish
DH_meth_set_flags
DH_meth_set_generate_key
DH_meth_set_generate_params
DH_meth_set_init
DH_new
DH_new_by_nid
DH_new_method
DH_security_bits
DH_set0_key
DH_set0_pqg
DH_set_default_method
DH_set_ex_data
DH_set_flags
DH_set_length
DH_set_method
DH_size
DH_test_flags
DH_up_ref
DHparams_dup
DHparams_it
DHparams_print
DHparams_print_fp
DIRECTORYSTRING_free
DIRECTORYSTRING_it
DIRECTORYSTRING_new
DISPLAYTEXT_free
DISPLAYTEXT_it
DISPLAYTEXT_new
DIST_POINT_NAME_free
DIST_POINT_NAME_it
DIST_POINT_NAME_new
DIST_POINT_free
DIST_POINT_it
DIST_POINT_new
DIST_POINT_set_dpname
DSA_OpenSSL
DSA_SIG_free
DSA_SIG_get0
DSA_SIG_new
DSA_SIG_set0
DSA_bits
DSA_clear_flags
DSA_do_sign
DSA_do_verify
DSA_dup_DH
DSA_free
DSA_generate_key
DSA_generate_parameters
DSA_generate_parameters_ex
DSA_get0_engine
DSA_get0_g
DSA_get0_key
DSA_get0_p
DSA_get0_pqg
DSA_get0_priv_key
DSA_get0_pub_key
DSA_get0_q
DSA_get_default_method
DSA_get_ex_data
DSA_get_method
DSA_meth_dup
DSA_meth_free
DSA_meth_get0_app_data
DSA_meth_get0_name
DSA_meth_get_bn_mod_exp
DSA_meth_get_finish
DSA_meth_get_flags
DSA_meth_get_init
DSA_meth_get_keygen
DSA_meth_get_mod_exp
DSA_meth_get_paramgen
DSA_meth_get_sign
DSA_meth_get_sign_setup
DSA_meth_get_verify
DSA_meth_new
DSA_meth_set0_app_data
DSA_meth_set1_name
DSA_meth_set_bn_mod_exp
DSA_meth_set_finish
DSA_meth_set_flags
DSA_meth_set_init
DSA_meth_set_keygen
DSA_meth_set_mod_exp
DSA_meth_set_paramgen
DSA_meth_set_sign
DSA_meth_set_sign_setup
DSA_meth_set_verify
DSA_new
DSA_new_method
DSA_print
DSA_print_fp
DSA_security_bits
DSA_set0_key
DSA_set0_pqg
DSA_set_default_method
DSA_set_ex_data
DSA_set_flags
DSA_set_method
DSA_sign
DSA_sign_setup
DSA_size
DSA_test_flags
DSA_up_ref
DSA_verify
DSAparams_dup
DSAparams_print
DSAparams_print_fp
DSO_METHOD_openssl
DSO_bind_func
DSO_convert_filename
DSO_ctrl
DSO_dsobyaddr
DSO_flags
DSO_free
DSO_get_filename
DSO_global_lookup
DSO_load
DSO_merge
DSO_new
DSO_pathbyaddr
DSO_set_filename
DSO_up_ref
ECDH_KDF_X9_62
ECDH_compute_key
ECDSA_SIG_free
ECDSA_SIG_get0
ECDSA_SIG_get0_r
ECDSA_SIG_get0_s
ECDSA_SIG_new
ECDSA_SIG_set0
ECDSA_do_sign
ECDSA_do_sign_ex
ECDSA_do_verify
ECDSA_sign
ECDSA_sign_ex
ECDSA_sign_setup
ECDSA_size
ECDSA_verify
ECPARAMETERS_free
ECPARAMETERS_it
ECPARAMETERS_new
ECPKPARAMETERS_free
ECPKPARAMETERS_it
ECPKPARAMETERS_new
ECPKParameters_print
ECPKParameters_print_fp
ECParameters_print
ECParameters_print_fp
EC_GF2m_simple_method
EC_GFp_mont_method
EC_GFp_nist_method
EC_GFp_simple_method
EC_GROUP_check
EC_GROUP_check_discriminant
EC_GROUP_clear_free
EC_GROUP_cmp
EC_GROUP_copy
EC_GROUP_dup
EC_GROUP_free
EC_GROUP_get0_cofactor
EC_GROUP_get0_generator
EC_GROUP_get0_order
EC_GROUP_get0_seed
EC_GROUP_get_asn1_flag
EC_GROUP_get_basis_type
EC_GROUP_get_cofactor
EC_GROUP_get_curve
EC_GROUP_get_curve_GF2m
EC_GROUP_get_curve_GFp
EC_GROUP_get_curve_name
EC_GROUP_get_degree
EC_GROUP_get_ecparameters
EC_GROUP_get_ecpkparameters
EC_GROUP_get_mont_data
EC_GROUP_get_order
EC_GROUP_get_pentanomial_basis
EC_GROUP_get_point_conversion_form
EC_GROUP_get_seed_len
EC_GROUP_get_trinomial_basis
EC_GROUP_have_precompute_mult
EC_GROUP_method_of
EC_GROUP_new
EC_GROUP_new_by_curve_name
EC_GROUP_new_curve_GF2m
EC_GROUP_new_curve_GFp
EC_GROUP_new_from_ecparameters
EC_GROUP_new_from_ecpkparameters
EC_GROUP_order_bits
EC_GROUP_precompute_mult
EC_GROUP_set_asn1_flag
EC_GROUP_set_curve
EC_GROUP_set_curve_GF2m
EC_GROUP_set_curve_GFp
EC_GROUP_set_curve_name
EC_GROUP_set_generator
EC_GROUP_set_point_conversion_form
EC_GROUP_set_seed
EC_KEY_METHOD_free
EC_KEY_METHOD_get_compute_key
EC_KEY_METHOD_get_init
EC_KEY_METHOD_get_keygen
EC_KEY_METHOD_get_sign
EC_KEY_METHOD_get_verify
EC_KEY_METHOD_new
EC_KEY_METHOD_set_compute_key
EC_KEY_METHOD_set_init
EC_KEY_METHOD_set_keygen
EC_KEY_METHOD_set_sign
EC_KEY_METHOD_set_verify
EC_KEY_OpenSSL
EC_KEY_can_sign
EC_KEY_check_key
EC_KEY_clear_flags
EC_KEY_copy
EC_KEY_dup
EC_KEY_free
EC_KEY_generate_key
EC_KEY_get0_engine
EC_KEY_get0_group
EC_KEY_get0_private_key
EC_KEY_get0_public_key
EC_KEY_get_conv_form
EC_KEY_get_default_method
EC_KEY_get_enc_flags
EC_KEY_get_ex_data
EC_KEY_get_flags
EC_KEY_get_method
EC_KEY_key2buf
EC_KEY_new
EC_KEY_new_by_curve_name
EC_KEY_new_method
EC_KEY_oct2key
EC_KEY_oct2priv
EC_KEY_precompute_mult
EC_KEY_print
EC_KEY_print_fp
EC_KEY_priv2buf
EC_KEY_priv2oct
EC_KEY_set_asn1_flag
EC_KEY_set_conv_form
EC_KEY_set_default_method
EC_KEY_set_enc_flags
EC_KEY_set_ex_data
EC_KEY_set_flags
EC_KEY_set_group
EC_KEY_set_method
EC_KEY_set_private_key
EC_KEY_set_public_key
EC_KEY_set_public_key_affine_coordinates
EC_KEY_up_ref
EC_METHOD_get_field_type
EC_POINT_add
EC_POINT_bn2point
EC_POINT_clear_free
EC_POINT_cmp
EC_POINT_copy
EC_POINT_dbl
EC_POINT_dup
EC_POINT_free
EC_POINT_get_Jprojective_coordinates_GFp
EC_POINT_get_affine_coordinates
EC_POINT_get_affine_coordinates_GF2m
EC_POINT_get_affine_coordinates_GFp
EC_POINT_hex2point
EC_POINT_invert
EC_POINT_is_at_infinity
EC_POINT_is_on_curve
EC_POINT_make_affine
EC_POINT_method_of
EC_POINT_mul
EC_POINT_new
EC_POINT_oct2point
EC_POINT_point2bn
EC_POINT_point2buf
EC_POINT_point2hex
EC_POINT_point2oct
EC_POINT_set_Jprojective_coordinates_GFp
EC_POINT_set_affine_coordinates
EC_POINT_set_affine_coordinates_GF2m
EC_POINT_set_affine_coordinates_GFp
EC_POINT_set_compressed_coordinates
EC_POINT_set_compressed_coordinates_GF2m
EC_POINT_set_compressed_coordinates_GFp
EC_POINT_set_to_infinity
EC_POINTs_make_affine
EC_POINTs_mul
EC_curve_nid2nist
EC_curve_nist2nid
EC_get_builtin_curves
EDIPARTYNAME_free
EDIPARTYNAME_it
EDIPARTYNAME_new
ENGINE_add
ENGINE_add_conf_module
ENGINE_by_id
ENGINE_cmd_is_executable
ENGINE_ctrl
ENGINE_ctrl_cmd
ENGINE_ctrl_cmd_string
ENGINE_finish
ENGINE_free
ENGINE_get_DH
ENGINE_get_DSA
ENGINE_get_EC
ENGINE_get_RAND
ENGINE_get_RSA
ENGINE_get_cipher
ENGINE_get_cipher_engine
ENGINE_get_ciphers
ENGINE_get_cmd_defns
ENGINE_get_ctrl_function
ENGINE_get_default_DH
ENGINE_get_default_DSA
ENGINE_get_default_EC
ENGINE_get_default_RAND
ENGINE_get_default_RSA
ENGINE_get_destroy_function
ENGINE_get_digest
ENGINE_get_digest_engine
ENGINE_get_digests
ENGINE_get_ex_data
ENGINE_get_finish_function
ENGINE_get_first
ENGINE_get_flags
ENGINE_get_id
ENGINE_get_init_function
ENGINE_get_last
ENGINE_get_load_privkey_function
ENGINE_get_load_pubkey_function
ENGINE_get_name
ENGINE_get_next
ENGINE_get_pkey_asn1_meth
ENGINE_get_pkey_asn1_meth_engine
ENGINE_get_pkey_asn1_meth_str
ENGINE_get_pkey_asn1_meths
ENGINE_get_pkey_meth
ENGINE_get_pkey_meth_engine
ENGINE_get_pkey_meths
ENGINE_get_prev
ENGINE_get_ssl_client_cert_function
ENGINE_get_static_state
ENGINE_get_table_flags
ENGINE_init
ENGINE_load_builtin_engines
ENGINE_load_private_key
ENGINE_load_public_key
ENGINE_load_ssl_client_cert
ENGINE_new
ENGINE_pkey_asn1_find_str
ENGINE_register_DH
ENGINE_register_DSA
ENGINE_register_EC
ENGINE_register_RAND
ENGINE_register_RSA
ENGINE_register_all_DH
ENGINE_register_all_DSA
ENGINE_register_all_EC
ENGINE_register_all_RAND
ENGINE_register_all_RSA
ENGINE_register_all_ciphers
ENGINE_register_all_complete
ENGINE_register_all_digests
ENGINE_register_all_pkey_asn1_meths
ENGINE_register_all_pkey_meths
ENGINE_register_ciphers
ENGINE_register_complete
ENGINE_register_digests
ENGINE_register_pkey_asn1_meths
ENGINE_register_pkey_meths
ENGINE_remove
ENGINE_set_DH
ENGINE_set_DSA
ENGINE_set_EC
ENGINE_set_RAND
ENGINE_set_RSA
ENGINE_set_ciphers
ENGINE_set_cmd_defns
ENGINE_set_ctrl_function
ENGINE_set_default
ENGINE_set_default_DH
ENGINE_set_default_DSA
ENGINE_set_default_EC
ENGINE_set_default_RAND
ENGINE_set_default_RSA
ENGINE_set_default_ciphers
ENGINE_set_default_digests
ENGINE_set_default_pkey_asn1_meths
ENGINE_set_default_pkey_meths
ENGINE_set_default_string
ENGINE_set_destroy_function
ENGINE_set_digests
ENGINE_set_ex_data
ENGINE_set_finish_function
ENGINE_set_flags
ENGINE_set_id
ENGINE_set_init_function
ENGINE_set_load_privkey_function
ENGINE_set_load_pubkey_function
ENGINE_set_load_ssl_client_cert_function
ENGINE_set_name
ENGINE_set_pkey_asn1_meths
ENGINE_set_pkey_meths
ENGINE_set_table_flags
ENGINE_unregister_DH
ENGINE_unregister_DSA
ENGINE_unregister_EC
ENGINE_unregister_RAND
ENGINE_unregister_RSA
ENGINE_unregister_ciphers
ENGINE_unregister_digests
ENGINE_unregister_pkey_asn1_meths
ENGINE_unregister_pkey_meths
ENGINE_up_ref
ERR_add_error_data
ERR_add_error_vdata
ERR_clear_error
ERR_clear_last_mark
ERR_error_string
ERR_error_string_n
ERR_func_error_string
ERR_get_error
ERR_get_error_line
ERR_get_error_line_data
ERR_get_next_error_library
ERR_get_state
ERR_lib_error_string
ERR_load_ASN1_strings
ERR_load_ASYNC_strings
ERR_load_BIO_strings
ERR_load_BN_strings
ERR_load_BUF_strings
ERR_load_CMS_strings
ERR_load_COMP_strings
ERR_load_CONF_strings
ERR_load_CRYPTO_strings
ERR_load_CT_strings
ERR_load_DH_strings
ERR_load_DSA_strings
ERR_load_DSO_strings
ERR_load_EC_strings
ERR_load_ENGINE_strings
ERR_load_ERR_strings
ERR_load_EVP_strings
ERR_load_KDF_strings
ERR_load_OBJ_strings
ERR_load_OCSP_strings
ERR_load_OSSL_STORE_strings
ERR_load_PEM_strings
ERR_load_PKCS12_strings
ERR_load_PKCS7_strings
ERR_load_RAND_strings
ERR_load_RSA_strings
ERR_load_TS_strings
ERR_load_UI_strings
ERR_load_X509V3_strings
ERR_load_X509_strings
ERR_load_strings
ERR_load_strings_const
ERR_peek_error
ERR_peek_error_line
ERR_peek_error_line_data
ERR_peek_last_error
ERR_peek_last_error_line
ERR_peek_last_error_line_data
ERR_pop_to_mark
ERR_print_errors
ERR_print_errors_cb
ERR_print_errors_fp
ERR_put_error
ERR_reason_error_string
ERR_remove_state
ERR_remove_thread_state
ERR_set_error_data
ERR_set_mark
ERR_unload_strings
ESS_CERT_ID_V2_dup
ESS_CERT_ID_V2_free
ESS_CERT_ID_V2_new
ESS_CERT_ID_dup
ESS_CERT_ID_free
ESS_CERT_ID_new
ESS_ISSUER_SERIAL_dup
ESS_ISSUER_SERIAL_free
ESS_ISSUER_SERIAL_new
ESS_SIGNING_CERT_V2_dup
ESS_SIGNING_CERT_V2_free
ESS_SIGNING_CERT_V2_new
ESS_SIGNING_CERT_dup
ESS_SIGNING_CERT_free
ESS_SIGNING_CERT_new
EVP_BytesToKey
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_buf_noconst
EVP_CIPHER_CTX_cipher
EVP_CIPHER_CTX_clear_flags
EVP_CIPHER_CTX_copy
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_encrypting
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_get_app_data
EVP_CIPHER_CTX_get_cipher_data
EVP_CIPHER_CTX_iv
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_iv_noconst
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_nid
EVP_CIPHER_CTX_num
EVP_CIPHER_CTX_original_iv
EVP_CIPHER_CTX_rand_key
EVP_CIPHER_CTX_reset
EVP_CIPHER_CTX_set_app_data
EVP_CIPHER_CTX_set_cipher_data
EVP_CIPHER_CTX_set_flags
EVP_CIPHER_CTX_set_key_length
EVP_CIPHER_CTX_set_num
EVP_CIPHER_CTX_set_padding
EVP_CIPHER_CTX_test_flags
EVP_CIPHER_asn1_to_param
EVP_CIPHER_block_size
EVP_CIPHER_do_all
EVP_CIPHER_do_all_sorted
EVP_CIPHER_flags
EVP_CIPHER_get_asn1_iv
EVP_CIPHER_impl_ctx_size
EVP_CIPHER_iv_length
EVP_CIPHER_key_length
EVP_CIPHER_meth_dup
EVP_CIPHER_meth_free
EVP_CIPHER_meth_get_cleanup
EVP_CIPHER_meth_get_ctrl
EVP_CIPHER_meth_get_do_cipher
EVP_CIPHER_meth_get_get_asn1_params
EVP_CIPHER_meth_get_init
EVP_CIPHER_meth_get_set_asn1_params
EVP_CIPHER_meth_new
EVP_CIPHER_meth_set_cleanup
EVP_CIPHER_meth_set_ctrl
EVP_CIPHER_meth_set_do_cipher
EVP_CIPHER_meth_set_flags
EVP_CIPHER_meth_set_get_asn1_params
EVP_CIPHER_meth_set_impl_ctx_size
EVP_CIPHER_meth_set_init
EVP_CIPHER_meth_set_iv_length
EVP_CIPHER_meth_set_set_asn1_params
EVP_CIPHER_nid
EVP_CIPHER_param_to_asn1
EVP_CIPHER_set_asn1_iv
EVP_CIPHER_type
EVP_Cipher
EVP_CipherFinal
EVP_CipherFinal_ex
EVP_CipherInit
EVP_CipherInit_ex
EVP_CipherUpdate
EVP_DecodeBlock
EVP_DecodeFinal
EVP_DecodeInit
EVP_DecodeUpdate
EVP_DecryptFinal
EVP_DecryptFinal_ex
EVP_DecryptInit
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_Digest
EVP_DigestFinal
EVP_DigestFinalXOF
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestSign
EVP_DigestSignFinal
EVP_DigestSignInit
EVP_DigestUpdate
EVP_DigestVerify
EVP_DigestVerifyFinal
EVP_DigestVerifyInit
EVP_ENCODE_CTX_copy
EVP_ENCODE_CTX_free
EVP_ENCODE_CTX_new
EVP_ENCODE_CTX_num
EVP_EncodeBlock
EVP_EncodeFinal
EVP_EncodeInit
EVP_EncodeUpdate
EVP_EncryptFinal
EVP_EncryptFinal_ex
EVP_EncryptInit
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_MD_CTX_clear_flags
EVP_MD_CTX_copy
EVP_MD_CTX_copy_ex
EVP_MD_CTX_ctrl
EVP_MD_CTX_free
EVP_MD_CTX_md
EVP_MD_CTX_md_data
EVP_MD_CTX_new
EVP_MD_CTX_pkey_ctx
EVP_MD_CTX_reset
EVP_MD_CTX_set_flags
EVP_MD_CTX_set_pkey_ctx
EVP_MD_CTX_set_update_fn
EVP_MD_CTX_test_flags
EVP_MD_CTX_update_fn
EVP_MD_block_size
EVP_MD_do_all
EVP_MD_do_all_sorted
EVP_MD_flags
EVP_MD_meth_dup
EVP_MD_meth_free
EVP_MD_meth_get_app_datasize
EVP_MD_meth_get_cleanup
EVP_MD_meth_get_copy
EVP_MD_meth_get_ctrl
EVP_MD_meth_get_final
EVP_MD_meth_get_flags
EVP_MD_meth_get_init
EVP_MD_meth_get_input_blocksize
EVP_MD_meth_get_result_size
EVP_MD_meth_get_update
EVP_MD_meth_new
EVP_MD_meth_set_app_datasize
EVP_MD_meth_set_cleanup
EVP_MD_meth_set_copy
EVP_MD_meth_set_ctrl
EVP_MD_meth_set_final
EVP_MD_meth_set_flags
EVP_MD_meth_set_init
EVP_MD_meth_set_input_blocksize
EVP_MD_meth_set_result_size
EVP_MD_meth_set_update
EVP_MD_pkey_type
EVP_MD_size
EVP_MD_type
EVP_OpenFinal
EVP_OpenInit
EVP_PBE_CipherInit
EVP_PBE_alg_add
EVP_PBE_alg_add_type
EVP_PBE_cleanup
EVP_PBE_find
EVP_PBE_get
EVP_PBE_scrypt
EVP_PKCS82PKEY
EVP_PKEY2PKCS8
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_ctrl_uint64
EVP_PKEY_CTX_dup
EVP_PKEY_CTX_free
EVP_PKEY_CTX_get0_peerkey
EVP_PKEY_CTX_get0_pkey
EVP_PKEY_CTX_get_app_data
EVP_PKEY_CTX_get_cb
EVP_PKEY_CTX_get_data
EVP_PKEY_CTX_get_keygen_info
EVP_PKEY_CTX_get_operation
EVP_PKEY_CTX_hex2ctrl
EVP_PKEY_CTX_md
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_CTX_set0_keygen_info
EVP_PKEY_CTX_set_app_data
EVP_PKEY_CTX_set_cb
EVP_PKEY_CTX_set_data
EVP_PKEY_CTX_str2ctrl
EVP_PKEY_add1_attr
EVP_PKEY_add1_attr_by_NID
EVP_PKEY_add1_attr_by_OBJ
EVP_PKEY_add1_attr_by_txt
EVP_PKEY_asn1_add0
EVP_PKEY_asn1_add_alias
EVP_PKEY_asn1_copy
EVP_PKEY_asn1_find
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_free
EVP_PKEY_asn1_get0
EVP_PKEY_asn1_get0_info
EVP_PKEY_asn1_get_count
EVP_PKEY_asn1_new
EVP_PKEY_asn1_set_check
EVP_PKEY_asn1_set_ctrl
EVP_PKEY_asn1_set_free
EVP_PKEY_asn1_set_get_priv_key
EVP_PKEY_asn1_set_get_pub_key
EVP_PKEY_asn1_set_item
EVP_PKEY_asn1_set_param
EVP_PKEY_asn1_set_param_check
EVP_PKEY_asn1_set_private
EVP_PKEY_asn1_set_public
EVP_PKEY_asn1_set_public_check
EVP_PKEY_asn1_set_security_bits
EVP_PKEY_asn1_set_set_priv_key
EVP_PKEY_asn1_set_set_pub_key
EVP_PKEY_asn1_set_siginf
EVP_PKEY_assign
EVP_PKEY_base_id
EVP_PKEY_bits
EVP_PKEY_check
EVP_PKEY_cmp
EVP_PKEY_cmp_parameters
EVP_PKEY_copy_parameters
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt_old
EVP_PKEY_delete_attr
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt_old
EVP_PKEY_free
EVP_PKEY_get0
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
EVP_PKEY_get0_asn1
EVP_PKEY_get0_engine
EVP_PKEY_get0_hmac
EVP_PKEY_get0_poly1305
EVP_PKEY_get0_siphash
EVP_PKEY_get1_DH
EVP_PKEY_get1_DSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_get1_tls_encodedpoint
EVP_PKEY_get_attr
EVP_PKEY_get_attr_by_NID
EVP_PKEY_get_attr_by_OBJ
EVP_PKEY_get_attr_count
EVP_PKEY_get_default_digest_nid
EVP_PKEY_get_raw_private_key
EVP_PKEY_get_raw_public_key
EVP_PKEY_id
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_meth_add0
EVP_PKEY_meth_copy
EVP_PKEY_meth_find
EVP_PKEY_meth_free
EVP_PKEY_meth_get0
EVP_PKEY_meth_get0_info
EVP_PKEY_meth_get_check
EVP_PKEY_meth_get_cleanup
EVP_PKEY_meth_get_copy
EVP_PKEY_meth_get_count
EVP_PKEY_meth_get_ctrl
EVP_PKEY_meth_get_decrypt
EVP_PKEY_meth_get_derive
EVP_PKEY_meth_get_digest_custom
EVP_PKEY_meth_get_encrypt
EVP_PKEY_meth_get_init
EVP_PKEY_meth_get_keygen
EVP_PKEY_meth_get_param_check
EVP_PKEY_meth_get_paramgen
EVP_PKEY_meth_get_public_check
EVP_PKEY_meth_get_sign
EVP_PKEY_meth_get_signctx
EVP_PKEY_meth_get_verify
EVP_PKEY_meth_get_verify_recover
EVP_PKEY_meth_get_verifyctx
EVP_PKEY_meth_new
EVP_PKEY_meth_remove
EVP_PKEY_meth_set_check
EVP_PKEY_meth_set_cleanup
EVP_PKEY_meth_set_copy
EVP_PKEY_meth_set_ctrl
EVP_PKEY_meth_set_decrypt
EVP_PKEY_meth_set_derive
EVP_PKEY_meth_set_digest_custom
EVP_PKEY_meth_set_encrypt
EVP_PKEY_meth_set_init
EVP_PKEY_meth_set_keygen
EVP_PKEY_meth_set_param_check
EVP_PKEY_meth_set_paramgen
EVP_PKEY_meth_set_public_check
EVP_PKEY_meth_set_sign
EVP_PKEY_meth_set_signctx
EVP_PKEY_meth_set_verify
EVP_PKEY_meth_set_verify_recover
EVP_PKEY_meth_set_verifyctx
EVP_PKEY_missing_parameters
EVP_PKEY_new
EVP_PKEY_new_CMAC_key
EVP_PKEY_new_mac_key
EVP_PKEY_new_raw_private_key
EVP_PKEY_new_raw_public_key
EVP_PKEY_param_check
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_print_params
EVP_PKEY_print_private
EVP_PKEY_print_public
EVP_PKEY_public_check
EVP_PKEY_save_parameters
EVP_PKEY_security_bits
EVP_PKEY_set1_DH
EVP_PKEY_set1_DSA
EVP_PKEY_set1_EC_KEY
EVP_PKEY_set1_RSA
EVP_PKEY_set1_engine
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_set_alias_type
EVP_PKEY_set_type
EVP_PKEY_set_type_str
EVP_PKEY_sign
EVP_PKEY_sign_init
EVP_PKEY_size
EVP_PKEY_type
EVP_PKEY_up_ref
EVP_PKEY_verify
EVP_PKEY_verify_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_recover_init
EVP_SealFinal
EVP_SealInit
EVP_SignFinal
EVP_VerifyFinal
EVP_add_alg_module
EVP_add_cipher
EVP_add_digest
EVP_aes_128_cbc
EVP_aes_128_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_128_ccm
EVP_aes_128_cfb1
EVP_aes_128_cfb128
EVP_aes_128_cfb8
EVP_aes_128_ctr
EVP_aes_128_ecb
EVP_aes_128_gcm
EVP_aes_128_ocb
EVP_aes_128_ofb
EVP_aes_128_wrap
EVP_aes_128_wrap_pad
EVP_aes_128_xts
EVP_aes_192_cbc
EVP_aes_192_ccm
EVP_aes_192_cfb1
EVP_aes_192_cfb128
EVP_aes_192_cfb8
EVP_aes_192_ctr
EVP_aes_192_ecb
EVP_aes_192_gcm
EVP_aes_192_ocb
EVP_aes_192_ofb
EVP_aes_192_wrap
EVP_aes_192_wrap_pad
EVP_aes_256_cbc
EVP_aes_256_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha256
EVP_aes_256_ccm
EVP_aes_256_cfb1
EVP_aes_256_cfb128
EVP_aes_256_cfb8
EVP_aes_256_ctr
EVP_aes_256_ecb
EVP_aes_256_gcm
EVP_aes_256_ocb
EVP_aes_256_ofb
EVP_aes_256_wrap
EVP_aes_256_wrap_pad
EVP_aes_256_xts
EVP_aria_128_cbc
EVP_aria_128_ccm
EVP_aria_128_cfb1
EVP_aria_128_cfb128
EVP_aria_128_cfb8
EVP_aria_128_ctr
EVP_aria_128_ecb
EVP_aria_128_gcm
EVP_aria_128_ofb
EVP_aria_192_cbc
EVP_aria_192_ccm
EVP_aria_192_cfb1
EVP_aria_192_cfb128
EVP_aria_192_cfb8
EVP_aria_192_ctr
EVP_aria_192_ecb
EVP_aria_192_gcm
EVP_aria_192_ofb
EVP_aria_256_cbc
EVP_aria_256_ccm
EVP_aria_256_cfb1
EVP_aria_256_cfb128
EVP_aria_256_cfb8
EVP_aria_256_ctr
EVP_aria_256_ecb
EVP_aria_256_gcm
EVP_aria_256_ofb
EVP_bf_cbc
EVP_bf_cfb64
EVP_bf_ecb
EVP_bf_ofb
EVP_blake2b512
EVP_blake2s256
EVP_camellia_128_cbc
EVP_camellia_128_cfb1
EVP_camellia_128_cfb128
EVP_camellia_128_cfb8
EVP_camellia_128_ctr
EVP_camellia_128_ecb
EVP_camellia_128_ofb
EVP_camellia_192_cbc
EVP_camellia_192_cfb1
EVP_camellia_192_cfb128
EVP_camellia_192_cfb8
EVP_camellia_192_ctr
EVP_camellia_192_ecb
EVP_camellia_192_ofb
EVP_camellia_256_cbc
EVP_camellia_256_cfb1
EVP_camellia_256_cfb128
EVP_camellia_256_cfb8
EVP_camellia_256_ctr
EVP_camellia_256_ecb
EVP_camellia_256_ofb
EVP_cast5_cbc
EVP_cast5_cfb64
EVP_cast5_ecb
EVP_cast5_ofb
EVP_chacha20
EVP_chacha20_poly1305
EVP_des_cbc
EVP_des_cfb1
EVP_des_cfb64
EVP_des_cfb8
EVP_des_ecb
EVP_des_ede
EVP_des_ede3
EVP_des_ede3_cbc
EVP_des_ede3_cfb1
EVP_des_ede3_cfb64
EVP_des_ede3_cfb8
EVP_des_ede3_ecb
EVP_des_ede3_ofb
EVP_des_ede3_wrap
EVP_des_ede_cbc
EVP_des_ede_cfb64
EVP_des_ede_ecb
EVP_des_ede_ofb
EVP_des_ofb
EVP_desx_cbc
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_get_pw_prompt
EVP_idea_cbc
EVP_idea_cfb64
EVP_idea_ecb
EVP_idea_ofb
EVP_md4
EVP_md5
EVP_md5_sha1
EVP_md_null
EVP_mdc2
EVP_rc2_40_cbc
EVP_rc2_64_cbc
EVP_rc2_cbc
EVP_rc2_cfb64
EVP_rc2_ecb
EVP_rc2_ofb
EVP_rc4
EVP_rc4_40
EVP_rc4_hmac_md5
EVP_read_pw_string
EVP_read_pw_string_min
EVP_ripemd160
EVP_seed_cbc
EVP_seed_cfb128
EVP_seed_ecb
EVP_seed_ofb
EVP_set_pw_prompt
EVP_sha1
EVP_sha224
EVP_sha256
EVP_sha384
EVP_sha3_224
EVP_sha3_256
EVP_sha3_384
EVP_sha3_512
EVP_sha512
EVP_sha512_224
EVP_sha512_256
EVP_shake128
EVP_shake256
EVP_sm3
EVP_sm4_cbc
EVP_sm4_cfb128
EVP_sm4_ctr
EVP_sm4_ecb
EVP_sm4_ofb
EVP_whirlpool
EXTENDED_KEY_USAGE_free
EXTENDED_KEY_USAGE_it
EXTENDED_KEY_USAGE_new
FIPS_mode
FIPS_mode_set
GENERAL_NAMES_free
GENERAL_NAMES_it
GENERAL_NAMES_new
GENERAL_NAME_cmp
GENERAL_NAME_dup
GENERAL_NAME_free
GENERAL_NAME_get0_otherName
GENERAL_NAME_get0_value
GENERAL_NAME_it
GENERAL_NAME_new
GENERAL_NAME_print
GENERAL_NAME_set0_othername
GENERAL_NAME_set0_value
GENERAL_SUBTREE_free
GENERAL_SUBTREE_it
GENERAL_SUBTREE_new
HMAC
HMAC_CTX_copy
HMAC_CTX_free
HMAC_CTX_get_md
HMAC_CTX_new
HMAC_CTX_reset
HMAC_CTX_set_flags
HMAC_Final
HMAC_Init
HMAC_Init_ex
HMAC_Update
HMAC_size
IDEA_cbc_encrypt
IDEA_cfb64_encrypt
IDEA_ecb_encrypt
IDEA_encrypt
IDEA_ofb64_encrypt
IDEA_options
IDEA_set_decrypt_key
IDEA_set_encrypt_key
INT32_it
INT64_it
IPAddressChoice_free
IPAddressChoice_it
IPAddressChoice_new
IPAddressFamily_free
IPAddressFamily_it
IPAddressFamily_new
IPAddressOrRange_free
IPAddressOrRange_it
IPAddressOrRange_new
IPAddressRange_free
IPAddressRange_it
IPAddressRange_new
ISSUING_DIST_POINT_free
ISSUING_DIST_POINT_it
ISSUING_DIST_POINT_new
LONG_it
MD4
MD4_Final
MD4_Init
MD4_Transform
MD4_Update
MD5
MD5_Final
MD5_Init
MD5_Transform
MD5_Update
MDC2
MDC2_Final
MDC2_Init
MDC2_Update
NAME_CONSTRAINTS_check
NAME_CONSTRAINTS_check_CN
NAME_CONSTRAINTS_free
NAME_CONSTRAINTS_it
NAME_CONSTRAINTS_new
NAMING_AUTHORITY_free
NAMING_AUTHORITY_get0_authorityId
NAMING_AUTHORITY_get0_authorityText
NAMING_AUTHORITY_get0_authorityURL
NAMING_AUTHORITY_it
NAMING_AUTHORITY_new
NAMING_AUTHORITY_set0_authorityId
NAMING_AUTHORITY_set0_authorityText
NAMING_AUTHORITY_set0_authorityURL
NCONF_WIN32
NCONF_default
NCONF_dump_bio
NCONF_dump_fp
NCONF_free
NCONF_free_data
NCONF_get_number_e
NCONF_get_section
NCONF_get_string
NCONF_load
NCONF_load_bio
NCONF_load_fp
NCONF_new
NETSCAPE_CERT_SEQUENCE_free
NETSCAPE_CERT_SEQUENCE_it
NETSCAPE_CERT_SEQUENCE_new
NETSCAPE_SPKAC_free
NETSCAPE_SPKAC_it
NETSCAPE_SPKAC_new
NETSCAPE_SPKI_b64_decode
NETSCAPE_SPKI_b64_encode
NETSCAPE_SPKI_free
NETSCAPE_SPKI_get_pubkey
NETSCAPE_SPKI_it
NETSCAPE_SPKI_new
NETSCAPE_SPKI_print
NETSCAPE_SPKI_set_pubkey
NETSCAPE_SPKI_sign
NETSCAPE_SPKI_verify
NOTICEREF_free
NOTICEREF_it
NOTICEREF_new
OBJ_NAME_add
OBJ_NAME_cleanup
OBJ_NAME_do_all
OBJ_NAME_do_all_sorted
OBJ_NAME_get
OBJ_NAME_init
OBJ_NAME_new_index
OBJ_NAME_remove
OBJ_add_object
OBJ_add_sigid
OBJ_bsearch_
OBJ_bsearch_ex_
OBJ_cmp
OBJ_create
OBJ_create_objects
OBJ_dup
OBJ_find_sigid_algs
OBJ_find_sigid_by_algs
OBJ_get0_data
OBJ_length
OBJ_ln2nid
OBJ_new_nid
OBJ_nid2ln
OBJ_nid2obj
OBJ_nid2sn
OBJ_obj2nid
OBJ_obj2txt
OBJ_sigid_free
OBJ_sn2nid
OBJ_txt2nid
OBJ_txt2obj
OCSP_BASICRESP_add1_ext_i2d
OCSP_BASICRESP_add_ext
OCSP_BASICRESP_delete_ext
OCSP_BASICRESP_free
OCSP_BASICRESP_get1_ext_d2i
OCSP_BASICRESP_get_ext
OCSP_BASICRESP_get_ext_by_NID
OCSP_BASICRESP_get_ext_by_OBJ
OCSP_BASICRESP_get_ext_by_critical
OCSP_BASICRESP_get_ext_count
OCSP_BASICRESP_it
OCSP_BASICRESP_new
OCSP_CERTID_dup
OCSP_CERTID_free
OCSP_CERTID_it
OCSP_CERTID_new
OCSP_CERTSTATUS_free
OCSP_CERTSTATUS_it
OCSP_CERTSTATUS_new
OCSP_CRLID_free
OCSP_CRLID_it
OCSP_CRLID_new
OCSP_ONEREQ_add1_ext_i2d
OCSP_ONEREQ_add_ext
OCSP_ONEREQ_delete_ext
OCSP_ONEREQ_free
OCSP_ONEREQ_get1_ext_d2i
OCSP_ONEREQ_get_ext
OCSP_ONEREQ_get_ext_by_NID
OCSP_ONEREQ_get_ext_by_OBJ
OCSP_ONEREQ_get_ext_by_critical
OCSP_ONEREQ_get_ext_count
OCSP_ONEREQ_it
OCSP_ONEREQ_new
OCSP_REQINFO_free
OCSP_REQINFO_it
OCSP_REQINFO_new
OCSP_REQUEST_add1_ext_i2d
OCSP_REQUEST_add_ext
OCSP_REQUEST_delete_ext
OCSP_REQUEST_free
OCSP_REQUEST_get1_ext_d2i
OCSP_REQUEST_get_ext
OCSP_REQUEST_get_ext_by_NID
OCSP_REQUEST_get_ext_by_OBJ
OCSP_REQUEST_get_ext_by_critical
OCSP_REQUEST_get_ext_count
OCSP_REQUEST_it
OCSP_REQUEST_new
OCSP_REQUEST_print
OCSP_REQ_CTX_add1_header
OCSP_REQ_CTX_free
OCSP_REQ_CTX_get0_mem_bio
OCSP_REQ_CTX_http
OCSP_REQ_CTX_i2d
OCSP_REQ_CTX_nbio
OCSP_REQ_CTX_nbio_d2i
OCSP_REQ_CTX_new
OCSP_REQ_CTX_set1_req
OCSP_RESPBYTES_free
OCSP_RESPBYTES_it
OCSP_RESPBYTES_new
OCSP_RESPDATA_free
OCSP_RESPDATA_it
OCSP_RESPDATA_new
OCSP_RESPID_free
OCSP_RESPID_it
OCSP_RESPID_match
OCSP_RESPID_new
OCSP_RESPID_set_by_key
OCSP_RESPID_set_by_name
OCSP_RESPONSE_free
OCSP_RESPONSE_it
OCSP_RESPONSE_new
OCSP_RESPONSE_print
OCSP_REVOKEDINFO_free
OCSP_REVOKEDINFO_it
OCSP_REVOKEDINFO_new
OCSP_SERVICELOC_free
OCSP_SERVICELOC_it
OCSP_SERVICELOC_new
OCSP_SIGNATURE_free
OCSP_SIGNATURE_it
OCSP_SIGNATURE_new
OCSP_SINGLERESP_add1_ext_i2d
OCSP_SINGLERESP_add_ext
OCSP_SINGLERESP_delete_ext
OCSP_SINGLERESP_free
OCSP_SINGLERESP_get0_id
OCSP_SINGLERESP_get1_ext_d2i
OCSP_SINGLERESP_get_ext
OCSP_SINGLERESP_get_ext_by_NID
OCSP_SINGLERESP_get_ext_by_OBJ
OCSP_SINGLERESP_get_ext_by_critical
OCSP_SINGLERESP_get_ext_count
OCSP_SINGLERESP_it
OCSP_SINGLERESP_new
OCSP_accept_responses_new
OCSP_archive_cutoff_new
OCSP_basic_add1_cert
OCSP_basic_add1_nonce
OCSP_basic_add1_status
OCSP_basic_sign
OCSP_basic_sign_ctx
OCSP_basic_verify
OCSP_cert_id_new
OCSP_cert_status_str
OCSP_cert_to_id
OCSP_check_nonce
OCSP_check_validity
OCSP_copy_nonce
OCSP_crlID_new
OCSP_crl_reason_str
OCSP_id_cmp
OCSP_id_get0_info
OCSP_id_issuer_cmp
OCSP_onereq_get0_id
OCSP_parse_url
OCSP_request_add0_id
OCSP_request_add1_cert
OCSP_request_add1_nonce
OCSP_request_is_signed
OCSP_request_onereq_count
OCSP_request_onereq_get0
OCSP_request_set1_name
OCSP_request_sign
OCSP_request_verify
OCSP_resp_count
OCSP_resp_find
OCSP_resp_find_status
OCSP_resp_get0
OCSP_resp_get0_certs
OCSP_resp_get0_id
OCSP_resp_get0_produced_at
OCSP_resp_get0_respdata
OCSP_resp_get0_signature
OCSP_resp_get0_signer
OCSP_resp_get0_tbs_sigalg
OCSP_resp_get1_id
OCSP_response_create
OCSP_response_get1_basic
OCSP_response_status
OCSP_response_status_str
OCSP_sendreq_bio
OCSP_sendreq_nbio
OCSP_sendreq_new
OCSP_set_max_response_length
OCSP_single_get0_status
OCSP_url_svcloc_new
OPENSSL_DIR_end
OPENSSL_DIR_read
OPENSSL_INIT_free
OPENSSL_INIT_new
OPENSSL_INIT_set_config_appname
OPENSSL_INIT_set_config_file_flags
OPENSSL_INIT_set_config_filename
OPENSSL_LH_delete
OPENSSL_LH_doall
OPENSSL_LH_doall_arg
OPENSSL_LH_error
OPENSSL_LH_free
OPENSSL_LH_get_down_load
OPENSSL_LH_insert
OPENSSL_LH_new
OPENSSL_LH_node_stats
OPENSSL_LH_node_stats_bio
OPENSSL_LH_node_usage_stats
OPENSSL_LH_node_usage_stats_bio
OPENSSL_LH_num_items
OPENSSL_LH_retrieve
OPENSSL_LH_set_down_load
OPENSSL_LH_stats
OPENSSL_LH_stats_bio
OPENSSL_LH_strhash
OPENSSL_asc2uni
OPENSSL_atexit
OPENSSL_buf2hexstr
OPENSSL_cleanse
OPENSSL_cleanup
OPENSSL_config
OPENSSL_die
OPENSSL_gmtime
OPENSSL_gmtime_adj
OPENSSL_gmtime_diff
OPENSSL_hexchar2int
OPENSSL_hexstr2buf
OPENSSL_init
OPENSSL_init_crypto
OPENSSL_isservice
OPENSSL_issetugid
OPENSSL_load_builtin_modules
OPENSSL_memcmp
OPENSSL_sk_deep_copy
OPENSSL_sk_delete
OPENSSL_sk_delete_ptr
OPENSSL_sk_dup
OPENSSL_sk_find
OPENSSL_sk_find_ex
OPENSSL_sk_free
OPENSSL_sk_insert
OPENSSL_sk_is_sorted
OPENSSL_sk_new
OPENSSL_sk_new_null
OPENSSL_sk_new_reserve
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_reserve
OPENSSL_sk_set
OPENSSL_sk_set_cmp_func
OPENSSL_sk_shift
OPENSSL_sk_sort
OPENSSL_sk_unshift
OPENSSL_sk_value
OPENSSL_sk_zero
OPENSSL_strlcat
OPENSSL_strlcpy
OPENSSL_strnlen
OPENSSL_thread_stop
OPENSSL_uni2asc
OPENSSL_uni2utf8
OPENSSL_utf82uni
OSSL_STORE_INFO_free
OSSL_STORE_INFO_get0_CERT
OSSL_STORE_INFO_get0_CRL
OSSL_STORE_INFO_get0_NAME
OSSL_STORE_INFO_get0_NAME_description
OSSL_STORE_INFO_get0_PARAMS
OSSL_STORE_INFO_get0_PKEY
OSSL_STORE_INFO_get1_CERT
OSSL_STORE_INFO_get1_CRL
OSSL_STORE_INFO_get1_NAME
OSSL_STORE_INFO_get1_NAME_description
OSSL_STORE_INFO_get1_PARAMS
OSSL_STORE_INFO_get1_PKEY
OSSL_STORE_INFO_get_type
OSSL_STORE_INFO_new_CERT
OSSL_STORE_INFO_new_CRL
OSSL_STORE_INFO_new_NAME
OSSL_STORE_INFO_new_PARAMS
OSSL_STORE_INFO_new_PKEY
OSSL_STORE_INFO_set0_NAME_description
OSSL_STORE_INFO_type_string
OSSL_STORE_LOADER_free
OSSL_STORE_LOADER_get0_engine
OSSL_STORE_LOADER_get0_scheme
OSSL_STORE_LOADER_new
OSSL_STORE_LOADER_set_close
OSSL_STORE_LOADER_set_ctrl
OSSL_STORE_LOADER_set_eof
OSSL_STORE_LOADER_set_error
OSSL_STORE_LOADER_set_expect
OSSL_STORE_LOADER_set_find
OSSL_STORE_LOADER_set_load
OSSL_STORE_LOADER_set_open
OSSL_STORE_SEARCH_by_alias
OSSL_STORE_SEARCH_by_issuer_serial
OSSL_STORE_SEARCH_by_key_fingerprint
OSSL_STORE_SEARCH_by_name
OSSL_STORE_SEARCH_free
OSSL_STORE_SEARCH_get0_bytes
OSSL_STORE_SEARCH_get0_digest
OSSL_STORE_SEARCH_get0_name
OSSL_STORE_SEARCH_get0_serial
OSSL_STORE_SEARCH_get0_string
OSSL_STORE_SEARCH_get_type
OSSL_STORE_close
OSSL_STORE_ctrl
OSSL_STORE_do_all_loaders
OSSL_STORE_eof
OSSL_STORE_error
OSSL_STORE_expect
OSSL_STORE_find
OSSL_STORE_load
OSSL_STORE_open
OSSL_STORE_register_loader
OSSL_STORE_supports_search
OSSL_STORE_unregister_loader
OSSL_STORE_vctrl
OTHERNAME_cmp
OTHERNAME_free
OTHERNAME_it
OTHERNAME_new
OpenSSL_version
OpenSSL_version_num
PBE2PARAM_free
PBE2PARAM_it
PBE2PARAM_new
PBEPARAM_free
PBEPARAM_it
PBEPARAM_new
PBKDF2PARAM_free
PBKDF2PARAM_it
PBKDF2PARAM_new
PEM_ASN1_read
PEM_ASN1_read_bio
PEM_ASN1_write
PEM_ASN1_write_bio
PEM_SignFinal
PEM_SignInit
PEM_SignUpdate
PEM_X509_INFO_read
PEM_X509_INFO_read_bio
PEM_X509_INFO_write_bio
PEM_bytes_read_bio
PEM_bytes_read_bio_secmem
PEM_def_callback
PEM_dek_info
PEM_do_header
PEM_get_EVP_CIPHER_INFO
PEM_proc_type
PEM_read
PEM_read_CMS
PEM_read_DHparams
PEM_read_DSAPrivateKey
PEM_read_DSA_PUBKEY
PEM_read_DSAparams
PEM_read_ECPKParameters
PEM_read_ECPrivateKey
PEM_read_EC_PUBKEY
PEM_read_NETSCAPE_CERT_SEQUENCE
PEM_read_PKCS7
PEM_read_PKCS8
PEM_read_PKCS8_PRIV_KEY_INFO
PEM_read_PUBKEY
PEM_read_PrivateKey
PEM_read_RSAPrivateKey
PEM_read_RSAPublicKey
PEM_read_RSA_PUBKEY
PEM_read_X509
PEM_read_X509_AUX
PEM_read_X509_CRL
PEM_read_X509_REQ
PEM_read_bio
PEM_read_bio_CMS
PEM_read_bio_DHparams
PEM_read_bio_DSAPrivateKey
PEM_read_bio_DSA_PUBKEY
PEM_read_bio_DSAparams
PEM_read_bio_ECPKParameters
PEM_read_bio_ECPrivateKey
PEM_read_bio_EC_PUBKEY
PEM_read_bio_NETSCAPE_CERT_SEQUENCE
PEM_read_bio_PKCS7
PEM_read_bio_PKCS8
PEM_read_bio_PKCS8_PRIV_KEY_INFO
PEM_read_bio_PUBKEY
PEM_read_bio_Parameters
PEM_read_bio_PrivateKey
PEM_read_bio_RSAPrivateKey
PEM_read_bio_RSAPublicKey
PEM_read_bio_RSA_PUBKEY
PEM_read_bio_X509
PEM_read_bio_X509_AUX
PEM_read_bio_X509_CRL
PEM_read_bio_X509_REQ
PEM_read_bio_ex
PEM_write
PEM_write_CMS
PEM_write_DHparams
PEM_write_DHxparams
PEM_write_DSAPrivateKey
PEM_write_DSA_PUBKEY
PEM_write_DSAparams
PEM_write_ECPKParameters
PEM_write_ECPrivateKey
PEM_write_EC_PUBKEY
PEM_write_NETSCAPE_CERT_SEQUENCE
PEM_write_PKCS7
PEM_write_PKCS8
PEM_write_PKCS8PrivateKey
PEM_write_PKCS8PrivateKey_nid
PEM_write_PKCS8_PRIV_KEY_INFO
PEM_write_PUBKEY
PEM_write_PrivateKey
PEM_write_RSAPrivateKey
PEM_write_RSAPublicKey
PEM_write_RSA_PUBKEY
PEM_write_X509
PEM_write_X509_AUX
PEM_write_X509_CRL
PEM_write_X509_REQ
PEM_write_X509_REQ_NEW
PEM_write_bio
PEM_write_bio_ASN1_stream
PEM_write_bio_CMS
PEM_write_bio_CMS_stream
PEM_write_bio_DHparams
PEM_write_bio_DHxparams
PEM_write_bio_DSAPrivateKey
PEM_write_bio_DSA_PUBKEY
PEM_write_bio_DSAparams
PEM_write_bio_ECPKParameters
PEM_write_bio_ECPrivateKey
PEM_write_bio_EC_PUBKEY
PEM_write_bio_NETSCAPE_CERT_SEQUENCE
PEM_write_bio_PKCS7
PEM_write_bio_PKCS7_stream
PEM_write_bio_PKCS8
PEM_write_bio_PKCS8PrivateKey
PEM_write_bio_PKCS8PrivateKey_nid
PEM_write_bio_PKCS8_PRIV_KEY_INFO
PEM_write_bio_PUBKEY
PEM_write_bio_Parameters
PEM_write_bio_PrivateKey
PEM_write_bio_PrivateKey_traditional
PEM_write_bio_RSAPrivateKey
PEM_write_bio_RSAPublicKey
PEM_write_bio_RSA_PUBKEY
PEM_write_bio_X509
PEM_write_bio_X509_AUX
PEM_write_bio_X509_CRL
PEM_write_bio_X509_REQ
PEM_write_bio_X509_REQ_NEW
PKCS12_AUTHSAFES_it
PKCS12_BAGS_free
PKCS12_BAGS_it
PKCS12_BAGS_new
PKCS12_MAC_DATA_free
PKCS12_MAC_DATA_it
PKCS12_MAC_DATA_new
PKCS12_PBE_add
PKCS12_PBE_keyivgen
PKCS12_SAFEBAGS_it
PKCS12_SAFEBAG_create0_p8inf
PKCS12_SAFEBAG_create0_pkcs8
PKCS12_SAFEBAG_create_cert
PKCS12_SAFEBAG_create_crl
PKCS12_SAFEBAG_create_pkcs8_encrypt
PKCS12_SAFEBAG_free
PKCS12_SAFEBAG_get0_attr
PKCS12_SAFEBAG_get0_attrs
PKCS12_SAFEBAG_get0_p8inf
PKCS12_SAFEBAG_get0_pkcs8
PKCS12_SAFEBAG_get0_safes
PKCS12_SAFEBAG_get0_type
PKCS12_SAFEBAG_get1_cert
PKCS12_SAFEBAG_get1_crl
PKCS12_SAFEBAG_get_bag_nid
PKCS12_SAFEBAG_get_nid
PKCS12_SAFEBAG_it
PKCS12_SAFEBAG_new
PKCS12_add_CSPName_asc
PKCS12_add_cert
PKCS12_add_friendlyname_asc
PKCS12_add_friendlyname_uni
PKCS12_add_friendlyname_utf8
PKCS12_add_key
PKCS12_add_localkeyid
PKCS12_add_safe
PKCS12_add_safes
PKCS12_create
PKCS12_decrypt_skey
PKCS12_free
PKCS12_gen_mac
PKCS12_get0_mac
PKCS12_get_attr
PKCS12_get_attr_gen
PKCS12_get_friendlyname
PKCS12_init
PKCS12_it
PKCS12_item_decrypt_d2i
PKCS12_item_i2d_encrypt
PKCS12_item_pack_safebag
PKCS12_key_gen_asc
PKCS12_key_gen_uni
PKCS12_key_gen_utf8
PKCS12_mac_present
PKCS12_new
PKCS12_newpass
PKCS12_pack_authsafes
PKCS12_pack_p7data
PKCS12_pack_p7encdata
PKCS12_parse
PKCS12_pbe_crypt
PKCS12_set_mac
PKCS12_setup_mac
PKCS12_unpack_authsafes
PKCS12_unpack_p7data
PKCS12_unpack_p7encdata
PKCS12_verify_mac
PKCS1_MGF1
PKCS5_PBE_add
PKCS5_PBE_keyivgen
PKCS5_PBKDF2_HMAC
PKCS5_PBKDF2_HMAC_SHA1
PKCS5_pbe2_set
PKCS5_pbe2_set_iv
PKCS5_pbe2_set_scrypt
PKCS5_pbe_set
PKCS5_pbe_set0_algor
PKCS5_pbkdf2_set
PKCS5_v2_PBE_keyivgen
PKCS5_v2_scrypt_keyivgen
PKCS7_ATTR_SIGN_it
PKCS7_ATTR_VERIFY_it
PKCS7_DIGEST_free
PKCS7_DIGEST_it
PKCS7_DIGEST_new
PKCS7_ENCRYPT_free
PKCS7_ENCRYPT_it
PKCS7_ENCRYPT_new
PKCS7_ENC_CONTENT_free
PKCS7_ENC_CONTENT_it
PKCS7_ENC_CONTENT_new
PKCS7_ENVELOPE_free
PKCS7_ENVELOPE_it
PKCS7_ENVELOPE_new
PKCS7_ISSUER_AND_SERIAL_digest
PKCS7_ISSUER_AND_SERIAL_free
PKCS7_ISSUER_AND_SERIAL_it
PKCS7_ISSUER_AND_SERIAL_new
PKCS7_RECIP_INFO_free
PKCS7_RECIP_INFO_get0_alg
PKCS7_RECIP_INFO_it
PKCS7_RECIP_INFO_new
PKCS7_RECIP_INFO_set
PKCS7_SIGNED_free
PKCS7_SIGNED_it
PKCS7_SIGNED_new
PKCS7_SIGNER_INFO_free
PKCS7_SIGNER_INFO_get0_algs
PKCS7_SIGNER_INFO_it
PKCS7_SIGNER_INFO_new
PKCS7_SIGNER_INFO_set
PKCS7_SIGNER_INFO_sign
PKCS7_SIGN_ENVELOPE_free
PKCS7_SIGN_ENVELOPE_it
PKCS7_SIGN_ENVELOPE_new
PKCS7_add0_attrib_signing_time
PKCS7_add1_attrib_digest
PKCS7_add_attrib_content_type
PKCS7_add_attrib_smimecap
PKCS7_add_attribute
PKCS7_add_certificate
PKCS7_add_crl
PKCS7_add_recipient
PKCS7_add_recipient_info
PKCS7_add_signature
PKCS7_add_signed_attribute
PKCS7_add_signer
PKCS7_cert_from_signer_info
PKCS7_content_new
PKCS7_ctrl
PKCS7_dataDecode
PKCS7_dataFinal
PKCS7_dataInit
PKCS7_dataVerify
PKCS7_decrypt
PKCS7_digest_from_attributes
PKCS7_dup
PKCS7_encrypt
PKCS7_final
PKCS7_free
PKCS7_get0_signers
PKCS7_get_attribute
PKCS7_get_issuer_and_serial
PKCS7_get_signed_attribute
PKCS7_get_signer_info
PKCS7_get_smimecap
PKCS7_it
PKCS7_new
PKCS7_print_ctx
PKCS7_set0_type_other
PKCS7_set_attributes
PKCS7_set_cipher
PKCS7_set_content
PKCS7_set_digest
PKCS7_set_signed_attributes
PKCS7_set_type
PKCS7_sign
PKCS7_sign_add_signer
PKCS7_signatureVerify
PKCS7_simple_smimecap
PKCS7_stream
PKCS7_to_TS_TST_INFO
PKCS7_verify
PKCS8_PRIV_KEY_INFO_free
PKCS8_PRIV_KEY_INFO_it
PKCS8_PRIV_KEY_INFO_new
PKCS8_add_keyusage
PKCS8_decrypt
PKCS8_encrypt
PKCS8_get_attr
PKCS8_pkey_add1_attr_by_NID
PKCS8_pkey_get0
PKCS8_pkey_get0_attrs
PKCS8_pkey_set0
PKCS8_set0_pbe
PKEY_USAGE_PERIOD_free
PKEY_USAGE_PERIOD_it
PKEY_USAGE_PERIOD_new
POLICYINFO_free
POLICYINFO_it
POLICYINFO_new
POLICYQUALINFO_free
POLICYQUALINFO_it
POLICYQUALINFO_new
POLICY_CONSTRAINTS_free
POLICY_CONSTRAINTS_it
POLICY_CONSTRAINTS_new
POLICY_MAPPINGS_it
POLICY_MAPPING_free
POLICY_MAPPING_it
POLICY_MAPPING_new
PROFESSION_INFO_free
PROFESSION_INFO_get0_addProfessionInfo
PROFESSION_INFO_get0_namingAuthority
PROFESSION_INFO_get0_professionItems
PROFESSION_INFO_get0_professionOIDs
PROFESSION_INFO_get0_registrationNumber
PROFESSION_INFO_it
PROFESSION_INFO_new
PROFESSION_INFO_set0_addProfessionInfo
PROFESSION_INFO_set0_namingAuthority
PROFESSION_INFO_set0_professionItems
PROFESSION_INFO_set0_professionOIDs
PROFESSION_INFO_set0_registrationNumber
PROXY_CERT_INFO_EXTENSION_free
PROXY_CERT_INFO_EXTENSION_it
PROXY_CERT_INFO_EXTENSION_new
PROXY_POLICY_free
PROXY_POLICY_it
PROXY_POLICY_new
RAND_DRBG_bytes
RAND_DRBG_free
RAND_DRBG_generate
RAND_DRBG_get0_master
RAND_DRBG_get0_private
RAND_DRBG_get0_public
RAND_DRBG_get_ex_data
RAND_DRBG_instantiate
RAND_DRBG_new
RAND_DRBG_reseed
RAND_DRBG_secure_new
RAND_DRBG_set
RAND_DRBG_set_callbacks
RAND_DRBG_set_defaults
RAND_DRBG_set_ex_data
RAND_DRBG_set_reseed_defaults
RAND_DRBG_set_reseed_interval
RAND_DRBG_set_reseed_time_interval
RAND_DRBG_uninstantiate
RAND_OpenSSL
RAND_add
RAND_bytes
RAND_event
RAND_file_name
RAND_get_rand_method
RAND_keep_random_devices_open
RAND_load_file
RAND_poll
RAND_priv_bytes
RAND_pseudo_bytes
RAND_screen
RAND_seed
RAND_set_rand_engine
RAND_set_rand_method
RAND_status
RAND_write_file
RC2_cbc_encrypt
RC2_cfb64_encrypt
RC2_decrypt
RC2_ecb_encrypt
RC2_encrypt
RC2_ofb64_encrypt
RC2_set_key
RC4
RC4_options
RC4_set_key
RIPEMD160
RIPEMD160_Final
RIPEMD160_Init
RIPEMD160_Transform
RIPEMD160_Update
RSAPrivateKey_dup
RSAPrivateKey_it
RSAPublicKey_dup
RSAPublicKey_it
RSA_OAEP_PARAMS_free
RSA_OAEP_PARAMS_it
RSA_OAEP_PARAMS_new
RSA_PKCS1_OpenSSL
RSA_PSS_PARAMS_free
RSA_PSS_PARAMS_it
RSA_PSS_PARAMS_new
RSA_X931_derive_ex
RSA_X931_generate_key_ex
RSA_X931_hash_id
RSA_bits
RSA_blinding_off
RSA_blinding_on
RSA_check_key
RSA_check_key_ex
RSA_clear_flags
RSA_flags
RSA_free
RSA_generate_key
RSA_generate_key_ex
RSA_generate_multi_prime_key
RSA_get0_crt_params
RSA_get0_d
RSA_get0_dmp1
RSA_get0_dmq1
RSA_get0_e
RSA_get0_engine
RSA_get0_factors
RSA_get0_iqmp
RSA_get0_key
RSA_get0_multi_prime_crt_params
RSA_get0_multi_prime_factors
RSA_get0_n
RSA_get0_p
RSA_get0_q
RSA_get_default_method
RSA_get_ex_data
RSA_get_method
RSA_get_multi_prime_extra_count
RSA_get_version
RSA_meth_dup
RSA_meth_free
RSA_meth_get0_app_data
RSA_meth_get0_name
RSA_meth_get_bn_mod_exp
RSA_meth_get_finish
RSA_meth_get_flags
RSA_meth_get_init
RSA_meth_get_keygen
RSA_meth_get_mod_exp
RSA_meth_get_multi_prime_keygen
RSA_meth_get_priv_dec
RSA_meth_get_priv_enc
RSA_meth_get_pub_dec
RSA_meth_get_pub_enc
RSA_meth_get_sign
RSA_meth_get_verify
RSA_meth_new
RSA_meth_set0_app_data
RSA_meth_set1_name
RSA_meth_set_bn_mod_exp
RSA_meth_set_finish
RSA_meth_set_flags
RSA_meth_set_init
RSA_meth_set_keygen
RSA_meth_set_mod_exp
RSA_meth_set_multi_prime_keygen
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_meth_set_pub_dec
RSA_meth_set_pub_enc
RSA_meth_set_sign
RSA_meth_set_verify
RSA_new
RSA_new_method
RSA_null_method
RSA_padding_add_PKCS1_OAEP
RSA_padding_add_PKCS1_OAEP_mgf1
RSA_padding_add_PKCS1_PSS
RSA_padding_add_PKCS1_PSS_mgf1
RSA_padding_add_PKCS1_type_1
RSA_padding_add_PKCS1_type_2
RSA_padding_add_SSLv23
RSA_padding_add_X931
RSA_padding_add_none
RSA_padding_check_PKCS1_OAEP
RSA_padding_check_PKCS1_OAEP_mgf1
RSA_padding_check_PKCS1_type_1
RSA_padding_check_PKCS1_type_2
RSA_padding_check_SSLv23
RSA_padding_check_X931
RSA_padding_check_none
RSA_pkey_ctx_ctrl
RSA_print
RSA_print_fp
RSA_private_decrypt
RSA_private_encrypt
RSA_public_decrypt
RSA_public_encrypt
RSA_security_bits
RSA_set0_crt_params
RSA_set0_factors
RSA_set0_key
RSA_set0_multi_prime_params
RSA_set_default_method
RSA_set_ex_data
RSA_set_flags
RSA_set_method
RSA_setup_blinding
RSA_sign
RSA_sign_ASN1_OCTET_STRING
RSA_size
RSA_test_flags
RSA_up_ref
RSA_verify
RSA_verify_ASN1_OCTET_STRING
RSA_verify_PKCS1_PSS
RSA_verify_PKCS1_PSS_mgf1
SCRYPT_PARAMS_free
SCRYPT_PARAMS_it
SCRYPT_PARAMS_new
SCT_LIST_free
SCT_LIST_print
SCT_LIST_validate
SCT_free
SCT_get0_extensions
SCT_get0_log_id
SCT_get0_signature
SCT_get_log_entry_type
SCT_get_signature_nid
SCT_get_source
SCT_get_timestamp
SCT_get_validation_status
SCT_get_version
SCT_new
SCT_new_from_base64
SCT_print
SCT_set0_extensions
SCT_set0_log_id
SCT_set0_signature
SCT_set1_extensions
SCT_set1_log_id
SCT_set1_signature
SCT_set_log_entry_type
SCT_set_signature_nid
SCT_set_source
SCT_set_timestamp
SCT_set_version
SCT_validate
SCT_validation_status_string
SEED_cbc_encrypt
SEED_cfb128_encrypt
SEED_decrypt
SEED_ecb_encrypt
SEED_encrypt
SEED_ofb128_encrypt
SEED_set_key
SHA1
SHA1_Final
SHA1_Init
SHA1_Transform
SHA1_Update
SHA224
SHA224_Final
SHA224_Init
SHA224_Update
SHA256
SHA256_Final
SHA256_Init
SHA256_Transform
SHA256_Update
SHA384
SHA384_Final
SHA384_Init
SHA384_Update
SHA512
SHA512_Final
SHA512_Init
SHA512_Transform
SHA512_Update
SMIME_crlf_copy
SMIME_read_ASN1
SMIME_read_CMS
SMIME_read_PKCS7
SMIME_text
SMIME_write_ASN1
SMIME_write_CMS
SMIME_write_PKCS7
SRP_Calc_A
SRP_Calc_B
SRP_Calc_client_key
SRP_Calc_server_key
SRP_Calc_u
SRP_Calc_x
SRP_VBASE_free
SRP_VBASE_get1_by_user
SRP_VBASE_get_by_user
SRP_VBASE_init
SRP_VBASE_new
SRP_Verify_A_mod_N
SRP_Verify_B_mod_N
SRP_check_known_gN_param
SRP_create_verifier
SRP_create_verifier_BN
SRP_get_default_gN
SRP_user_pwd_free
SXNETID_free
SXNETID_it
SXNETID_new
SXNET_add_id_INTEGER
SXNET_add_id_asc
SXNET_add_id_ulong
SXNET_free
SXNET_get_id_INTEGER
SXNET_get_id_asc
SXNET_get_id_ulong
SXNET_it
SXNET_new
TLS_FEATURE_free
TLS_FEATURE_new
TS_ACCURACY_dup
TS_ACCURACY_free
TS_ACCURACY_get_micros
TS_ACCURACY_get_millis
TS_ACCURACY_get_seconds
TS_ACCURACY_new
TS_ACCURACY_set_micros
TS_ACCURACY_set_millis
TS_ACCURACY_set_seconds
TS_ASN1_INTEGER_print_bio
TS_CONF_get_tsa_section
TS_CONF_load_cert
TS_CONF_load_certs
TS_CONF_load_key
TS_CONF_set_accuracy
TS_CONF_set_certs
TS_CONF_set_clock_precision_digits
TS_CONF_set_crypto_device
TS_CONF_set_def_policy
TS_CONF_set_default_engine
TS_CONF_set_digests
TS_CONF_set_ess_cert_id_chain
TS_CONF_set_ess_cert_id_digest
TS_CONF_set_ordering
TS_CONF_set_policies
TS_CONF_set_serial
TS_CONF_set_signer_cert
TS_CONF_set_signer_digest
TS_CONF_set_signer_key
TS_CONF_set_tsa_name
TS_MSG_IMPRINT_dup
TS_MSG_IMPRINT_free
TS_MSG_IMPRINT_get_algo
TS_MSG_IMPRINT_get_msg
TS_MSG_IMPRINT_new
TS_MSG_IMPRINT_print_bio
TS_MSG_IMPRINT_set_algo
TS_MSG_IMPRINT_set_msg
TS_OBJ_print_bio
TS_REQ_add_ext
TS_REQ_delete_ext
TS_REQ_dup
TS_REQ_ext_free
TS_REQ_free
TS_REQ_get_cert_req
TS_REQ_get_ext
TS_REQ_get_ext_by_NID
TS_REQ_get_ext_by_OBJ
TS_REQ_get_ext_by_critical
TS_REQ_get_ext_count
TS_REQ_get_ext_d2i
TS_REQ_get_exts
TS_REQ_get_msg_imprint
TS_REQ_get_nonce
TS_REQ_get_policy_id
TS_REQ_get_version
TS_REQ_new
TS_REQ_print_bio
TS_REQ_set_cert_req
TS_REQ_set_msg_imprint
TS_REQ_set_nonce
TS_REQ_set_policy_id
TS_REQ_set_version
TS_REQ_to_TS_VERIFY_CTX
TS_RESP_CTX_add_failure_info
TS_RESP_CTX_add_flags
TS_RESP_CTX_add_md
TS_RESP_CTX_add_policy
TS_RESP_CTX_free
TS_RESP_CTX_get_request
TS_RESP_CTX_get_tst_info
TS_RESP_CTX_new
TS_RESP_CTX_set_accuracy
TS_RESP_CTX_set_certs
TS_RESP_CTX_set_clock_precision_digits
TS_RESP_CTX_set_def_policy
TS_RESP_CTX_set_ess_cert_id_digest
TS_RESP_CTX_set_extension_cb
TS_RESP_CTX_set_serial_cb
TS_RESP_CTX_set_signer_cert
TS_RESP_CTX_set_signer_digest
TS_RESP_CTX_set_signer_key
TS_RESP_CTX_set_status_info
TS_RESP_CTX_set_status_info_cond
TS_RESP_CTX_set_time_cb
TS_RESP_create_response
TS_RESP_dup
TS_RESP_free
TS_RESP_get_status_info
TS_RESP_get_token
TS_RESP_get_tst_info
TS_RESP_new
TS_RESP_print_bio
TS_RESP_set_status_info
TS_RESP_set_tst_info
TS_RESP_verify_response
TS_RESP_verify_signature
TS_RESP_verify_token
TS_STATUS_INFO_dup
TS_STATUS_INFO_free
TS_STATUS_INFO_get0_failure_info
TS_STATUS_INFO_get0_status
TS_STATUS_INFO_get0_text
TS_STATUS_INFO_new
TS_STATUS_INFO_print_bio
TS_STATUS_INFO_set_status
TS_TST_INFO_add_ext
TS_TST_INFO_delete_ext
TS_TST_INFO_dup
TS_TST_INFO_ext_free
TS_TST_INFO_free
TS_TST_INFO_get_accuracy
TS_TST_INFO_get_ext
TS_TST_INFO_get_ext_by_NID
TS_TST_INFO_get_ext_by_OBJ
TS_TST_INFO_get_ext_by_critical
TS_TST_INFO_get_ext_count
TS_TST_INFO_get_ext_d2i
TS_TST_INFO_get_exts
TS_TST_INFO_get_msg_imprint
TS_TST_INFO_get_nonce
TS_TST_INFO_get_ordering
TS_TST_INFO_get_policy_id
TS_TST_INFO_get_serial
TS_TST_INFO_get_time
TS_TST_INFO_get_tsa
TS_TST_INFO_get_version
TS_TST_INFO_new
TS_TST_INFO_print_bio
TS_TST_INFO_set_accuracy
TS_TST_INFO_set_msg_imprint
TS_TST_INFO_set_nonce
TS_TST_INFO_set_ordering
TS_TST_INFO_set_policy_id
TS_TST_INFO_set_serial
TS_TST_INFO_set_time
TS_TST_INFO_set_tsa
TS_TST_INFO_set_version
TS_VERIFY_CTS_set_certs
TS_VERIFY_CTX_add_flags
TS_VERIFY_CTX_cleanup
TS_VERIFY_CTX_free
TS_VERIFY_CTX_init
TS_VERIFY_CTX_new
TS_VERIFY_CTX_set_data
TS_VERIFY_CTX_set_flags
TS_VERIFY_CTX_set_imprint
TS_VERIFY_CTX_set_store
TS_X509_ALGOR_print_bio
TS_ext_print_bio
TXT_DB_create_index
TXT_DB_free
TXT_DB_get_by_index
TXT_DB_insert
TXT_DB_read
TXT_DB_write
UINT32_it
UINT64_it
UI_OpenSSL
UI_UTIL_read_pw
UI_UTIL_read_pw_string
UI_UTIL_wrap_read_pem_callback
UI_add_error_string
UI_add_info_string
UI_add_input_boolean
UI_add_input_string
UI_add_user_data
UI_add_verify_string
UI_construct_prompt
UI_create_method
UI_ctrl
UI_destroy_method
UI_dup_error_string
UI_dup_info_string
UI_dup_input_boolean
UI_dup_input_string
UI_dup_user_data
UI_dup_verify_string
UI_free
UI_get0_action_string
UI_get0_output_string
UI_get0_result
UI_get0_result_string
UI_get0_test_string
UI_get0_user_data
UI_get_default_method
UI_get_ex_data
UI_get_input_flags
UI_get_method
UI_get_result_length
UI_get_result_maxsize
UI_get_result_minsize
UI_get_result_string_length
UI_get_string_type
UI_method_get_closer
UI_method_get_data_destructor
UI_method_get_data_duplicator
UI_method_get_ex_data
UI_method_get_flusher
UI_method_get_opener
UI_method_get_prompt_constructor
UI_method_get_reader
UI_method_get_writer
UI_method_set_closer
UI_method_set_data_duplicator
UI_method_set_ex_data
UI_method_set_flusher
UI_method_set_opener
UI_method_set_prompt_constructor
UI_method_set_reader
UI_method_set_writer
UI_new
UI_new_method
UI_null
UI_process
UI_set_default_method
UI_set_ex_data
UI_set_method
UI_set_result
UI_set_result_ex
USERNOTICE_free
USERNOTICE_it
USERNOTICE_new
UTF8_getc
UTF8_putc
WHIRLPOOL
WHIRLPOOL_BitUpdate
WHIRLPOOL_Final
WHIRLPOOL_Init
WHIRLPOOL_Update
X509V3_EXT_CRL_add_conf
X509V3_EXT_CRL_add_nconf
X509V3_EXT_REQ_add_conf
X509V3_EXT_REQ_add_nconf
X509V3_EXT_add
X509V3_EXT_add_alias
X509V3_EXT_add_conf
X509V3_EXT_add_list
X509V3_EXT_add_nconf
X509V3_EXT_add_nconf_sk
X509V3_EXT_cleanup
X509V3_EXT_conf
X509V3_EXT_conf_nid
X509V3_EXT_d2i
X509V3_EXT_get
X509V3_EXT_get_nid
X509V3_EXT_i2d
X509V3_EXT_nconf
X509V3_EXT_nconf_nid
X509V3_EXT_print
X509V3_EXT_print_fp
X509V3_EXT_val_prn
X509V3_NAME_from_section
X509V3_add1_i2d
X509V3_add_standard_extensions
X509V3_add_value
X509V3_add_value_bool
X509V3_add_value_bool_nf
X509V3_add_value_int
X509V3_add_value_uchar
X509V3_conf_free
X509V3_extensions_print
X509V3_get_d2i
X509V3_get_section
X509V3_get_string
X509V3_get_value_bool
X509V3_get_value_int
X509V3_parse_list
X509V3_section_free
X509V3_set_conf_lhash
X509V3_set_ctx
X509V3_set_nconf
X509V3_string_free
X509_ALGORS_it
X509_ALGOR_cmp
X509_ALGOR_dup
X509_ALGOR_free
X509_ALGOR_get0
X509_ALGOR_it
X509_ALGOR_new
X509_ALGOR_set0
X509_ALGOR_set_md
X509_ATTRIBUTE_count
X509_ATTRIBUTE_create
X509_ATTRIBUTE_create_by_NID
X509_ATTRIBUTE_create_by_OBJ
X509_ATTRIBUTE_create_by_txt
X509_ATTRIBUTE_dup
X509_ATTRIBUTE_free
X509_ATTRIBUTE_get0_data
X509_ATTRIBUTE_get0_object
X509_ATTRIBUTE_get0_type
X509_ATTRIBUTE_it
X509_ATTRIBUTE_new
X509_ATTRIBUTE_set1_data
X509_ATTRIBUTE_set1_object
X509_CERT_AUX_free
X509_CERT_AUX_it
X509_CERT_AUX_new
X509_CINF_free
X509_CINF_it
X509_CINF_new
X509_CRL_INFO_free
X509_CRL_INFO_it
X509_CRL_INFO_new
X509_CRL_METHOD_free
X509_CRL_METHOD_new
X509_CRL_add0_revoked
X509_CRL_add1_ext_i2d
X509_CRL_add_ext
X509_CRL_check_suiteb
X509_CRL_cmp
X509_CRL_delete_ext
X509_CRL_diff
X509_CRL_digest
X509_CRL_dup
X509_CRL_free
X509_CRL_get0_by_cert
X509_CRL_get0_by_serial
X509_CRL_get0_extensions
X509_CRL_get0_lastUpdate
X509_CRL_get0_nextUpdate
X509_CRL_get0_signature
X509_CRL_get_REVOKED
X509_CRL_get_ext
X509_CRL_get_ext_by_NID
X509_CRL_get_ext_by_OBJ
X509_CRL_get_ext_by_critical
X509_CRL_get_ext_count
X509_CRL_get_ext_d2i
X509_CRL_get_issuer
X509_CRL_get_lastUpdate
X509_CRL_get_meth_data
X509_CRL_get_nextUpdate
X509_CRL_get_signature_nid
X509_CRL_get_version
X509_CRL_http_nbio
X509_CRL_it
X509_CRL_match
X509_CRL_new
X509_CRL_print
X509_CRL_print_ex
X509_CRL_print_fp
X509_CRL_set1_lastUpdate
X509_CRL_set1_nextUpdate
X509_CRL_set_default_method
X509_CRL_set_issuer_name
X509_CRL_set_meth_data
X509_CRL_set_version
X509_CRL_sign
X509_CRL_sign_ctx
X509_CRL_sort
X509_CRL_up_ref
X509_CRL_verify
X509_EXTENSIONS_it
X509_EXTENSION_create_by_NID
X509_EXTENSION_create_by_OBJ
X509_EXTENSION_dup
X509_EXTENSION_free
X509_EXTENSION_get_critical
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_EXTENSION_it
X509_EXTENSION_new
X509_EXTENSION_set_critical
X509_EXTENSION_set_data
X509_EXTENSION_set_object
X509_INFO_free
X509_INFO_new
X509_LOOKUP_by_alias
X509_LOOKUP_by_fingerprint
X509_LOOKUP_by_issuer_serial
X509_LOOKUP_by_subject
X509_LOOKUP_ctrl
X509_LOOKUP_file
X509_LOOKUP_free
X509_LOOKUP_get_method_data
X509_LOOKUP_get_store
X509_LOOKUP_hash_dir
X509_LOOKUP_init
X509_LOOKUP_meth_free
X509_LOOKUP_meth_get_ctrl
X509_LOOKUP_meth_get_free
X509_LOOKUP_meth_get_get_by_alias
X509_LOOKUP_meth_get_get_by_fingerprint
X509_LOOKUP_meth_get_get_by_issuer_serial
X509_LOOKUP_meth_get_get_by_subject
X509_LOOKUP_meth_get_init
X509_LOOKUP_meth_get_new_item
X509_LOOKUP_meth_get_shutdown
X509_LOOKUP_meth_new
X509_LOOKUP_meth_set_ctrl
X509_LOOKUP_meth_set_free
X509_LOOKUP_meth_set_get_by_alias
X509_LOOKUP_meth_set_get_by_fingerprint
X509_LOOKUP_meth_set_get_by_issuer_serial
X509_LOOKUP_meth_set_get_by_subject
X509_LOOKUP_meth_set_init
X509_LOOKUP_meth_set_new_item
X509_LOOKUP_meth_set_shutdown
X509_LOOKUP_new
X509_LOOKUP_set_method_data
X509_LOOKUP_shutdown
X509_NAME_ENTRY_create_by_NID
X509_NAME_ENTRY_create_by_OBJ
X509_NAME_ENTRY_create_by_txt
X509_NAME_ENTRY_dup
X509_NAME_ENTRY_free
X509_NAME_ENTRY_get_data
X509_NAME_ENTRY_get_object
X509_NAME_ENTRY_it
X509_NAME_ENTRY_new
X509_NAME_ENTRY_set
X509_NAME_ENTRY_set_data
X509_NAME_ENTRY_set_object
X509_NAME_add_entry
X509_NAME_add_entry_by_NID
X509_NAME_add_entry_by_OBJ
X509_NAME_add_entry_by_txt
X509_NAME_cmp
X509_NAME_delete_entry
X509_NAME_digest
X509_NAME_dup
X509_NAME_entry_count
X509_NAME_free
X509_NAME_get0_der
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_get_index_by_OBJ
X509_NAME_get_text_by_NID
X509_NAME_get_text_by_OBJ
X509_NAME_hash
X509_NAME_hash_old
X509_NAME_it
X509_NAME_new
X509_NAME_oneline
X509_NAME_print
X509_NAME_print_ex
X509_NAME_print_ex_fp
X509_NAME_set
X509_OBJECT_free
X509_OBJECT_get0_X509
X509_OBJECT_get0_X509_CRL
X509_OBJECT_get_type
X509_OBJECT_idx_by_subject
X509_OBJECT_new
X509_OBJECT_retrieve_by_subject
X509_OBJECT_retrieve_match
X509_OBJECT_set1_X509
X509_OBJECT_set1_X509_CRL
X509_OBJECT_up_ref_count
X509_PKEY_free
X509_PKEY_new
X509_POLICY_NODE_print
X509_PUBKEY_free
X509_PUBKEY_get
X509_PUBKEY_get0
X509_PUBKEY_get0_param
X509_PUBKEY_it
X509_PUBKEY_new
X509_PUBKEY_set
X509_PUBKEY_set0_param
X509_PURPOSE_add
X509_PURPOSE_cleanup
X509_PURPOSE_get0
X509_PURPOSE_get0_name
X509_PURPOSE_get0_sname
X509_PURPOSE_get_by_id
X509_PURPOSE_get_by_sname
X509_PURPOSE_get_count
X509_PURPOSE_get_id
X509_PURPOSE_get_trust
X509_PURPOSE_set
X509_REQ_INFO_free
X509_REQ_INFO_it
X509_REQ_INFO_new
X509_REQ_add1_attr
X509_REQ_add1_attr_by_NID
X509_REQ_add1_attr_by_OBJ
X509_REQ_add1_attr_by_txt
X509_REQ_add_extensions
X509_REQ_add_extensions_nid
X509_REQ_check_private_key
X509_REQ_delete_attr
X509_REQ_digest
X509_REQ_dup
X509_REQ_extension_nid
X509_REQ_free
X509_REQ_get0_pubkey
X509_REQ_get0_signature
X509_REQ_get1_email
X509_REQ_get_X509_PUBKEY
X509_REQ_get_attr
X509_REQ_get_attr_by_NID
X509_REQ_get_attr_by_OBJ
X509_REQ_get_attr_count
X509_REQ_get_extension_nids
X509_REQ_get_extensions
X509_REQ_get_pubkey
X509_REQ_get_signature_nid
X509_REQ_get_subject_name
X509_REQ_get_version
X509_REQ_it
X509_REQ_new
X509_REQ_print
X509_REQ_print_ex
X509_REQ_print_fp
X509_REQ_set_extension_nids
X509_REQ_set_pubkey
X509_REQ_set_subject_name
X509_REQ_set_version
X509_REQ_sign
X509_REQ_sign_ctx
X509_REQ_to_X509
X509_REQ_verify
X509_REVOKED_add1_ext_i2d
X509_REVOKED_add_ext
X509_REVOKED_delete_ext
X509_REVOKED_dup
X509_REVOKED_free
X509_REVOKED_get0_extensions
X509_REVOKED_get0_revocationDate
X509_REVOKED_get0_serialNumber
X509_REVOKED_get_ext
X509_REVOKED_get_ext_by_NID
X509_REVOKED_get_ext_by_OBJ
X509_REVOKED_get_ext_by_critical
X509_REVOKED_get_ext_count
X509_REVOKED_get_ext_d2i
X509_REVOKED_it
X509_REVOKED_new
X509_REVOKED_set_revocationDate
X509_REVOKED_set_serialNumber
X509_SIG_INFO_get
X509_SIG_INFO_set
X509_SIG_free
X509_SIG_get0
X509_SIG_getm
X509_SIG_it
X509_SIG_new
X509_STORE_CTX_cleanup
X509_STORE_CTX_free
X509_STORE_CTX_get0_cert
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get0_current_crl
X509_STORE_CTX_get0_current_issuer
X509_STORE_CTX_get0_param
X509_STORE_CTX_get0_parent_ctx
X509_STORE_CTX_get0_policy_tree
X509_STORE_CTX_get0_store
X509_STORE_CTX_get0_untrusted
X509_STORE_CTX_get1_certs
X509_STORE_CTX_get1_chain
X509_STORE_CTX_get1_crls
X509_STORE_CTX_get1_issuer
X509_STORE_CTX_get_by_subject
X509_STORE_CTX_get_cert_crl
X509_STORE_CTX_get_check_crl
X509_STORE_CTX_get_check_issued
X509_STORE_CTX_get_check_policy
X509_STORE_CTX_get_check_revocation
X509_STORE_CTX_get_cleanup
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_error
X509_STORE_CTX_get_error_depth
X509_STORE_CTX_get_ex_data
X509_STORE_CTX_get_explicit_policy
X509_STORE_CTX_get_get_crl
X509_STORE_CTX_get_get_issuer
X509_STORE_CTX_get_lookup_certs
X509_STORE_CTX_get_lookup_crls
X509_STORE_CTX_get_num_untrusted
X509_STORE_CTX_get_obj_by_subject
X509_STORE_CTX_get_verify
X509_STORE_CTX_get_verify_cb
X509_STORE_CTX_init
X509_STORE_CTX_new
X509_STORE_CTX_purpose_inherit
X509_STORE_CTX_set0_crls
X509_STORE_CTX_set0_dane
X509_STORE_CTX_set0_param
X509_STORE_CTX_set0_trusted_stack
X509_STORE_CTX_set0_untrusted
X509_STORE_CTX_set0_verified_chain
X509_STORE_CTX_set_cert
X509_STORE_CTX_set_current_cert
X509_STORE_CTX_set_default
X509_STORE_CTX_set_depth
X509_STORE_CTX_set_error
X509_STORE_CTX_set_error_depth
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_set_flags
X509_STORE_CTX_set_purpose
X509_STORE_CTX_set_time
X509_STORE_CTX_set_trust
X509_STORE_CTX_set_verify
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_add_crl
X509_STORE_add_lookup
X509_STORE_free
X509_STORE_get0_objects
X509_STORE_get0_param
X509_STORE_get_cert_crl
X509_STORE_get_check_crl
X509_STORE_get_check_issued
X509_STORE_get_check_policy
X509_STORE_get_check_revocation
X509_STORE_get_cleanup
X509_STORE_get_ex_data
X509_STORE_get_get_crl
X509_STORE_get_get_issuer
X509_STORE_get_lookup_certs
X509_STORE_get_lookup_crls
X509_STORE_get_verify
X509_STORE_get_verify_cb
X509_STORE_load_locations
X509_STORE_lock
X509_STORE_new
X509_STORE_set1_param
X509_STORE_set_cert_crl
X509_STORE_set_check_crl
X509_STORE_set_check_issued
X509_STORE_set_check_policy
X509_STORE_set_check_revocation
X509_STORE_set_cleanup
X509_STORE_set_default_paths
X509_STORE_set_depth
X509_STORE_set_ex_data
X509_STORE_set_flags
X509_STORE_set_get_crl
X509_STORE_set_get_issuer
X509_STORE_set_lookup_certs
X509_STORE_set_lookup_crls
X509_STORE_set_purpose
X509_STORE_set_trust
X509_STORE_set_verify
X509_STORE_set_verify_cb
X509_STORE_unlock
X509_STORE_up_ref
X509_TRUST_add
X509_TRUST_cleanup
X509_TRUST_get0
X509_TRUST_get0_name
X509_TRUST_get_by_id
X509_TRUST_get_count
X509_TRUST_get_flags
X509_TRUST_get_trust
X509_TRUST_set
X509_TRUST_set_default
X509_VAL_free
X509_VAL_it
X509_VAL_new
X509_VERIFY_PARAM_add0_policy
X509_VERIFY_PARAM_add0_table
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_clear_flags
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_get0
X509_VERIFY_PARAM_get0_name
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_auth_level
X509_VERIFY_PARAM_get_count
X509_VERIFY_PARAM_get_depth
X509_VERIFY_PARAM_get_flags
X509_VERIFY_PARAM_get_hostflags
X509_VERIFY_PARAM_get_inh_flags
X509_VERIFY_PARAM_get_time
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_lookup
X509_VERIFY_PARAM_move_peername
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set1_email
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_set1_ip
X509_VERIFY_PARAM_set1_ip_asc
X509_VERIFY_PARAM_set1_name
X509_VERIFY_PARAM_set1_policies
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set_flags
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_set_inh_flags
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_time
X509_VERIFY_PARAM_set_trust
X509_VERIFY_PARAM_table_cleanup
X509_add1_ext_i2d
X509_add1_reject_object
X509_add1_trust_object
X509_add_ext
X509_alias_get0
X509_alias_set1
X509_aux_print
X509_certificate_type
X509_chain_check_suiteb
X509_chain_up_ref
X509_check_akid
X509_check_ca
X509_check_email
X509_check_host
X509_check_ip
X509_check_ip_asc
X509_check_issued
X509_check_private_key
X509_check_purpose
X509_check_trust
X509_cmp
X509_cmp_current_time
X509_cmp_time
X509_delete_ext
X509_digest
X509_dup
X509_email_free
X509_find_by_issuer_and_serial
X509_find_by_subject
X509_free
X509_get0_authority_issuer
X509_get0_authority_key_id
X509_get0_authority_serial
X509_get0_extensions
X509_get0_notAfter
X509_get0_notBefore
X509_get0_pubkey
X509_get0_pubkey_bitstr
X509_get0_reject_objects
X509_get0_serialNumber
X509_get0_signature
X509_get0_subject_key_id
X509_get0_tbs_sigalg
X509_get0_trust_objects
X509_get0_uids
X509_get1_email
X509_get1_ocsp
X509_get_X509_PUBKEY
X509_get_default_cert_area
X509_get_default_cert_dir
X509_get_default_cert_dir_env
X509_get_default_cert_file
X509_get_default_cert_file_env
X509_get_default_private_dir
X509_get_ex_data
X509_get_ext
X509_get_ext_by_NID
X509_get_ext_by_OBJ
X509_get_ext_by_critical
X509_get_ext_count
X509_get_ext_d2i
X509_get_extended_key_usage
X509_get_extension_flags
X509_get_issuer_name
X509_get_key_usage
X509_get_pathlen
X509_get_proxy_pathlen
X509_get_pubkey
X509_get_pubkey_parameters
X509_get_serialNumber
X509_get_signature_info
X509_get_signature_nid
X509_get_signature_type
X509_get_subject_name
X509_get_version
X509_getm_notAfter
X509_getm_notBefore
X509_gmtime_adj
X509_http_nbio
X509_issuer_and_serial_cmp
X509_issuer_and_serial_hash
X509_issuer_name_cmp
X509_issuer_name_hash
X509_issuer_name_hash_old
X509_it
X509_keyid_get0
X509_keyid_set1
X509_load_cert_crl_file
X509_load_cert_file
X509_load_crl_file
X509_new
X509_ocspid_print
X509_policy_check
X509_policy_level_get0_node
X509_policy_level_node_count
X509_policy_node_get0_parent
X509_policy_node_get0_policy
X509_policy_node_get0_qualifiers
X509_policy_tree_free
X509_policy_tree_get0_level
X509_policy_tree_get0_policies
X509_policy_tree_get0_user_policies
X509_policy_tree_level_count
X509_print
X509_print_ex
X509_print_ex_fp
X509_print_fp
X509_pubkey_digest
X509_reject_clear
X509_set1_notAfter
X509_set1_notBefore
X509_set_ex_data
X509_set_issuer_name
X509_set_proxy_flag
X509_set_proxy_pathlen
X509_set_pubkey
X509_set_serialNumber
X509_set_subject_name
X509_set_version
X509_sign
X509_sign_ctx
X509_signature_dump
X509_signature_print
X509_subject_name_cmp
X509_subject_name_hash
X509_subject_name_hash_old
X509_supported_extension
X509_time_adj
X509_time_adj_ex
X509_to_X509_REQ
X509_trust_clear
X509_trusted
X509_up_ref
X509_verify
X509_verify_cert
X509_verify_cert_error_string
X509at_add1_attr
X509at_add1_attr_by_NID
X509at_add1_attr_by_OBJ
X509at_add1_attr_by_txt
X509at_delete_attr
X509at_get0_data_by_OBJ
X509at_get_attr
X509at_get_attr_by_NID
X509at_get_attr_by_OBJ
X509at_get_attr_count
X509v3_add_ext
X509v3_addr_add_inherit
X509v3_addr_add_prefix
X509v3_addr_add_range
X509v3_addr_canonize
X509v3_addr_get_afi
X509v3_addr_get_range
X509v3_addr_inherits
X509v3_addr_is_canonical
X509v3_addr_subset
X509v3_addr_validate_path
X509v3_addr_validate_resource_set
X509v3_asid_add_id_or_range
X509v3_asid_add_inherit
X509v3_asid_canonize
X509v3_asid_inherits
X509v3_asid_is_canonical
X509v3_asid_subset
X509v3_asid_validate_path
X509v3_asid_validate_resource_set
X509v3_delete_ext
X509v3_get_ext
X509v3_get_ext_by_NID
X509v3_get_ext_by_OBJ
X509v3_get_ext_by_critical
X509v3_get_ext_count
ZINT32_it
ZINT64_it
ZLONG_it
ZUINT32_it
ZUINT64_it
_shadow_DES_check_key
a2d_ASN1_OBJECT
a2i_ASN1_ENUMERATED
a2i_ASN1_INTEGER
a2i_ASN1_STRING
a2i_GENERAL_NAME
a2i_IPADDRESS
a2i_IPADDRESS_NC
b2i_PVK_bio
b2i_PrivateKey
b2i_PrivateKey_bio
b2i_PublicKey
b2i_PublicKey_bio
conf_ssl_get
conf_ssl_get_cmd
conf_ssl_name_find
d2i_ACCESS_DESCRIPTION
d2i_ADMISSIONS
d2i_ADMISSION_SYNTAX
d2i_ASIdOrRange
d2i_ASIdentifierChoice
d2i_ASIdentifiers
d2i_ASN1_BIT_STRING
d2i_ASN1_BMPSTRING
d2i_ASN1_ENUMERATED
d2i_ASN1_GENERALIZEDTIME
d2i_ASN1_GENERALSTRING
d2i_ASN1_IA5STRING
d2i_ASN1_INTEGER
d2i_ASN1_NULL
d2i_ASN1_OBJECT
d2i_ASN1_OCTET_STRING
d2i_ASN1_PRINTABLE
d2i_ASN1_PRINTABLESTRING
d2i_ASN1_SEQUENCE_ANY
d2i_ASN1_SET_ANY
d2i_ASN1_T61STRING
d2i_ASN1_TIME
d2i_ASN1_TYPE
d2i_ASN1_UINTEGER
d2i_ASN1_UNIVERSALSTRING
d2i_ASN1_UTCTIME
d2i_ASN1_UTF8STRING
d2i_ASN1_VISIBLESTRING
d2i_ASRange
d2i_AUTHORITY_INFO_ACCESS
d2i_AUTHORITY_KEYID
d2i_AutoPrivateKey
d2i_BASIC_CONSTRAINTS
d2i_CERTIFICATEPOLICIES
d2i_CMS_ContentInfo
d2i_CMS_ReceiptRequest
d2i_CMS_bio
d2i_CRL_DIST_POINTS
d2i_DHparams
d2i_DHxparams
d2i_DIRECTORYSTRING
d2i_DISPLAYTEXT
d2i_DIST_POINT
d2i_DIST_POINT_NAME
d2i_DSAPrivateKey
d2i_DSAPrivateKey_bio
d2i_DSAPrivateKey_fp
d2i_DSAPublicKey
d2i_DSA_PUBKEY
d2i_DSA_PUBKEY_bio
d2i_DSA_PUBKEY_fp
d2i_DSA_SIG
d2i_DSAparams
d2i_ECDSA_SIG
d2i_ECPKParameters
d2i_ECParameters
d2i_ECPrivateKey
d2i_ECPrivateKey_bio
d2i_ECPrivateKey_fp
d2i_EC_PUBKEY
d2i_EC_PUBKEY_bio
d2i_EC_PUBKEY_fp
d2i_EDIPARTYNAME
d2i_ESS_CERT_ID
d2i_ESS_CERT_ID_V2
d2i_ESS_ISSUER_SERIAL
d2i_ESS_SIGNING_CERT
d2i_ESS_SIGNING_CERT_V2
d2i_EXTENDED_KEY_USAGE
d2i_GENERAL_NAME
d2i_GENERAL_NAMES
d2i_IPAddressChoice
d2i_IPAddressFamily
d2i_IPAddressOrRange
d2i_IPAddressRange
d2i_ISSUING_DIST_POINT
d2i_NAMING_AUTHORITY
d2i_NETSCAPE_CERT_SEQUENCE
d2i_NETSCAPE_SPKAC
d2i_NETSCAPE_SPKI
d2i_NOTICEREF
d2i_OCSP_BASICRESP
d2i_OCSP_CERTID
d2i_OCSP_CERTSTATUS
d2i_OCSP_CRLID
d2i_OCSP_ONEREQ
d2i_OCSP_REQINFO
d2i_OCSP_REQUEST
d2i_OCSP_RESPBYTES
d2i_OCSP_RESPDATA
d2i_OCSP_RESPID
d2i_OCSP_RESPONSE
d2i_OCSP_REVOKEDINFO
d2i_OCSP_SERVICELOC
d2i_OCSP_SIGNATURE
d2i_OCSP_SINGLERESP
d2i_OTHERNAME
d2i_PBE2PARAM
d2i_PBEPARAM
d2i_PBKDF2PARAM
d2i_PKCS12
d2i_PKCS12_BAGS
d2i_PKCS12_MAC_DATA
d2i_PKCS12_SAFEBAG
d2i_PKCS12_bio
d2i_PKCS12_fp
d2i_PKCS7
d2i_PKCS7_DIGEST
d2i_PKCS7_ENCRYPT
d2i_PKCS7_ENC_CONTENT
d2i_PKCS7_ENVELOPE
d2i_PKCS7_ISSUER_AND_SERIAL
d2i_PKCS7_RECIP_INFO
d2i_PKCS7_SIGNED
d2i_PKCS7_SIGNER_INFO
d2i_PKCS7_SIGN_ENVELOPE
d2i_PKCS7_bio
d2i_PKCS7_fp
d2i_PKCS8PrivateKey_bio
d2i_PKCS8PrivateKey_fp
d2i_PKCS8_PRIV_KEY_INFO
d2i_PKCS8_PRIV_KEY_INFO_bio
d2i_PKCS8_PRIV_KEY_INFO_fp
d2i_PKCS8_bio
d2i_PKCS8_fp
d2i_PKEY_USAGE_PERIOD
d2i_POLICYINFO
d2i_POLICYQUALINFO
d2i_PROFESSION_INFO
d2i_PROXY_CERT_INFO_EXTENSION
d2i_PROXY_POLICY
d2i_PUBKEY
d2i_PUBKEY_bio
d2i_PUBKEY_fp
d2i_PrivateKey
d2i_PrivateKey_bio
d2i_PrivateKey_fp
d2i_PublicKey
d2i_RSAPrivateKey
d2i_RSAPrivateKey_bio
d2i_RSAPrivateKey_fp
d2i_RSAPublicKey
d2i_RSAPublicKey_bio
d2i_RSAPublicKey_fp
d2i_RSA_OAEP_PARAMS
d2i_RSA_PSS_PARAMS
d2i_RSA_PUBKEY
d2i_RSA_PUBKEY_bio
d2i_RSA_PUBKEY_fp
d2i_SCRYPT_PARAMS
d2i_SCT_LIST
d2i_SXNET
d2i_SXNETID
d2i_TS_ACCURACY
d2i_TS_MSG_IMPRINT
d2i_TS_MSG_IMPRINT_bio
d2i_TS_MSG_IMPRINT_fp
d2i_TS_REQ
d2i_TS_REQ_bio
d2i_TS_REQ_fp
d2i_TS_RESP
d2i_TS_RESP_bio
d2i_TS_RESP_fp
d2i_TS_STATUS_INFO
d2i_TS_TST_INFO
d2i_TS_TST_INFO_bio
d2i_TS_TST_INFO_fp
d2i_USERNOTICE
d2i_X509
d2i_X509_ALGOR
d2i_X509_ALGORS
d2i_X509_ATTRIBUTE
d2i_X509_AUX
d2i_X509_CERT_AUX
d2i_X509_CINF
d2i_X509_CRL
d2i_X509_CRL_INFO
d2i_X509_CRL_bio
d2i_X509_CRL_fp
d2i_X509_EXTENSION
d2i_X509_EXTENSIONS
d2i_X509_NAME
d2i_X509_NAME_ENTRY
d2i_X509_PUBKEY
d2i_X509_REQ
d2i_X509_REQ_INFO
d2i_X509_REQ_bio
d2i_X509_REQ_fp
d2i_X509_REVOKED
d2i_X509_SIG
d2i_X509_VAL
d2i_X509_bio
d2i_X509_fp
err_free_strings_int
i2a_ACCESS_DESCRIPTION
i2a_ASN1_ENUMERATED
i2a_ASN1_INTEGER
i2a_ASN1_OBJECT
i2a_ASN1_STRING
i2b_PVK_bio
i2b_PrivateKey_bio
i2b_PublicKey_bio
i2d_ACCESS_DESCRIPTION
i2d_ADMISSIONS
i2d_ADMISSION_SYNTAX
i2d_ASIdOrRange
i2d_ASIdentifierChoice
i2d_ASIdentifiers
i2d_ASN1_BIT_STRING
i2d_ASN1_BMPSTRING
i2d_ASN1_ENUMERATED
i2d_ASN1_GENERALIZEDTIME
i2d_ASN1_GENERALSTRING
i2d_ASN1_IA5STRING
i2d_ASN1_INTEGER
i2d_ASN1_NULL
i2d_ASN1_OBJECT
i2d_ASN1_OCTET_STRING
i2d_ASN1_PRINTABLE
i2d_ASN1_PRINTABLESTRING
i2d_ASN1_SEQUENCE_ANY
i2d_ASN1_SET_ANY
i2d_ASN1_T61STRING
i2d_ASN1_TIME
i2d_ASN1_TYPE
i2d_ASN1_UNIVERSALSTRING
i2d_ASN1_UTCTIME
i2d_ASN1_UTF8STRING
i2d_ASN1_VISIBLESTRING
i2d_ASN1_bio_stream
i2d_ASRange
i2d_AUTHORITY_INFO_ACCESS
i2d_AUTHORITY_KEYID
i2d_BASIC_CONSTRAINTS
i2d_CERTIFICATEPOLICIES
i2d_CMS_ContentInfo
i2d_CMS_ReceiptRequest
i2d_CMS_bio
i2d_CMS_bio_stream
i2d_CRL_DIST_POINTS
i2d_DHparams
i2d_DHxparams
i2d_DIRECTORYSTRING
i2d_DISPLAYTEXT
i2d_DIST_POINT
i2d_DIST_POINT_NAME
i2d_DSAPrivateKey
i2d_DSAPrivateKey_bio
i2d_DSAPrivateKey_fp
i2d_DSAPublicKey
i2d_DSA_PUBKEY
i2d_DSA_PUBKEY_bio
i2d_DSA_PUBKEY_fp
i2d_DSA_SIG
i2d_DSAparams
i2d_ECDSA_SIG
i2d_ECPKParameters
i2d_ECParameters
i2d_ECPrivateKey
i2d_ECPrivateKey_bio
i2d_ECPrivateKey_fp
i2d_EC_PUBKEY
i2d_EC_PUBKEY_bio
i2d_EC_PUBKEY_fp
i2d_EDIPARTYNAME
i2d_ESS_CERT_ID
i2d_ESS_CERT_ID_V2
i2d_ESS_ISSUER_SERIAL
i2d_ESS_SIGNING_CERT
i2d_ESS_SIGNING_CERT_V2
i2d_EXTENDED_KEY_USAGE
i2d_GENERAL_NAME
i2d_GENERAL_NAMES
i2d_IPAddressChoice
i2d_IPAddressFamily
i2d_IPAddressOrRange
i2d_IPAddressRange
i2d_ISSUING_DIST_POINT
i2d_NAMING_AUTHORITY
i2d_NETSCAPE_CERT_SEQUENCE
i2d_NETSCAPE_SPKAC
i2d_NETSCAPE_SPKI
i2d_NOTICEREF
i2d_OCSP_BASICRESP
i2d_OCSP_CERTID
i2d_OCSP_CERTSTATUS
i2d_OCSP_CRLID
i2d_OCSP_ONEREQ
i2d_OCSP_REQINFO
i2d_OCSP_REQUEST
i2d_OCSP_RESPBYTES
i2d_OCSP_RESPDATA
i2d_OCSP_RESPID
i2d_OCSP_RESPONSE
i2d_OCSP_REVOKEDINFO
i2d_OCSP_SERVICELOC
i2d_OCSP_SIGNATURE
i2d_OCSP_SINGLERESP
i2d_OTHERNAME
i2d_PBE2PARAM
i2d_PBEPARAM
i2d_PBKDF2PARAM
i2d_PKCS12
i2d_PKCS12_BAGS
i2d_PKCS12_MAC_DATA
i2d_PKCS12_SAFEBAG
i2d_PKCS12_bio
i2d_PKCS12_fp
i2d_PKCS7
i2d_PKCS7_DIGEST
i2d_PKCS7_ENCRYPT
i2d_PKCS7_ENC_CONTENT
i2d_PKCS7_ENVELOPE
i2d_PKCS7_ISSUER_AND_SERIAL
i2d_PKCS7_NDEF
i2d_PKCS7_RECIP_INFO
i2d_PKCS7_SIGNED
i2d_PKCS7_SIGNER_INFO
i2d_PKCS7_SIGN_ENVELOPE
i2d_PKCS7_bio
i2d_PKCS7_bio_stream
i2d_PKCS7_fp
i2d_PKCS8PrivateKeyInfo_bio
i2d_PKCS8PrivateKeyInfo_fp
i2d_PKCS8PrivateKey_bio
i2d_PKCS8PrivateKey_fp
i2d_PKCS8PrivateKey_nid_bio
i2d_PKCS8PrivateKey_nid_fp
i2d_PKCS8_PRIV_KEY_INFO
i2d_PKCS8_PRIV_KEY_INFO_bio
i2d_PKCS8_PRIV_KEY_INFO_fp
i2d_PKCS8_bio
i2d_PKCS8_fp
i2d_PKEY_USAGE_PERIOD
i2d_POLICYINFO
i2d_POLICYQUALINFO
i2d_PROFESSION_INFO
i2d_PROXY_CERT_INFO_EXTENSION
i2d_PROXY_POLICY
i2d_PUBKEY
i2d_PUBKEY_bio
i2d_PUBKEY_fp
i2d_PrivateKey
i2d_PrivateKey_bio
i2d_PrivateKey_fp
i2d_PublicKey
i2d_RSAPrivateKey
i2d_RSAPrivateKey_bio
i2d_RSAPrivateKey_fp
i2d_RSAPublicKey
i2d_RSAPublicKey_bio
i2d_RSAPublicKey_fp
i2d_RSA_OAEP_PARAMS
i2d_RSA_PSS_PARAMS
i2d_RSA_PUBKEY
i2d_RSA_PUBKEY_bio
i2d_RSA_PUBKEY_fp
i2d_SCRYPT_PARAMS
i2d_SCT_LIST
i2d_SXNET
i2d_SXNETID
i2d_TS_ACCURACY
i2d_TS_MSG_IMPRINT
i2d_TS_MSG_IMPRINT_bio
i2d_TS_MSG_IMPRINT_fp
i2d_TS_REQ
i2d_TS_REQ_bio
i2d_TS_REQ_fp
i2d_TS_RESP
i2d_TS_RESP_bio
i2d_TS_RESP_fp
i2d_TS_STATUS_INFO
i2d_TS_TST_INFO
i2d_TS_TST_INFO_bio
i2d_TS_TST_INFO_fp
i2d_USERNOTICE
i2d_X509
i2d_X509_ALGOR
i2d_X509_ALGORS
i2d_X509_ATTRIBUTE
i2d_X509_AUX
i2d_X509_CERT_AUX
i2d_X509_CINF
i2d_X509_CRL
i2d_X509_CRL_INFO
i2d_X509_CRL_bio
i2d_X509_CRL_fp
i2d_X509_EXTENSION
i2d_X509_EXTENSIONS
i2d_X509_NAME
i2d_X509_NAME_ENTRY
i2d_X509_PUBKEY
i2d_X509_REQ
i2d_X509_REQ_INFO
i2d_X509_REQ_bio
i2d_X509_REQ_fp
i2d_X509_REVOKED
i2d_X509_SIG
i2d_X509_VAL
i2d_X509_bio
i2d_X509_fp
i2d_re_X509_CRL_tbs
i2d_re_X509_REQ_tbs
i2d_re_X509_tbs
i2o_ECPublicKey
i2o_SCT
i2o_SCT_LIST
i2s_ASN1_ENUMERATED
i2s_ASN1_ENUMERATED_TABLE
i2s_ASN1_IA5STRING
i2s_ASN1_INTEGER
i2s_ASN1_OCTET_STRING
i2t_ASN1_OBJECT
i2v_ASN1_BIT_STRING
i2v_GENERAL_NAME
i2v_GENERAL_NAMES
o2i_ECPublicKey
o2i_SCT
o2i_SCT_LIST
s2i_ASN1_IA5STRING
s2i_ASN1_INTEGER
s2i_ASN1_OCTET_STRING
v2i_ASN1_BIT_STRING
v2i_GENERAL_NAME
v2i_GENERAL_NAMES
v2i_GENERAL_NAME_ex
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
607KB
Virtual Size
607KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=207, version=50929,
count=28, id=205, version=50929,
count=172, id=206, version=50929,
count=13, id=185, version=30716,
count=163, id=1, productName=Unmarked objects,
count=23, productName=Unmarked objects (old),
count=631, id=206, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
libssl-1_1.dll
- IMPHASH 0fbf72d833f142763a403114ef7eac10
- SHA256 797ba3a838a6d0bc7b9b39efec86473ffe4255f782bb54066e81856eb0adf0a9
- MD5 723c79630b1971f327fb7bff5ff38eda
- SHA1 77844078bfea3b45e7fc4a42e5b7261fc5c6ad3a
- SHA512 8329b8755104ad17889e1f4b1ead597a38bec8f07cebc246c5b0e8a0b88e1046d31cd3724e8fb8ed903e52e1e4808324e63ba4d4927a7fae3233ae37da8d31c2
- SSDEEP 12288:4b4Y1HbWEsPTvVDAibOrwth/u2aom9qiDrMzNg+6U2lvz9s4:E4Y14JHkbxDrMRg+6U2lvzS4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
363535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libssl-1_1.pdb
libcrypto-1_1
COMP_CTX_new
COMP_CTX_free
BIO_s_mem
EVP_CIPHER_key_length
EVP_MD_CTX_ctrl
EVP_MD_CTX_set_flags
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_md5
EVP_sha1
OPENSSL_sk_num
OPENSSL_sk_value
OPENSSL_sk_new_reserve
OPENSSL_sk_pop_free
CRYPTO_memdup
CRYPTO_strdup
EVP_sha256
EVP_PKEY_security_bits
EVP_PKEY_set_type
EVP_PKEY_set1_DH
EVP_PKEY_new
EVP_PKEY_up_ref
EVP_PKEY_free
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_CTX_free
EVP_PKEY_CTX_ctrl
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_derive
EVP_PKEY_paramgen_init
EVP_PKEY_paramgen
EVP_PKEY_keygen_init
EVP_PKEY_keygen
EC_GROUP_get_curve_name
EC_KEY_get0_group
X509_NAME_free
X509_free
ASN1_OCTET_STRING_it
INT32_it
ZINT32_it
UINT32_it
ZUINT32_it
ZINT64_it
ZUINT64_it
X509_it
CRYPTO_strndup
ASN1_item_free
ASN1_item_d2i
ASN1_item_i2d
OPENSSL_DIR_read
OPENSSL_DIR_end
OPENSSL_sk_shift
OPENSSL_sk_pop
OPENSSL_sk_set_cmp_func
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_lock_free
CRYPTO_get_ex_new_index
CRYPTO_THREAD_run_once
BIO_s_file
EVP_PKEY_id
OPENSSL_LH_new
OPENSSL_LH_free
OPENSSL_LH_insert
OPENSSL_LH_retrieve
X509_STORE_new
X509_STORE_free
X509_STORE_up_ref
X509_STORE_CTX_new
X509_STORE_CTX_free
X509_STORE_CTX_init
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_get_error
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get1_chain
X509_STORE_CTX_set_flags
X509_STORE_CTX_get0_param
X509_STORE_CTX_set_default
X509_STORE_CTX_set0_dane
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_move_peername
X509_verify_cert_error_string
X509_NAME_dup
i2d_X509_NAME
X509_get_subject_name
X509_up_ref
X509_chain_up_ref
X509_cmp
X509_NAME_hash
X509_verify_cert
PEM_read_bio_X509
X509_get_extension_flags
OPENSSL_sk_new
OPENSSL_sk_insert
OPENSSL_sk_delete
OPENSSL_sk_dup
OPENSSL_sk_sort
CRYPTO_mem_ctrl
OBJ_nid2sn
COMP_get_type
COMP_get_name
COMP_zlib
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0_info
ENGINE_finish
CONF_parse_list
DH_free
OBJ_sn2nid
EC_curve_nist2nid
EC_KEY_new_by_curve_name
EC_KEY_free
X509_STORE_load_locations
PEM_read_bio_DHparams
ERR_func_error_string
ERR_load_strings_const
OPENSSL_init_crypto
OPENSSL_atexit
err_free_strings_int
OBJ_NAME_add
EVP_md5_sha1
EVP_sha224
EVP_sha384
EVP_sha512
EVP_des_cbc
EVP_des_ede3_cbc
EVP_rc4
EVP_rc4_hmac_md5
EVP_idea_cbc
EVP_rc2_cbc
EVP_rc2_40_cbc
EVP_aes_128_cbc
EVP_aes_128_ccm
EVP_aes_128_gcm
EVP_aes_192_cbc
EVP_aes_256_cbc
EVP_aes_256_ccm
EVP_aes_256_gcm
EVP_aes_128_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_256_cbc_hmac_sha256
EVP_aria_128_gcm
EVP_aria_256_gcm
EVP_camellia_128_cbc
EVP_camellia_256_cbc
EVP_chacha20_poly1305
EVP_seed_cbc
EVP_add_cipher
EVP_add_digest
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_write_lock
CRYPTO_THREAD_unlock
CRYPTO_new_ex_data
CRYPTO_dup_ex_data
CRYPTO_free_ex_data
CRYPTO_set_ex_data
CRYPTO_get_ex_data
CRYPTO_realloc
CRYPTO_secure_zalloc
CRYPTO_secure_free
BUF_MEM_free
COMP_CTX_get_method
BIO_int_ctrl
BIO_pop
BIO_free_all
BIO_s_socket
OPENSSL_LH_num_items
ERR_peek_error
OBJ_bsearch_
EVP_CIPHER_CTX_free
X509_STORE_add_lookup
OPENSSL_cleanse
X509_LOOKUP_file
X509_LOOKUP_ctrl
X509_STORE_set_default_paths
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_trust
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_depth
d2i_PUBKEY
X509_EXTENSION_free
d2i_X509
X509_get0_pubkey
X509_check_private_key
X509_get_ext_d2i
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_start_job
ASYNC_get_current_job
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
SCT_LIST_free
SCT_set_source
SCT_get_validation_status
SCT_LIST_validate
o2i_SCT_LIST
CTLOG_STORE_new
CTLOG_STORE_free
CTLOG_STORE_load_file
CTLOG_STORE_load_default_file
X509_get_key_usage
RAND_priv_bytes
OCSP_response_get1_basic
OCSP_resp_count
OCSP_resp_get0
OCSP_SINGLERESP_get1_ext_d2i
OCSP_BASICRESP_free
OCSP_RESPID_free
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
conf_ssl_get
conf_ssl_name_find
conf_ssl_get_cmd
RSA_free
RSA_up_ref
RSA_flags
d2i_RSAPrivateKey
ERR_peek_last_error
EVP_PKEY_assign
EVP_PKEY_get0_RSA
EVP_PKEY_get0_EC_KEY
d2i_PrivateKey
EVP_PKEY_copy_parameters
EVP_PKEY_missing_parameters
EVP_PKEY_cmp
EC_KEY_can_sign
d2i_X509_bio
d2i_RSAPrivateKey_bio
d2i_PrivateKey_bio
X509_get_pubkey
PEM_read_bio
PEM_read_bio_X509_AUX
PEM_read_bio_RSAPrivateKey
PEM_read_bio_PrivateKey
OPENSSL_LH_delete
OPENSSL_LH_doall_arg
OPENSSL_LH_get_down_load
OPENSSL_LH_set_down_load
PEM_ASN1_read_bio
PEM_ASN1_write_bio
PEM_ASN1_read
PEM_ASN1_write
ENGINE_get_ssl_client_cert_function
ENGINE_init
BIO_puts
BIO_dump_indent
BIO_printf
EVP_DigestSignInit
EVP_PKEY_new_raw_private_key
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_get1_tls_encodedpoint
i2d_X509_EXTENSIONS
i2d_OCSP_RESPID
EVP_DigestSign
d2i_X509_EXTENSIONS
d2i_OCSP_RESPID
BUF_MEM_new
BUF_MEM_grow_clean
BN_is_zero
BN_num_bits
BN_bin2bn
BN_bn2bin
BN_free
RSA_pkey_ctx_ctrl
DH_new
DH_security_bits
DH_check_params
DH_set0_pqg
DH_get0_key
DH_set0_key
EVP_Digest
EVP_DigestInit
EVP_DigestVerify
EVP_DigestVerifyInit
EVP_PKEY_size
EVP_PKEY_get0_DH
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt
ENGINE_load_ssl_client_cert
BUF_reverse
EVP_DigestVerifyFinal
d2i_X509_NAME
i2d_X509
X509_NAME_cmp
BN_ucmp
RSA_size
RSA_private_decrypt
DH_get0_pqg
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_EncryptFinal
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt
HMAC_CTX_new
HMAC_CTX_free
HMAC_Init_ex
HMAC_Update
HMAC_Final
EVP_PKEY_new_mac_key
BN_new
BN_set_word
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_8192
OBJ_ln2nid
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_DecryptFinal
EVP_PKEY_get0
EVP_PKEY_get_default_digest_nid
HMAC_size
EC_GROUP_method_of
EC_METHOD_get_field_type
EC_KEY_get_conv_form
DH_get_1024_160
DH_get_2048_224
X509_get_signature_info
X509_get_signature_nid
X509_get_issuer_name
X509_chain_check_suiteb
ERR_set_mark
ERR_pop_to_mark
BN_clear_free
BN_copy
BN_dup
SRP_create_verifier_BN
SRP_check_known_gN_param
SRP_get_default_gN
SRP_Calc_server_key
SRP_Calc_B
SRP_Verify_A_mod_N
SRP_Calc_u
SRP_Calc_x
SRP_Calc_A
SRP_Calc_client_key
SRP_Verify_B_mod_N
CRYPTO_clear_free
MD5_Transform
MD5_Init
SHA512_Transform
SHA512_Init
SHA384_Init
SHA256_Transform
SHA256_Init
SHA224_Init
SHA1_Transform
SHA1_Init
EVP_DigestFinal
EVP_DigestInit_ex
EVP_MD_type
EVP_CipherFinal_ex
EVP_CipherUpdate
EVP_CipherInit_ex
RAND_bytes
EVP_CIPHER_CTX_ctrl
EVP_DigestSignFinal
EVP_MD_CTX_copy
EVP_DigestFinal_ex
EVP_DigestUpdate
EVP_MD_CTX_copy_ex
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_Cipher
EVP_CIPHER_CTX_block_size
EVP_CIPHER_iv_length
EVP_CIPHER_block_size
COMP_expand_block
COMP_compress_block
CRYPTO_memcmp
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_cipher
EVP_CIPHER_flags
EVP_MD_CTX_md
EVP_MD_size
ERR_add_error_data
BIO_snprintf
CRYPTO_malloc
BUF_MEM_grow
OPENSSL_sk_push
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_new_null
ERR_clear_error
BIO_ADDR_clear
BIO_ADDR_free
BIO_ADDR_new
BIO_read
BIO_test_flags
ERR_put_error
BIO_copy_next_retry
BIO_f_buffer
BIO_s_connect
BIO_set_retry_reason
BIO_get_retry_reason
BIO_set_next
BIO_next
BIO_find_type
BIO_push
BIO_callback_ctrl
BIO_ctrl
BIO_write
BIO_up_ref
BIO_get_shutdown
BIO_set_shutdown
BIO_get_init
BIO_set_init
BIO_get_data
BIO_set_data
BIO_free
BIO_new
BIO_method_type
BIO_clear_flags
BIO_set_flags
CRYPTO_free
X509_LOOKUP_hash_dir
CRYPTO_zalloc
kernel32
CreateFileW
FlushFileBuffers
HeapSize
LoadLibraryW
OutputDebugStringW
WriteConsoleW
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
SetConsoleCtrlHandler
LoadLibraryExW
FreeLibrary
InterlockedExchange
GetModuleFileNameW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
Sleep
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
AreFileApisANSI
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateSemaphoreW
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
SystemTimeToFileTime
GetSystemTime
SetLastError
CloseHandle
BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_get_data_mtu
DTLS_method
DTLS_server_method
DTLS_set_timer_cb
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_listen
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
OPENSSL_cipher_name
OPENSSL_init_ssl
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_auth_nid
SSL_CIPHER_get_bits
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_digest_nid
SSL_CIPHER_get_handshake_digest
SSL_CIPHER_get_id
SSL_CIPHER_get_kx_nid
SSL_CIPHER_get_name
SSL_CIPHER_get_protocol_id
SSL_CIPHER_get_version
SSL_CIPHER_is_aead
SSL_CIPHER_standard_name
SSL_COMP_add_compression_method
SSL_COMP_get0_name
SSL_COMP_get_compression_methods
SSL_COMP_get_id
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add1_to_CA_list
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_clear_options
SSL_CTX_config
SSL_CTX_ct_is_enabled
SSL_CTX_ctrl
SSL_CTX_dane_clear_flags
SSL_CTX_dane_enable
SSL_CTX_dane_mtype_set
SSL_CTX_dane_set_flags
SSL_CTX_enable_ct
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_CA_list
SSL_CTX_get0_certificate
SSL_CTX_get0_ctlog_store
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get0_security_ex_data
SSL_CTX_get_cert_store
SSL_CTX_get_ciphers
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_get_info_callback
SSL_CTX_get_keylog_callback
SSL_CTX_get_max_early_data
SSL_CTX_get_num_tickets
SSL_CTX_get_options
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_record_padding_callback_arg
SSL_CTX_get_recv_max_early_data
SSL_CTX_get_security_callback
SSL_CTX_get_security_level
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_has_client_custom_ext
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set0_CA_list
SSL_CTX_set0_ctlog_store
SSL_CTX_set0_security_ex_data
SSL_CTX_set1_cert_store
SSL_CTX_set1_param
SSL_CTX_set_allow_early_data_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_block_padding
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_client_hello_cb
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_ct_validation_callback
SSL_CTX_set_ctlog_list_file
SSL_CTX_set_default_ctlog_list_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_read_buffer_len
SSL_CTX_set_default_verify_dir
SSL_CTX_set_default_verify_file
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_keylog_callback
SSL_CTX_set_max_early_data
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_not_resumable_session_callback
SSL_CTX_set_num_tickets
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_find_session_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_psk_use_session_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_record_padding_callback
SSL_CTX_set_record_padding_callback_arg
SSL_CTX_set_recv_max_early_data
SSL_CTX_set_security_callback
SSL_CTX_set_security_level
SSL_CTX_set_session_id_context
SSL_CTX_set_session_ticket_cb
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_stateless_cookie_generate_cb
SSL_CTX_set_stateless_cookie_verify_cb
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_max_fragment_length
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_up_ref
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_cert_and_key
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_ex
SSL_CTX_use_serverinfo_file
SSL_SESSION_dup
SSL_SESSION_free
SSL_SESSION_get0_alpn_selected
SSL_SESSION_get0_cipher
SSL_SESSION_get0_hostname
SSL_SESSION_get0_id_context
SSL_SESSION_get0_peer
SSL_SESSION_get0_ticket
SSL_SESSION_get0_ticket_appdata
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_id
SSL_SESSION_get_master_key
SSL_SESSION_get_max_early_data
SSL_SESSION_get_max_fragment_length
SSL_SESSION_get_protocol_version
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_is_resumable
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_print_keylog
SSL_SESSION_set1_alpn_selected
SSL_SESSION_set1_hostname
SSL_SESSION_set1_id
SSL_SESSION_set1_id_context
SSL_SESSION_set1_master_key
SSL_SESSION_set1_ticket_appdata
SSL_SESSION_set_cipher
SSL_SESSION_set_ex_data
SSL_SESSION_set_max_early_data
SSL_SESSION_set_protocol_version
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SESSION_up_ref
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add1_host
SSL_add1_to_CA_list
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_add_ssl_module
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_alloc_buffers
SSL_bytes_to_cipher_list
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_clear_options
SSL_client_hello_get0_ciphers
SSL_client_hello_get0_compression_methods
SSL_client_hello_get0_ext
SSL_client_hello_get0_legacy_version
SSL_client_hello_get0_random
SSL_client_hello_get0_session_id
SSL_client_hello_get1_extensions_present
SSL_client_hello_isv2
SSL_client_version
SSL_config
SSL_connect
SSL_copy_session_id
SSL_ct_is_enabled
SSL_ctrl
SSL_dane_clear_flags
SSL_dane_enable
SSL_dane_set_flags
SSL_dane_tlsa_add
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_enable_ct
SSL_export_keying_material
SSL_export_keying_material_early
SSL_extension_supported
SSL_free
SSL_free_buffers
SSL_get0_CA_list
SSL_get0_alpn_selected
SSL_get0_dane
SSL_get0_dane_authority
SSL_get0_dane_tlsa
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get0_peer_CA_list
SSL_get0_peer_scts
SSL_get0_peername
SSL_get0_security_ex_data
SSL_get0_verified_chain
SSL_get1_session
SSL_get1_supported_ciphers
SSL_get_SSL_CTX
SSL_get_all_async_fds
SSL_get_certificate
SSL_get_changed_async_fds
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_client_ciphers
SSL_get_client_random
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_passwd_cb
SSL_get_default_passwd_cb_userdata
SSL_get_default_timeout
SSL_get_early_data_status
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_key_update_type
SSL_get_max_early_data
SSL_get_num_tickets
SSL_get_options
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_peer_signature_type_nid
SSL_get_pending_cipher
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_record_padding_callback_arg
SSL_get_recv_max_early_data
SSL_get_rfd
SSL_get_security_callback
SSL_get_security_level
SSL_get_selected_srtp_profile
SSL_get_server_random
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_signature_type_nid
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_state
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_has_pending
SSL_in_before
SSL_in_init
SSL_is_dtls
SSL_is_init_finished
SSL_is_server
SSL_key_update
SSL_load_client_CA_file
SSL_new
SSL_peek
SSL_peek_ex
SSL_pending
SSL_read
SSL_read_early_data
SSL_read_ex
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_session_reused
SSL_set0_CA_list
SSL_set0_rbio
SSL_set0_security_ex_data
SSL_set0_wbio
SSL_set1_host
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_allow_early_data_cb
SSL_set_alpn_protos
SSL_set_bio
SSL_set_block_padding
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_ciphersuites
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_ct_validation_callback
SSL_set_debug
SSL_set_default_passwd_cb
SSL_set_default_passwd_cb_userdata
SSL_set_default_read_buffer_len
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_hostflags
SSL_set_info_callback
SSL_set_max_early_data
SSL_set_msg_callback
SSL_set_not_resumable_session_callback
SSL_set_num_tickets
SSL_set_options
SSL_set_post_handshake_auth
SSL_set_psk_client_callback
SSL_set_psk_find_session_callback
SSL_set_psk_server_callback
SSL_set_psk_use_session_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_record_padding_callback
SSL_set_record_padding_callback_arg
SSL_set_recv_max_early_data
SSL_set_rfd
SSL_set_security_callback
SSL_set_security_level
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_tlsext_max_fragment_length
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state_string
SSL_state_string_long
SSL_stateless
SSL_up_ref
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_cert_and_key
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_chain_file
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_verify_client_post_handshake
SSL_version
SSL_waiting_for_async
SSL_want
SSL_write
SSL_write_early_data
SSL_write_ex
TLS_client_method
TLS_method
TLS_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION
Name
.text
Size
451KB
Virtual Size
451KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
19KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=185, version=30716,
count=28, id=207, version=50929,
count=16, id=205, version=50929,
count=97, id=206, version=50929,
count=3, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=513, id=1, productName=Unmarked objects,
count=44, id=206, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
locale/da_DK.mo
- SHA256 cfa11e43e7a35d8e70748b9fed9799cd4c5bbc9fb3b984f4461f6d3c06519328
- MD5 35b41bfed4624b2984df341cdabc0ddd
- SHA1 4406c32944a572dcaa1c281899e3c48aea257443
- SHA512 4fc208dd603dda33e374c8f0f4f64c193b4840a15fb149ba9ab891062a399e9154c94a80677ccdcf7db079a6f33c6c00524d334b5fa8840b4a5a8efb4c098a85
- SSDEEP 6144:m0x0zfyGKUYSCFzLywSyJCs5gz0F2ndVCvTm:dx9tRLyjBz0F2nP
- MD5 SHA1 SHA512 SSDEEP
locale/de_DE.mo
- SHA256 75918538429b33d4bc6495143f44586464eec66511547cf05075360361cc442a
- MD5 346d6d204469741a6933d9d997283b0f
- SHA1 8fa8520d7f6cf75282e99833f6b36be45e035861
- SHA512 7e6b11778073528b87804d30585a669e356bd3c99518d5fe546fe667eee974626c84ae45dc8c1ad8be620149dae2fc9d8b87e36c9462f086e26110e256a0ae36
- SSDEEP 6144:m0x0dlyKUYSCFzLywSyJCOLjvFsGQxq4V9F1YW6:d69tRLyjmLjvQxJ9F2
- MD5 SHA1 SHA512 SSDEEP
locale/es_ES.mo
- SHA256 866d133376b188702c406779ffcede316d4577d2a029f78538a5d30faf71e47e
- MD5 cf3800582e8dd0a7b346665a366b0369
- SHA1 931d789e756fb4b6deb04c5f5bfe28305f22578c
- SHA512 419660dc419a92a2771fc9568108f6f306db5b42bc2b8e58193aa03320bd4f2538f7f660ae01b810287231a99ee24168d8c56ddba84f33923db0bc13d2d67cbb
- SSDEEP 3072:m0x0uslIRHwrousbvs+n1iu2UYSCCszdcMyXIfFN8yJCuDUhe3C6M+e1Co8AFM04:m0x0wwmKUYSCFzLywSyJCXYw+YFMv
- MD5 SHA1 SHA512 SSDEEP
locale/fr_FR.mo
- SHA256 a78ffa801a90f998817cbe401c9186f5b2bff3f225c486d1dcafee9e089b7f3e
- MD5 2d43a9c7652d14fb9869e484eb7d8022
- SHA1 08d74e102dccfbd3b3bbb5ea6859f79312fa18d4
- SHA512 2dcc15f87ae812702aef018868bfad33a14f77523ed4baca2866e1c277d6a2f696ae924d86581cd5955c34e0736c9ed838cf8bbf3e552e59f70f8d3db3937c34
- SSDEEP 6144:m0x0huxTKUYSCFzLywSyJCLj3SLKma3/3ma5cGmWArUiCYRxp3/A7+:dnQ9tRLyjaLKma3/3ma5irRRxp37
- MD5 SHA1 SHA512 SSDEEP
locale/it_IT.mo
- SHA256 6e6e5ac92a3341cba3585430d460f74071dbff1bde2f79b8246810dc35983775
- MD5 9e5efee9c003ff0f7c23786b049d1baf
- SHA1 623e5c61dc11d1ca88ebb6722ead5287e543b12c
- SHA512 22061fefc040800a40f487efb023807fb5dcffb68c2aaa04250fd4e0265b7de56f021da0adcd147dcbba1f60f78df998efb32c7996776abb0d051cbd496f5541
- SSDEEP 6144:m0x0InKKUYSCFzLywSyJCoqRC0d3T9lVfm1dOIFjjmFQ2mYNowTp8Fmdk/C8UuTN:ddb9tRLyjq
- MD5 SHA1 SHA512 SSDEEP
locale/nl_NL.mo
- SHA256 17dac2d8db8208e99c219e00db2fb7c192ae0d721c7953a38eafbfbb6910ba51
- MD5 5c49172e8ead4717f508d2f858a91e6d
- SHA1 4d85561468cd004f45bdc205d74f71713937733f
- SHA512 5651abc36f158991dc48fb8e9df53c417b587689742decda8b751340b4e10db74979f1d5480112401b04cb9860b637a1faa25a4640c74afe9e1ea080e15bab96
- SSDEEP 3072:m0x0uslI77EP3ousbvs+n1iu2UYSCCszdcMyXIfFN8yJCQsUJtpNMFtRkkO8RBWp:m0x0E7xKUYSCFzLywSyJCLJCSENLcgL
- MD5 SHA1 SHA512 SSDEEP
locale/nn_NO.mo
- SHA256 bed4e35de6424cdb297d92a9e9eb3e00d73592beb828a7b764fe3a33f903198d
- MD5 9a0c9fc80aee4b697e647c5361eb184e
- SHA1 c7857e4daa4ab0206d9542d1367215783f6124a2
- SHA512 2790b8597e49502ac12d73b0b581e3b0d2058867b2f19f207d67f6d8b191eccb07f906acb707078364e7ba63267200b371e20426c6fa8557646d82ad871dbe45
- SSDEEP 6144:m0x0SAtakKUYSCFzLywSyJCBmmywW5zz95RKnDXlGAg:d+ah9tRLyj65tang
- MD5 SHA1 SHA512 SSDEEP
locale/pl_PL.mo
- SHA256 5687ab0bacf4ab323d0fff553c60b77e79bf64dd3fb89a4f21ac8c60b50fac3a
- MD5 86b7193a0be54bfae03b31033f9bc224
- SHA1 1ed49b98af5f2fe3b960b06fb537a8f6a68db1f0
- SHA512 e2491cf0915b746b59b35e13e19ba400d1b5406e6d70f3835447574f992011f359a1055de42ef2c5839887f4252dc6d1a2987d802d0d0a3624812d092f9cd5f8
- SSDEEP 6144:m0x0+CLgUKUYSCFzLywSyJCYufXKOWgK1zbFk+pbNafW4KjQF:ddd9tRLyjMO5KDk+pZafDY4
- MD5 SHA1 SHA512 SSDEEP
locale/pt_PT.mo
- SHA256 5698eb42acfc94cd15acdc3d1eb8a650f2adeb935a8881fe6165abe39d9d61cb
- MD5 1c8e2f0bef857a0f02696441f4a91564
- SHA1 4bb0ecc08f0b6aec1f81d6b5c575402a1bf95294
- SHA512 1cc3fd9960e3aafcd8f17063b6d07da91ea9796bd88fc5dacfe7642cfc237a8e1d18ec5f0adf047b7a94dbb4c913d07f8fa3af204b536f988a7a3cf4f8fd9e16
- SSDEEP 3072:m0x0uslIJ+RfCousbvs+n1iu2UYSCCszdcMyXIfFN8yJClCuSfaKSTIX/EhQK3zm:m0x05fBKUYSCFzLywSyJCt3YdV
- MD5 SHA1 SHA512 SSDEEP
locale/sv_SE.mo
- SHA256 1ee39ccda4805331e4899545fdf616d3b180347961e8bbf593540daeeb328494
- MD5 625db4b4625d7f4025b6f3aad18c1056
- SHA1 5e4e3e538f68011125e9c53a2fd5ec01d3ccafa9
- SHA512 0230361e122c1c0ac178a24ad5c6df83976c279da8523fdf01f8511079aad1ae1d061acc395d30090aa6b05dee58fd56654447f7daeb2026ab2763179835d86c
- SSDEEP 6144:m0x0u80DGp+KUYSCFzLywSyJCS6veBn2b3EkrZVymURfRdd393sH:dPb+9tRLyjKLBn2bv0w
- MD5 SHA1 SHA512 SSDEEP
locale/tr_TR.mo
- SHA256 c8d764870132527a03ce4e6a90c237a4318f7663cefeb289eb3194dcfeec9e3f
- MD5 3cc00d8143903aaf1601f93e8d5956cb
- SHA1 a4121622dbe600302e327376e238901722f0bdf7
- SHA512 25c42ffb446a639dc150f83844f45fd0760150911a9324b0553b2c9b558ec1c28c7d61259f4974c577140232b0358b5b20905bbb3b22421a6cdb0635a730f574
- SSDEEP 3072:m0x0uslIk0wWousbvs+n1iu2UYSCCszdcMyXIfFN8yJCZuqYMAjAJoF+yRT48ggF:m0x0dZdKUYSCFzLywSyJCpAUTglokH
- MD5 SHA1 SHA512 SSDEEP
mscordaccore.dll
- IMPHASH b48f4be60ce658f8283045be599a540f
- SHA256 5e63a9d0e5a7d10a738a7ce4633bff84e223183ef2155b7adf80c211a2b80a77
- MD5 87a7aaf5ae5b7de4e15572166ca95d74
- SHA1 76ec73926d22b708904e01623beb0138009dec5a
- SHA512 5f0b2761c04c5565b5232446e3ca77a07f4a15567fd3a5de69661e705dd872a3e87358d79d6f02e807879eb1e15934fb09ad2e066a805c12c67c8d2c917e696f
- SSDEEP 24576:TqNZkhwIJ9S6lumIuLLR4VCXsfPOdejmRmGSGKV5Fl5vWI:OMhwIHHumIuLLRAC8eejilgfl5vWI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d3:c1:d6:99:8f:18:9c:35:7c:72:82:60:60:41:be:6c:9c:15:e2:6b:7b:ba:d3:c8:37:ff:42:ed:62:c9:b7:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:c3:dd:83:8b:aa:3e:94:d9:c2:00:00:00:00:04:c3
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 30, 2022 - Jun 30, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
1
Major OS version
6
Entry point
636656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb
kernel32
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
TlsGetValue
TlsAlloc
TlsFree
RaiseException
TlsSetValue
CreateEventW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
DebugBreak
GetProcessAffinityMask
SwitchToThread
GetEnvironmentVariableW
GetFullPathNameW
ReadProcessMemory
LoadLibraryExW
CreateFileW
GetModuleFileNameW
TerminateProcess
OutputDebugStringW
IsDebuggerPresent
RaiseFailFastException
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoTaskMemFree
CoCreateGuid
IIDFromString
oleaut32
SetErrorInfo
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscat_s
strcmp
strcpy_s
strlen
strncat_s
wcsncat_s
wcsncmp
_wcslwr_s
wcscpy_s
strncmp
strncpy_s
strnlen
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
abort
_cexit
_errno
_execute_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
_flushall
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
_putws
__stdio_common_vsnprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
704KB
Virtual Size
703KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=261, version=26706,
count=18, id=260, version=26706,
count=15, id=259, version=26706,
count=4, id=260, version=26213,
count=11, id=257, version=26213,
count=194, id=1, productName=Unmarked objects,
count=1, id=256, version=27048,
count=193, id=265, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
mscordaccore_x86_x86_4.700.22.55902.dll
- IMPHASH b48f4be60ce658f8283045be599a540f
- SHA256 5e63a9d0e5a7d10a738a7ce4633bff84e223183ef2155b7adf80c211a2b80a77
- MD5 87a7aaf5ae5b7de4e15572166ca95d74
- SHA1 76ec73926d22b708904e01623beb0138009dec5a
- SHA512 5f0b2761c04c5565b5232446e3ca77a07f4a15567fd3a5de69661e705dd872a3e87358d79d6f02e807879eb1e15934fb09ad2e066a805c12c67c8d2c917e696f
- SSDEEP 24576:TqNZkhwIJ9S6lumIuLLR4VCXsfPOdejmRmGSGKV5Fl5vWI:OMhwIHHumIuLLRAC8eejilgfl5vWI
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d3:c1:d6:99:8f:18:9c:35:7c:72:82:60:60:41:be:6c:9c:15:e2:6b:7b:ba:d3:c8:37:ff:42:ed:62:c9:b7:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:c3:dd:83:8b:aa:3e:94:d9:c2:00:00:00:00:04:c3
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 30, 2022 - Jun 30, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
1
Major OS version
6
Entry point
636656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb
kernel32
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
TlsGetValue
TlsAlloc
TlsFree
RaiseException
TlsSetValue
CreateEventW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
DebugBreak
GetProcessAffinityMask
SwitchToThread
GetEnvironmentVariableW
GetFullPathNameW
ReadProcessMemory
LoadLibraryExW
CreateFileW
GetModuleFileNameW
TerminateProcess
OutputDebugStringW
IsDebuggerPresent
RaiseFailFastException
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoTaskMemFree
CoCreateGuid
IIDFromString
oleaut32
SetErrorInfo
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscat_s
strcmp
strcpy_s
strlen
strncat_s
wcsncat_s
wcsncmp
_wcslwr_s
wcscpy_s
strncmp
strncpy_s
strnlen
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
abort
_cexit
_errno
_execute_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
_flushall
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
_putws
__stdio_common_vsnprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
704KB
Virtual Size
703KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=261, version=26706,
count=18, id=260, version=26706,
count=15, id=259, version=26706,
count=4, id=260, version=26213,
count=11, id=257, version=26213,
count=194, id=1, productName=Unmarked objects,
count=1, id=256, version=27048,
count=193, id=265, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
mscordbi.dll
- IMPHASH 406ce9b644c8bf4e31063e1f8559d643
- SHA256 776150b3c8008d9ef5d931ec871fc00638d81e3f5f37fe6cd4988353d6eaef25
- MD5 0f5287ccf46af868d472a16dfada82f8
- SHA1 96f9943dbdf240205de2a17c1c413ca3e0ac9b45
- SHA512 d0e993348577b7fa526d046bb684e449d82a40c0a1964f1714474d9711660eb9f83ef34e01c5fcf1089ab7c8400afce6d0e7946b5f278a08226cb46ad0afd2fa
- SSDEEP 24576:O1tPRQ/bWmM1hPu16JeC2KInVt3qwUk/:bamM1hPu1meClInVt6wUk/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:79:a7:cf:ef:a8:d5:e3:6d:fa:0a:bb:1c:89:3a:1e:f3:6d:14:d1:7e:fa:63:c5:23:a3:92:87:fb:d2:ae:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=.NET DAC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:c3:dd:83:8b:aa:3e:94:d9:c2:00:00:00:00:04:c3
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 30, 2022 - Jun 30, 2023
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
1
Major OS version
6
Entry point
671440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb
kernel32
OpenThread
SuspendThread
ResumeThread
DuplicateHandle
CreateThread
TerminateProcess
GetThreadContext
SetThreadContext
ContinueDebugEvent
FreeLibrary
VirtualQueryEx
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
OpenProcess
GetCurrentProcessId
IsWow64Process
ReadProcessMemory
WriteProcessMemory
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
GetSystemInfo
IsDebuggerPresent
DebugBreak
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
FlushInstructionCache
GetEnvironmentVariableW
GetFullPathNameW
MultiByteToWideChar
SwitchToThread
GetCurrentThread
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
CreateProcessW
TlsGetValue
TlsAlloc
TlsFree
TlsSetValue
WaitForSingleObjectEx
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
WriteFile
SetFilePointer
FlushFileBuffers
ReadFile
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetProcAddress
WaitForSingleObject
LoadLibraryW
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
advapi32
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
SetThreadToken
RevertToSelf
OpenThreadToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
IIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoCreateGuid
oleaut32
SetErrorInfo
VariantInit
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncpy_s
wcsncmp
strncmp
wcsncat_s
wcscpy_s
_wcsicmp
wcscat_s
wcsncpy_s
strcpy_s
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_cexit
_invalid_parameter_noinfo
_errno
abort
_initterm
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__acrt_iob_func
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wmakepath_s
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-math-l1-1-0
_except1
CoreCLRCreateCordbObject
CoreCLRCreateCordbObjectEx
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
OpenVirtualProcessImpl2
Name
.text
Size
747KB
Virtual Size
746KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=30, id=261, version=26706,
count=16, id=260, version=26706,
count=13, id=259, version=26706,
count=4, id=260, version=26213,
count=11, id=257, version=26213,
count=214, id=1, productName=Unmarked objects,
count=117, id=265, version=27048,
count=1, id=256, version=27048,
count=1, id=255, version=27048,
count=1, id=258, version=27048,
mscorlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e7f86acfe925900814e0f57828a9b437b108e50315a2d4e87654ac7dc39852f
- MD5 c53ff6de7a243279034e8ddbab23325d
- SHA1 f846e0a35c768188769e9fd08ed0b69ab7fffa73
- SHA512 2baa9be32ab750e91ef174fc1d6db764bde37b9400040fa80b702b0989b5053afd9645a2242861548f092a6dee6c76d47f63ee5597cddc5035a07e14e5e9ca38
- SSDEEP 384:fniCq6HTn8KR6WdUtox5q64O3HZhB52YtUBVT9yaDbcZN8dV0IaohKuirRkvx9AV:/n9RzF5J4yklDbcZV/Cq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
mscorrc.debug.dll
- SHA256 4681c02858164bb8cb210238fde27c7099dfd34d6150e9706da8845a3706b8e6
- MD5 6552055346ddd6cfa8fb05bef8f26cfc
- SHA1 4b6b93bdaa00fe2c3a8a8f313cac140ce04c785e
- SHA512 fdcc771b0d7f43c8a808da1280890c721b47d6412a28c53acadd7bc3ddff9c4eae1d3a141f99f1b183bacbcc501fce795d9199581a597ff748792914872ec9f9
- SSDEEP 1536:lJql0Zzb8IVAkR1RhQi/s1PzHvh7xYSmUlMbcCV9jfnw5RVvZ48MSZctpoEXtVH3:lJql0ZzgASHlMbrhnYDAS4SGB/VV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
02:b5:06:c1:46:46:47:88:60:be:62:9f:71:76:0f:9c:a3:d8:52:d3:b4:59:5a:32:c0:32:3e:0e:13:78:34:34
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\full\Release\mscorrc.debug.pdb
Name
.rdata
Size
512B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27048,
count=1, id=258, version=27048,
mscorrc.dll
- SHA256 ac84b2497a3875aa104e2a18e0dd49a43ea38dc505c57d836f368d8443280e78
- MD5 30041ff905e8057be55fff732f8de1bf
- SHA1 b783bff2e6b2fc182d6a4345c6a33323b8eb7a53
- SHA512 3daf4b0a481b93c3ad2d078cccd2e185506f3607309c1b11799b15e958137d51528638263281f7d0152751fd4ab301d0dce8705166f05820cd9eaab50beec829
- SSDEEP 192:hcWPqdwGiWrdwFuzLeWvcuyjS7HnhWgN7aMWhfRETTbbrmjX01k9z3AzsCnNz:hcWPYXiWRiA7HRN7MRE3X+R9zusCd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
44:36:9d:ab:55:da:f4:9f:62:5e:08:44:36:c4:b9:59:af:19:ea:e7:e7:79:36:2d:1b:ea:88:f7:42:54:12:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\bin\obj\Windows_NT.x86.Release\src\dlls\mscorrc\small\Release\mscorrc.pdb
Name
.rdata
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27048,
count=1, id=258, version=27048,
netstandard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de0ef6c3af1c9b8199ba4e16c1392d3127a4a30dcc4cfbf96bcc463fe0a5d27d
- MD5 671ed9d6e873ad29ccff10bcfaea6021
- SHA1 49507f0040c27249e209be9ff92ea4c143575873
- SHA512 15649a0a37d1e26bf3e670ee1986a6f6d991a6821868f2e90c1a1986122c4cfa78854f5f02c7d5ec1354837126f3226da09f8c89823496045644b48fc4e80f6e
- SSDEEP 768:y5x6TGSoxq/iImVvMVYd75IXL4bObKZbc6NtjSPU5gBkVb7TikFlnQrOu:AxFwiIU6Y15C4bObKZlNAs5fukFOf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
79582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
nfapi.dll
- IMPHASH 144166113ab4a5e253b0d586d0c21c38
- SHA256 268142cc83918e1a04a7f9ac1f9f827e15ffbc65bd80dac85a8b7d99cd8721d9
- MD5 9da4b43b921e4a28d8d440166e0e9d38
- SHA1 b063280d258b14f48e4061b2b24ba9ab1dcf145b
- SHA512 6b5c52aa001e0d77e4ec49088c8bdf5460dd0b323ea0f6a7aa651a5dcf3d66c9b93ea5885e8edaa393da85285b912a65d00b83ec08c05d2fe46cd33206d033b0
- SSDEEP 3072:1KpHwC6H+AYYYxYYYYYrs/NAWOZFvyfaP710WkYsf+6pu6v3tgHf+dNUxJcGtHFU:1KpHMg61ZFvyfKLkzfrnvGHfDcGtr6
- MD5 SHA1 SHA512 SSDEEP
Digest
71:70:ec:22:a8:6f:75:dc:10:5e:c2:8e:0e:83:da:ae:8a:ad:9c:90:9a:0c:2b:10:91:b1:bc:78:48:55:39:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
Oct 31, 2023
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
09:57:7e:c4:35:5f:db:d6:db:33:cc:e6:77:c1:7c:a8
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 8, 2021 - Feb 28, 2024
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
92182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\projectsJ\nfsdk2_1.6\nfapi\build\release_c_api\win32\nfapi.pdb
kernel32
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GetCurrentProcessId
OpenProcess
CancelIo
GetTickCount
GetModuleHandleA
GetProcAddress
WaitForMultipleObjects
CreateFileA
GetVersionExA
DeviceIoControl
GetOverlappedResult
SetLastError
GetLastError
CloseHandle
WriteFile
ReadFile
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
InitializeCriticalSection
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapFree
HeapAlloc
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
RaiseException
RtlUnwind
GetCommandLineA
GetProcessHeap
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapSize
Sleep
IsDebuggerPresent
InterlockedIncrement
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CreateSemaphoreW
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
FatalAppExitA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
LoadLibraryW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
CreateFileW
advapi32
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceW
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
StartServiceA
psapi
GetModuleFileNameExA
GetModuleFileNameExW
nf_addBindingRule
nf_addFlowCtl
nf_addRule
nf_addRuleEx
nf_adjustProcessPriviledges
nf_completeTCPConnectRequest
nf_completeUDPConnectRequest
nf_deleteBindingRules
nf_deleteFlowCtl
nf_deleteRules
nf_free
nf_getConnCount
nf_getDriverType
nf_getFlowCtlStat
nf_getProcessNameA
nf_getProcessNameFromKernel
nf_getProcessNameW
nf_getTCPConnInfo
nf_getTCPStat
nf_getUDPConnInfo
nf_getUDPStat
nf_init
nf_ipPostReceive
nf_ipPostSend
nf_modifyFlowCtl
nf_registerDriver
nf_registerDriverEx
nf_setIPEventHandler
nf_setOptions
nf_setRules
nf_setRulesEx
nf_setTCPFlowCtl
nf_setTCPTimeout
nf_setUDPFlowCtl
nf_tcpClose
nf_tcpDisableFiltering
nf_tcpIsProxy
nf_tcpPostReceive
nf_tcpPostSend
nf_tcpSetConnectionState
nf_tcpSetSockOpt
nf_udpDisableFiltering
nf_udpPostReceive
nf_udpPostSend
nf_udpSetConnectionState
nf_unRegisterDriver
Name
.text
Size
243KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=15, id=205, version=50929,
count=101, id=206, version=50929,
count=39, id=207, version=50929,
count=115, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=5, id=207, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
nfregdrv.exe
- IMPHASH 40b9d8afc649d5414a04999cb3a4d2f0
- SHA256 aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812
- MD5 01b5780505301ada6dc102fb77b2298c
- SHA1 328c3931a54af2d7adb88ba4c4c18ce1af8d5a72
- SHA512 bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947
- SSDEEP 768:2/1x+sxHjR9Q9V0nczMWkL/zDJ6kqsEtm:YjR8VfRkL0Jtm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
h:\projects\netfilter3\bin\Release_c_api\Win32\nfregdrv.pdb
nfapi
nf_registerDriver
nf_unRegisterDriver
user32
MessageBoxA
CharNextA
kernel32
HeapDestroy
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=110, productName=VS2005 build 50727, version=50727,
count=72, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=79, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
ovpn/libcrypto-1_1.dll
- IMPHASH a543d3b1f1e76db5f1ab4d97a41e7c66
- SHA256 548c59044738554e6fd8aee9e1cd0e6cb13ee7b6f4f71532aff868e771eb8a7d
- MD5 b9eb6a8ac15e8eee936d994bc87f9d5e
- SHA1 b432473b753f371bb2415eb63d178e560455d4c8
- SHA512 83688bdee057964072215de15039e27f0e3188fc32856183f9de3484f11d6cbd633f36c0f0abe7ec6f3eb17dd467c59e8cc8517a371091279270c6c2bb5c631c
- SSDEEP 98304:+mjNt5deg7yCsF4Qd/CsIhu2w0ne8nB5U5jOmp9P1CPwDv3uFfJl2xEcFiuW9MZe:+mjVpGCsFldKsIhuSne8nBIjx9P1CPwE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
de:14:9b:07:f2:f0:64:35:ee:b0:ba:bd:cc:e1:a2:91:25:81:f7:d5:f7:3d:01:0d:31:ad:02:7d:0a:ea:ad:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 21, 2021
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2019 - Nov 4, 2022
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceA
RegisterEventSourceW
ReportEventA
ReportEventW
kernel32
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
GetFileType
GetLastError
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetLastError
SetUnhandledExceptionFilter
Sleep
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile
msvcrt
__dllonexit
_amsg_exit
_chmod
_errno
_exit
_fileno
_initterm
_iob
_lock
_onexit
_setmode
_snwprintf
_stat
time
gmtime
_strdup
_stricmp
_strnicmp
_unlock
calloc
clearerr
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getenv
isspace
malloc
memchr
memcmp
memcpy
memmove
memset
perror
qsort
raise
realloc
setbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtol
strtoul
_vsnprintf
_vsnwprintf
_wfopen
abort
vfprintf
wcscpy
wcsstr
atoi
_fstat
_strdup
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getsockname
getsockopt
ioctlsocket
listen
ntohs
recv
recvfrom
send
sendto
setsockopt
shutdown
socket
ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
ADMISSIONS_free
ADMISSIONS_get0_admissionAuthority
ADMISSIONS_get0_namingAuthority
ADMISSIONS_get0_professionInfos
ADMISSIONS_it
ADMISSIONS_new
ADMISSIONS_set0_admissionAuthority
ADMISSIONS_set0_namingAuthority
ADMISSIONS_set0_professionInfos
ADMISSION_SYNTAX_free
ADMISSION_SYNTAX_get0_admissionAuthority
ADMISSION_SYNTAX_get0_contentsOfAdmissions
ADMISSION_SYNTAX_it
ADMISSION_SYNTAX_new
ADMISSION_SYNTAX_set0_admissionAuthority
ADMISSION_SYNTAX_set0_contentsOfAdmissions
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_ITEM_get
ASN1_ITEM_lookup
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_bind
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_lookup_ex
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_read_ex
BIO_meth_get_write
BIO_meth_get_write_ex
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_read_ex
BIO_meth_set_write
BIO_meth_set_write_ex
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_read_ex
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_log
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BIO_write_ex
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_is_current_thread
BN_BLINDING_lock
BN_BLINDING_new
BN_BLINDING_set_current_thread
BN_BLINDING_set_flags
BN_BLINDING_unlock
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_secure_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp
BN_GF2m_mod_exp_arr
BN_GF2m_mod_inv
BN_GF2m_mod_inv_arr
BN_GF2m_mod_mul
BN_GF2m_mod_mul_arr
BN_GF2m_mod_solve_quad
BN_GF2m_mod_solve_quad_arr
BN_GF2m_mod_sqr
BN_GF2m_mod_sqr_arr
BN_GF2m_mod_sqrt
BN_GF2m_mod_sqrt_arr
BN_GF2m_poly2arr
BN_MONT_CTX_copy
BN_MONT_CTX_free
BN_MONT_CTX_new
BN_MONT_CTX_set
BN_MONT_CTX_set_locked
BN_RECP_CTX_free
BN_RECP_CTX_new
BN_RECP_CTX_set
BN_X931_derive_prime_ex
BN_X931_generate_Xpq
BN_X931_generate_prime_ex
BN_abs_is_word
BN_add
BN_add_word
BN_asc2bn
BN_bin2bn
BN_bn2bin
BN_bn2binpad
BN_bn2dec
BN_bn2hex
BN_bn2lebinpad
BN_bn2mpi
BN_bntest_rand
BN_clear
BN_clear_bit
BN_clear_free
BN_cmp
BN_consttime_swap
BN_copy
BN_dec2bn
BN_div
BN_div_recp
BN_div_word
BN_dup
BN_exp
BN_free
BN_from_montgomery
BN_gcd
BN_generate_dsa_nonce
BN_generate_prime
BN_generate_prime_ex
BN_get0_nist_prime_192
BN_get0_nist_prime_224
BN_get0_nist_prime_256
BN_get0_nist_prime_384
BN_get0_nist_prime_521
BN_get_flags
BN_get_params
BN_get_rfc2409_prime_1024
BN_get_rfc2409_prime_768
BN_get_rfc3526_prime_1536
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_6144
BN_get_rfc3526_prime_8192
BN_get_word
BN_hex2bn
BN_is_bit_set
BN_is_negative
BN_is_odd
BN_is_one
BN_is_prime
BN_is_prime_ex
BN_is_prime_fasttest
BN_is_prime_fasttest_ex
BN_is_word
BN_is_zero
BN_kronecker
BN_lebin2bn
BN_lshift
BN_lshift1
BN_mask_bits
BN_mod_add
BN_mod_add_quick
BN_mod_exp
BN_mod_exp2_mont
BN_mod_exp_mont
BN_mod_exp_mont_consttime
BN_mod_exp_mont_word
BN_mod_exp_recp
BN_mod_exp_simple
BN_mod_inverse
BN_mod_lshift
BN_mod_lshift1
BN_mod_lshift1_quick
BN_mod_lshift_quick
BN_mod_mul
BN_mod_mul_montgomery
BN_mod_mul_reciprocal
BN_mod_sqr
BN_mod_sqrt
BN_mod_sub
BN_mod_sub_quick
BN_mod_word
BN_mpi2bn
BN_mul
BN_mul_word
BN_new
BN_nist_mod_192
BN_nist_mod_224
BN_nist_mod_256
BN_nist_mod_384
BN_nist_mod_521
BN_nist_mod_func
BN_nnmod
BN_num_bits
BN_num_bits_word
BN_options
BN_print
BN_print_fp
BN_priv_rand
BN_priv_rand_range
BN_pseudo_rand
BN_pseudo_rand_range
BN_rand
BN_rand_range
BN_reciprocal
BN_rshift
BN_rshift1
BN_secure_new
BN_security_bits
BN_set_bit
BN_set_flags
BN_set_negative
BN_set_params
BN_set_word
BN_sqr
BN_sub
BN_sub_word
BN_swap
BN_to_ASN1_ENUMERATED
BN_to_ASN1_INTEGER
BN_to_montgomery
BN_uadd
BN_ucmp
BN_usub
BN_value_one
BN_with_flags
BN_zero_ex
BUF_MEM_free
BUF_MEM_grow
BUF_MEM_grow_clean
BUF_MEM_new
BUF_MEM_new_ex
BUF_reverse
CAST_cbc_encrypt
CAST_cfb64_encrypt
CAST_decrypt
CAST_ecb_encrypt
CAST_encrypt
CAST_ofb64_encrypt
CAST_set_key
CBIGNUM_it
CERTIFICATEPOLICIES_free
CERTIFICATEPOLICIES_it
CERTIFICATEPOLICIES_new
CMAC_CTX_cleanup
CMAC_CTX_copy
CMAC_CTX_free
CMAC_CTX_get0_cipher_ctx
CMAC_CTX_new
CMAC_Final
CMAC_Init
CMAC_Update
CMAC_resume
CMS_ContentInfo_free
CMS_ContentInfo_it
CMS_ContentInfo_new
CMS_ContentInfo_print_ctx
CMS_EncryptedData_decrypt
CMS_EncryptedData_encrypt
CMS_EncryptedData_set1_key
CMS_EnvelopedData_create
CMS_ReceiptRequest_create0
CMS_ReceiptRequest_free
CMS_ReceiptRequest_get0_values
CMS_ReceiptRequest_it
CMS_ReceiptRequest_new
CMS_RecipientEncryptedKey_cert_cmp
CMS_RecipientEncryptedKey_get0_id
CMS_RecipientInfo_decrypt
CMS_RecipientInfo_encrypt
CMS_RecipientInfo_get0_pkey_ctx
CMS_RecipientInfo_kari_decrypt
CMS_RecipientInfo_kari_get0_alg
CMS_RecipientInfo_kari_get0_ctx
CMS_RecipientInfo_kari_get0_orig_id
CMS_RecipientInfo_kari_get0_reks
CMS_RecipientInfo_kari_orig_id_cmp
CMS_RecipientInfo_kari_set0_pkey
CMS_RecipientInfo_kekri_get0_id
CMS_RecipientInfo_kekri_id_cmp
CMS_RecipientInfo_ktri_cert_cmp
CMS_RecipientInfo_ktri_get0_algs
CMS_RecipientInfo_ktri_get0_signer_id
CMS_RecipientInfo_set0_key
CMS_RecipientInfo_set0_password
CMS_RecipientInfo_set0_pkey
CMS_RecipientInfo_type
CMS_SharedInfo_encode
CMS_SignedData_init
CMS_SignerInfo_cert_cmp
CMS_SignerInfo_get0_algs
CMS_SignerInfo_get0_md_ctx
CMS_SignerInfo_get0_pkey_ctx
CMS_SignerInfo_get0_signature
CMS_SignerInfo_get0_signer_id
CMS_SignerInfo_set1_signer_cert
CMS_SignerInfo_sign
CMS_SignerInfo_verify
CMS_SignerInfo_verify_content
CMS_add0_CertificateChoices
CMS_add0_RevocationInfoChoice
CMS_add0_cert
CMS_add0_crl
CMS_add0_recipient_key
CMS_add0_recipient_password
CMS_add1_ReceiptRequest
CMS_add1_cert
CMS_add1_crl
CMS_add1_recipient_cert
CMS_add1_signer
CMS_add_simple_smimecap
CMS_add_smimecap
CMS_add_standard_smimecap
CMS_compress
CMS_data
CMS_dataFinal
CMS_dataInit
CMS_data_create
CMS_decrypt
CMS_decrypt_set1_key
CMS_decrypt_set1_password
CMS_decrypt_set1_pkey
CMS_digest_create
CMS_digest_verify
CMS_encrypt
CMS_final
CMS_get0_RecipientInfos
CMS_get0_SignerInfos
CMS_get0_content
CMS_get0_eContentType
CMS_get0_signers
CMS_get0_type
CMS_get1_ReceiptRequest
CMS_get1_certs
CMS_get1_crls
CMS_is_detached
CMS_set1_eContentType
CMS_set1_signers_certs
CMS_set_detached
CMS_sign
CMS_sign_receipt
CMS_signed_add1_attr
CMS_signed_add1_attr_by_NID
CMS_signed_add1_attr_by_OBJ
CMS_signed_add1_attr_by_txt
CMS_signed_delete_attr
CMS_signed_get0_data_by_OBJ
CMS_signed_get_attr
CMS_signed_get_attr_by_NID
CMS_signed_get_attr_by_OBJ
CMS_signed_get_attr_count
CMS_stream
CMS_uncompress
CMS_unsigned_add1_attr
CMS_unsigned_add1_attr_by_NID
CMS_unsigned_add1_attr_by_OBJ
CMS_unsigned_add1_attr_by_txt
CMS_unsigned_delete_attr
CMS_unsigned_get0_data_by_OBJ
CMS_unsigned_get_attr
CMS_unsigned_get_attr_by_NID
CMS_unsigned_get_attr_by_OBJ
CMS_unsigned_get_attr_count
CMS_verify
CMS_verify_receipt
COMP_CTX_free
COMP_CTX_get_method
COMP_CTX_get_type
COMP_CTX_new
COMP_compress_block
COMP_expand_block
COMP_get_name
COMP_get_type
COMP_zlib
CONF_dump_bio
CONF_dump_fp
CONF_free
CONF_get1_default_config_file
CONF_get_number
CONF_get_section
CONF_get_string
CONF_imodule_get_flags
CONF_imodule_get_module
CONF_imodule_get_name
CONF_imodule_get_usr_data
CONF_imodule_get_value
CONF_imodule_set_flags
CONF_imodule_set_usr_data
CONF_load
CONF_load_bio
CONF_load_fp
CONF_module_add
CONF_module_get_usr_data
CONF_module_set_usr_data
CONF_modules_finish
CONF_modules_load
CONF_modules_load_file
CONF_modules_unload
CONF_parse_list
CONF_set_default_method
CONF_set_nconf
CRL_DIST_POINTS_free
CRL_DIST_POINTS_it
CRL_DIST_POINTS_new
CRYPTO_128_unwrap
CRYPTO_128_unwrap_pad
CRYPTO_128_wrap
CRYPTO_128_wrap_pad
CRYPTO_THREAD_cleanup_local
CRYPTO_THREAD_compare_id
CRYPTO_THREAD_get_current_id
CRYPTO_THREAD_get_local
CRYPTO_THREAD_init_local
CRYPTO_THREAD_lock_free
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_run_once
CRYPTO_THREAD_set_local
CRYPTO_THREAD_unlock
CRYPTO_THREAD_write_lock
CRYPTO_atomic_add
CRYPTO_cbc128_decrypt
CRYPTO_cbc128_encrypt
CRYPTO_ccm128_aad
CRYPTO_ccm128_decrypt
CRYPTO_ccm128_decrypt_ccm64
CRYPTO_ccm128_encrypt
CRYPTO_ccm128_encrypt_ccm64
CRYPTO_ccm128_init
CRYPTO_ccm128_setiv
CRYPTO_ccm128_tag
CRYPTO_cfb128_1_encrypt
CRYPTO_cfb128_8_encrypt
CRYPTO_cfb128_encrypt
CRYPTO_clear_free
CRYPTO_clear_realloc
CRYPTO_ctr128_encrypt
CRYPTO_ctr128_encrypt_ctr32
CRYPTO_cts128_decrypt
CRYPTO_cts128_decrypt_block
CRYPTO_cts128_encrypt
CRYPTO_cts128_encrypt_block
CRYPTO_dup_ex_data
CRYPTO_free
CRYPTO_free_ex_data
CRYPTO_free_ex_index
CRYPTO_gcm128_aad
CRYPTO_gcm128_decrypt
CRYPTO_gcm128_decrypt_ctr32
CRYPTO_gcm128_encrypt
CRYPTO_gcm128_encrypt_ctr32
CRYPTO_gcm128_finish
CRYPTO_gcm128_init
CRYPTO_gcm128_new
CRYPTO_gcm128_release
CRYPTO_gcm128_setiv
CRYPTO_gcm128_tag
CRYPTO_get_ex_data
CRYPTO_get_ex_new_index
CRYPTO_get_mem_functions
CRYPTO_malloc
CRYPTO_mem_ctrl
CRYPTO_memcmp
CRYPTO_memdup
CRYPTO_new_ex_data
CRYPTO_nistcts128_decrypt
CRYPTO_nistcts128_decrypt_block
CRYPTO_nistcts128_encrypt
CRYPTO_nistcts128_encrypt_block
CRYPTO_ocb128_aad
CRYPTO_ocb128_cleanup
CRYPTO_ocb128_copy_ctx
CRYPTO_ocb128_decrypt
CRYPTO_ocb128_encrypt
CRYPTO_ocb128_finish
CRYPTO_ocb128_init
CRYPTO_ocb128_new
CRYPTO_ocb128_setiv
CRYPTO_ocb128_tag
CRYPTO_ofb128_encrypt
CRYPTO_realloc
CRYPTO_secure_actual_size
CRYPTO_secure_allocated
CRYPTO_secure_clear_free
CRYPTO_secure_free
CRYPTO_secure_malloc
CRYPTO_secure_malloc_done
CRYPTO_secure_malloc_init
CRYPTO_secure_malloc_initialized
CRYPTO_secure_used
CRYPTO_secure_zalloc
CRYPTO_set_ex_data
CRYPTO_set_mem_debug
CRYPTO_set_mem_functions
CRYPTO_strdup
CRYPTO_strndup
CRYPTO_xts128_encrypt
CRYPTO_zalloc
CTLOG_STORE_free
CTLOG_STORE_get0_log_by_id
CTLOG_STORE_load_default_file
CTLOG_STORE_load_file
CTLOG_STORE_new
CTLOG_free
CTLOG_get0_log_id
CTLOG_get0_name
CTLOG_get0_public_key
CTLOG_new
CTLOG_new_from_base64
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_get0_cert
CT_POLICY_EVAL_CTX_get0_issuer
CT_POLICY_EVAL_CTX_get0_log_store
CT_POLICY_EVAL_CTX_get_time
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
Camellia_cbc_encrypt
Camellia_cfb128_encrypt
Camellia_cfb1_encrypt
Camellia_cfb8_encrypt
Camellia_ctr128_encrypt
Camellia_decrypt
Camellia_ecb_encrypt
Camellia_encrypt
Camellia_ofb128_encrypt
Camellia_set_key
DES_cbc_cksum
DES_cbc_encrypt
DES_cfb64_encrypt
DES_cfb_encrypt
DES_check_key_parity
DES_crypt
DES_decrypt3
DES_ecb3_encrypt
DES_ecb_encrypt
DES_ede3_cbc_encrypt
DES_ede3_cfb64_encrypt
DES_ede3_cfb_encrypt
DES_ede3_ofb64_encrypt
DES_encrypt1
DES_encrypt2
DES_encrypt3
DES_fcrypt
DES_is_weak_key
DES_key_sched
DES_ncbc_encrypt
DES_ofb64_encrypt
DES_ofb_encrypt
DES_options
DES_pcbc_encrypt
DES_quad_cksum
DES_random_key
DES_set_key
DES_set_key_checked
DES_set_key_unchecked
DES_set_odd_parity
DES_string_to_2keys
DES_string_to_key
DES_xcbc_encrypt
DH_KDF_X9_42
DH_OpenSSL
DH_bits
DH_check
DH_check_ex
DH_check_params
DH_check_params_ex
DH_check_pub_key
DH_check_pub_key_ex
DH_clear_flags
DH_compute_key
DH_compute_key_padded
DH_free
DH_generate_key
DH_generate_parameters
DH_generate_parameters_ex
DH_get0_engine
DH_get0_g
DH_get0_key
DH_get0_p
DH_get0_pqg
DH_get0_priv_key
DH_get0_pub_key
DH_get0_q
DH_get_1024_160
DH_get_2048_224
DH_get_2048_256
DH_get_default_method
DH_get_ex_data
DH_get_length
DH_get_nid
DH_meth_dup
DH_meth_free
DH_meth_get0_app_data
DH_meth_get0_name
DH_meth_get_bn_mod_exp
DH_meth_get_compute_key
DH_meth_get_finish
DH_meth_get_flags
DH_meth_get_generate_key
DH_meth_get_generate_params
DH_meth_get_init
DH_meth_new
DH_meth_set0_app_data
DH_meth_set1_name
DH_meth_set_bn_mod_exp
DH_meth_set_compute_key
DH_meth_set_finish
DH_meth_set_flags
DH_meth_set_generate_key
DH_meth_set_generate_params
DH_meth_set_init
DH_new
DH_new_by_nid
DH_new_method
DH_security_bits
DH_set0_key
DH_set0_pqg
DH_set_default_method
DH_set_ex_data
DH_set_flags
DH_set_length
DH_set_method
DH_size
DH_test_flags
DH_up_ref
DHparams_dup
DHparams_it
DHparams_print
DHparams_print_fp
DIRECTORYSTRING_free
DIRECTORYSTRING_it
DIRECTORYSTRING_new
DISPLAYTEXT_free
DISPLAYTEXT_it
DISPLAYTEXT_new
DIST_POINT_NAME_free
DIST_POINT_NAME_it
DIST_POINT_NAME_new
DIST_POINT_free
DIST_POINT_it
DIST_POINT_new
DIST_POINT_set_dpname
DSA_OpenSSL
DSA_SIG_free
DSA_SIG_get0
DSA_SIG_new
DSA_SIG_set0
DSA_bits
DSA_clear_flags
DSA_do_sign
DSA_do_verify
DSA_dup_DH
DSA_free
DSA_generate_key
DSA_generate_parameters
DSA_generate_parameters_ex
DSA_get0_engine
DSA_get0_g
DSA_get0_key
DSA_get0_p
DSA_get0_pqg
DSA_get0_priv_key
DSA_get0_pub_key
DSA_get0_q
DSA_get_default_method
DSA_get_ex_data
DSA_get_method
DSA_meth_dup
DSA_meth_free
DSA_meth_get0_app_data
DSA_meth_get0_name
DSA_meth_get_bn_mod_exp
DSA_meth_get_finish
DSA_meth_get_flags
DSA_meth_get_init
DSA_meth_get_keygen
DSA_meth_get_mod_exp
DSA_meth_get_paramgen
DSA_meth_get_sign
DSA_meth_get_sign_setup
DSA_meth_get_verify
DSA_meth_new
DSA_meth_set0_app_data
DSA_meth_set1_name
DSA_meth_set_bn_mod_exp
DSA_meth_set_finish
DSA_meth_set_flags
DSA_meth_set_init
DSA_meth_set_keygen
DSA_meth_set_mod_exp
DSA_meth_set_paramgen
DSA_meth_set_sign
DSA_meth_set_sign_setup
DSA_meth_set_verify
DSA_new
DSA_new_method
DSA_print
DSA_print_fp
DSA_security_bits
DSA_set0_key
DSA_set0_pqg
DSA_set_default_method
DSA_set_ex_data
DSA_set_flags
DSA_set_method
DSA_sign
DSA_sign_setup
DSA_size
DSA_test_flags
DSA_up_ref
DSA_verify
DSAparams_dup
DSAparams_print
DSAparams_print_fp
DSO_METHOD_openssl
DSO_bind_func
DSO_convert_filename
DSO_ctrl
DSO_dsobyaddr
DSO_flags
DSO_free
DSO_get_filename
DSO_global_lookup
DSO_load
DSO_merge
DSO_new
DSO_pathbyaddr
DSO_set_filename
DSO_up_ref
ECDH_KDF_X9_62
ECDH_compute_key
ECDSA_SIG_free
ECDSA_SIG_get0
ECDSA_SIG_get0_r
ECDSA_SIG_get0_s
ECDSA_SIG_new
ECDSA_SIG_set0
ECDSA_do_sign
ECDSA_do_sign_ex
ECDSA_do_verify
ECDSA_sign
ECDSA_sign_ex
ECDSA_sign_setup
ECDSA_size
ECDSA_verify
ECPARAMETERS_free
ECPARAMETERS_it
ECPARAMETERS_new
ECPKPARAMETERS_free
ECPKPARAMETERS_it
ECPKPARAMETERS_new
ECPKParameters_print
ECPKParameters_print_fp
ECParameters_print
ECParameters_print_fp
EC_GF2m_simple_method
EC_GFp_mont_method
EC_GFp_nist_method
EC_GFp_simple_method
EC_GROUP_check
EC_GROUP_check_discriminant
EC_GROUP_clear_free
EC_GROUP_cmp
EC_GROUP_copy
EC_GROUP_dup
EC_GROUP_free
EC_GROUP_get0_cofactor
EC_GROUP_get0_generator
EC_GROUP_get0_order
EC_GROUP_get0_seed
EC_GROUP_get_asn1_flag
EC_GROUP_get_basis_type
EC_GROUP_get_cofactor
EC_GROUP_get_curve
EC_GROUP_get_curve_GF2m
EC_GROUP_get_curve_GFp
EC_GROUP_get_curve_name
EC_GROUP_get_degree
EC_GROUP_get_ecparameters
EC_GROUP_get_ecpkparameters
EC_GROUP_get_mont_data
EC_GROUP_get_order
EC_GROUP_get_pentanomial_basis
EC_GROUP_get_point_conversion_form
EC_GROUP_get_seed_len
EC_GROUP_get_trinomial_basis
EC_GROUP_have_precompute_mult
EC_GROUP_method_of
EC_GROUP_new
EC_GROUP_new_by_curve_name
EC_GROUP_new_curve_GF2m
EC_GROUP_new_curve_GFp
EC_GROUP_new_from_ecparameters
EC_GROUP_new_from_ecpkparameters
EC_GROUP_order_bits
EC_GROUP_precompute_mult
EC_GROUP_set_asn1_flag
EC_GROUP_set_curve
EC_GROUP_set_curve_GF2m
EC_GROUP_set_curve_GFp
EC_GROUP_set_curve_name
EC_GROUP_set_generator
EC_GROUP_set_point_conversion_form
EC_GROUP_set_seed
EC_KEY_METHOD_free
EC_KEY_METHOD_get_compute_key
EC_KEY_METHOD_get_init
EC_KEY_METHOD_get_keygen
EC_KEY_METHOD_get_sign
EC_KEY_METHOD_get_verify
EC_KEY_METHOD_new
EC_KEY_METHOD_set_compute_key
EC_KEY_METHOD_set_init
EC_KEY_METHOD_set_keygen
EC_KEY_METHOD_set_sign
EC_KEY_METHOD_set_verify
EC_KEY_OpenSSL
EC_KEY_can_sign
EC_KEY_check_key
EC_KEY_clear_flags
EC_KEY_copy
EC_KEY_decoded_from_explicit_params
EC_KEY_dup
EC_KEY_free
EC_KEY_generate_key
EC_KEY_get0_engine
EC_KEY_get0_group
EC_KEY_get0_private_key
EC_KEY_get0_public_key
EC_KEY_get_conv_form
EC_KEY_get_default_method
EC_KEY_get_enc_flags
EC_KEY_get_ex_data
EC_KEY_get_flags
EC_KEY_get_method
EC_KEY_key2buf
EC_KEY_new
EC_KEY_new_by_curve_name
EC_KEY_new_method
EC_KEY_oct2key
EC_KEY_oct2priv
EC_KEY_precompute_mult
EC_KEY_print
EC_KEY_print_fp
EC_KEY_priv2buf
EC_KEY_priv2oct
EC_KEY_set_asn1_flag
EC_KEY_set_conv_form
EC_KEY_set_default_method
EC_KEY_set_enc_flags
EC_KEY_set_ex_data
EC_KEY_set_flags
EC_KEY_set_group
EC_KEY_set_method
EC_KEY_set_private_key
EC_KEY_set_public_key
EC_KEY_set_public_key_affine_coordinates
EC_KEY_up_ref
EC_METHOD_get_field_type
EC_POINT_add
EC_POINT_bn2point
EC_POINT_clear_free
EC_POINT_cmp
EC_POINT_copy
EC_POINT_dbl
EC_POINT_dup
EC_POINT_free
EC_POINT_get_Jprojective_coordinates_GFp
EC_POINT_get_affine_coordinates
EC_POINT_get_affine_coordinates_GF2m
EC_POINT_get_affine_coordinates_GFp
EC_POINT_hex2point
EC_POINT_invert
EC_POINT_is_at_infinity
EC_POINT_is_on_curve
EC_POINT_make_affine
EC_POINT_method_of
EC_POINT_mul
EC_POINT_new
EC_POINT_oct2point
EC_POINT_point2bn
EC_POINT_point2buf
EC_POINT_point2hex
EC_POINT_point2oct
EC_POINT_set_Jprojective_coordinates_GFp
EC_POINT_set_affine_coordinates
EC_POINT_set_affine_coordinates_GF2m
EC_POINT_set_affine_coordinates_GFp
EC_POINT_set_compressed_coordinates
EC_POINT_set_compressed_coordinates_GF2m
EC_POINT_set_compressed_coordinates_GFp
EC_POINT_set_to_infinity
EC_POINTs_make_affine
EC_POINTs_mul
EC_curve_nid2nist
EC_curve_nist2nid
EC_get_builtin_curves
EDIPARTYNAME_free
EDIPARTYNAME_it
EDIPARTYNAME_new
ENGINE_add
ENGINE_add_conf_module
ENGINE_by_id
ENGINE_cmd_is_executable
ENGINE_ctrl
ENGINE_ctrl_cmd
ENGINE_ctrl_cmd_string
ENGINE_finish
ENGINE_free
ENGINE_get_DH
ENGINE_get_DSA
ENGINE_get_EC
ENGINE_get_RAND
ENGINE_get_RSA
ENGINE_get_cipher
ENGINE_get_cipher_engine
ENGINE_get_ciphers
ENGINE_get_cmd_defns
ENGINE_get_ctrl_function
ENGINE_get_default_DH
ENGINE_get_default_DSA
ENGINE_get_default_EC
ENGINE_get_default_RAND
ENGINE_get_default_RSA
ENGINE_get_destroy_function
ENGINE_get_digest
ENGINE_get_digest_engine
ENGINE_get_digests
ENGINE_get_ex_data
ENGINE_get_finish_function
ENGINE_get_first
ENGINE_get_flags
ENGINE_get_id
ENGINE_get_init_function
ENGINE_get_last
ENGINE_get_load_privkey_function
ENGINE_get_load_pubkey_function
ENGINE_get_name
ENGINE_get_next
ENGINE_get_pkey_asn1_meth
ENGINE_get_pkey_asn1_meth_engine
ENGINE_get_pkey_asn1_meth_str
ENGINE_get_pkey_asn1_meths
ENGINE_get_pkey_meth
ENGINE_get_pkey_meth_engine
ENGINE_get_pkey_meths
ENGINE_get_prev
ENGINE_get_ssl_client_cert_function
ENGINE_get_static_state
ENGINE_get_table_flags
ENGINE_init
ENGINE_load_builtin_engines
ENGINE_load_private_key
ENGINE_load_public_key
ENGINE_load_ssl_client_cert
ENGINE_new
ENGINE_pkey_asn1_find_str
ENGINE_register_DH
ENGINE_register_DSA
ENGINE_register_EC
ENGINE_register_RAND
ENGINE_register_RSA
ENGINE_register_all_DH
ENGINE_register_all_DSA
ENGINE_register_all_EC
ENGINE_register_all_RAND
ENGINE_register_all_RSA
ENGINE_register_all_ciphers
ENGINE_register_all_complete
ENGINE_register_all_digests
ENGINE_register_all_pkey_asn1_meths
ENGINE_register_all_pkey_meths
ENGINE_register_ciphers
ENGINE_register_complete
ENGINE_register_digests
ENGINE_register_pkey_asn1_meths
ENGINE_register_pkey_meths
ENGINE_remove
ENGINE_set_DH
ENGINE_set_DSA
ENGINE_set_EC
ENGINE_set_RAND
ENGINE_set_RSA
ENGINE_set_ciphers
ENGINE_set_cmd_defns
ENGINE_set_ctrl_function
ENGINE_set_default
ENGINE_set_default_DH
ENGINE_set_default_DSA
ENGINE_set_default_EC
ENGINE_set_default_RAND
ENGINE_set_default_RSA
ENGINE_set_default_ciphers
ENGINE_set_default_digests
ENGINE_set_default_pkey_asn1_meths
ENGINE_set_default_pkey_meths
ENGINE_set_default_string
ENGINE_set_destroy_function
ENGINE_set_digests
ENGINE_set_ex_data
ENGINE_set_finish_function
ENGINE_set_flags
ENGINE_set_id
ENGINE_set_init_function
ENGINE_set_load_privkey_function
ENGINE_set_load_pubkey_function
ENGINE_set_load_ssl_client_cert_function
ENGINE_set_name
ENGINE_set_pkey_asn1_meths
ENGINE_set_pkey_meths
ENGINE_set_table_flags
ENGINE_unregister_DH
ENGINE_unregister_DSA
ENGINE_unregister_EC
ENGINE_unregister_RAND
ENGINE_unregister_RSA
ENGINE_unregister_ciphers
ENGINE_unregister_digests
ENGINE_unregister_pkey_asn1_meths
ENGINE_unregister_pkey_meths
ENGINE_up_ref
ERR_add_error_data
ERR_add_error_vdata
ERR_clear_error
ERR_clear_last_mark
ERR_error_string
ERR_error_string_n
ERR_func_error_string
ERR_get_error
ERR_get_error_line
ERR_get_error_line_data
ERR_get_next_error_library
ERR_get_state
ERR_lib_error_string
ERR_load_ASN1_strings
ERR_load_ASYNC_strings
ERR_load_BIO_strings
ERR_load_BN_strings
ERR_load_BUF_strings
ERR_load_CMS_strings
ERR_load_COMP_strings
ERR_load_CONF_strings
ERR_load_CRYPTO_strings
ERR_load_CT_strings
ERR_load_DH_strings
ERR_load_DSA_strings
ERR_load_DSO_strings
ERR_load_EC_strings
ERR_load_ENGINE_strings
ERR_load_ERR_strings
ERR_load_EVP_strings
ERR_load_KDF_strings
ERR_load_OBJ_strings
ERR_load_OCSP_strings
ERR_load_OSSL_STORE_strings
ERR_load_PEM_strings
ERR_load_PKCS12_strings
ERR_load_PKCS7_strings
ERR_load_RAND_strings
ERR_load_RSA_strings
ERR_load_TS_strings
ERR_load_UI_strings
ERR_load_X509V3_strings
ERR_load_X509_strings
ERR_load_strings
ERR_load_strings_const
ERR_peek_error
ERR_peek_error_line
ERR_peek_error_line_data
ERR_peek_last_error
ERR_peek_last_error_line
ERR_peek_last_error_line_data
ERR_pop_to_mark
ERR_print_errors
ERR_print_errors_cb
ERR_print_errors_fp
ERR_put_error
ERR_reason_error_string
ERR_remove_state
ERR_remove_thread_state
ERR_set_error_data
ERR_set_mark
ERR_unload_strings
ESS_CERT_ID_V2_dup
ESS_CERT_ID_V2_free
ESS_CERT_ID_V2_new
ESS_CERT_ID_dup
ESS_CERT_ID_free
ESS_CERT_ID_new
ESS_ISSUER_SERIAL_dup
ESS_ISSUER_SERIAL_free
ESS_ISSUER_SERIAL_new
ESS_SIGNING_CERT_V2_dup
ESS_SIGNING_CERT_V2_free
ESS_SIGNING_CERT_V2_new
ESS_SIGNING_CERT_dup
ESS_SIGNING_CERT_free
ESS_SIGNING_CERT_new
EVP_BytesToKey
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_buf_noconst
EVP_CIPHER_CTX_cipher
EVP_CIPHER_CTX_clear_flags
EVP_CIPHER_CTX_copy
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_encrypting
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_get_app_data
EVP_CIPHER_CTX_get_cipher_data
EVP_CIPHER_CTX_iv
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_iv_noconst
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_nid
EVP_CIPHER_CTX_num
EVP_CIPHER_CTX_original_iv
EVP_CIPHER_CTX_rand_key
EVP_CIPHER_CTX_reset
EVP_CIPHER_CTX_set_app_data
EVP_CIPHER_CTX_set_cipher_data
EVP_CIPHER_CTX_set_flags
EVP_CIPHER_CTX_set_key_length
EVP_CIPHER_CTX_set_num
EVP_CIPHER_CTX_set_padding
EVP_CIPHER_CTX_test_flags
EVP_CIPHER_asn1_to_param
EVP_CIPHER_block_size
EVP_CIPHER_do_all
EVP_CIPHER_do_all_sorted
EVP_CIPHER_flags
EVP_CIPHER_get_asn1_iv
EVP_CIPHER_impl_ctx_size
EVP_CIPHER_iv_length
EVP_CIPHER_key_length
EVP_CIPHER_meth_dup
EVP_CIPHER_meth_free
EVP_CIPHER_meth_get_cleanup
EVP_CIPHER_meth_get_ctrl
EVP_CIPHER_meth_get_do_cipher
EVP_CIPHER_meth_get_get_asn1_params
EVP_CIPHER_meth_get_init
EVP_CIPHER_meth_get_set_asn1_params
EVP_CIPHER_meth_new
EVP_CIPHER_meth_set_cleanup
EVP_CIPHER_meth_set_ctrl
EVP_CIPHER_meth_set_do_cipher
EVP_CIPHER_meth_set_flags
EVP_CIPHER_meth_set_get_asn1_params
EVP_CIPHER_meth_set_impl_ctx_size
EVP_CIPHER_meth_set_init
EVP_CIPHER_meth_set_iv_length
EVP_CIPHER_meth_set_set_asn1_params
EVP_CIPHER_nid
EVP_CIPHER_param_to_asn1
EVP_CIPHER_set_asn1_iv
EVP_CIPHER_type
EVP_Cipher
EVP_CipherFinal
EVP_CipherFinal_ex
EVP_CipherInit
EVP_CipherInit_ex
EVP_CipherUpdate
EVP_DecodeBlock
EVP_DecodeFinal
EVP_DecodeInit
EVP_DecodeUpdate
EVP_DecryptFinal
EVP_DecryptFinal_ex
EVP_DecryptInit
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_Digest
EVP_DigestFinal
EVP_DigestFinalXOF
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestSign
EVP_DigestSignFinal
EVP_DigestSignInit
EVP_DigestUpdate
EVP_DigestVerify
EVP_DigestVerifyFinal
EVP_DigestVerifyInit
EVP_ENCODE_CTX_copy
EVP_ENCODE_CTX_free
EVP_ENCODE_CTX_new
EVP_ENCODE_CTX_num
EVP_EncodeBlock
EVP_EncodeFinal
EVP_EncodeInit
EVP_EncodeUpdate
EVP_EncryptFinal
EVP_EncryptFinal_ex
EVP_EncryptInit
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_MD_CTX_clear_flags
EVP_MD_CTX_copy
EVP_MD_CTX_copy_ex
EVP_MD_CTX_ctrl
EVP_MD_CTX_free
EVP_MD_CTX_md
EVP_MD_CTX_md_data
EVP_MD_CTX_new
EVP_MD_CTX_pkey_ctx
EVP_MD_CTX_reset
EVP_MD_CTX_set_flags
EVP_MD_CTX_set_pkey_ctx
EVP_MD_CTX_set_update_fn
EVP_MD_CTX_test_flags
EVP_MD_CTX_update_fn
EVP_MD_block_size
EVP_MD_do_all
EVP_MD_do_all_sorted
EVP_MD_flags
EVP_MD_meth_dup
EVP_MD_meth_free
EVP_MD_meth_get_app_datasize
EVP_MD_meth_get_cleanup
EVP_MD_meth_get_copy
EVP_MD_meth_get_ctrl
EVP_MD_meth_get_final
EVP_MD_meth_get_flags
EVP_MD_meth_get_init
EVP_MD_meth_get_input_blocksize
EVP_MD_meth_get_result_size
EVP_MD_meth_get_update
EVP_MD_meth_new
EVP_MD_meth_set_app_datasize
EVP_MD_meth_set_cleanup
EVP_MD_meth_set_copy
EVP_MD_meth_set_ctrl
EVP_MD_meth_set_final
EVP_MD_meth_set_flags
EVP_MD_meth_set_init
EVP_MD_meth_set_input_blocksize
EVP_MD_meth_set_result_size
EVP_MD_meth_set_update
EVP_MD_pkey_type
EVP_MD_size
EVP_MD_type
EVP_OpenFinal
EVP_OpenInit
EVP_PBE_CipherInit
EVP_PBE_alg_add
EVP_PBE_alg_add_type
EVP_PBE_cleanup
EVP_PBE_find
EVP_PBE_get
EVP_PBE_scrypt
EVP_PKCS82PKEY
EVP_PKEY2PKCS8
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_ctrl_str
EVP_PKEY_CTX_ctrl_uint64
EVP_PKEY_CTX_dup
EVP_PKEY_CTX_free
EVP_PKEY_CTX_get0_peerkey
EVP_PKEY_CTX_get0_pkey
EVP_PKEY_CTX_get_app_data
EVP_PKEY_CTX_get_cb
EVP_PKEY_CTX_get_data
EVP_PKEY_CTX_get_keygen_info
EVP_PKEY_CTX_get_operation
EVP_PKEY_CTX_hex2ctrl
EVP_PKEY_CTX_md
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_CTX_set0_keygen_info
EVP_PKEY_CTX_set_app_data
EVP_PKEY_CTX_set_cb
EVP_PKEY_CTX_set_data
EVP_PKEY_CTX_str2ctrl
EVP_PKEY_add1_attr
EVP_PKEY_add1_attr_by_NID
EVP_PKEY_add1_attr_by_OBJ
EVP_PKEY_add1_attr_by_txt
EVP_PKEY_asn1_add0
EVP_PKEY_asn1_add_alias
EVP_PKEY_asn1_copy
EVP_PKEY_asn1_find
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_free
EVP_PKEY_asn1_get0
EVP_PKEY_asn1_get0_info
EVP_PKEY_asn1_get_count
EVP_PKEY_asn1_new
EVP_PKEY_asn1_set_check
EVP_PKEY_asn1_set_ctrl
EVP_PKEY_asn1_set_free
EVP_PKEY_asn1_set_get_priv_key
EVP_PKEY_asn1_set_get_pub_key
EVP_PKEY_asn1_set_item
EVP_PKEY_asn1_set_param
EVP_PKEY_asn1_set_param_check
EVP_PKEY_asn1_set_private
EVP_PKEY_asn1_set_public
EVP_PKEY_asn1_set_public_check
EVP_PKEY_asn1_set_security_bits
EVP_PKEY_asn1_set_set_priv_key
EVP_PKEY_asn1_set_set_pub_key
EVP_PKEY_asn1_set_siginf
EVP_PKEY_assign
EVP_PKEY_base_id
EVP_PKEY_bits
EVP_PKEY_check
EVP_PKEY_cmp
EVP_PKEY_cmp_parameters
EVP_PKEY_copy_parameters
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt_old
EVP_PKEY_delete_attr
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt_old
EVP_PKEY_free
EVP_PKEY_get0
EVP_PKEY_get0_DH
EVP_PKEY_get0_DSA
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
EVP_PKEY_get0_asn1
EVP_PKEY_get0_engine
EVP_PKEY_get0_hmac
EVP_PKEY_get0_poly1305
EVP_PKEY_get0_siphash
EVP_PKEY_get1_DH
EVP_PKEY_get1_DSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_get1_tls_encodedpoint
EVP_PKEY_get_attr
EVP_PKEY_get_attr_by_NID
EVP_PKEY_get_attr_by_OBJ
EVP_PKEY_get_attr_count
EVP_PKEY_get_default_digest_nid
EVP_PKEY_get_raw_private_key
EVP_PKEY_get_raw_public_key
EVP_PKEY_id
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_meth_add0
EVP_PKEY_meth_copy
EVP_PKEY_meth_find
EVP_PKEY_meth_free
EVP_PKEY_meth_get0
EVP_PKEY_meth_get0_info
EVP_PKEY_meth_get_check
EVP_PKEY_meth_get_cleanup
EVP_PKEY_meth_get_copy
EVP_PKEY_meth_get_count
EVP_PKEY_meth_get_ctrl
EVP_PKEY_meth_get_decrypt
EVP_PKEY_meth_get_derive
EVP_PKEY_meth_get_digest_custom
EVP_PKEY_meth_get_digestsign
EVP_PKEY_meth_get_digestverify
EVP_PKEY_meth_get_encrypt
EVP_PKEY_meth_get_init
EVP_PKEY_meth_get_keygen
EVP_PKEY_meth_get_param_check
EVP_PKEY_meth_get_paramgen
EVP_PKEY_meth_get_public_check
EVP_PKEY_meth_get_sign
EVP_PKEY_meth_get_signctx
EVP_PKEY_meth_get_verify
EVP_PKEY_meth_get_verify_recover
EVP_PKEY_meth_get_verifyctx
EVP_PKEY_meth_new
EVP_PKEY_meth_remove
EVP_PKEY_meth_set_check
EVP_PKEY_meth_set_cleanup
EVP_PKEY_meth_set_copy
EVP_PKEY_meth_set_ctrl
EVP_PKEY_meth_set_decrypt
EVP_PKEY_meth_set_derive
EVP_PKEY_meth_set_digest_custom
EVP_PKEY_meth_set_digestsign
EVP_PKEY_meth_set_digestverify
EVP_PKEY_meth_set_encrypt
EVP_PKEY_meth_set_init
EVP_PKEY_meth_set_keygen
EVP_PKEY_meth_set_param_check
EVP_PKEY_meth_set_paramgen
EVP_PKEY_meth_set_public_check
EVP_PKEY_meth_set_sign
EVP_PKEY_meth_set_signctx
EVP_PKEY_meth_set_verify
EVP_PKEY_meth_set_verify_recover
EVP_PKEY_meth_set_verifyctx
EVP_PKEY_missing_parameters
EVP_PKEY_new
EVP_PKEY_new_CMAC_key
EVP_PKEY_new_mac_key
EVP_PKEY_new_raw_private_key
EVP_PKEY_new_raw_public_key
EVP_PKEY_param_check
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_print_params
EVP_PKEY_print_private
EVP_PKEY_print_public
EVP_PKEY_public_check
EVP_PKEY_save_parameters
EVP_PKEY_security_bits
EVP_PKEY_set1_DH
EVP_PKEY_set1_DSA
EVP_PKEY_set1_EC_KEY
EVP_PKEY_set1_RSA
EVP_PKEY_set1_engine
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_set_alias_type
EVP_PKEY_set_type
EVP_PKEY_set_type_str
EVP_PKEY_sign
EVP_PKEY_sign_init
EVP_PKEY_size
EVP_PKEY_type
EVP_PKEY_up_ref
EVP_PKEY_verify
EVP_PKEY_verify_init
EVP_PKEY_verify_recover
EVP_PKEY_verify_recover_init
EVP_SealFinal
EVP_SealInit
EVP_SignFinal
EVP_VerifyFinal
EVP_add_alg_module
EVP_add_cipher
EVP_add_digest
EVP_aes_128_cbc
EVP_aes_128_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_128_ccm
EVP_aes_128_cfb1
EVP_aes_128_cfb128
EVP_aes_128_cfb8
EVP_aes_128_ctr
EVP_aes_128_ecb
EVP_aes_128_gcm
EVP_aes_128_ocb
EVP_aes_128_ofb
EVP_aes_128_wrap
EVP_aes_128_wrap_pad
EVP_aes_128_xts
EVP_aes_192_cbc
EVP_aes_192_ccm
EVP_aes_192_cfb1
EVP_aes_192_cfb128
EVP_aes_192_cfb8
EVP_aes_192_ctr
EVP_aes_192_ecb
EVP_aes_192_gcm
EVP_aes_192_ocb
EVP_aes_192_ofb
EVP_aes_192_wrap
EVP_aes_192_wrap_pad
EVP_aes_256_cbc
EVP_aes_256_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha256
EVP_aes_256_ccm
EVP_aes_256_cfb1
EVP_aes_256_cfb128
EVP_aes_256_cfb8
EVP_aes_256_ctr
EVP_aes_256_ecb
EVP_aes_256_gcm
EVP_aes_256_ocb
EVP_aes_256_ofb
EVP_aes_256_wrap
EVP_aes_256_wrap_pad
EVP_aes_256_xts
EVP_aria_128_cbc
EVP_aria_128_ccm
EVP_aria_128_cfb1
EVP_aria_128_cfb128
EVP_aria_128_cfb8
EVP_aria_128_ctr
EVP_aria_128_ecb
EVP_aria_128_gcm
EVP_aria_128_ofb
EVP_aria_192_cbc
EVP_aria_192_ccm
EVP_aria_192_cfb1
EVP_aria_192_cfb128
EVP_aria_192_cfb8
EVP_aria_192_ctr
EVP_aria_192_ecb
EVP_aria_192_gcm
EVP_aria_192_ofb
EVP_aria_256_cbc
EVP_aria_256_ccm
EVP_aria_256_cfb1
EVP_aria_256_cfb128
EVP_aria_256_cfb8
EVP_aria_256_ctr
EVP_aria_256_ecb
EVP_aria_256_gcm
EVP_aria_256_ofb
EVP_bf_cbc
EVP_bf_cfb64
EVP_bf_ecb
EVP_bf_ofb
EVP_blake2b512
EVP_blake2s256
EVP_camellia_128_cbc
EVP_camellia_128_cfb1
EVP_camellia_128_cfb128
EVP_camellia_128_cfb8
EVP_camellia_128_ctr
EVP_camellia_128_ecb
EVP_camellia_128_ofb
EVP_camellia_192_cbc
EVP_camellia_192_cfb1
EVP_camellia_192_cfb128
EVP_camellia_192_cfb8
EVP_camellia_192_ctr
EVP_camellia_192_ecb
EVP_camellia_192_ofb
EVP_camellia_256_cbc
EVP_camellia_256_cfb1
EVP_camellia_256_cfb128
EVP_camellia_256_cfb8
EVP_camellia_256_ctr
EVP_camellia_256_ecb
EVP_camellia_256_ofb
EVP_cast5_cbc
EVP_cast5_cfb64
EVP_cast5_ecb
EVP_cast5_ofb
EVP_chacha20
EVP_chacha20_poly1305
EVP_des_cbc
EVP_des_cfb1
EVP_des_cfb64
EVP_des_cfb8
EVP_des_ecb
EVP_des_ede
EVP_des_ede3
EVP_des_ede3_cbc
EVP_des_ede3_cfb1
EVP_des_ede3_cfb64
EVP_des_ede3_cfb8
EVP_des_ede3_ecb
EVP_des_ede3_ofb
EVP_des_ede3_wrap
EVP_des_ede_cbc
EVP_des_ede_cfb64
EVP_des_ede_ecb
EVP_des_ede_ofb
EVP_des_ofb
EVP_desx_cbc
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_get_pw_prompt
EVP_idea_cbc
EVP_idea_cfb64
EVP_idea_ecb
EVP_idea_ofb
EVP_md4
EVP_md5
EVP_md5_sha1
EVP_md_null
EVP_mdc2
EVP_rc2_40_cbc
EVP_rc2_64_cbc
EVP_rc2_cbc
EVP_rc2_cfb64
EVP_rc2_ecb
EVP_rc2_ofb
EVP_rc4
EVP_rc4_40
EVP_rc4_hmac_md5
EVP_read_pw_string
EVP_read_pw_string_min
EVP_ripemd160
EVP_seed_cbc
EVP_seed_cfb128
EVP_seed_ecb
EVP_seed_ofb
EVP_set_pw_prompt
EVP_sha1
EVP_sha224
EVP_sha256
EVP_sha384
EVP_sha3_224
EVP_sha3_256
EVP_sha3_384
EVP_sha3_512
EVP_sha512
EVP_sha512_224
EVP_sha512_256
EVP_shake128
EVP_shake256
EVP_sm3
EVP_sm4_cbc
EVP_sm4_cfb128
EVP_sm4_ctr
EVP_sm4_ecb
EVP_sm4_ofb
EVP_whirlpool
EXTENDED_KEY_USAGE_free
EXTENDED_KEY_USAGE_it
EXTENDED_KEY_USAGE_new
FIPS_mode
FIPS_mode_set
GENERAL_NAMES_free
GENERAL_NAMES_it
GENERAL_NAMES_new
GENERAL_NAME_cmp
GENERAL_NAME_dup
GENERAL_NAME_free
GENERAL_NAME_get0_otherName
GENERAL_NAME_get0_value
GENERAL_NAME_it
GENERAL_NAME_new
GENERAL_NAME_print
GENERAL_NAME_set0_othername
GENERAL_NAME_set0_value
GENERAL_SUBTREE_free
GENERAL_SUBTREE_it
GENERAL_SUBTREE_new
HMAC
HMAC_CTX_copy
HMAC_CTX_free
HMAC_CTX_get_md
HMAC_CTX_new
HMAC_CTX_reset
HMAC_CTX_set_flags
HMAC_Final
HMAC_Init
HMAC_Init_ex
HMAC_Update
HMAC_size
IDEA_cbc_encrypt
IDEA_cfb64_encrypt
IDEA_ecb_encrypt
IDEA_encrypt
IDEA_ofb64_encrypt
IDEA_options
IDEA_set_decrypt_key
IDEA_set_encrypt_key
INT32_it
INT64_it
IPAddressChoice_free
IPAddressChoice_it
IPAddressChoice_new
IPAddressFamily_free
IPAddressFamily_it
IPAddressFamily_new
IPAddressOrRange_free
IPAddressOrRange_it
IPAddressOrRange_new
IPAddressRange_free
IPAddressRange_it
IPAddressRange_new
ISSUING_DIST_POINT_free
ISSUING_DIST_POINT_it
ISSUING_DIST_POINT_new
LONG_it
MD4
MD4_Final
MD4_Init
MD4_Transform
MD4_Update
MD5
MD5_Final
MD5_Init
MD5_Transform
MD5_Update
MDC2
MDC2_Final
MDC2_Init
MDC2_Update
NAME_CONSTRAINTS_check
NAME_CONSTRAINTS_check_CN
NAME_CONSTRAINTS_free
NAME_CONSTRAINTS_it
NAME_CONSTRAINTS_new
NAMING_AUTHORITY_free
NAMING_AUTHORITY_get0_authorityId
NAMING_AUTHORITY_get0_authorityText
NAMING_AUTHORITY_get0_authorityURL
NAMING_AUTHORITY_it
NAMING_AUTHORITY_new
NAMING_AUTHORITY_set0_authorityId
NAMING_AUTHORITY_set0_authorityText
NAMING_AUTHORITY_set0_authorityURL
NCONF_WIN32
NCONF_default
NCONF_dump_bio
NCONF_dump_fp
NCONF_free
NCONF_free_data
NCONF_get_number_e
NCONF_get_section
NCONF_get_string
NCONF_load
NCONF_load_bio
NCONF_load_fp
NCONF_new
NETSCAPE_CERT_SEQUENCE_free
NETSCAPE_CERT_SEQUENCE_it
NETSCAPE_CERT_SEQUENCE_new
NETSCAPE_SPKAC_free
NETSCAPE_SPKAC_it
NETSCAPE_SPKAC_new
NETSCAPE_SPKI_b64_decode
NETSCAPE_SPKI_b64_encode
NETSCAPE_SPKI_free
NETSCAPE_SPKI_get_pubkey
NETSCAPE_SPKI_it
NETSCAPE_SPKI_new
NETSCAPE_SPKI_print
NETSCAPE_SPKI_set_pubkey
NETSCAPE_SPKI_sign
NETSCAPE_SPKI_verify
NOTICEREF_free
NOTICEREF_it
NOTICEREF_new
OBJ_NAME_add
OBJ_NAME_cleanup
OBJ_NAME_do_all
OBJ_NAME_do_all_sorted
OBJ_NAME_get
OBJ_NAME_init
OBJ_NAME_new_index
OBJ_NAME_remove
OBJ_add_object
OBJ_add_sigid
OBJ_bsearch_
OBJ_bsearch_ex_
OBJ_cmp
OBJ_create
OBJ_create_objects
OBJ_dup
OBJ_find_sigid_algs
OBJ_find_sigid_by_algs
OBJ_get0_data
OBJ_length
OBJ_ln2nid
OBJ_new_nid
OBJ_nid2ln
OBJ_nid2obj
OBJ_nid2sn
OBJ_obj2nid
OBJ_obj2txt
OBJ_sigid_free
OBJ_sn2nid
OBJ_txt2nid
OBJ_txt2obj
OCSP_BASICRESP_add1_ext_i2d
OCSP_BASICRESP_add_ext
OCSP_BASICRESP_delete_ext
OCSP_BASICRESP_free
OCSP_BASICRESP_get1_ext_d2i
OCSP_BASICRESP_get_ext
OCSP_BASICRESP_get_ext_by_NID
OCSP_BASICRESP_get_ext_by_OBJ
OCSP_BASICRESP_get_ext_by_critical
OCSP_BASICRESP_get_ext_count
OCSP_BASICRESP_it
OCSP_BASICRESP_new
OCSP_CERTID_dup
OCSP_CERTID_free
OCSP_CERTID_it
OCSP_CERTID_new
OCSP_CERTSTATUS_free
OCSP_CERTSTATUS_it
OCSP_CERTSTATUS_new
OCSP_CRLID_free
OCSP_CRLID_it
OCSP_CRLID_new
OCSP_ONEREQ_add1_ext_i2d
OCSP_ONEREQ_add_ext
OCSP_ONEREQ_delete_ext
OCSP_ONEREQ_free
OCSP_ONEREQ_get1_ext_d2i
OCSP_ONEREQ_get_ext
OCSP_ONEREQ_get_ext_by_NID
OCSP_ONEREQ_get_ext_by_OBJ
OCSP_ONEREQ_get_ext_by_critical
OCSP_ONEREQ_get_ext_count
OCSP_ONEREQ_it
OCSP_ONEREQ_new
OCSP_REQINFO_free
OCSP_REQINFO_it
OCSP_REQINFO_new
OCSP_REQUEST_add1_ext_i2d
OCSP_REQUEST_add_ext
OCSP_REQUEST_delete_ext
OCSP_REQUEST_free
OCSP_REQUEST_get1_ext_d2i
OCSP_REQUEST_get_ext
OCSP_REQUEST_get_ext_by_NID
OCSP_REQUEST_get_ext_by_OBJ
OCSP_REQUEST_get_ext_by_critical
OCSP_REQUEST_get_ext_count
OCSP_REQUEST_it
OCSP_REQUEST_new
OCSP_REQUEST_print
OCSP_REQ_CTX_add1_header
OCSP_REQ_CTX_free
OCSP_REQ_CTX_get0_mem_bio
OCSP_REQ_CTX_http
OCSP_REQ_CTX_i2d
OCSP_REQ_CTX_nbio
OCSP_REQ_CTX_nbio_d2i
OCSP_REQ_CTX_new
OCSP_REQ_CTX_set1_req
OCSP_RESPBYTES_free
OCSP_RESPBYTES_it
OCSP_RESPBYTES_new
OCSP_RESPDATA_free
OCSP_RESPDATA_it
OCSP_RESPDATA_new
OCSP_RESPID_free
OCSP_RESPID_it
OCSP_RESPID_match
OCSP_RESPID_new
OCSP_RESPID_set_by_key
OCSP_RESPID_set_by_name
OCSP_RESPONSE_free
OCSP_RESPONSE_it
OCSP_RESPONSE_new
OCSP_RESPONSE_print
OCSP_REVOKEDINFO_free
OCSP_REVOKEDINFO_it
OCSP_REVOKEDINFO_new
OCSP_SERVICELOC_free
OCSP_SERVICELOC_it
OCSP_SERVICELOC_new
OCSP_SIGNATURE_free
OCSP_SIGNATURE_it
OCSP_SIGNATURE_new
OCSP_SINGLERESP_add1_ext_i2d
OCSP_SINGLERESP_add_ext
OCSP_SINGLERESP_delete_ext
OCSP_SINGLERESP_free
OCSP_SINGLERESP_get0_id
OCSP_SINGLERESP_get1_ext_d2i
OCSP_SINGLERESP_get_ext
OCSP_SINGLERESP_get_ext_by_NID
OCSP_SINGLERESP_get_ext_by_OBJ
OCSP_SINGLERESP_get_ext_by_critical
OCSP_SINGLERESP_get_ext_count
OCSP_SINGLERESP_it
OCSP_SINGLERESP_new
OCSP_accept_responses_new
OCSP_archive_cutoff_new
OCSP_basic_add1_cert
OCSP_basic_add1_nonce
OCSP_basic_add1_status
OCSP_basic_sign
OCSP_basic_sign_ctx
OCSP_basic_verify
OCSP_cert_id_new
OCSP_cert_status_str
OCSP_cert_to_id
OCSP_check_nonce
OCSP_check_validity
OCSP_copy_nonce
OCSP_crlID_new
OCSP_crl_reason_str
OCSP_id_cmp
OCSP_id_get0_info
OCSP_id_issuer_cmp
OCSP_onereq_get0_id
OCSP_parse_url
OCSP_request_add0_id
OCSP_request_add1_cert
OCSP_request_add1_nonce
OCSP_request_is_signed
OCSP_request_onereq_count
OCSP_request_onereq_get0
OCSP_request_set1_name
OCSP_request_sign
OCSP_request_verify
OCSP_resp_count
OCSP_resp_find
OCSP_resp_find_status
OCSP_resp_get0
OCSP_resp_get0_certs
OCSP_resp_get0_id
OCSP_resp_get0_produced_at
OCSP_resp_get0_respdata
OCSP_resp_get0_signature
OCSP_resp_get0_signer
OCSP_resp_get0_tbs_sigalg
OCSP_resp_get1_id
OCSP_response_create
OCSP_response_get1_basic
OCSP_response_status
OCSP_response_status_str
OCSP_sendreq_bio
OCSP_sendreq_nbio
OCSP_sendreq_new
OCSP_set_max_response_length
OCSP_single_get0_status
OCSP_url_svcloc_new
OPENSSL_DIR_end
OPENSSL_DIR_read
OPENSSL_INIT_free
OPENSSL_INIT_new
OPENSSL_INIT_set_config_appname
OPENSSL_INIT_set_config_file_flags
OPENSSL_INIT_set_config_filename
OPENSSL_LH_delete
OPENSSL_LH_doall
OPENSSL_LH_doall_arg
OPENSSL_LH_error
OPENSSL_LH_free
OPENSSL_LH_get_down_load
OPENSSL_LH_insert
OPENSSL_LH_new
OPENSSL_LH_node_stats
OPENSSL_LH_node_stats_bio
OPENSSL_LH_node_usage_stats
OPENSSL_LH_node_usage_stats_bio
OPENSSL_LH_num_items
OPENSSL_LH_retrieve
OPENSSL_LH_set_down_load
OPENSSL_LH_stats
OPENSSL_LH_stats_bio
OPENSSL_LH_strhash
OPENSSL_asc2uni
OPENSSL_atexit
OPENSSL_buf2hexstr
OPENSSL_cleanse
OPENSSL_cleanup
OPENSSL_config
OPENSSL_die
OPENSSL_gmtime
OPENSSL_gmtime_adj
OPENSSL_gmtime_diff
OPENSSL_hexchar2int
OPENSSL_hexstr2buf
OPENSSL_init
OPENSSL_init_crypto
OPENSSL_isservice
OPENSSL_issetugid
OPENSSL_load_builtin_modules
OPENSSL_memcmp
OPENSSL_sk_deep_copy
OPENSSL_sk_delete
OPENSSL_sk_delete_ptr
OPENSSL_sk_dup
OPENSSL_sk_find
OPENSSL_sk_find_ex
OPENSSL_sk_free
OPENSSL_sk_insert
OPENSSL_sk_is_sorted
OPENSSL_sk_new
OPENSSL_sk_new_null
OPENSSL_sk_new_reserve
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_reserve
OPENSSL_sk_set
OPENSSL_sk_set_cmp_func
OPENSSL_sk_shift
OPENSSL_sk_sort
OPENSSL_sk_unshift
OPENSSL_sk_value
OPENSSL_sk_zero
OPENSSL_strlcat
OPENSSL_strlcpy
OPENSSL_strnlen
OPENSSL_thread_stop
OPENSSL_uni2asc
OPENSSL_uni2utf8
OPENSSL_utf82uni
OSSL_STORE_INFO_free
OSSL_STORE_INFO_get0_CERT
OSSL_STORE_INFO_get0_CRL
OSSL_STORE_INFO_get0_NAME
OSSL_STORE_INFO_get0_NAME_description
OSSL_STORE_INFO_get0_PARAMS
OSSL_STORE_INFO_get0_PKEY
OSSL_STORE_INFO_get1_CERT
OSSL_STORE_INFO_get1_CRL
OSSL_STORE_INFO_get1_NAME
OSSL_STORE_INFO_get1_NAME_description
OSSL_STORE_INFO_get1_PARAMS
OSSL_STORE_INFO_get1_PKEY
OSSL_STORE_INFO_get_type
OSSL_STORE_INFO_new_CERT
OSSL_STORE_INFO_new_CRL
OSSL_STORE_INFO_new_NAME
OSSL_STORE_INFO_new_PARAMS
OSSL_STORE_INFO_new_PKEY
OSSL_STORE_INFO_set0_NAME_description
OSSL_STORE_INFO_type_string
OSSL_STORE_LOADER_free
OSSL_STORE_LOADER_get0_engine
OSSL_STORE_LOADER_get0_scheme
OSSL_STORE_LOADER_new
OSSL_STORE_LOADER_set_close
OSSL_STORE_LOADER_set_ctrl
OSSL_STORE_LOADER_set_eof
OSSL_STORE_LOADER_set_error
OSSL_STORE_LOADER_set_expect
OSSL_STORE_LOADER_set_find
OSSL_STORE_LOADER_set_load
OSSL_STORE_LOADER_set_open
OSSL_STORE_SEARCH_by_alias
OSSL_STORE_SEARCH_by_issuer_serial
OSSL_STORE_SEARCH_by_key_fingerprint
OSSL_STORE_SEARCH_by_name
OSSL_STORE_SEARCH_free
OSSL_STORE_SEARCH_get0_bytes
OSSL_STORE_SEARCH_get0_digest
OSSL_STORE_SEARCH_get0_name
OSSL_STORE_SEARCH_get0_serial
OSSL_STORE_SEARCH_get0_string
OSSL_STORE_SEARCH_get_type
OSSL_STORE_close
OSSL_STORE_ctrl
OSSL_STORE_do_all_loaders
OSSL_STORE_eof
OSSL_STORE_error
OSSL_STORE_expect
OSSL_STORE_find
OSSL_STORE_load
OSSL_STORE_open
OSSL_STORE_register_loader
OSSL_STORE_supports_search
OSSL_STORE_unregister_loader
OSSL_STORE_vctrl
OTHERNAME_cmp
OTHERNAME_free
OTHERNAME_it
OTHERNAME_new
OpenSSL_version
OpenSSL_version_num
PBE2PARAM_free
PBE2PARAM_it
PBE2PARAM_new
PBEPARAM_free
PBEPARAM_it
PBEPARAM_new
PBKDF2PARAM_free
PBKDF2PARAM_it
PBKDF2PARAM_new
PEM_ASN1_read
PEM_ASN1_read_bio
PEM_ASN1_write
PEM_ASN1_write_bio
PEM_SignFinal
PEM_SignInit
PEM_SignUpdate
PEM_X509_INFO_read
PEM_X509_INFO_read_bio
PEM_X509_INFO_write_bio
PEM_bytes_read_bio
PEM_bytes_read_bio_secmem
PEM_def_callback
PEM_dek_info
PEM_do_header
PEM_get_EVP_CIPHER_INFO
PEM_proc_type
PEM_read
PEM_read_CMS
PEM_read_DHparams
PEM_read_DSAPrivateKey
PEM_read_DSA_PUBKEY
PEM_read_DSAparams
PEM_read_ECPKParameters
PEM_read_ECPrivateKey
PEM_read_EC_PUBKEY
PEM_read_NETSCAPE_CERT_SEQUENCE
PEM_read_PKCS7
PEM_read_PKCS8
PEM_read_PKCS8_PRIV_KEY_INFO
PEM_read_PUBKEY
PEM_read_PrivateKey
PEM_read_RSAPrivateKey
PEM_read_RSAPublicKey
PEM_read_RSA_PUBKEY
PEM_read_X509
PEM_read_X509_AUX
PEM_read_X509_CRL
PEM_read_X509_REQ
PEM_read_bio
PEM_read_bio_CMS
PEM_read_bio_DHparams
PEM_read_bio_DSAPrivateKey
PEM_read_bio_DSA_PUBKEY
PEM_read_bio_DSAparams
PEM_read_bio_ECPKParameters
PEM_read_bio_ECPrivateKey
PEM_read_bio_EC_PUBKEY
PEM_read_bio_NETSCAPE_CERT_SEQUENCE
PEM_read_bio_PKCS7
PEM_read_bio_PKCS8
PEM_read_bio_PKCS8_PRIV_KEY_INFO
PEM_read_bio_PUBKEY
PEM_read_bio_Parameters
PEM_read_bio_PrivateKey
PEM_read_bio_RSAPrivateKey
PEM_read_bio_RSAPublicKey
PEM_read_bio_RSA_PUBKEY
PEM_read_bio_X509
PEM_read_bio_X509_AUX
PEM_read_bio_X509_CRL
PEM_read_bio_X509_REQ
PEM_read_bio_ex
PEM_write
PEM_write_CMS
PEM_write_DHparams
PEM_write_DHxparams
PEM_write_DSAPrivateKey
PEM_write_DSA_PUBKEY
PEM_write_DSAparams
PEM_write_ECPKParameters
PEM_write_ECPrivateKey
PEM_write_EC_PUBKEY
PEM_write_NETSCAPE_CERT_SEQUENCE
PEM_write_PKCS7
PEM_write_PKCS8
PEM_write_PKCS8PrivateKey
PEM_write_PKCS8PrivateKey_nid
PEM_write_PKCS8_PRIV_KEY_INFO
PEM_write_PUBKEY
PEM_write_PrivateKey
PEM_write_RSAPrivateKey
PEM_write_RSAPublicKey
PEM_write_RSA_PUBKEY
PEM_write_X509
PEM_write_X509_AUX
PEM_write_X509_CRL
PEM_write_X509_REQ
PEM_write_X509_REQ_NEW
PEM_write_bio
PEM_write_bio_ASN1_stream
PEM_write_bio_CMS
PEM_write_bio_CMS_stream
PEM_write_bio_DHparams
PEM_write_bio_DHxparams
PEM_write_bio_DSAPrivateKey
PEM_write_bio_DSA_PUBKEY
PEM_write_bio_DSAparams
PEM_write_bio_ECPKParameters
PEM_write_bio_ECPrivateKey
PEM_write_bio_EC_PUBKEY
PEM_write_bio_NETSCAPE_CERT_SEQUENCE
PEM_write_bio_PKCS7
PEM_write_bio_PKCS7_stream
PEM_write_bio_PKCS8
PEM_write_bio_PKCS8PrivateKey
PEM_write_bio_PKCS8PrivateKey_nid
PEM_write_bio_PKCS8_PRIV_KEY_INFO
PEM_write_bio_PUBKEY
PEM_write_bio_Parameters
PEM_write_bio_PrivateKey
PEM_write_bio_PrivateKey_traditional
PEM_write_bio_RSAPrivateKey
PEM_write_bio_RSAPublicKey
PEM_write_bio_RSA_PUBKEY
PEM_write_bio_X509
PEM_write_bio_X509_AUX
PEM_write_bio_X509_CRL
PEM_write_bio_X509_REQ
PEM_write_bio_X509_REQ_NEW
PKCS12_AUTHSAFES_it
PKCS12_BAGS_free
PKCS12_BAGS_it
PKCS12_BAGS_new
PKCS12_MAC_DATA_free
PKCS12_MAC_DATA_it
PKCS12_MAC_DATA_new
PKCS12_PBE_add
PKCS12_PBE_keyivgen
PKCS12_SAFEBAGS_it
PKCS12_SAFEBAG_create0_p8inf
PKCS12_SAFEBAG_create0_pkcs8
PKCS12_SAFEBAG_create_cert
PKCS12_SAFEBAG_create_crl
PKCS12_SAFEBAG_create_pkcs8_encrypt
PKCS12_SAFEBAG_free
PKCS12_SAFEBAG_get0_attr
PKCS12_SAFEBAG_get0_attrs
PKCS12_SAFEBAG_get0_p8inf
PKCS12_SAFEBAG_get0_pkcs8
PKCS12_SAFEBAG_get0_safes
PKCS12_SAFEBAG_get0_type
PKCS12_SAFEBAG_get1_cert
PKCS12_SAFEBAG_get1_crl
PKCS12_SAFEBAG_get_bag_nid
PKCS12_SAFEBAG_get_nid
PKCS12_SAFEBAG_it
PKCS12_SAFEBAG_new
PKCS12_add_CSPName_asc
PKCS12_add_cert
PKCS12_add_friendlyname_asc
PKCS12_add_friendlyname_uni
PKCS12_add_friendlyname_utf8
PKCS12_add_key
PKCS12_add_localkeyid
PKCS12_add_safe
PKCS12_add_safes
PKCS12_create
PKCS12_decrypt_skey
PKCS12_free
PKCS12_gen_mac
PKCS12_get0_mac
PKCS12_get_attr
PKCS12_get_attr_gen
PKCS12_get_friendlyname
PKCS12_init
PKCS12_it
PKCS12_item_decrypt_d2i
PKCS12_item_i2d_encrypt
PKCS12_item_pack_safebag
PKCS12_key_gen_asc
PKCS12_key_gen_uni
PKCS12_key_gen_utf8
PKCS12_mac_present
PKCS12_new
PKCS12_newpass
PKCS12_pack_authsafes
PKCS12_pack_p7data
PKCS12_pack_p7encdata
PKCS12_parse
PKCS12_pbe_crypt
PKCS12_set_mac
PKCS12_setup_mac
PKCS12_unpack_authsafes
PKCS12_unpack_p7data
PKCS12_unpack_p7encdata
PKCS12_verify_mac
PKCS1_MGF1
PKCS5_PBE_add
PKCS5_PBE_keyivgen
PKCS5_PBKDF2_HMAC
PKCS5_PBKDF2_HMAC_SHA1
PKCS5_pbe2_set
PKCS5_pbe2_set_iv
PKCS5_pbe2_set_scrypt
PKCS5_pbe_set
PKCS5_pbe_set0_algor
PKCS5_pbkdf2_set
PKCS5_v2_PBE_keyivgen
PKCS5_v2_scrypt_keyivgen
PKCS7_ATTR_SIGN_it
PKCS7_ATTR_VERIFY_it
PKCS7_DIGEST_free
PKCS7_DIGEST_it
PKCS7_DIGEST_new
PKCS7_ENCRYPT_free
PKCS7_ENCRYPT_it
PKCS7_ENCRYPT_new
PKCS7_ENC_CONTENT_free
PKCS7_ENC_CONTENT_it
PKCS7_ENC_CONTENT_new
PKCS7_ENVELOPE_free
PKCS7_ENVELOPE_it
PKCS7_ENVELOPE_new
PKCS7_ISSUER_AND_SERIAL_digest
PKCS7_ISSUER_AND_SERIAL_free
PKCS7_ISSUER_AND_SERIAL_it
PKCS7_ISSUER_AND_SERIAL_new
PKCS7_RECIP_INFO_free
PKCS7_RECIP_INFO_get0_alg
PKCS7_RECIP_INFO_it
PKCS7_RECIP_INFO_new
PKCS7_RECIP_INFO_set
PKCS7_SIGNED_free
PKCS7_SIGNED_it
PKCS7_SIGNED_new
PKCS7_SIGNER_INFO_free
PKCS7_SIGNER_INFO_get0_algs
PKCS7_SIGNER_INFO_it
PKCS7_SIGNER_INFO_new
PKCS7_SIGNER_INFO_set
PKCS7_SIGNER_INFO_sign
PKCS7_SIGN_ENVELOPE_free
PKCS7_SIGN_ENVELOPE_it
PKCS7_SIGN_ENVELOPE_new
PKCS7_add0_attrib_signing_time
PKCS7_add1_attrib_digest
PKCS7_add_attrib_content_type
PKCS7_add_attrib_smimecap
PKCS7_add_attribute
PKCS7_add_certificate
PKCS7_add_crl
PKCS7_add_recipient
PKCS7_add_recipient_info
PKCS7_add_signature
PKCS7_add_signed_attribute
PKCS7_add_signer
PKCS7_cert_from_signer_info
PKCS7_content_new
PKCS7_ctrl
PKCS7_dataDecode
PKCS7_dataFinal
PKCS7_dataInit
PKCS7_dataVerify
PKCS7_decrypt
PKCS7_digest_from_attributes
PKCS7_dup
PKCS7_encrypt
PKCS7_final
PKCS7_free
PKCS7_get0_signers
PKCS7_get_attribute
PKCS7_get_issuer_and_serial
PKCS7_get_signed_attribute
PKCS7_get_signer_info
PKCS7_get_smimecap
PKCS7_it
PKCS7_new
PKCS7_print_ctx
PKCS7_set0_type_other
PKCS7_set_attributes
PKCS7_set_cipher
PKCS7_set_content
PKCS7_set_digest
PKCS7_set_signed_attributes
PKCS7_set_type
PKCS7_sign
PKCS7_sign_add_signer
PKCS7_signatureVerify
PKCS7_simple_smimecap
PKCS7_stream
PKCS7_to_TS_TST_INFO
PKCS7_verify
PKCS8_PRIV_KEY_INFO_free
PKCS8_PRIV_KEY_INFO_it
PKCS8_PRIV_KEY_INFO_new
PKCS8_add_keyusage
PKCS8_decrypt
PKCS8_encrypt
PKCS8_get_attr
PKCS8_pkey_add1_attr_by_NID
PKCS8_pkey_get0
PKCS8_pkey_get0_attrs
PKCS8_pkey_set0
PKCS8_set0_pbe
PKEY_USAGE_PERIOD_free
PKEY_USAGE_PERIOD_it
PKEY_USAGE_PERIOD_new
POLICYINFO_free
POLICYINFO_it
POLICYINFO_new
POLICYQUALINFO_free
POLICYQUALINFO_it
POLICYQUALINFO_new
POLICY_CONSTRAINTS_free
POLICY_CONSTRAINTS_it
POLICY_CONSTRAINTS_new
POLICY_MAPPINGS_it
POLICY_MAPPING_free
POLICY_MAPPING_it
POLICY_MAPPING_new
PROFESSION_INFO_free
PROFESSION_INFO_get0_addProfessionInfo
PROFESSION_INFO_get0_namingAuthority
PROFESSION_INFO_get0_professionItems
PROFESSION_INFO_get0_professionOIDs
PROFESSION_INFO_get0_registrationNumber
PROFESSION_INFO_it
PROFESSION_INFO_new
PROFESSION_INFO_set0_addProfessionInfo
PROFESSION_INFO_set0_namingAuthority
PROFESSION_INFO_set0_professionItems
PROFESSION_INFO_set0_professionOIDs
PROFESSION_INFO_set0_registrationNumber
PROXY_CERT_INFO_EXTENSION_free
PROXY_CERT_INFO_EXTENSION_it
PROXY_CERT_INFO_EXTENSION_new
PROXY_POLICY_free
PROXY_POLICY_it
PROXY_POLICY_new
RAND_DRBG_bytes
RAND_DRBG_free
RAND_DRBG_generate
RAND_DRBG_get0_master
RAND_DRBG_get0_private
RAND_DRBG_get0_public
RAND_DRBG_get_ex_data
RAND_DRBG_instantiate
RAND_DRBG_new
RAND_DRBG_reseed
RAND_DRBG_secure_new
RAND_DRBG_set
RAND_DRBG_set_callbacks
RAND_DRBG_set_defaults
RAND_DRBG_set_ex_data
RAND_DRBG_set_reseed_defaults
RAND_DRBG_set_reseed_interval
RAND_DRBG_set_reseed_time_interval
RAND_DRBG_uninstantiate
RAND_OpenSSL
RAND_add
RAND_bytes
RAND_event
RAND_file_name
RAND_get_rand_method
RAND_keep_random_devices_open
RAND_load_file
RAND_poll
RAND_priv_bytes
RAND_pseudo_bytes
RAND_screen
RAND_seed
RAND_set_rand_engine
RAND_set_rand_method
RAND_status
RAND_write_file
RC2_cbc_encrypt
RC2_cfb64_encrypt
RC2_decrypt
RC2_ecb_encrypt
RC2_encrypt
RC2_ofb64_encrypt
RC2_set_key
RC4
RC4_options
RC4_set_key
RIPEMD160
RIPEMD160_Final
RIPEMD160_Init
RIPEMD160_Transform
RIPEMD160_Update
RSAPrivateKey_dup
RSAPrivateKey_it
RSAPublicKey_dup
RSAPublicKey_it
RSA_OAEP_PARAMS_free
RSA_OAEP_PARAMS_it
RSA_OAEP_PARAMS_new
RSA_PKCS1_OpenSSL
RSA_PSS_PARAMS_free
RSA_PSS_PARAMS_it
RSA_PSS_PARAMS_new
RSA_X931_derive_ex
RSA_X931_generate_key_ex
RSA_X931_hash_id
RSA_bits
RSA_blinding_off
RSA_blinding_on
RSA_check_key
RSA_check_key_ex
RSA_clear_flags
RSA_flags
RSA_free
RSA_generate_key
RSA_generate_key_ex
RSA_generate_multi_prime_key
RSA_get0_crt_params
RSA_get0_d
RSA_get0_dmp1
RSA_get0_dmq1
RSA_get0_e
RSA_get0_engine
RSA_get0_factors
RSA_get0_iqmp
RSA_get0_key
RSA_get0_multi_prime_crt_params
RSA_get0_multi_prime_factors
RSA_get0_n
RSA_get0_p
RSA_get0_pss_params
RSA_get0_q
RSA_get_default_method
RSA_get_ex_data
RSA_get_method
RSA_get_multi_prime_extra_count
RSA_get_version
RSA_meth_dup
RSA_meth_free
RSA_meth_get0_app_data
RSA_meth_get0_name
RSA_meth_get_bn_mod_exp
RSA_meth_get_finish
RSA_meth_get_flags
RSA_meth_get_init
RSA_meth_get_keygen
RSA_meth_get_mod_exp
RSA_meth_get_multi_prime_keygen
RSA_meth_get_priv_dec
RSA_meth_get_priv_enc
RSA_meth_get_pub_dec
RSA_meth_get_pub_enc
RSA_meth_get_sign
RSA_meth_get_verify
RSA_meth_new
RSA_meth_set0_app_data
RSA_meth_set1_name
RSA_meth_set_bn_mod_exp
RSA_meth_set_finish
RSA_meth_set_flags
RSA_meth_set_init
RSA_meth_set_keygen
RSA_meth_set_mod_exp
RSA_meth_set_multi_prime_keygen
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_meth_set_pub_dec
RSA_meth_set_pub_enc
RSA_meth_set_sign
RSA_meth_set_verify
RSA_new
RSA_new_method
RSA_null_method
RSA_padding_add_PKCS1_OAEP
RSA_padding_add_PKCS1_OAEP_mgf1
RSA_padding_add_PKCS1_PSS
RSA_padding_add_PKCS1_PSS_mgf1
RSA_padding_add_PKCS1_type_1
RSA_padding_add_PKCS1_type_2
RSA_padding_add_SSLv23
RSA_padding_add_X931
RSA_padding_add_none
RSA_padding_check_PKCS1_OAEP
RSA_padding_check_PKCS1_OAEP_mgf1
RSA_padding_check_PKCS1_type_1
RSA_padding_check_PKCS1_type_2
RSA_padding_check_SSLv23
RSA_padding_check_X931
RSA_padding_check_none
RSA_pkey_ctx_ctrl
RSA_print
RSA_print_fp
RSA_private_decrypt
RSA_private_encrypt
RSA_public_decrypt
RSA_public_encrypt
RSA_security_bits
RSA_set0_crt_params
RSA_set0_factors
RSA_set0_key
RSA_set0_multi_prime_params
RSA_set_default_method
RSA_set_ex_data
RSA_set_flags
RSA_set_method
RSA_setup_blinding
RSA_sign
RSA_sign_ASN1_OCTET_STRING
RSA_size
RSA_test_flags
RSA_up_ref
RSA_verify
RSA_verify_ASN1_OCTET_STRING
RSA_verify_PKCS1_PSS
RSA_verify_PKCS1_PSS_mgf1
SCRYPT_PARAMS_free
SCRYPT_PARAMS_it
SCRYPT_PARAMS_new
SCT_LIST_free
SCT_LIST_print
SCT_LIST_validate
SCT_free
SCT_get0_extensions
SCT_get0_log_id
SCT_get0_signature
SCT_get_log_entry_type
SCT_get_signature_nid
SCT_get_source
SCT_get_timestamp
SCT_get_validation_status
SCT_get_version
SCT_new
SCT_new_from_base64
SCT_print
SCT_set0_extensions
SCT_set0_log_id
SCT_set0_signature
SCT_set1_extensions
SCT_set1_log_id
SCT_set1_signature
SCT_set_log_entry_type
SCT_set_signature_nid
SCT_set_source
SCT_set_timestamp
SCT_set_version
SCT_validate
SCT_validation_status_string
SEED_cbc_encrypt
SEED_cfb128_encrypt
SEED_decrypt
SEED_ecb_encrypt
SEED_encrypt
SEED_ofb128_encrypt
SEED_set_key
SHA1
SHA1_Final
SHA1_Init
SHA1_Transform
SHA1_Update
SHA224
SHA224_Final
SHA224_Init
SHA224_Update
SHA256
SHA256_Final
SHA256_Init
SHA256_Transform
SHA256_Update
SHA384
SHA384_Final
SHA384_Init
SHA384_Update
SHA512
SHA512_Final
SHA512_Init
SHA512_Transform
SHA512_Update
SMIME_crlf_copy
SMIME_read_ASN1
SMIME_read_CMS
SMIME_read_PKCS7
SMIME_text
SMIME_write_ASN1
SMIME_write_CMS
SMIME_write_PKCS7
SRP_Calc_A
SRP_Calc_B
SRP_Calc_client_key
SRP_Calc_server_key
SRP_Calc_u
SRP_Calc_x
SRP_VBASE_free
SRP_VBASE_get1_by_user
SRP_VBASE_get_by_user
SRP_VBASE_init
SRP_VBASE_new
SRP_Verify_A_mod_N
SRP_Verify_B_mod_N
SRP_check_known_gN_param
SRP_create_verifier
SRP_create_verifier_BN
SRP_get_default_gN
SRP_user_pwd_free
SXNETID_free
SXNETID_it
SXNETID_new
SXNET_add_id_INTEGER
SXNET_add_id_asc
SXNET_add_id_ulong
SXNET_free
SXNET_get_id_INTEGER
SXNET_get_id_asc
SXNET_get_id_ulong
SXNET_it
SXNET_new
TLS_FEATURE_free
TLS_FEATURE_new
TS_ACCURACY_dup
TS_ACCURACY_free
TS_ACCURACY_get_micros
TS_ACCURACY_get_millis
TS_ACCURACY_get_seconds
TS_ACCURACY_new
TS_ACCURACY_set_micros
TS_ACCURACY_set_millis
TS_ACCURACY_set_seconds
TS_ASN1_INTEGER_print_bio
TS_CONF_get_tsa_section
TS_CONF_load_cert
TS_CONF_load_certs
TS_CONF_load_key
TS_CONF_set_accuracy
TS_CONF_set_certs
TS_CONF_set_clock_precision_digits
TS_CONF_set_crypto_device
TS_CONF_set_def_policy
TS_CONF_set_default_engine
TS_CONF_set_digests
TS_CONF_set_ess_cert_id_chain
TS_CONF_set_ess_cert_id_digest
TS_CONF_set_ordering
TS_CONF_set_policies
TS_CONF_set_serial
TS_CONF_set_signer_cert
TS_CONF_set_signer_digest
TS_CONF_set_signer_key
TS_CONF_set_tsa_name
TS_MSG_IMPRINT_dup
TS_MSG_IMPRINT_free
TS_MSG_IMPRINT_get_algo
TS_MSG_IMPRINT_get_msg
TS_MSG_IMPRINT_new
TS_MSG_IMPRINT_print_bio
TS_MSG_IMPRINT_set_algo
TS_MSG_IMPRINT_set_msg
TS_OBJ_print_bio
TS_REQ_add_ext
TS_REQ_delete_ext
TS_REQ_dup
TS_REQ_ext_free
TS_REQ_free
TS_REQ_get_cert_req
TS_REQ_get_ext
TS_REQ_get_ext_by_NID
TS_REQ_get_ext_by_OBJ
TS_REQ_get_ext_by_critical
TS_REQ_get_ext_count
TS_REQ_get_ext_d2i
TS_REQ_get_exts
TS_REQ_get_msg_imprint
TS_REQ_get_nonce
TS_REQ_get_policy_id
TS_REQ_get_version
TS_REQ_new
TS_REQ_print_bio
TS_REQ_set_cert_req
TS_REQ_set_msg_imprint
TS_REQ_set_nonce
TS_REQ_set_policy_id
TS_REQ_set_version
TS_REQ_to_TS_VERIFY_CTX
TS_RESP_CTX_add_failure_info
TS_RESP_CTX_add_flags
TS_RESP_CTX_add_md
TS_RESP_CTX_add_policy
TS_RESP_CTX_free
TS_RESP_CTX_get_request
TS_RESP_CTX_get_tst_info
TS_RESP_CTX_new
TS_RESP_CTX_set_accuracy
TS_RESP_CTX_set_certs
TS_RESP_CTX_set_clock_precision_digits
TS_RESP_CTX_set_def_policy
TS_RESP_CTX_set_ess_cert_id_digest
TS_RESP_CTX_set_extension_cb
TS_RESP_CTX_set_serial_cb
TS_RESP_CTX_set_signer_cert
TS_RESP_CTX_set_signer_digest
TS_RESP_CTX_set_signer_key
TS_RESP_CTX_set_status_info
TS_RESP_CTX_set_status_info_cond
TS_RESP_CTX_set_time_cb
TS_RESP_create_response
TS_RESP_dup
TS_RESP_free
TS_RESP_get_status_info
TS_RESP_get_token
TS_RESP_get_tst_info
TS_RESP_new
TS_RESP_print_bio
TS_RESP_set_status_info
TS_RESP_set_tst_info
TS_RESP_verify_response
TS_RESP_verify_signature
TS_RESP_verify_token
TS_STATUS_INFO_dup
TS_STATUS_INFO_free
TS_STATUS_INFO_get0_failure_info
TS_STATUS_INFO_get0_status
TS_STATUS_INFO_get0_text
TS_STATUS_INFO_new
TS_STATUS_INFO_print_bio
TS_STATUS_INFO_set_status
TS_TST_INFO_add_ext
TS_TST_INFO_delete_ext
TS_TST_INFO_dup
TS_TST_INFO_ext_free
TS_TST_INFO_free
TS_TST_INFO_get_accuracy
TS_TST_INFO_get_ext
TS_TST_INFO_get_ext_by_NID
TS_TST_INFO_get_ext_by_OBJ
TS_TST_INFO_get_ext_by_critical
TS_TST_INFO_get_ext_count
TS_TST_INFO_get_ext_d2i
TS_TST_INFO_get_exts
TS_TST_INFO_get_msg_imprint
TS_TST_INFO_get_nonce
TS_TST_INFO_get_ordering
TS_TST_INFO_get_policy_id
TS_TST_INFO_get_serial
TS_TST_INFO_get_time
TS_TST_INFO_get_tsa
TS_TST_INFO_get_version
TS_TST_INFO_new
TS_TST_INFO_print_bio
TS_TST_INFO_set_accuracy
TS_TST_INFO_set_msg_imprint
TS_TST_INFO_set_nonce
TS_TST_INFO_set_ordering
TS_TST_INFO_set_policy_id
TS_TST_INFO_set_serial
TS_TST_INFO_set_time
TS_TST_INFO_set_tsa
TS_TST_INFO_set_version
TS_VERIFY_CTS_set_certs
TS_VERIFY_CTX_add_flags
TS_VERIFY_CTX_cleanup
TS_VERIFY_CTX_free
TS_VERIFY_CTX_init
TS_VERIFY_CTX_new
TS_VERIFY_CTX_set_data
TS_VERIFY_CTX_set_flags
TS_VERIFY_CTX_set_imprint
TS_VERIFY_CTX_set_store
TS_X509_ALGOR_print_bio
TS_ext_print_bio
TXT_DB_create_index
TXT_DB_free
TXT_DB_get_by_index
TXT_DB_insert
TXT_DB_read
TXT_DB_write
UINT32_it
UINT64_it
UI_OpenSSL
UI_UTIL_read_pw
UI_UTIL_read_pw_string
UI_UTIL_wrap_read_pem_callback
UI_add_error_string
UI_add_info_string
UI_add_input_boolean
UI_add_input_string
UI_add_user_data
UI_add_verify_string
UI_construct_prompt
UI_create_method
UI_ctrl
UI_destroy_method
UI_dup_error_string
UI_dup_info_string
UI_dup_input_boolean
UI_dup_input_string
UI_dup_user_data
UI_dup_verify_string
UI_free
UI_get0_action_string
UI_get0_output_string
UI_get0_result
UI_get0_result_string
UI_get0_test_string
UI_get0_user_data
UI_get_default_method
UI_get_ex_data
UI_get_input_flags
UI_get_method
UI_get_result_length
UI_get_result_maxsize
UI_get_result_minsize
UI_get_result_string_length
UI_get_string_type
UI_method_get_closer
UI_method_get_data_destructor
UI_method_get_data_duplicator
UI_method_get_ex_data
UI_method_get_flusher
UI_method_get_opener
UI_method_get_prompt_constructor
UI_method_get_reader
UI_method_get_writer
UI_method_set_closer
UI_method_set_data_duplicator
UI_method_set_ex_data
UI_method_set_flusher
UI_method_set_opener
UI_method_set_prompt_constructor
UI_method_set_reader
UI_method_set_writer
UI_new
UI_new_method
UI_null
UI_process
UI_set_default_method
UI_set_ex_data
UI_set_method
UI_set_result
UI_set_result_ex
USERNOTICE_free
USERNOTICE_it
USERNOTICE_new
UTF8_getc
UTF8_putc
WHIRLPOOL
WHIRLPOOL_BitUpdate
WHIRLPOOL_Final
WHIRLPOOL_Init
WHIRLPOOL_Update
X509V3_EXT_CRL_add_conf
X509V3_EXT_CRL_add_nconf
X509V3_EXT_REQ_add_conf
X509V3_EXT_REQ_add_nconf
X509V3_EXT_add
X509V3_EXT_add_alias
X509V3_EXT_add_conf
X509V3_EXT_add_list
X509V3_EXT_add_nconf
X509V3_EXT_add_nconf_sk
X509V3_EXT_cleanup
X509V3_EXT_conf
X509V3_EXT_conf_nid
X509V3_EXT_d2i
X509V3_EXT_get
X509V3_EXT_get_nid
X509V3_EXT_i2d
X509V3_EXT_nconf
X509V3_EXT_nconf_nid
X509V3_EXT_print
X509V3_EXT_print_fp
X509V3_EXT_val_prn
X509V3_NAME_from_section
X509V3_add1_i2d
X509V3_add_standard_extensions
X509V3_add_value
X509V3_add_value_bool
X509V3_add_value_bool_nf
X509V3_add_value_int
X509V3_add_value_uchar
X509V3_conf_free
X509V3_extensions_print
X509V3_get_d2i
X509V3_get_section
X509V3_get_string
X509V3_get_value_bool
X509V3_get_value_int
X509V3_parse_list
X509V3_section_free
X509V3_set_conf_lhash
X509V3_set_ctx
X509V3_set_nconf
X509V3_string_free
X509_ALGORS_it
X509_ALGOR_cmp
X509_ALGOR_copy
X509_ALGOR_dup
X509_ALGOR_free
X509_ALGOR_get0
X509_ALGOR_it
X509_ALGOR_new
X509_ALGOR_set0
X509_ALGOR_set_md
X509_ATTRIBUTE_count
X509_ATTRIBUTE_create
X509_ATTRIBUTE_create_by_NID
X509_ATTRIBUTE_create_by_OBJ
X509_ATTRIBUTE_create_by_txt
X509_ATTRIBUTE_dup
X509_ATTRIBUTE_free
X509_ATTRIBUTE_get0_data
X509_ATTRIBUTE_get0_object
X509_ATTRIBUTE_get0_type
X509_ATTRIBUTE_it
X509_ATTRIBUTE_new
X509_ATTRIBUTE_set1_data
X509_ATTRIBUTE_set1_object
X509_CERT_AUX_free
X509_CERT_AUX_it
X509_CERT_AUX_new
X509_CINF_free
X509_CINF_it
X509_CINF_new
X509_CRL_INFO_free
X509_CRL_INFO_it
X509_CRL_INFO_new
X509_CRL_METHOD_free
X509_CRL_METHOD_new
X509_CRL_add0_revoked
X509_CRL_add1_ext_i2d
X509_CRL_add_ext
X509_CRL_check_suiteb
X509_CRL_cmp
X509_CRL_delete_ext
X509_CRL_diff
X509_CRL_digest
X509_CRL_dup
X509_CRL_free
X509_CRL_get0_by_cert
X509_CRL_get0_by_serial
X509_CRL_get0_extensions
X509_CRL_get0_lastUpdate
X509_CRL_get0_nextUpdate
X509_CRL_get0_signature
X509_CRL_get_REVOKED
X509_CRL_get_ext
X509_CRL_get_ext_by_NID
X509_CRL_get_ext_by_OBJ
X509_CRL_get_ext_by_critical
X509_CRL_get_ext_count
X509_CRL_get_ext_d2i
X509_CRL_get_issuer
X509_CRL_get_lastUpdate
X509_CRL_get_meth_data
X509_CRL_get_nextUpdate
X509_CRL_get_signature_nid
X509_CRL_get_version
X509_CRL_http_nbio
X509_CRL_it
X509_CRL_match
X509_CRL_new
X509_CRL_print
X509_CRL_print_ex
X509_CRL_print_fp
X509_CRL_set1_lastUpdate
X509_CRL_set1_nextUpdate
X509_CRL_set_default_method
X509_CRL_set_issuer_name
X509_CRL_set_meth_data
X509_CRL_set_version
X509_CRL_sign
X509_CRL_sign_ctx
X509_CRL_sort
X509_CRL_up_ref
X509_CRL_verify
X509_EXTENSIONS_it
X509_EXTENSION_create_by_NID
X509_EXTENSION_create_by_OBJ
X509_EXTENSION_dup
X509_EXTENSION_free
X509_EXTENSION_get_critical
X509_EXTENSION_get_data
X509_EXTENSION_get_object
X509_EXTENSION_it
X509_EXTENSION_new
X509_EXTENSION_set_critical
X509_EXTENSION_set_data
X509_EXTENSION_set_object
X509_INFO_free
X509_INFO_new
X509_LOOKUP_by_alias
X509_LOOKUP_by_fingerprint
X509_LOOKUP_by_issuer_serial
X509_LOOKUP_by_subject
X509_LOOKUP_ctrl
X509_LOOKUP_file
X509_LOOKUP_free
X509_LOOKUP_get_method_data
X509_LOOKUP_get_store
X509_LOOKUP_hash_dir
X509_LOOKUP_init
X509_LOOKUP_meth_free
X509_LOOKUP_meth_get_ctrl
X509_LOOKUP_meth_get_free
X509_LOOKUP_meth_get_get_by_alias
X509_LOOKUP_meth_get_get_by_fingerprint
X509_LOOKUP_meth_get_get_by_issuer_serial
X509_LOOKUP_meth_get_get_by_subject
X509_LOOKUP_meth_get_init
X509_LOOKUP_meth_get_new_item
X509_LOOKUP_meth_get_shutdown
X509_LOOKUP_meth_new
X509_LOOKUP_meth_set_ctrl
X509_LOOKUP_meth_set_free
X509_LOOKUP_meth_set_get_by_alias
X509_LOOKUP_meth_set_get_by_fingerprint
X509_LOOKUP_meth_set_get_by_issuer_serial
X509_LOOKUP_meth_set_get_by_subject
X509_LOOKUP_meth_set_init
X509_LOOKUP_meth_set_new_item
X509_LOOKUP_meth_set_shutdown
X509_LOOKUP_new
X509_LOOKUP_set_method_data
X509_LOOKUP_shutdown
X509_NAME_ENTRY_create_by_NID
X509_NAME_ENTRY_create_by_OBJ
X509_NAME_ENTRY_create_by_txt
X509_NAME_ENTRY_dup
X509_NAME_ENTRY_free
X509_NAME_ENTRY_get_data
X509_NAME_ENTRY_get_object
X509_NAME_ENTRY_it
X509_NAME_ENTRY_new
X509_NAME_ENTRY_set
X509_NAME_ENTRY_set_data
X509_NAME_ENTRY_set_object
X509_NAME_add_entry
X509_NAME_add_entry_by_NID
X509_NAME_add_entry_by_OBJ
X509_NAME_add_entry_by_txt
X509_NAME_cmp
X509_NAME_delete_entry
X509_NAME_digest
X509_NAME_dup
X509_NAME_entry_count
X509_NAME_free
X509_NAME_get0_der
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_get_index_by_OBJ
X509_NAME_get_text_by_NID
X509_NAME_get_text_by_OBJ
X509_NAME_hash
X509_NAME_hash_old
X509_NAME_it
X509_NAME_new
X509_NAME_oneline
X509_NAME_print
X509_NAME_print_ex
X509_NAME_print_ex_fp
X509_NAME_set
X509_OBJECT_free
X509_OBJECT_get0_X509
X509_OBJECT_get0_X509_CRL
X509_OBJECT_get_type
X509_OBJECT_idx_by_subject
X509_OBJECT_new
X509_OBJECT_retrieve_by_subject
X509_OBJECT_retrieve_match
X509_OBJECT_set1_X509
X509_OBJECT_set1_X509_CRL
X509_OBJECT_up_ref_count
X509_PKEY_free
X509_PKEY_new
X509_POLICY_NODE_print
X509_PUBKEY_free
X509_PUBKEY_get
X509_PUBKEY_get0
X509_PUBKEY_get0_param
X509_PUBKEY_it
X509_PUBKEY_new
X509_PUBKEY_set
X509_PUBKEY_set0_param
X509_PURPOSE_add
X509_PURPOSE_cleanup
X509_PURPOSE_get0
X509_PURPOSE_get0_name
X509_PURPOSE_get0_sname
X509_PURPOSE_get_by_id
X509_PURPOSE_get_by_sname
X509_PURPOSE_get_count
X509_PURPOSE_get_id
X509_PURPOSE_get_trust
X509_PURPOSE_set
X509_REQ_INFO_free
X509_REQ_INFO_it
X509_REQ_INFO_new
X509_REQ_add1_attr
X509_REQ_add1_attr_by_NID
X509_REQ_add1_attr_by_OBJ
X509_REQ_add1_attr_by_txt
X509_REQ_add_extensions
X509_REQ_add_extensions_nid
X509_REQ_check_private_key
X509_REQ_delete_attr
X509_REQ_digest
X509_REQ_dup
X509_REQ_extension_nid
X509_REQ_free
X509_REQ_get0_pubkey
X509_REQ_get0_signature
X509_REQ_get1_email
X509_REQ_get_X509_PUBKEY
X509_REQ_get_attr
X509_REQ_get_attr_by_NID
X509_REQ_get_attr_by_OBJ
X509_REQ_get_attr_count
X509_REQ_get_extension_nids
X509_REQ_get_extensions
X509_REQ_get_pubkey
X509_REQ_get_signature_nid
X509_REQ_get_subject_name
X509_REQ_get_version
X509_REQ_it
X509_REQ_new
X509_REQ_print
X509_REQ_print_ex
X509_REQ_print_fp
X509_REQ_set0_signature
X509_REQ_set1_signature_algo
X509_REQ_set_extension_nids
X509_REQ_set_pubkey
X509_REQ_set_subject_name
X509_REQ_set_version
X509_REQ_sign
X509_REQ_sign_ctx
X509_REQ_to_X509
X509_REQ_verify
X509_REVOKED_add1_ext_i2d
X509_REVOKED_add_ext
X509_REVOKED_delete_ext
X509_REVOKED_dup
X509_REVOKED_free
X509_REVOKED_get0_extensions
X509_REVOKED_get0_revocationDate
X509_REVOKED_get0_serialNumber
X509_REVOKED_get_ext
X509_REVOKED_get_ext_by_NID
X509_REVOKED_get_ext_by_OBJ
X509_REVOKED_get_ext_by_critical
X509_REVOKED_get_ext_count
X509_REVOKED_get_ext_d2i
X509_REVOKED_it
X509_REVOKED_new
X509_REVOKED_set_revocationDate
X509_REVOKED_set_serialNumber
X509_SIG_INFO_get
X509_SIG_INFO_set
X509_SIG_free
X509_SIG_get0
X509_SIG_getm
X509_SIG_it
X509_SIG_new
X509_STORE_CTX_cleanup
X509_STORE_CTX_free
X509_STORE_CTX_get0_cert
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get0_current_crl
X509_STORE_CTX_get0_current_issuer
X509_STORE_CTX_get0_param
X509_STORE_CTX_get0_parent_ctx
X509_STORE_CTX_get0_policy_tree
X509_STORE_CTX_get0_store
X509_STORE_CTX_get0_untrusted
X509_STORE_CTX_get1_certs
X509_STORE_CTX_get1_chain
X509_STORE_CTX_get1_crls
X509_STORE_CTX_get1_issuer
X509_STORE_CTX_get_by_subject
X509_STORE_CTX_get_cert_crl
X509_STORE_CTX_get_check_crl
X509_STORE_CTX_get_check_issued
X509_STORE_CTX_get_check_policy
X509_STORE_CTX_get_check_revocation
X509_STORE_CTX_get_cleanup
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_error
X509_STORE_CTX_get_error_depth
X509_STORE_CTX_get_ex_data
X509_STORE_CTX_get_explicit_policy
X509_STORE_CTX_get_get_crl
X509_STORE_CTX_get_get_issuer
X509_STORE_CTX_get_lookup_certs
X509_STORE_CTX_get_lookup_crls
X509_STORE_CTX_get_num_untrusted
X509_STORE_CTX_get_obj_by_subject
X509_STORE_CTX_get_verify
X509_STORE_CTX_get_verify_cb
X509_STORE_CTX_init
X509_STORE_CTX_new
X509_STORE_CTX_purpose_inherit
X509_STORE_CTX_set0_crls
X509_STORE_CTX_set0_dane
X509_STORE_CTX_set0_param
X509_STORE_CTX_set0_trusted_stack
X509_STORE_CTX_set0_untrusted
X509_STORE_CTX_set0_verified_chain
X509_STORE_CTX_set_cert
X509_STORE_CTX_set_current_cert
X509_STORE_CTX_set_default
X509_STORE_CTX_set_depth
X509_STORE_CTX_set_error
X509_STORE_CTX_set_error_depth
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_set_flags
X509_STORE_CTX_set_purpose
X509_STORE_CTX_set_time
X509_STORE_CTX_set_trust
X509_STORE_CTX_set_verify
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_add_crl
X509_STORE_add_lookup
X509_STORE_free
X509_STORE_get0_objects
X509_STORE_get0_param
X509_STORE_get_cert_crl
X509_STORE_get_check_crl
X509_STORE_get_check_issued
X509_STORE_get_check_policy
X509_STORE_get_check_revocation
X509_STORE_get_cleanup
X509_STORE_get_ex_data
X509_STORE_get_get_crl
X509_STORE_get_get_issuer
X509_STORE_get_lookup_certs
X509_STORE_get_lookup_crls
X509_STORE_get_verify
X509_STORE_get_verify_cb
X509_STORE_load_locations
X509_STORE_lock
X509_STORE_new
X509_STORE_set1_param
X509_STORE_set_cert_crl
X509_STORE_set_check_crl
X509_STORE_set_check_issued
X509_STORE_set_check_policy
X509_STORE_set_check_revocation
X509_STORE_set_cleanup
X509_STORE_set_default_paths
X509_STORE_set_depth
X509_STORE_set_ex_data
X509_STORE_set_flags
X509_STORE_set_get_crl
X509_STORE_set_get_issuer
X509_STORE_set_lookup_certs
X509_STORE_set_lookup_crls
X509_STORE_set_purpose
X509_STORE_set_trust
X509_STORE_set_verify
X509_STORE_set_verify_cb
X509_STORE_unlock
X509_STORE_up_ref
X509_TRUST_add
X509_TRUST_cleanup
X509_TRUST_get0
X509_TRUST_get0_name
X509_TRUST_get_by_id
X509_TRUST_get_count
X509_TRUST_get_flags
X509_TRUST_get_trust
X509_TRUST_set
X509_TRUST_set_default
X509_VAL_free
X509_VAL_it
X509_VAL_new
X509_VERIFY_PARAM_add0_policy
X509_VERIFY_PARAM_add0_table
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_clear_flags
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_get0
X509_VERIFY_PARAM_get0_name
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_auth_level
X509_VERIFY_PARAM_get_count
X509_VERIFY_PARAM_get_depth
X509_VERIFY_PARAM_get_flags
X509_VERIFY_PARAM_get_hostflags
X509_VERIFY_PARAM_get_inh_flags
X509_VERIFY_PARAM_get_time
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_lookup
X509_VERIFY_PARAM_move_peername
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set1_email
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_set1_ip
X509_VERIFY_PARAM_set1_ip_asc
X509_VERIFY_PARAM_set1_name
X509_VERIFY_PARAM_set1_policies
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set_flags
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_set_inh_flags
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_time
X509_VERIFY_PARAM_set_trust
X509_VERIFY_PARAM_table_cleanup
X509_add1_ext_i2d
X509_add1_reject_object
X509_add1_trust_object
X509_add_ext
X509_alias_get0
X509_alias_set1
X509_aux_print
X509_certificate_type
X509_chain_check_suiteb
X509_chain_up_ref
X509_check_akid
X509_check_ca
X509_check_email
X509_check_host
X509_check_ip
X509_check_ip_asc
X509_check_issued
X509_check_private_key
X509_check_purpose
X509_check_trust
X509_cmp
X509_cmp_current_time
X509_cmp_time
X509_delete_ext
X509_digest
X509_dup
X509_email_free
X509_find_by_issuer_and_serial
X509_find_by_subject
X509_free
X509_get0_authority_issuer
X509_get0_authority_key_id
X509_get0_authority_serial
X509_get0_extensions
X509_get0_notAfter
X509_get0_notBefore
X509_get0_pubkey
X509_get0_pubkey_bitstr
X509_get0_reject_objects
X509_get0_serialNumber
X509_get0_signature
X509_get0_subject_key_id
X509_get0_tbs_sigalg
X509_get0_trust_objects
X509_get0_uids
X509_get1_email
X509_get1_ocsp
X509_get_X509_PUBKEY
X509_get_default_cert_area
X509_get_default_cert_dir
X509_get_default_cert_dir_env
X509_get_default_cert_file
X509_get_default_cert_file_env
X509_get_default_private_dir
X509_get_ex_data
X509_get_ext
X509_get_ext_by_NID
X509_get_ext_by_OBJ
X509_get_ext_by_critical
X509_get_ext_count
X509_get_ext_d2i
X509_get_extended_key_usage
X509_get_extension_flags
X509_get_issuer_name
X509_get_key_usage
X509_get_pathlen
X509_get_proxy_pathlen
X509_get_pubkey
X509_get_pubkey_parameters
X509_get_serialNumber
X509_get_signature_info
X509_get_signature_nid
X509_get_signature_type
X509_get_subject_name
X509_get_version
X509_getm_notAfter
X509_getm_notBefore
X509_gmtime_adj
X509_http_nbio
X509_issuer_and_serial_cmp
X509_issuer_and_serial_hash
X509_issuer_name_cmp
X509_issuer_name_hash
X509_issuer_name_hash_old
X509_it
X509_keyid_get0
X509_keyid_set1
X509_load_cert_crl_file
X509_load_cert_file
X509_load_crl_file
X509_new
X509_ocspid_print
X509_policy_check
X509_policy_level_get0_node
X509_policy_level_node_count
X509_policy_node_get0_parent
X509_policy_node_get0_policy
X509_policy_node_get0_qualifiers
X509_policy_tree_free
X509_policy_tree_get0_level
X509_policy_tree_get0_policies
X509_policy_tree_get0_user_policies
X509_policy_tree_level_count
X509_print
X509_print_ex
X509_print_ex_fp
X509_print_fp
X509_pubkey_digest
X509_reject_clear
X509_set1_notAfter
X509_set1_notBefore
X509_set_ex_data
X509_set_issuer_name
X509_set_proxy_flag
X509_set_proxy_pathlen
X509_set_pubkey
X509_set_serialNumber
X509_set_subject_name
X509_set_version
X509_sign
X509_sign_ctx
X509_signature_dump
X509_signature_print
X509_subject_name_cmp
X509_subject_name_hash
X509_subject_name_hash_old
X509_supported_extension
X509_time_adj
X509_time_adj_ex
X509_to_X509_REQ
X509_trust_clear
X509_trusted
X509_up_ref
X509_verify
X509_verify_cert
X509_verify_cert_error_string
X509at_add1_attr
X509at_add1_attr_by_NID
X509at_add1_attr_by_OBJ
X509at_add1_attr_by_txt
X509at_delete_attr
X509at_get0_data_by_OBJ
X509at_get_attr
X509at_get_attr_by_NID
X509at_get_attr_by_OBJ
X509at_get_attr_count
X509v3_add_ext
X509v3_addr_add_inherit
X509v3_addr_add_prefix
X509v3_addr_add_range
X509v3_addr_canonize
X509v3_addr_get_afi
X509v3_addr_get_range
X509v3_addr_inherits
X509v3_addr_is_canonical
X509v3_addr_subset
X509v3_addr_validate_path
X509v3_addr_validate_resource_set
X509v3_asid_add_id_or_range
X509v3_asid_add_inherit
X509v3_asid_canonize
X509v3_asid_inherits
X509v3_asid_is_canonical
X509v3_asid_subset
X509v3_asid_validate_path
X509v3_asid_validate_resource_set
X509v3_delete_ext
X509v3_get_ext
X509v3_get_ext_by_NID
X509v3_get_ext_by_OBJ
X509v3_get_ext_by_critical
X509v3_get_ext_count
ZINT32_it
ZINT64_it
ZLONG_it
ZUINT32_it
ZUINT64_it
_shadow_DES_check_key
a2d_ASN1_OBJECT
a2i_ASN1_ENUMERATED
a2i_ASN1_INTEGER
a2i_ASN1_STRING
a2i_GENERAL_NAME
a2i_IPADDRESS
a2i_IPADDRESS_NC
b2i_PVK_bio
b2i_PrivateKey
b2i_PrivateKey_bio
b2i_PublicKey
b2i_PublicKey_bio
conf_ssl_get
conf_ssl_get_cmd
conf_ssl_name_find
d2i_ACCESS_DESCRIPTION
d2i_ADMISSIONS
d2i_ADMISSION_SYNTAX
d2i_ASIdOrRange
d2i_ASIdentifierChoice
d2i_ASIdentifiers
d2i_ASN1_BIT_STRING
d2i_ASN1_BMPSTRING
d2i_ASN1_ENUMERATED
d2i_ASN1_GENERALIZEDTIME
d2i_ASN1_GENERALSTRING
d2i_ASN1_IA5STRING
d2i_ASN1_INTEGER
d2i_ASN1_NULL
d2i_ASN1_OBJECT
d2i_ASN1_OCTET_STRING
d2i_ASN1_PRINTABLE
d2i_ASN1_PRINTABLESTRING
d2i_ASN1_SEQUENCE_ANY
d2i_ASN1_SET_ANY
d2i_ASN1_T61STRING
d2i_ASN1_TIME
d2i_ASN1_TYPE
d2i_ASN1_UINTEGER
d2i_ASN1_UNIVERSALSTRING
d2i_ASN1_UTCTIME
d2i_ASN1_UTF8STRING
d2i_ASN1_VISIBLESTRING
d2i_ASRange
d2i_AUTHORITY_INFO_ACCESS
d2i_AUTHORITY_KEYID
d2i_AutoPrivateKey
d2i_BASIC_CONSTRAINTS
d2i_CERTIFICATEPOLICIES
d2i_CMS_ContentInfo
d2i_CMS_ReceiptRequest
d2i_CMS_bio
d2i_CRL_DIST_POINTS
d2i_DHparams
d2i_DHxparams
d2i_DIRECTORYSTRING
d2i_DISPLAYTEXT
d2i_DIST_POINT
d2i_DIST_POINT_NAME
d2i_DSAPrivateKey
d2i_DSAPrivateKey_bio
d2i_DSAPrivateKey_fp
d2i_DSAPublicKey
d2i_DSA_PUBKEY
d2i_DSA_PUBKEY_bio
d2i_DSA_PUBKEY_fp
d2i_DSA_SIG
d2i_DSAparams
d2i_ECDSA_SIG
d2i_ECPKParameters
d2i_ECParameters
d2i_ECPrivateKey
d2i_ECPrivateKey_bio
d2i_ECPrivateKey_fp
d2i_EC_PUBKEY
d2i_EC_PUBKEY_bio
d2i_EC_PUBKEY_fp
d2i_EDIPARTYNAME
d2i_ESS_CERT_ID
d2i_ESS_CERT_ID_V2
d2i_ESS_ISSUER_SERIAL
d2i_ESS_SIGNING_CERT
d2i_ESS_SIGNING_CERT_V2
d2i_EXTENDED_KEY_USAGE
d2i_GENERAL_NAME
d2i_GENERAL_NAMES
d2i_IPAddressChoice
d2i_IPAddressFamily
d2i_IPAddressOrRange
d2i_IPAddressRange
d2i_ISSUING_DIST_POINT
d2i_NAMING_AUTHORITY
d2i_NETSCAPE_CERT_SEQUENCE
d2i_NETSCAPE_SPKAC
d2i_NETSCAPE_SPKI
d2i_NOTICEREF
d2i_OCSP_BASICRESP
d2i_OCSP_CERTID
d2i_OCSP_CERTSTATUS
d2i_OCSP_CRLID
d2i_OCSP_ONEREQ
d2i_OCSP_REQINFO
d2i_OCSP_REQUEST
d2i_OCSP_RESPBYTES
d2i_OCSP_RESPDATA
d2i_OCSP_RESPID
d2i_OCSP_RESPONSE
d2i_OCSP_REVOKEDINFO
d2i_OCSP_SERVICELOC
d2i_OCSP_SIGNATURE
d2i_OCSP_SINGLERESP
d2i_OTHERNAME
d2i_PBE2PARAM
d2i_PBEPARAM
d2i_PBKDF2PARAM
d2i_PKCS12
d2i_PKCS12_BAGS
d2i_PKCS12_MAC_DATA
d2i_PKCS12_SAFEBAG
d2i_PKCS12_bio
d2i_PKCS12_fp
d2i_PKCS7
d2i_PKCS7_DIGEST
d2i_PKCS7_ENCRYPT
d2i_PKCS7_ENC_CONTENT
d2i_PKCS7_ENVELOPE
d2i_PKCS7_ISSUER_AND_SERIAL
d2i_PKCS7_RECIP_INFO
d2i_PKCS7_SIGNED
d2i_PKCS7_SIGNER_INFO
d2i_PKCS7_SIGN_ENVELOPE
d2i_PKCS7_bio
d2i_PKCS7_fp
d2i_PKCS8PrivateKey_bio
d2i_PKCS8PrivateKey_fp
d2i_PKCS8_PRIV_KEY_INFO
d2i_PKCS8_PRIV_KEY_INFO_bio
d2i_PKCS8_PRIV_KEY_INFO_fp
d2i_PKCS8_bio
d2i_PKCS8_fp
d2i_PKEY_USAGE_PERIOD
d2i_POLICYINFO
d2i_POLICYQUALINFO
d2i_PROFESSION_INFO
d2i_PROXY_CERT_INFO_EXTENSION
d2i_PROXY_POLICY
d2i_PUBKEY
d2i_PUBKEY_bio
d2i_PUBKEY_fp
d2i_PrivateKey
d2i_PrivateKey_bio
d2i_PrivateKey_fp
d2i_PublicKey
d2i_RSAPrivateKey
d2i_RSAPrivateKey_bio
d2i_RSAPrivateKey_fp
d2i_RSAPublicKey
d2i_RSAPublicKey_bio
d2i_RSAPublicKey_fp
d2i_RSA_OAEP_PARAMS
d2i_RSA_PSS_PARAMS
d2i_RSA_PUBKEY
d2i_RSA_PUBKEY_bio
d2i_RSA_PUBKEY_fp
d2i_SCRYPT_PARAMS
d2i_SCT_LIST
d2i_SXNET
d2i_SXNETID
d2i_TS_ACCURACY
d2i_TS_MSG_IMPRINT
d2i_TS_MSG_IMPRINT_bio
d2i_TS_MSG_IMPRINT_fp
d2i_TS_REQ
d2i_TS_REQ_bio
d2i_TS_REQ_fp
d2i_TS_RESP
d2i_TS_RESP_bio
d2i_TS_RESP_fp
d2i_TS_STATUS_INFO
d2i_TS_TST_INFO
d2i_TS_TST_INFO_bio
d2i_TS_TST_INFO_fp
d2i_USERNOTICE
d2i_X509
d2i_X509_ALGOR
d2i_X509_ALGORS
d2i_X509_ATTRIBUTE
d2i_X509_AUX
d2i_X509_CERT_AUX
d2i_X509_CINF
d2i_X509_CRL
d2i_X509_CRL_INFO
d2i_X509_CRL_bio
d2i_X509_CRL_fp
d2i_X509_EXTENSION
d2i_X509_EXTENSIONS
d2i_X509_NAME
d2i_X509_NAME_ENTRY
d2i_X509_PUBKEY
d2i_X509_REQ
d2i_X509_REQ_INFO
d2i_X509_REQ_bio
d2i_X509_REQ_fp
d2i_X509_REVOKED
d2i_X509_SIG
d2i_X509_VAL
d2i_X509_bio
d2i_X509_fp
err_free_strings_int
i2a_ACCESS_DESCRIPTION
i2a_ASN1_ENUMERATED
i2a_ASN1_INTEGER
i2a_ASN1_OBJECT
i2a_ASN1_STRING
i2b_PVK_bio
i2b_PrivateKey_bio
i2b_PublicKey_bio
i2d_ACCESS_DESCRIPTION
i2d_ADMISSIONS
i2d_ADMISSION_SYNTAX
i2d_ASIdOrRange
i2d_ASIdentifierChoice
i2d_ASIdentifiers
i2d_ASN1_BIT_STRING
i2d_ASN1_BMPSTRING
i2d_ASN1_ENUMERATED
i2d_ASN1_GENERALIZEDTIME
i2d_ASN1_GENERALSTRING
i2d_ASN1_IA5STRING
i2d_ASN1_INTEGER
i2d_ASN1_NULL
i2d_ASN1_OBJECT
i2d_ASN1_OCTET_STRING
i2d_ASN1_PRINTABLE
i2d_ASN1_PRINTABLESTRING
i2d_ASN1_SEQUENCE_ANY
i2d_ASN1_SET_ANY
i2d_ASN1_T61STRING
i2d_ASN1_TIME
i2d_ASN1_TYPE
i2d_ASN1_UNIVERSALSTRING
i2d_ASN1_UTCTIME
i2d_ASN1_UTF8STRING
i2d_ASN1_VISIBLESTRING
i2d_ASN1_bio_stream
i2d_ASRange
i2d_AUTHORITY_INFO_ACCESS
i2d_AUTHORITY_KEYID
i2d_BASIC_CONSTRAINTS
i2d_CERTIFICATEPOLICIES
i2d_CMS_ContentInfo
i2d_CMS_ReceiptRequest
i2d_CMS_bio
i2d_CMS_bio_stream
i2d_CRL_DIST_POINTS
i2d_DHparams
i2d_DHxparams
i2d_DIRECTORYSTRING
i2d_DISPLAYTEXT
i2d_DIST_POINT
i2d_DIST_POINT_NAME
i2d_DSAPrivateKey
i2d_DSAPrivateKey_bio
i2d_DSAPrivateKey_fp
i2d_DSAPublicKey
i2d_DSA_PUBKEY
i2d_DSA_PUBKEY_bio
i2d_DSA_PUBKEY_fp
i2d_DSA_SIG
i2d_DSAparams
i2d_ECDSA_SIG
i2d_ECPKParameters
i2d_ECParameters
i2d_ECPrivateKey
i2d_ECPrivateKey_bio
i2d_ECPrivateKey_fp
i2d_EC_PUBKEY
i2d_EC_PUBKEY_bio
i2d_EC_PUBKEY_fp
i2d_EDIPARTYNAME
i2d_ESS_CERT_ID
i2d_ESS_CERT_ID_V2
i2d_ESS_ISSUER_SERIAL
i2d_ESS_SIGNING_CERT
i2d_ESS_SIGNING_CERT_V2
i2d_EXTENDED_KEY_USAGE
i2d_GENERAL_NAME
i2d_GENERAL_NAMES
i2d_IPAddressChoice
i2d_IPAddressFamily
i2d_IPAddressOrRange
i2d_IPAddressRange
i2d_ISSUING_DIST_POINT
i2d_NAMING_AUTHORITY
i2d_NETSCAPE_CERT_SEQUENCE
i2d_NETSCAPE_SPKAC
i2d_NETSCAPE_SPKI
i2d_NOTICEREF
i2d_OCSP_BASICRESP
i2d_OCSP_CERTID
i2d_OCSP_CERTSTATUS
i2d_OCSP_CRLID
i2d_OCSP_ONEREQ
i2d_OCSP_REQINFO
i2d_OCSP_REQUEST
i2d_OCSP_RESPBYTES
i2d_OCSP_RESPDATA
i2d_OCSP_RESPID
i2d_OCSP_RESPONSE
i2d_OCSP_REVOKEDINFO
i2d_OCSP_SERVICELOC
i2d_OCSP_SIGNATURE
i2d_OCSP_SINGLERESP
i2d_OTHERNAME
i2d_PBE2PARAM
i2d_PBEPARAM
i2d_PBKDF2PARAM
i2d_PKCS12
i2d_PKCS12_BAGS
i2d_PKCS12_MAC_DATA
i2d_PKCS12_SAFEBAG
i2d_PKCS12_bio
i2d_PKCS12_fp
i2d_PKCS7
i2d_PKCS7_DIGEST
i2d_PKCS7_ENCRYPT
i2d_PKCS7_ENC_CONTENT
i2d_PKCS7_ENVELOPE
i2d_PKCS7_ISSUER_AND_SERIAL
i2d_PKCS7_NDEF
i2d_PKCS7_RECIP_INFO
i2d_PKCS7_SIGNED
i2d_PKCS7_SIGNER_INFO
i2d_PKCS7_SIGN_ENVELOPE
i2d_PKCS7_bio
i2d_PKCS7_bio_stream
i2d_PKCS7_fp
i2d_PKCS8PrivateKeyInfo_bio
i2d_PKCS8PrivateKeyInfo_fp
i2d_PKCS8PrivateKey_bio
i2d_PKCS8PrivateKey_fp
i2d_PKCS8PrivateKey_nid_bio
i2d_PKCS8PrivateKey_nid_fp
i2d_PKCS8_PRIV_KEY_INFO
i2d_PKCS8_PRIV_KEY_INFO_bio
i2d_PKCS8_PRIV_KEY_INFO_fp
i2d_PKCS8_bio
i2d_PKCS8_fp
i2d_PKEY_USAGE_PERIOD
i2d_POLICYINFO
i2d_POLICYQUALINFO
i2d_PROFESSION_INFO
i2d_PROXY_CERT_INFO_EXTENSION
i2d_PROXY_POLICY
i2d_PUBKEY
i2d_PUBKEY_bio
i2d_PUBKEY_fp
i2d_PrivateKey
i2d_PrivateKey_bio
i2d_PrivateKey_fp
i2d_PublicKey
i2d_RSAPrivateKey
i2d_RSAPrivateKey_bio
i2d_RSAPrivateKey_fp
i2d_RSAPublicKey
i2d_RSAPublicKey_bio
i2d_RSAPublicKey_fp
i2d_RSA_OAEP_PARAMS
i2d_RSA_PSS_PARAMS
i2d_RSA_PUBKEY
i2d_RSA_PUBKEY_bio
i2d_RSA_PUBKEY_fp
i2d_SCRYPT_PARAMS
i2d_SCT_LIST
i2d_SXNET
i2d_SXNETID
i2d_TS_ACCURACY
i2d_TS_MSG_IMPRINT
i2d_TS_MSG_IMPRINT_bio
i2d_TS_MSG_IMPRINT_fp
i2d_TS_REQ
i2d_TS_REQ_bio
i2d_TS_REQ_fp
i2d_TS_RESP
i2d_TS_RESP_bio
i2d_TS_RESP_fp
i2d_TS_STATUS_INFO
i2d_TS_TST_INFO
i2d_TS_TST_INFO_bio
i2d_TS_TST_INFO_fp
i2d_USERNOTICE
i2d_X509
i2d_X509_ALGOR
i2d_X509_ALGORS
i2d_X509_ATTRIBUTE
i2d_X509_AUX
i2d_X509_CERT_AUX
i2d_X509_CINF
i2d_X509_CRL
i2d_X509_CRL_INFO
i2d_X509_CRL_bio
i2d_X509_CRL_fp
i2d_X509_EXTENSION
i2d_X509_EXTENSIONS
i2d_X509_NAME
i2d_X509_NAME_ENTRY
i2d_X509_PUBKEY
i2d_X509_REQ
i2d_X509_REQ_INFO
i2d_X509_REQ_bio
i2d_X509_REQ_fp
i2d_X509_REVOKED
i2d_X509_SIG
i2d_X509_VAL
i2d_X509_bio
i2d_X509_fp
i2d_re_X509_CRL_tbs
i2d_re_X509_REQ_tbs
i2d_re_X509_tbs
i2o_ECPublicKey
i2o_SCT
i2o_SCT_LIST
i2s_ASN1_ENUMERATED
i2s_ASN1_ENUMERATED_TABLE
i2s_ASN1_IA5STRING
i2s_ASN1_INTEGER
i2s_ASN1_OCTET_STRING
i2t_ASN1_OBJECT
i2v_ASN1_BIT_STRING
i2v_GENERAL_NAME
i2v_GENERAL_NAMES
o2i_ECPublicKey
o2i_SCT
o2i_SCT_LIST
s2i_ASN1_IA5STRING
s2i_ASN1_INTEGER
s2i_ASN1_OCTET_STRING
v2i_ASN1_BIT_STRING
v2i_GENERAL_NAME
v2i_GENERAL_NAMES
v2i_GENERAL_NAME_ex
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
387KB
Virtual Size
387KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
205KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ovpn/liblzo2-2.dll
- IMPHASH a11e7dc095461a50ba9511e2c1a77e7a
- SHA256 22c1a7a44308ff6aafd80caa6fd53c93df7696c99feadf9ae700f26365c0986f
- MD5 bd9eab80f953d1674d71c315e050292b
- SHA1 7f0d391e1d7b4dd455359ca1381bc5b90a23c84d
- SHA512 baedfe72d58711ce95ad5ab2010f99d1f42825b825eae48c72add6c2cb8c8f756eb8d1f8c13b78d4cd6cc2a3cfeb920f4188ca47dc6f59aa1c66b0d83b0ebf4e
- SSDEEP 3072:xyJHcFYd6nLF3XRAXqXKGfyI4yaIw4QBkUgPQtRfG/:oeF3XWXq6GK14CVgIvO
- MD5 SHA1 SHA512 SSDEEP
Digest
90:97:00:cc:1b:02:de:be:b8:9c:fb:e9:90:43:e4:0b:c3:5b:96:f2:95:8f:ae:96:4e:43:78:ee:5d:8f:4d:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 21, 2021
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2019 - Nov 4, 2022
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
calloc
free
fwrite
malloc
memcmp
memcpy
memmove
memset
strlen
strncmp
abort
vfprintf
@feat.00
__lzo_align_gap
__lzo_init_v2
__lzo_ptr_linear
_lzo1b_1_compress_func
_lzo1b_2_compress_func
_lzo1b_3_compress_func
_lzo1b_4_compress_func
_lzo1b_5_compress_func
_lzo1b_6_compress_func
_lzo1b_7_compress_func
_lzo1b_8_compress_func
_lzo1b_99_compress_func
_lzo1b_9_compress_func
_lzo1b_do_compress
_lzo1b_store_run
_lzo1c_1_compress_func
_lzo1c_2_compress_func
_lzo1c_3_compress_func
_lzo1c_4_compress_func
_lzo1c_5_compress_func
_lzo1c_6_compress_func
_lzo1c_7_compress_func
_lzo1c_8_compress_func
_lzo1c_99_compress_func
_lzo1c_9_compress_func
_lzo1c_do_compress
_lzo1c_store_run
_lzo_config_check
_lzo_version_date
_lzo_version_string
lzo1_99_compress
lzo1_compress
lzo1_decompress
lzo1_info
lzo1a_99_compress
lzo1a_compress
lzo1a_decompress
lzo1a_info
lzo1b_1_compress
lzo1b_2_compress
lzo1b_3_compress
lzo1b_4_compress
lzo1b_5_compress
lzo1b_6_compress
lzo1b_7_compress
lzo1b_8_compress
lzo1b_999_compress
lzo1b_999_compress_callback
lzo1b_99_compress
lzo1b_9_compress
lzo1b_compress
lzo1b_decompress
lzo1b_decompress_safe
lzo1c_1_compress
lzo1c_2_compress
lzo1c_3_compress
lzo1c_4_compress
lzo1c_5_compress
lzo1c_6_compress
lzo1c_7_compress
lzo1c_8_compress
lzo1c_999_compress
lzo1c_999_compress_callback
lzo1c_99_compress
lzo1c_9_compress
lzo1c_compress
lzo1c_decompress
lzo1c_decompress_asm
lzo1c_decompress_asm_safe
lzo1c_decompress_safe
lzo1f_1_compress
lzo1f_999_compress
lzo1f_999_compress_callback
lzo1f_decompress
lzo1f_decompress_asm_fast
lzo1f_decompress_asm_fast_safe
lzo1f_decompress_safe
lzo1x_1_11_compress
lzo1x_1_12_compress
lzo1x_1_15_compress
lzo1x_1_compress
lzo1x_999_compress
lzo1x_999_compress_dict
lzo1x_999_compress_internal
lzo1x_999_compress_level
lzo1x_decompress
lzo1x_decompress_asm
lzo1x_decompress_asm_fast
lzo1x_decompress_asm_fast_safe
lzo1x_decompress_asm_safe
lzo1x_decompress_dict_safe
lzo1x_decompress_safe
lzo1x_optimize
lzo1y_1_compress
lzo1y_999_compress
lzo1y_999_compress_dict
lzo1y_999_compress_internal
lzo1y_999_compress_level
lzo1y_decompress
lzo1y_decompress_asm
lzo1y_decompress_asm_fast
lzo1y_decompress_asm_fast_safe
lzo1y_decompress_asm_safe
lzo1y_decompress_dict_safe
lzo1y_decompress_safe
lzo1y_optimize
lzo1z_999_compress
lzo1z_999_compress_dict
lzo1z_999_compress_internal
lzo1z_999_compress_level
lzo1z_decompress
lzo1z_decompress_dict_safe
lzo1z_decompress_safe
lzo2a_999_compress
lzo2a_999_compress_callback
lzo2a_decompress
lzo2a_decompress_safe
lzo_adler32
lzo_copyright
lzo_crc32
lzo_get_crc32_table
lzo_memcmp
lzo_memcpy
lzo_memmove
lzo_memset
lzo_version
lzo_version_date
lzo_version_string
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ovpn/libpkcs11-helper-1.dll
- IMPHASH a1faeb7748678e2828e3209f0aff2acc
- SHA256 6f0e5fbeec6474e0cc2bd0536aed3ff47fef4588fe28625ce2b3eaacb5f0dead
- MD5 5e12d4d264ba957604e80ebbb436c61b
- SHA1 50ad9a622518989a80355d226b77c5c57aecba64
- SHA512 e4dbb5e094b48bb47a30dc5782b9a5b58dd039c626922cc7884c00f2bc24ae4c457b11e2889ff373cc592c47daf1511ca4ab10a6f26f7f2f745efd9e64a5f002
- SSDEEP 3072:tACv01QslFoJiU4ixhvt5hTQQU7kVTAHluobjrf1Evu5g8V:tPv01rI3t5hTQQU7kVTAHluobjrf1Evu
- MD5 SHA1 SHA512 SSDEEP
Digest
3b:06:63:e0:26:be:05:0f:ab:d2:07:5b:4a:72:41:66:b2:fa:7e:dd:f5:cd:03:f4:e3:38:c3:8d:86:d2:57:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 21, 2021
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2019 - Nov 4, 2022
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
libcrypto-1_1
BN_bin2bn
BN_clear_free
BN_free
CRYPTO_get_ex_new_index
DSA_SIG_free
DSA_SIG_new
DSA_SIG_set0
DSA_free
DSA_get_default_method
DSA_get_ex_data
DSA_meth_dup
DSA_meth_free
DSA_meth_set1_name
DSA_meth_set_sign
DSA_set_ex_data
DSA_set_method
ECDSA_SIG_free
ECDSA_SIG_new
ECDSA_SIG_set0
EC_KEY_METHOD_free
EC_KEY_METHOD_get_sign
EC_KEY_METHOD_new
EC_KEY_METHOD_set_sign
EC_KEY_free
EC_KEY_get_default_method
EC_KEY_get_ex_data
EC_KEY_set_ex_data
EC_KEY_set_method
EVP_PKEY_free
EVP_PKEY_get1_DSA
EVP_PKEY_get1_EC_KEY
EVP_PKEY_get1_RSA
EVP_PKEY_id
RSA_free
RSA_get_default_method
RSA_get_ex_data
RSA_meth_dup
RSA_meth_free
RSA_meth_set1_name
RSA_meth_set_flags
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_set_ex_data
RSA_set_method
RSA_size
X509_NAME_cmp
X509_NAME_oneline
X509_cmp_current_time
X509_dup
X509_free
X509_get0_notAfter
X509_get0_notBefore
X509_get_issuer_name
X509_get_pubkey
X509_get_subject_name
X509_new
X509_verify
d2i_X509
kernel32
CloseHandle
CreateEventA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReleaseMutex
SetEvent
SetUnhandledExceptionFilter
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
__dllonexit
_amsg_exit
_beginthreadex
_exit
_initterm
_iob
_lock
_onexit
_snwprintf
time
mktime
localtime
gmtime
_unlock
calloc
free
fwprintf
fwrite
getenv
isgraph
isxdigit
malloc
memmove
memset
raise
sprintf
sscanf
strchr
strcmp
strlen
strncat
strncmp
strncpy
strrchr
abort
asctime
vfprintf
wcscpy
user32
MessageBoxW
pkcs11h_addProvider
pkcs11h_certificate_create
pkcs11h_certificate_decrypt
pkcs11h_certificate_decryptAny
pkcs11h_certificate_deserializeCertificateId
pkcs11h_certificate_duplicateCertificateId
pkcs11h_certificate_ensureCertificateAccess
pkcs11h_certificate_ensureKeyAccess
pkcs11h_certificate_enumCertificateIds
pkcs11h_certificate_enumTokenCertificateIds
pkcs11h_certificate_freeCertificate
pkcs11h_certificate_freeCertificateId
pkcs11h_certificate_freeCertificateIdList
pkcs11h_certificate_getCertificateBlob
pkcs11h_certificate_getCertificateId
pkcs11h_certificate_getPromptMask
pkcs11h_certificate_getUserData
pkcs11h_certificate_lockSession
pkcs11h_certificate_releaseSession
pkcs11h_certificate_serializeCertificateId
pkcs11h_certificate_setCertificateIdCertificateBlob
pkcs11h_certificate_setPromptMask
pkcs11h_certificate_setUserData
pkcs11h_certificate_sign
pkcs11h_certificate_signAny
pkcs11h_certificate_signRecover
pkcs11h_certificate_unwrap
pkcs11h_data_del
pkcs11h_data_enumDataObjects
pkcs11h_data_freeDataIdList
pkcs11h_data_get
pkcs11h_data_put
pkcs11h_engine_setCrypto
pkcs11h_engine_setSystem
pkcs11h_forkFixup
pkcs11h_getFeatures
pkcs11h_getLogLevel
pkcs11h_getMessage
pkcs11h_getVersion
pkcs11h_initialize
pkcs11h_logout
pkcs11h_openssl_createSession
pkcs11h_openssl_freeSession
pkcs11h_openssl_getCleanupHook
pkcs11h_openssl_getX509
pkcs11h_openssl_session_getEVP
pkcs11h_openssl_session_getRSA
pkcs11h_openssl_session_getX509
pkcs11h_openssl_setCleanupHook
pkcs11h_plugAndPlay
pkcs11h_removeProvider
pkcs11h_setForkMode
pkcs11h_setLogHook
pkcs11h_setLogLevel
pkcs11h_setMaxLoginRetries
pkcs11h_setPINCachePeriod
pkcs11h_setPINPromptHook
pkcs11h_setProtectedAuthentication
pkcs11h_setSlotEventHook
pkcs11h_setTokenPromptHook
pkcs11h_terminate
pkcs11h_token_deserializeTokenId
pkcs11h_token_duplicateTokenId
pkcs11h_token_ensureAccess
pkcs11h_token_enumTokenIds
pkcs11h_token_freeTokenId
pkcs11h_token_freeTokenIdList
pkcs11h_token_login
pkcs11h_token_logout
pkcs11h_token_sameTokenId
pkcs11h_token_serializeTokenId
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ovpn/libssl-1_1.dll
- IMPHASH c380e5cdb447699b978cfcecd75b85b1
- SHA256 89d49df485a5c33f0ebef4a78f6ceb63e60c08113fe21a911cd2c196bf9393fd
- MD5 d6d65e0a4a7706a90e328578251f43ae
- SHA1 5a34a15fd21f345b3f6c1876df3503e0050e7428
- SHA512 2f524f1f9281a643ca3dd657e8136828fbb4c58b259c717bd05ea964379ad814fabd9e47d129ff1866dd92e8d5cadbce38b66c8daf2aba944c57368e7c1d8273
- SSDEEP 24576:jN/UGlfUX71WzUoh53Xbj9Vku1UYaN4vlMAUBYSwF/mbsgEKQG7iiHh7xqwg:x/61Wz3534u1UYaWvlMAUuSwF/mbsgpc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
b3:ee:47:ad:a1:53:e3:9a:2e:d2:12:ca:09:75:90:73:c1:b0:33:60:2a:1e:5c:5e:46:c2:68:43:3e:c7:44:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 21, 2021
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2019 - Nov 4, 2022
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
5120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
libcrypto-1_1
ASN1_ANY_it
ASN1_OCTET_STRING_it
ASN1_TYPE_get
ASN1_item_d2i
ASN1_item_free
ASN1_item_i2d
ASN1_item_new
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_new
ASYNC_get_current_job
ASYNC_start_job
BIO_ADDR_clear
BIO_ADDR_free
BIO_ADDR_new
BIO_callback_ctrl
BIO_clear_flags
BIO_copy_next_retry
BIO_ctrl
BIO_dump_indent
BIO_f_buffer
BIO_find_type
BIO_free
BIO_free_all
BIO_get_data
BIO_get_init
BIO_get_retry_reason
BIO_get_shutdown
BIO_int_ctrl
BIO_method_type
BIO_new
BIO_next
BIO_pop
BIO_printf
BIO_push
BIO_puts
BIO_read
BIO_s_connect
BIO_s_file
BIO_s_mem
BIO_s_socket
BIO_set_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_snprintf
BIO_test_flags
BIO_up_ref
BIO_write
BN_bin2bn
BN_bn2bin
BN_clear_free
BN_copy
BN_dup
BN_free
BN_get_rfc2409_prime_1024
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_8192
BN_is_zero
BN_new
BN_num_bits
BN_set_word
BN_ucmp
BUF_MEM_free
BUF_MEM_grow
BUF_MEM_grow_clean
BUF_MEM_new
BUF_reverse
COMP_CTX_free
COMP_CTX_get_method
COMP_CTX_new
COMP_compress_block
COMP_expand_block
COMP_get_name
COMP_get_type
COMP_zlib
CONF_parse_list
CRYPTO_THREAD_lock_free
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_run_once
CRYPTO_THREAD_unlock
CRYPTO_THREAD_write_lock
CRYPTO_clear_free
CRYPTO_dup_ex_data
CRYPTO_free
CRYPTO_free_ex_data
CRYPTO_get_ex_data
CRYPTO_get_ex_new_index
CRYPTO_malloc
CRYPTO_mem_ctrl
CRYPTO_memcmp
CRYPTO_memdup
CRYPTO_new_ex_data
CRYPTO_realloc
CRYPTO_secure_free
CRYPTO_secure_zalloc
CRYPTO_set_ex_data
CRYPTO_strdup
CRYPTO_strndup
CRYPTO_zalloc
CTLOG_STORE_free
CTLOG_STORE_load_default_file
CTLOG_STORE_load_file
CTLOG_STORE_new
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
DH_check_params
DH_free
DH_get0_key
DH_get0_pqg
DH_new
DH_set0_key
DH_set0_pqg
EC_GROUP_get_curve_name
EC_GROUP_method_of
EC_KEY_can_sign
EC_KEY_free
EC_KEY_get0_group
EC_KEY_get_conv_form
EC_KEY_new_by_curve_name
EC_METHOD_get_field_type
EC_curve_nist2nid
ENGINE_finish
ENGINE_get_ssl_client_cert_function
ENGINE_init
ENGINE_load_ssl_client_cert
ERR_add_error_data
ERR_clear_error
ERR_func_error_string
ERR_load_strings_const
ERR_peek_error
ERR_peek_last_error
ERR_pop_to_mark
ERR_put_error
ERR_set_mark
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_cipher
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_CIPHER_block_size
EVP_CIPHER_flags
EVP_CIPHER_iv_length
EVP_CIPHER_key_length
EVP_Cipher
EVP_CipherFinal_ex
EVP_CipherInit_ex
EVP_CipherUpdate
EVP_DecryptFinal
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_Digest
EVP_DigestFinal
EVP_DigestFinal_ex
EVP_DigestInit
EVP_DigestInit_ex
EVP_DigestSign
EVP_DigestSignFinal
EVP_DigestSignInit
EVP_DigestUpdate
EVP_DigestVerify
EVP_DigestVerifyFinal
EVP_DigestVerifyInit
EVP_EncryptFinal
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_MD_CTX_copy
EVP_MD_CTX_copy_ex
EVP_MD_CTX_ctrl
EVP_MD_CTX_free
EVP_MD_CTX_md
EVP_MD_CTX_new
EVP_MD_CTX_set_flags
EVP_MD_size
EVP_MD_type
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_free
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0_info
EVP_PKEY_assign
EVP_PKEY_cmp
EVP_PKEY_copy_parameters
EVP_PKEY_decrypt
EVP_PKEY_decrypt_init
EVP_PKEY_derive
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_encrypt
EVP_PKEY_encrypt_init
EVP_PKEY_free
EVP_PKEY_get0
EVP_PKEY_get0_DH
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
EVP_PKEY_get1_tls_encodedpoint
EVP_PKEY_get_default_digest_nid
EVP_PKEY_id
EVP_PKEY_keygen
EVP_PKEY_keygen_init
EVP_PKEY_missing_parameters
EVP_PKEY_new
EVP_PKEY_new_mac_key
EVP_PKEY_new_raw_private_key
EVP_PKEY_paramgen
EVP_PKEY_paramgen_init
EVP_PKEY_security_bits
EVP_PKEY_set1_DH
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_set_type
EVP_PKEY_size
EVP_PKEY_up_ref
EVP_add_cipher
EVP_add_digest
EVP_aes_128_cbc
EVP_aes_128_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_128_ccm
EVP_aes_128_gcm
EVP_aes_192_cbc
EVP_aes_256_cbc
EVP_aes_256_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha256
EVP_aes_256_ccm
EVP_aes_256_gcm
EVP_aria_128_gcm
EVP_aria_256_gcm
EVP_camellia_128_cbc
EVP_camellia_256_cbc
EVP_chacha20_poly1305
EVP_des_cbc
EVP_des_ede3_cbc
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_idea_cbc
EVP_md5
EVP_md5_sha1
EVP_rc2_40_cbc
EVP_rc2_cbc
EVP_rc4
EVP_rc4_hmac_md5
EVP_seed_cbc
EVP_sha1
EVP_sha224
EVP_sha256
EVP_sha384
EVP_sha512
HMAC_CTX_free
HMAC_CTX_new
HMAC_Final
HMAC_Init_ex
HMAC_Update
HMAC_size
INT32_it
MD5_Init
MD5_Transform
OBJ_NAME_add
OBJ_bsearch_
OBJ_ln2nid
OBJ_nid2sn
OBJ_sn2nid
OCSP_BASICRESP_free
OCSP_RESPID_free
OCSP_RESPONSE_free
OCSP_SINGLERESP_get1_ext_d2i
OCSP_resp_count
OCSP_resp_get0
OCSP_response_get1_basic
OPENSSL_DIR_end
OPENSSL_DIR_read
OPENSSL_LH_delete
OPENSSL_LH_doall_arg
OPENSSL_LH_free
OPENSSL_LH_get_down_load
OPENSSL_LH_insert
OPENSSL_LH_new
OPENSSL_LH_num_items
OPENSSL_LH_retrieve
OPENSSL_LH_set_down_load
OPENSSL_atexit
OPENSSL_cleanse
OPENSSL_init_crypto
OPENSSL_sk_delete
OPENSSL_sk_dup
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_insert
OPENSSL_sk_new
OPENSSL_sk_new_null
OPENSSL_sk_new_reserve
OPENSSL_sk_num
OPENSSL_sk_pop
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_set_cmp_func
OPENSSL_sk_shift
OPENSSL_sk_sort
OPENSSL_sk_value
PEM_ASN1_read
PEM_ASN1_read_bio
PEM_ASN1_write
PEM_ASN1_write_bio
PEM_read_bio
PEM_read_bio_DHparams
PEM_read_bio_PrivateKey
PEM_read_bio_RSAPrivateKey
PEM_read_bio_X509
PEM_read_bio_X509_AUX
RAND_bytes
RAND_priv_bytes
RSA_free
RSA_pkey_ctx_ctrl
RSA_private_decrypt
RSA_size
RSA_up_ref
SCT_LIST_free
SCT_LIST_validate
SCT_get_validation_status
SCT_set_source
SHA1_Init
SHA1_Transform
SHA224_Init
SHA256_Init
SHA256_Transform
SHA384_Init
SHA512_Init
SHA512_Transform
SRP_Calc_A
SRP_Calc_B
SRP_Calc_client_key
SRP_Calc_server_key
SRP_Calc_u
SRP_Calc_x
SRP_Verify_A_mod_N
SRP_Verify_B_mod_N
SRP_check_known_gN_param
SRP_create_verifier_BN
SRP_get_default_gN
UINT32_it
X509_EXTENSION_free
X509_LOOKUP_ctrl
X509_LOOKUP_file
X509_LOOKUP_hash_dir
X509_NAME_cmp
X509_NAME_dup
X509_NAME_free
X509_NAME_hash
X509_STORE_CTX_free
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get0_param
X509_STORE_CTX_get1_chain
X509_STORE_CTX_get_error
X509_STORE_CTX_init
X509_STORE_CTX_new
X509_STORE_CTX_set0_dane
X509_STORE_CTX_set_default
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_set_flags
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_add_lookup
X509_STORE_free
X509_STORE_load_locations
X509_STORE_new
X509_STORE_set_default_paths
X509_STORE_up_ref
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_depth
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_move_peername
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_trust
X509_chain_check_suiteb
X509_chain_up_ref
X509_check_private_key
X509_cmp
X509_free
X509_get0_pubkey
X509_get_ext_d2i
X509_get_extension_flags
X509_get_issuer_name
X509_get_key_usage
X509_get_pubkey
X509_get_signature_info
X509_get_signature_nid
X509_get_subject_name
X509_it
X509_up_ref
X509_verify_cert
X509_verify_cert_error_string
ZINT32_it
ZINT64_it
ZUINT32_it
ZUINT64_it
conf_ssl_get
conf_ssl_get_cmd
conf_ssl_name_find
d2i_OCSP_RESPID
d2i_OCSP_RESPONSE
d2i_PUBKEY
d2i_PrivateKey
d2i_PrivateKey_bio
d2i_RSAPrivateKey
d2i_RSAPrivateKey_bio
d2i_X509
d2i_X509_EXTENSIONS
d2i_X509_NAME
d2i_X509_bio
err_free_strings_int
i2d_OCSP_RESPID
i2d_X509
i2d_X509_EXTENSIONS
i2d_X509_NAME
o2i_SCT_LIST
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_errno
_initterm
_iob
_lock
_onexit
time
_stricmp
_strnicmp
_unlock
calloc
free
fwrite
malloc
memchr
memcmp
memcpy
memmove
memset
qsort
sprintf
strchr
strcmp
strcpy
strlen
strncmp
abort
vfprintf
atoi
BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_get_data_mtu
DTLS_method
DTLS_server_method
DTLS_set_timer_cb
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_listen
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
OPENSSL_cipher_name
OPENSSL_init_ssl
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_auth_nid
SSL_CIPHER_get_bits
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_digest_nid
SSL_CIPHER_get_handshake_digest
SSL_CIPHER_get_id
SSL_CIPHER_get_kx_nid
SSL_CIPHER_get_name
SSL_CIPHER_get_protocol_id
SSL_CIPHER_get_version
SSL_CIPHER_is_aead
SSL_CIPHER_standard_name
SSL_COMP_add_compression_method
SSL_COMP_get0_name
SSL_COMP_get_compression_methods
SSL_COMP_get_id
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add1_to_CA_list
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_clear_options
SSL_CTX_config
SSL_CTX_ct_is_enabled
SSL_CTX_ctrl
SSL_CTX_dane_clear_flags
SSL_CTX_dane_enable
SSL_CTX_dane_mtype_set
SSL_CTX_dane_set_flags
SSL_CTX_enable_ct
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_CA_list
SSL_CTX_get0_certificate
SSL_CTX_get0_ctlog_store
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get0_security_ex_data
SSL_CTX_get_cert_store
SSL_CTX_get_ciphers
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_get_info_callback
SSL_CTX_get_keylog_callback
SSL_CTX_get_max_early_data
SSL_CTX_get_num_tickets
SSL_CTX_get_options
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_record_padding_callback_arg
SSL_CTX_get_recv_max_early_data
SSL_CTX_get_security_callback
SSL_CTX_get_security_level
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_has_client_custom_ext
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set0_CA_list
SSL_CTX_set0_ctlog_store
SSL_CTX_set0_security_ex_data
SSL_CTX_set1_cert_store
SSL_CTX_set1_param
SSL_CTX_set_allow_early_data_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_block_padding
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_client_hello_cb
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_ct_validation_callback
SSL_CTX_set_ctlog_list_file
SSL_CTX_set_default_ctlog_list_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_read_buffer_len
SSL_CTX_set_default_verify_dir
SSL_CTX_set_default_verify_file
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_keylog_callback
SSL_CTX_set_max_early_data
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_not_resumable_session_callback
SSL_CTX_set_num_tickets
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_find_session_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_psk_use_session_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_record_padding_callback
SSL_CTX_set_record_padding_callback_arg
SSL_CTX_set_recv_max_early_data
SSL_CTX_set_security_callback
SSL_CTX_set_security_level
SSL_CTX_set_session_id_context
SSL_CTX_set_session_ticket_cb
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_stateless_cookie_generate_cb
SSL_CTX_set_stateless_cookie_verify_cb
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_max_fragment_length
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_up_ref
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_cert_and_key
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_ex
SSL_CTX_use_serverinfo_file
SSL_SESSION_dup
SSL_SESSION_free
SSL_SESSION_get0_alpn_selected
SSL_SESSION_get0_cipher
SSL_SESSION_get0_hostname
SSL_SESSION_get0_id_context
SSL_SESSION_get0_peer
SSL_SESSION_get0_ticket
SSL_SESSION_get0_ticket_appdata
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_id
SSL_SESSION_get_master_key
SSL_SESSION_get_max_early_data
SSL_SESSION_get_max_fragment_length
SSL_SESSION_get_protocol_version
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_is_resumable
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_print_keylog
SSL_SESSION_set1_alpn_selected
SSL_SESSION_set1_hostname
SSL_SESSION_set1_id
SSL_SESSION_set1_id_context
SSL_SESSION_set1_master_key
SSL_SESSION_set1_ticket_appdata
SSL_SESSION_set_cipher
SSL_SESSION_set_ex_data
SSL_SESSION_set_max_early_data
SSL_SESSION_set_protocol_version
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SESSION_up_ref
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add1_host
SSL_add1_to_CA_list
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_add_ssl_module
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_alloc_buffers
SSL_bytes_to_cipher_list
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_clear_options
SSL_client_hello_get0_ciphers
SSL_client_hello_get0_compression_methods
SSL_client_hello_get0_ext
SSL_client_hello_get0_legacy_version
SSL_client_hello_get0_random
SSL_client_hello_get0_session_id
SSL_client_hello_get1_extensions_present
SSL_client_hello_isv2
SSL_client_version
SSL_config
SSL_connect
SSL_copy_session_id
SSL_ct_is_enabled
SSL_ctrl
SSL_dane_clear_flags
SSL_dane_enable
SSL_dane_set_flags
SSL_dane_tlsa_add
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_enable_ct
SSL_export_keying_material
SSL_export_keying_material_early
SSL_extension_supported
SSL_free
SSL_free_buffers
SSL_get0_CA_list
SSL_get0_alpn_selected
SSL_get0_dane
SSL_get0_dane_authority
SSL_get0_dane_tlsa
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get0_peer_CA_list
SSL_get0_peer_scts
SSL_get0_peername
SSL_get0_security_ex_data
SSL_get0_verified_chain
SSL_get1_session
SSL_get1_supported_ciphers
SSL_get_SSL_CTX
SSL_get_all_async_fds
SSL_get_certificate
SSL_get_changed_async_fds
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_client_ciphers
SSL_get_client_random
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_passwd_cb
SSL_get_default_passwd_cb_userdata
SSL_get_default_timeout
SSL_get_early_data_status
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_key_update_type
SSL_get_max_early_data
SSL_get_num_tickets
SSL_get_options
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_peer_signature_type_nid
SSL_get_pending_cipher
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_record_padding_callback_arg
SSL_get_recv_max_early_data
SSL_get_rfd
SSL_get_security_callback
SSL_get_security_level
SSL_get_selected_srtp_profile
SSL_get_server_random
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_signature_type_nid
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_state
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_has_pending
SSL_in_before
SSL_in_init
SSL_is_dtls
SSL_is_init_finished
SSL_is_server
SSL_key_update
SSL_load_client_CA_file
SSL_new
SSL_peek
SSL_peek_ex
SSL_pending
SSL_read
SSL_read_early_data
SSL_read_ex
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_session_reused
SSL_set0_CA_list
SSL_set0_rbio
SSL_set0_security_ex_data
SSL_set0_wbio
SSL_set1_host
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_allow_early_data_cb
SSL_set_alpn_protos
SSL_set_bio
SSL_set_block_padding
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_ciphersuites
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_ct_validation_callback
SSL_set_debug
SSL_set_default_passwd_cb
SSL_set_default_passwd_cb_userdata
SSL_set_default_read_buffer_len
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_hostflags
SSL_set_info_callback
SSL_set_max_early_data
SSL_set_msg_callback
SSL_set_not_resumable_session_callback
SSL_set_num_tickets
SSL_set_options
SSL_set_post_handshake_auth
SSL_set_psk_client_callback
SSL_set_psk_find_session_callback
SSL_set_psk_server_callback
SSL_set_psk_use_session_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_record_padding_callback
SSL_set_record_padding_callback_arg
SSL_set_recv_max_early_data
SSL_set_rfd
SSL_set_security_callback
SSL_set_security_level
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_tlsext_max_fragment_length
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state_string
SSL_state_string_long
SSL_stateless
SSL_up_ref
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_cert_and_key
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_chain_file
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_verify_client_post_handshake
SSL_version
SSL_waiting_for_async
SSL_want
SSL_write
SSL_write_early_data
SSL_write_ex
TLS_client_method
TLS_method
TLS_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION
Name
.text
Size
385KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ovpn/openssl-license .txt
- SHA256 b9f6a4d26b1c7118c3b0ac41f0777a2b82de0ea25f48a9ca6a0e5550dba2382a
- MD5 4c359b890e7eeb474a96075f6df68597
- SHA1 eb7d89454cd1f62d8ad37d61fe52117be5b38a12
- SHA512 d3578180c52d0daebd7b1792a261140bb49a11ff592efcb0c9d520a06ff6dc11ec3b1fcede1c95594deeffbd46d8703d1c5aabcd1677ab685774dadebb1af9bf
- SSDEEP 192:uf9fG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhR:Q1u9b01DY/rGBt+dc+acR
- MD5 SHA1 SHA512 SSDEEP
ovpn/openvpn-license.txt
- SHA256 a45afcd949cb0e29a3ca81801c7b72666e585ac039a0e1eac63546bcb7273d4c
- MD5 a5aa9694cc581daf09c7f75d1bc64c30
- SHA1 484b11367024a690fbd459fb4f45fd044f42d63a
- SHA512 5dd967d247732aa4d718e25347224ea93a15c597c47507deeea30be84c87283e984daf39798492167a422acdc5af174eebd7f7220162f0907ad89d3730c7b306
- SSDEEP 384:H4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPoqHZ:H46uh1iYWrTXoPoqHZ
- MD5 SHA1 SHA512 SSDEEP
ovpn/openvpn.exe
- IMPHASH 20cbd3fa02694a58ad084032cf6a8ecf
- SHA256 1c704ce36e37384692d4e9d111be69665fb2bfd3edc614ed6117ed6b934b736e
- MD5 d62e7bd8fcfc550f4c664eb7f6933186
- SHA1 0c1434e0afc5abb50e4fc266a83b7d412a23c280
- SHA512 36f8d5c714108140134d0e1d6852e2ef78da186d75fe6d6134ae7cbe43b79e451762f9e070004b13c0ccbb60e2c5ac12d34664381b7ed2187be57228861c815c
- SSDEEP 24576:AHLo6iymW1bTJJf+mae38OB8s1k0yu3z3di6YT5WPYsrUFuyeAToym:YojeP+8828YYqp68
- MD5 SHA1 SHA512 SSDEEP
Digest
5e:54:0c:2c:78:cc:ec:e0:3e:1e:3c:91:db:a2:29:0f:f8:e0:b4:a5:33:e3:e4:eb:46:01:a2:cf:6f:c2:77:cc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Chains
Apr 21, 2021
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
Serial Number
0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 31, 2019 - Nov 4, 2022
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
libcrypto-1_1
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_INTEGER_to_BN
ASN1_OBJECT_free
ASN1_STRING_to_UTF8
BIO_ctrl
BIO_f_base64
BIO_free
BIO_free_all
BIO_new
BIO_new_file
BIO_new_mem_buf
BIO_push
BIO_read
BIO_s_mem
BIO_test_flags
BIO_write
BN_bin2bn
BN_bn2dec
BN_dup
BN_free
CRYPTO_free
CRYPTO_get_ex_new_index
CRYPTO_memcmp
DES_check_key_parity
DES_ecb_encrypt
DES_is_weak_key
DES_set_key_unchecked
DES_set_odd_parity
DH_free
DH_size
ECDSA_SIG_free
ECDSA_SIG_new
ECDSA_SIG_set0
ECDSA_size
EC_GROUP_get_curve_name
EC_KEY_METHOD_free
EC_KEY_METHOD_new
EC_KEY_METHOD_set_init
EC_KEY_METHOD_set_sign
EC_KEY_OpenSSL
EC_KEY_dup
EC_KEY_free
EC_KEY_get0_group
EC_KEY_get_ex_data
EC_KEY_get_method
EC_KEY_new_by_curve_name
EC_KEY_set_ex_data
EC_KEY_set_method
EC_get_builtin_curves
ENGINE_by_id
ENGINE_ctrl_cmd_string
ENGINE_finish
ENGINE_free
ENGINE_get_first
ENGINE_get_id
ENGINE_get_name
ENGINE_get_next
ENGINE_init
ENGINE_load_builtin_engines
ENGINE_load_private_key
ENGINE_register_all_complete
ENGINE_set_default
ERR_clear_error
ERR_error_string
ERR_get_error
ERR_load_strings
ERR_peek_error
ERR_put_error
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_cipher
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_key_length
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_CIPHER_CTX_set_key_length
EVP_CIPHER_block_size
EVP_CIPHER_flags
EVP_CIPHER_iv_length
EVP_CIPHER_key_length
EVP_CIPHER_nid
EVP_CipherFinal
EVP_CipherInit
EVP_CipherInit_ex
EVP_CipherUpdate
EVP_Digest
EVP_DigestFinal
EVP_DigestInit
EVP_DigestUpdate
EVP_MD_CTX_free
EVP_MD_CTX_md
EVP_MD_CTX_new
EVP_MD_CTX_reset
EVP_MD_size
EVP_MD_type
EVP_PKEY_CTX_ctrl
EVP_PKEY_CTX_get0_pkey
EVP_PKEY_assign
EVP_PKEY_bits
EVP_PKEY_free
EVP_PKEY_get0_EC_KEY
EVP_PKEY_get0_RSA
EVP_PKEY_id
EVP_PKEY_meth_add0
EVP_PKEY_meth_copy
EVP_PKEY_meth_find
EVP_PKEY_meth_get_sign
EVP_PKEY_meth_new
EVP_PKEY_meth_set_sign
EVP_PKEY_new
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_sha1
EVP_sha256
HMAC_CTX_free
HMAC_CTX_new
HMAC_CTX_reset
HMAC_Final
HMAC_Init_ex
HMAC_Update
HMAC_size
OBJ_nid2sn
OBJ_obj2nid
OBJ_obj2txt
OBJ_sn2nid
OBJ_txt2nid
OBJ_txt2obj
OPENSSL_init_crypto
OPENSSL_sk_delete
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_new
OPENSSL_sk_num
OPENSSL_sk_pop_free
OPENSSL_sk_push
OPENSSL_sk_value
OpenSSL_version
PEM_X509_INFO_read_bio
PEM_read_bio
PEM_read_bio_DHparams
PEM_read_bio_PrivateKey
PEM_read_bio_X509
PEM_read_bio_X509_CRL
PEM_write_X509
PEM_write_bio
PKCS12_free
PKCS12_parse
RAND_bytes
RSA_bits
RSA_flags
RSA_free
RSA_get0_key
RSA_get_method
RSA_meth_free
RSA_meth_get0_app_data
RSA_meth_new
RSA_meth_set0_app_data
RSA_meth_set_finish
RSA_meth_set_init
RSA_meth_set_priv_dec
RSA_meth_set_priv_enc
RSA_meth_set_pub_dec
RSA_meth_set_pub_enc
RSA_new
RSA_pkey_ctx_ctrl
RSA_set0_key
RSA_set_flags
RSA_set_method
RSA_size
UI_create_method
UI_destroy_method
UI_get0_user_data
UI_get_string_type
UI_method_set_reader
UI_set_result
X509V3_EXT_print
X509_CRL_free
X509_INFO_free
X509_LOOKUP_ctrl
X509_LOOKUP_hash_dir
X509_NAME_ENTRY_get_data
X509_NAME_ENTRY_get_object
X509_NAME_cmp
X509_NAME_dup
X509_NAME_entry_count
X509_NAME_get_entry
X509_NAME_get_index_by_NID
X509_NAME_get_index_by_OBJ
X509_NAME_print_ex
X509_OBJECT_free
X509_OBJECT_get_type
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_error
X509_STORE_CTX_get_error_depth
X509_STORE_CTX_get_ex_data
X509_STORE_add_cert
X509_STORE_add_crl
X509_STORE_add_lookup
X509_STORE_get0_objects
X509_STORE_set_flags
X509_check_purpose
X509_cmp_time
X509_digest
X509_free
X509_get0_notAfter
X509_get0_notBefore
X509_get0_pubkey
X509_get_ext
X509_get_ext_by_NID
X509_get_ext_d2i
X509_get_pubkey
X509_get_serialNumber
X509_get_signature_nid
X509_get_subject_name
X509_verify_cert_error_string
d2i_ECDSA_SIG
d2i_PKCS12_bio
d2i_PKCS12_fp
d2i_X509
i2a_ASN1_INTEGER
i2d_ECDSA_SIG
liblzo2-2
__lzo_init_v2
lzo1x_1_15_compress
lzo1x_decompress_safe
lzo_version_string
libpkcs11-helper-1
pkcs11h_addProvider
pkcs11h_certificate_create
pkcs11h_certificate_deserializeCertificateId
pkcs11h_certificate_enumCertificateIds
pkcs11h_certificate_freeCertificate
pkcs11h_certificate_freeCertificateId
pkcs11h_certificate_freeCertificateIdList
pkcs11h_certificate_getCertificateBlob
pkcs11h_certificate_serializeCertificateId
pkcs11h_engine_setSystem
pkcs11h_getMessage
pkcs11h_initialize
pkcs11h_logout
pkcs11h_openssl_createSession
pkcs11h_openssl_freeSession
pkcs11h_openssl_getX509
pkcs11h_openssl_session_getEVP
pkcs11h_openssl_session_getX509
pkcs11h_setForkMode
pkcs11h_setLogHook
pkcs11h_setLogLevel
pkcs11h_setPINCachePeriod
pkcs11h_setPINPromptHook
pkcs11h_setProtectedAuthentication
pkcs11h_setTokenPromptHook
pkcs11h_terminate
libssl-1_1
BIO_f_ssl
SSL_CIPHER_get_name
SSL_CIPHER_get_version
SSL_CTX_add_client_CA
SSL_CTX_check_private_key
SSL_CTX_ctrl
SSL_CTX_free
SSL_CTX_get0_certificate
SSL_CTX_get_cert_store
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_new
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_info_callback
SSL_CTX_set_options
SSL_CTX_set_security_level
SSL_CTX_set_verify
SSL_CTX_use_PrivateKey
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_certificate
SSL_alert_desc_string_long
SSL_alert_type_string_long
SSL_export_keying_material
SSL_free
SSL_get1_supported_ciphers
SSL_get_cipher_list
SSL_get_current_cipher
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_peer_certificate
SSL_get_version
SSL_new
SSL_set_accept_state
SSL_set_bio
SSL_set_connect_state
SSL_set_ex_data
SSL_state_string_long
TLS_client_method
TLS_method
TLS_server_method
advapi32
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptSetHashParam
CryptSignHashA
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
SetKernelObjectSecurity
SetSecurityDescriptorDacl
crypt32
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CertVerifyTimeValidity
CryptAcquireCertificatePrivateKey
fwpuclnt
FwpmEngineClose0
FwpmEngineOpen0
FwpmFilterAdd0
FwpmFreeMemory0
FwpmGetAppIdFromFileName0
FwpmSubLayerAdd0
FwpmSubLayerGetByKey0
iphlpapi
AddIPAddress
ConvertInterfaceIndexToLuid
CreateIpForwardEntry
DeleteIPAddress
DeleteIpForwardEntry
FlushIpNetTable
GetAdapterIndex
GetAdaptersInfo
GetBestInterfaceEx
GetBestRoute2
GetInterfaceInfo
GetIpForwardTable
GetIpInterfaceEntry
GetPerAdapterInfo
InitializeIpInterfaceEntry
IpReleaseAddress
IpRenewAddress
SetIpInterfaceEntry
kernel32
CancelIo
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateProcessA
CreateProcessW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FormatMessageA
FormatMessageW
FreeLibrary
GetConsoleMode
GetConsoleTitleA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileType
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetNumberOfConsoleInputEvents
GetOverlappedResult
GetProcAddress
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
IsWow64Process
LeaveCriticalSection
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadConsoleInputA
ReadConsoleW
ReadFile
ReleaseSemaphore
ResetEvent
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleOutputCP
SetConsoleTitleA
SetEvent
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteConsoleInputA
WriteFile
msvcrt
__dllonexit
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_atoi64
_cexit
_chsize
_dup2
_errno
_exit
_fdopen
_fmode
_initterm
_iob
_lock
_onexit
_open_osfhandle
_snwprintf
time
localtime
_stricmp
_strnicmp
_unlock
calloc
exit
fclose
feof
fflush
fgetc
fgets
fopen
fprintf
fputc
fread
free
fwprintf
fwrite
isalnum
isalpha
iscntrl
isprint
ispunct
isspace
isxdigit
malloc
mbstowcs
memcmp
memcpy
memmove
memset
printf
putchar
puts
qsort
raise
rand
realloc
setlocale
signal
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtok
strtoul
_vsnprintf
_vsnwprintf
_waccess
_wchdir
_wcmdln
_wfopen
_wopen
abort
tolower
toupper
vfprintf
wcscmp
wcscpy
wcstombs
atoi
_wstat
_write
_strdup
_read
_open
_lseek
_dup2
_dup
_close
ncrypt
NCryptFreeObject
NCryptSignHash
setupapi
CM_Get_Device_Interface_ListA
CM_Get_Device_Interface_List_SizeA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsExA
SetupDiGetDeviceInstanceIdA
SetupDiOpenDevRegKey
user32
MessageBoxW
ws2_32
WSACleanup
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAGetOverlappedResult
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getnameinfo
getservbyname
getsockname
getsockopt
htonl
htons
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
socket
Name
.text
Size
791KB
Virtual Size
791KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
392B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
ovpn/openvpn_down.bat
- SHA256 6cab17fee12d3a2c43eb4d7c3a790cdbd7fc9afc6b0c6d60dbbb61594f6cec74
- MD5 08bae2de82fa4fb579f707376d440056
- SHA1 33eaaac6f01f017affb58b68636cffa6ce30b157
- SHA512 67bfb8a995eb12b5f995860472a0817279ff2acdbdc19e7ee38a0a91eaec67a870dfc56ce39cf4bb5d29c227809cb35b16635d1fe1c0bbc64429079e5aada6f0
- MD5 SHA1 SHA512
ovpn/openvpn_up.bat
- SHA256 6ed4c6d1ba69e5aad84434e40f97c39432be10b903652860f8f16d7861ea79d6
- MD5 cd4d223acddbd08101a159b17022324b
- SHA1 510979a24584898281d7190c9981a1f7aa5b09ca
- SHA512 8516ff62ecf818db7f794d66a2c479ea549444ed718f519b297a0723d78e191466d8f889f4f544a3e3324d6ce9002ceaa3d119b2a5fb63dcb8a2fd324110e1c7
- MD5 SHA1 SHA512
protected_elam/amd64/protected_elam.sys
- IMPHASH 293190b331b17091579cb7083407b852
- SHA256 119bb976356fac1cc0b81e2cdc8d1135c1f57c1d06b631a1814796e1601c2bbc
- MD5 e9806e894443f95671064755f9663a18
- SHA1 ee77dcdeda8f1c8f81dee89ae3924c1ef5d6c69b
- SHA512 7a52c467cbcf80ec10e8e4656bf57198a9ee4b28971120ac4d47de3f3b20a5acd4199366d7ebe6920c9b4232768c000a9bae66905313016037f46a64f62f0cbb
- SSDEEP 192:DGCPcD0vWi7GszmVY84WVDi5f/VWQ4WWtd7JAh+Il+jX01k9z3Aalf3N:DGUcDfLVYIs/aN8EjR9zl53N
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
74:f7:c4:71:c8:92:7d:e6:bd:26:cb:cf:84:08:8e:28:e3:4b:db:b9:00:a0:19:de:45:d2:13:8c:b2:52:3b:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:45:1c:57:99:61:a7:a9:78:10:00:00:00:00:04:45
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
4272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\repos\protected_elam\protected_elam\x64\Release\protected_elam.pdb
ntoskrnl.exe
DbgPrintEx
IoUnregisterBootDriverCallback
IoRegisterBootDriverCallback
RtlCopyUnicodeString
wdfldr.sys
WdfVersionUnbindClass
WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
728B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
654B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=263, version=27412,
count=5, id=257, version=27412,
count=8, id=1, productName=Unmarked objects,
count=1, id=259, version=27412,
count=3, id=260, version=27412,
count=1, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,
count=1, id=255, productName=VS2019 v16.8.3 build 29335, version=29335,
count=1, id=258, productName=VS2019 v16.8.3 build 29335, version=29335,
protected_elam/x86/protected_elam.sys
- IMPHASH 293190b331b17091579cb7083407b852
- SHA256 0b0d0898257846c320f7ddf30771126bbdf9edc7f9afbe1fb3d4f0925680215b
- MD5 cf833a28b40ab93655f342a9d760d224
- SHA1 d03ec91202f85970e4a24124bca36d7b4e262a16
- SHA512 3332f2eb60a422124628c749ba43a140ae6bc8c753019ba78edbbf0a390efcccefa15f3eaa192e7bb5b2d3195cf58def64bae42a844f5fbbde741d3c465a5e3a
- SSDEEP 384:fV/MVnhyp3DiyZbV0VYjt4s/GpQtR9zusP3:fVbVbGeRMQP9zuG
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c2:f5:4e:ab:a7:b4:7b:9e:e5:08:30:7d:1c:8b:69:fc:6c:06:59:c1:76:bb:13:90:25:18:4b:d2:29:d4:f9:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Early Launch Anti-malware Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:45:1c:57:99:61:a7:a9:78:10:00:00:00:00:04:45
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
4256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\repos\protected_elam\protected_elam\Release\protected_elam.pdb
ntoskrnl.exe
DbgPrintEx
IoUnregisterBootDriverCallback
IoRegisterBootDriverCallback
RtlCopyUnicodeString
wdfldr.sys
WdfVersionUnbindClass
WdfVersionBindClass
WdfVersionUnbind
WdfVersionBind
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
632B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1024B
Virtual Size
526B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=263, version=27412,
count=5, id=257, version=27412,
count=8, id=1, productName=Unmarked objects,
count=3, id=260, version=27412,
count=1, id=260, productName=VS2019 v16.8.3 build 29335, version=29335,
count=1, id=255, productName=VS2019 v16.8.3 build 29335, version=29335,
count=1, id=258, productName=VS2019 v16.8.3 build 29335, version=29335,
pwm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58ea66beb9fd07738a6a05622e04cc14bdea6e2d7628c3ef52e9960ff254ceba
- MD5 885a2706ad5cd98c637a9d02a6712d56
- SHA1 7bbe52a527efc084516c512372c8102749bd3746
- SHA512 f966d711ffca055354ee68116032d818ce857237c7c27d92ddbb5f5a6a4b8dc3d17637e22532e524dcc72a428aeb60ca534150f41648e59c842a804b89790d63
- SSDEEP 768:0ymFTYwH+5FUraxpcn0CLRGgFxZZjQZ9XIjFDqrdtUn5k:mH+5FUrfbAojQZ9XIjRqrjWe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
securityservice.cat
- SHA256 17da88c29be86ba54c810ec0afdcfe9584a648e24745fdd3c049791959c47cdd
- MD5 f7d1d228beafd2473fe5d039b0b5a8c2
- SHA1 e9855109124b96c781c68e4fadfc4a658db7c305
- SHA512 2a7c81444c9a80670674a8d22e8aca5e516241168fde9653977f3d9dbbda48c3cb4165b94cbccdf6012c9c28d00abb47d523b785fee35b9f98fbbf4fe18aba29
- SSDEEP 24576:uoV5o//555/dbwUQaAsoAMC4Yt1t6n+CSbDO8xF8IUs4D+Q8CRFc25MusMT:bzu5wNCJ100BxO8CRFcQL
- MD5 SHA1 SHA512 SSDEEP
sni.dll
- IMPHASH 00f5001ebf137746556043a7c9155eca
- SHA256 1446d6b26da49a5a9f366972f89f4e236f916955f31ddc38ebb96217c1cace9c
- MD5 c62a83f20bc23aeface70ec13003c4c5
- SHA1 35553cfcdcbeccdc49710e68aec495c16880f0bd
- SHA512 4dda44fd5b538f5da9e8cb46a3ab1bdc14b43425b9a61249eccc925d986af7b8b3548db9490238f14807909ecf479415117141ddb344119438a59f97e894ea37
- SSDEEP 3072:H3SGhrfrdqCn3bctzdGRX18u5e++dowahamD5/f+vHPoW:H3SGhbBqCnmzERyiepSUm9moW
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
be:e0:1f:b9:15:bc:e5:77:a2:a0:e3:dd:41:4e:59:93:c8:28:3b:1c:91:bd:9d:1c:42:fa:96:2c:4e:9a:f0:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
a4:da:98:d6:cc:38:31:14:3a:60:44:18:10:f5:a7:26:00:cf:81:f1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 12, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
70512
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\410\s\bin\obj\Windows_NT.x86.Release\Native\sni\Release\sni.pdb
kernel32
SetEvent
CreateSemaphoreA
SetLastError
GetQueuedCompletionStatus
Sleep
FileTimeToSystemTime
GetSystemDirectoryA
CreateThread
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
InitializeSListHead
CreateIoCompletionPort
GetComputerNameA
TlsSetValue
FormatMessageW
TlsAlloc
WaitForMultipleObjects
TlsFree
SetHandleInformation
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
MultiByteToWideChar
GetComputerNameExA
WideCharToMultiByte
CompareStringA
LCMapStringA
SetFileCompletionNotificationModes
GetTickCount
GetOverlappedResult
CreateFileA
DisconnectNamedPipe
WaitForSingleObject
PeekNamedPipe
WriteFile
GetCurrentProcess
WaitNamedPipeA
SetNamedPipeHandleState
ReadFile
QueryDepthSList
InterlockedPopEntrySList
CreateEventA
InterlockedPushEntrySList
RtlUnwind
RaiseException
IsDebuggerPresent
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
EncodePointer
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeLibrary
DeleteCriticalSection
GetProcAddress
CloseHandle
LoadLibraryA
InterlockedFlushSList
GetLastError
PostQueuedCompletionStatus
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
user32
CharNextExA
advapi32
RegCloseKey
ImpersonateNamedPipeClient
CryptDestroyKey
CryptReleaseContext
IsTokenRestricted
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RevertToSelf
rpcrt4
UuidCreate
ws2_32
WSAIoctl
WSASend
getpeername
getsockname
ntohs
shutdown
bind
WSARecv
WSAPoll
getnameinfo
WSACleanup
__WSAFDIsSet
closesocket
select
WSAEnumProtocolsW
connect
WSAGetLastError
setsockopt
sendto
freeaddrinfo
htons
htonl
socket
WSAStartup
getaddrinfo
WSAStringToAddressW
recv
api-ms-win-crt-string-l1-1-0
_wcsnicmp
_stricmp
strcpy_s
strncmp
_stricmp_l
wcsncpy_s
_strnicmp_l
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
_atoi_l
atoi
api-ms-win-crt-multibyte-l1-1-0
_mbsnbicmp_l
_mbschr
_mbsspn
api-ms-win-crt-runtime-l1-1-0
_cexit
abort
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
terminate
_invalid_parameter_noinfo
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_errno
api-ms-win-crt-heap-l1-1-0
_calloc_base
_callnewh
free
malloc
_free_base
GetSniMaxComposedSpnLength
SNIAddProviderWrapper
SNICheckConnectionWrapper
SNICloseWrapper
SNIGetInfoWrapper
SNIGetLastError
SNIInitialize
SNIOpenSyncExWrapper
SNIOpenWrapper
SNIPacketAllocateWrapper
SNIPacketGetDataWrapper
SNIPacketRelease
SNIPacketResetWrapper
SNIPacketSetData
SNIQueryInfo
SNIReadAsyncWrapper
SNIReadSyncOverAsync
SNIRemoveProviderWrapper
SNISecGenClientContextWrapper
SNISecInitPackage
SNISetInfoWrapper
SNITerminate
SNIWaitForSSLHandshakeToCompleteWrapper
SNIWriteAsyncWrapper
SNIWriteSyncOverAsync
UnmanagedIsTokenRestricted
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=24123,
count=33, id=261, version=24123,
count=15, id=260, version=24123,
count=15, id=203, version=65501,
count=182, id=1, productName=Unmarked objects,
count=16, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
ucrtbase.dll
- IMPHASH e97d8949b62ac66aa0d4cfccf17c8a2e
- SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
- MD5 6343ff7874ba03f78bb0dfe20b45f817
- SHA1 82221a9ac1c1b8006f3f5e8539e74e3308f10bcb
- SHA512 63c3d3207577d4761103daf3f9901dd0a0ae8a89694ad1128fd7e054627cdd930d1020049317c5a898411735e2f75e2103ae303e7e514b6387a3c8463a4fb994
- SSDEEP 24576:Os974wcfeCepgb9qqu+XMO4nXIzvQVbe1SmcvIZPoy4/ZBVX:b96WghMOqI8Vbe1GZBVX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
30:aa:01:6d:b0:35:c9:61:c8:d9:c3:fe:74:38:8e:42:06:ff:c6:fb:86:9d:17:2d:bb:49:99:de:0f:db:71:37
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
PE Signature issue
Digest
7e:11:3c:29:b8:de:a4:9c:00:ae:7e:79:e2:be:8d:21:f4:00:84:34
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 20, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c3:3b:b8:10:d6:ab:75:9c:84:00:00:00:00:00:c3
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cc:b5:5b:42:17:07:60:13:11:00:00:00:00:01:cc
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2017 - Sep 12, 2018
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Minor OS version
0
Major OS version
10
Entry point
196768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ucrtbase.pdb
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
RaiseException
GetLastError
SetLastError
api-ms-win-core-heap-l1-1-0
HeapSize
HeapAlloc
HeapCompact
HeapValidate
HeapReAlloc
HeapQueryInformation
GetProcessHeap
HeapWalk
HeapFree
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TlsAlloc
TerminateProcess
TlsSetValue
GetCurrentThreadId
TlsGetValue
ExitProcess
TlsFree
GetCurrentProcessId
GetExitCodeProcess
ResumeThread
ExitThread
CreateThread
CreateProcessW
GetStartupInfoW
api-ms-win-core-file-l1-1-0
WriteFile
GetDiskFreeSpaceW
GetLogicalDrives
SetFileTime
SetFilePointerEx
LockFileEx
UnlockFileEx
FlushFileBuffers
SetEndOfFile
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
GetFileAttributesExW
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
FindFirstFileExW
CreateFileW
FindNextFileW
ReadFile
GetFileType
FindClose
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
FreeLibraryAndExitThread
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-processenvironment-l1-1-0
GetEnvironmentStringsW
GetStdHandle
GetCommandLineA
FreeEnvironmentStringsW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetCommandLineW
GetCurrentDirectoryW
SetStdHandle
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
GetStringTypeW
CompareStringW
WideCharToMultiByte
api-ms-win-core-localization-l1-2-0
GetUserDefaultLCID
GetCPInfo
GetACP
IsValidCodePage
GetLocaleInfoW
LCMapStringW
EnumSystemLocalesW
IsValidLocale
GetOEMCP
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetLocalTime
SetLocalTime
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-console-l1-1-0
ReadConsoleInputW
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleCP
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleW
PeekConsoleInputA
GetConsoleMode
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-namedpipe-l1-1-0
CreatePipe
PeekNamedPipe
api-ms-win-core-timezone-l1-1-0
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
api-ms-win-core-file-l2-1-0
MoveFileExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualQuery
VirtualProtect
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
Beep
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InterlockedPushEntrySList
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_Cbuild
_Cmulcc
_Cmulcr
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_Exit
_FCbuild
_FCmulcc
_FCmulcr
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_IsExceptionObjectToBeDestroyed
_LCbuild
_LCmulcc
_LCmulcr
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
__acrt_iob_func
__conio_common_vcprintf
__conio_common_vcprintf_p
__conio_common_vcprintf_s
__conio_common_vcscanf
__conio_common_vcwprintf
__conio_common_vcwprintf_p
__conio_common_vcwprintf_s
__conio_common_vcwscanf
__control87_2
__current_exception
__current_exception_context
__daylight
__dcrt_get_wide_environment_from_os
__dcrt_initial_narrow_environment
__doserrno
__dstbias
__fpe_flt_rounds
__fpecode
__initialize_lconv_for_unsigned_char
__intrinsic_abnormal_termination
__intrinsic_setjmp
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__environ
__p__fmode
__p__mbcasemap
__p__mbctype
__p__pgmptr
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__processing_throw
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__setusermatherr
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__stdio_common_vfprintf
__stdio_common_vfprintf_p
__stdio_common_vfprintf_s
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vfwprintf_p
__stdio_common_vfwprintf_s
__stdio_common_vfwscanf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_p
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__strncnt
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__wcserror
__wcserror_s
__wcsncnt
_abs64
_access
_access_s
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_atoll_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_base
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chgsignf
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_configthreadlocale
_configure_narrow_argv
_configure_wide_argv
_control87
_controlfp
_controlfp_s
_copysign
_copysignf
_cputs
_cputws
_creat
_create_locale
_crt_at_quick_exit
_crt_atexit
_crt_debugger_hook
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_d_int
_dclass
_dexp
_difftime32
_difftime64
_dlog
_dnorm
_dpcomp
_dpoly
_dscale
_dsign
_dsin
_dtest
_dunscale
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_endthread
_endthreadex
_eof
_errno
_except1
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execute_onexit_table
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fd_int
_fdclass
_fdexp
_fdlog
_fdnorm
_fdopen
_fdpcomp
_fdpoly
_fdscale
_fdsign
_fdsin
_fdtest
_fdunscale
_fflush_nolock
_fgetc_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flushall
_fpclass
_fpieee_flt
_fpreset
_fputc_nolock
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_base
_free_locale
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwrite_nolock
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_heap_handle
_get_initial_narrow_environment
_get_initial_wide_environment
_get_invalid_parameter_handler
_get_narrow_winmain_command_line
_get_osfhandle
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_stream_buffer_pointers
_get_terminate
_get_thread_local_invalid_parameter_handler
_get_timezone
_get_tzname
_get_unexpected
_get_wide_winmain_command_line
_get_wpgmptr
_getc_nolock
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwc_nolock
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2
_gmtime32
_gmtime32_s
_gmtime64
_gmtime64_s
_heapchk
_heapmin
_heapwalk
_hypot
_hypotf
_i64toa
_i64toa_s
_i64tow
_i64tow_s
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_is_exception_typeof
_isalnum_l
_isalpha_l
_isatty
_isblank_l
_iscntrl_l
_isctype
_isctype_l
_isdigit_l
_isgraph_l
_isleadbyte_l
_islower_l
_ismbbalnum
_ismbbalnum_l
_ismbbalpha
_ismbbalpha_l
_ismbbblank
_ismbbblank_l
_ismbbgraph
_ismbbgraph_l
_ismbbkalnum
_ismbbkalnum_l
_ismbbkana
_ismbbkana_l
_ismbbkprint
_ismbbkprint_l
_ismbbkpunct
_ismbbkpunct_l
_ismbblead
_ismbblead_l
_ismbbprint
_ismbbprint_l
_ismbbpunct
_ismbbpunct_l
_ismbbtrail
_ismbbtrail_l
_ismbcalnum
_ismbcalnum_l
_ismbcalpha
_ismbcalpha_l
_ismbcblank
_ismbcblank_l
_ismbcdigit
_ismbcdigit_l
_ismbcgraph
_ismbcgraph_l
_ismbchira
_ismbchira_l
_ismbckata
_ismbckata_l
_ismbcl0
_ismbcl0_l
_ismbcl1
_ismbcl1_l
_ismbcl2
_ismbcl2_l
_ismbclegal
_ismbclegal_l
_ismbclower
_ismbclower_l
_ismbcprint
_ismbcprint_l
_ismbcpunct
_ismbcpunct_l
_ismbcspace
_ismbcspace_l
_ismbcsymbol
_ismbcsymbol_l
_ismbcupper
_ismbcupper_l
_ismbslead
_ismbslead_l
_ismbstrail
_ismbstrail_l
_isnan
_isprint_l
_ispunct_l
_isspace_l
_isupper_l
_iswalnum_l
_iswalpha_l
_iswblank_l
_iswcntrl_l
_iswcsym_l
_iswcsymf_l
_iswctype_l
_iswdigit_l
_iswgraph_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_isxdigit_l
_itoa
_itoa_s
_itow
_itow_s
_j0
_j1
_jn
_kbhit
_ld_int
_ldclass
_ldexp
_ldlog
_ldpcomp
_ldpoly
_ldscale
_ldsign
_ldsin
_ldtest
_ldunscale
_lfind
_lfind_s
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
_loaddll
_local_unwind2
_local_unwind4
_localtime32
_localtime32_s
_localtime64
_localtime64_s
_lock_file
_lock_locales
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lsearch_s
_lseek
_lseeki64
_ltoa
_ltoa_s
_ltow
_ltow_s
_makepath
_makepath_s
_malloc_base
_mbbtombc
_mbbtombc_l
_mbbtype
_mbbtype_l
_mbcasemap
_mbccpy
_mbccpy_l
_mbccpy_s
_mbccpy_s_l
_mbcjistojms
_mbcjistojms_l
_mbcjmstojis
_mbcjmstojis_l
_mbclen
_mbclen_l
_mbctohira
_mbctohira_l
_mbctokata
_mbctokata_l
_mbctolower
_mbctolower_l
_mbctombb
_mbctombb_l
_mbctoupper
_mbctoupper_l
_mblen_l
_mbsbtype
_mbsbtype_l
_mbscat_s
_mbscat_s_l
_mbschr
_mbschr_l
_mbscmp
_mbscmp_l
_mbscoll
_mbscoll_l
_mbscpy_s
_mbscpy_s_l
_mbscspn
_mbscspn_l
_mbsdec
_mbsdec_l
_mbsdup
_mbsicmp
_mbsicmp_l
_mbsicoll
_mbsicoll_l
_mbsinc
_mbsinc_l
_mbslen
_mbslen_l
_mbslwr
_mbslwr_l
_mbslwr_s
_mbslwr_s_l
_mbsnbcat
_mbsnbcat_l
_mbsnbcat_s
_mbsnbcat_s_l
_mbsnbcmp
_mbsnbcmp_l
_mbsnbcnt
_mbsnbcnt_l
_mbsnbcoll
_mbsnbcoll_l
_mbsnbcpy
_mbsnbcpy_l
_mbsnbcpy_s
_mbsnbcpy_s_l
_mbsnbicmp
_mbsnbicmp_l
_mbsnbicoll
_mbsnbicoll_l
_mbsnbset
_mbsnbset_l
_mbsnbset_s
_mbsnbset_s_l
_mbsncat
_mbsncat_l
_mbsncat_s
_mbsncat_s_l
_mbsnccnt
_mbsnccnt_l
_mbsncmp
_mbsncmp_l
_mbsncoll
_mbsncoll_l
_mbsncpy
_mbsncpy_l
_mbsncpy_s
_mbsncpy_s_l
_mbsnextc
_mbsnextc_l
_mbsnicmp
_mbsnicmp_l
_mbsnicoll
_mbsnicoll_l
_mbsninc
_mbsninc_l
_mbsnlen
_mbsnlen_l
_mbsnset
_mbsnset_l
_mbsnset_s
_mbsnset_s_l
_mbspbrk
_mbspbrk_l
_mbsrchr
_mbsrchr_l
_mbsrev
_mbsrev_l
_mbsset
_mbsset_l
_mbsset_s
_mbsset_s_l
_mbsspn
_mbsspn_l
_mbsspnp
_mbsspnp_l
_mbsstr
_mbsstr_l
_mbstok
_mbstok_l
_mbstok_s
_mbstok_s_l
_mbstowcs_l
_mbstowcs_s_l
_mbstrlen
_mbstrlen_l
_mbstrnlen
_mbstrnlen_l
_mbsupr
_mbsupr_l
_mbsupr_s
_mbsupr_s_l
_mbtowc_l
_memccpy
_memicmp
_memicmp_l
_mkdir
_mkgmtime32
_mkgmtime64
_mktemp
_mktemp_s
_mktime32
_mktime64
_msize
_nextafter
_o__CIacos
_o__CIasin
_o__CIatan
_o__CIatan2
_o__CIcos
_o__CIcosh
_o__CIexp
_o__CIfmod
_o__CIlog
_o__CIlog10
_o__CIpow
_o__CIsin
_o__CIsinh
_o__CIsqrt
_o__CItan
_o__CItanh
_o__Getdays
_o__Getmonths
_o__Gettnames
_o__Strftime
_o__W_Getdays
_o__W_Getmonths
_o__W_Gettnames
_o__Wcsftime
_o____lc_codepage_func
_o____lc_collate_cp_func
_o____lc_locale_name_func
_o____mb_cur_max_func
_o___acrt_iob_func
_o___conio_common_vcprintf
_o___conio_common_vcprintf_p
_o___conio_common_vcprintf_s
_o___conio_common_vcscanf
_o___conio_common_vcwprintf
_o___conio_common_vcwprintf_p
_o___conio_common_vcwprintf_s
_o___conio_common_vcwscanf
_o___daylight
_o___dstbias
_o___fpe_flt_rounds
_o___libm_sse2_acos
_o___libm_sse2_acosf
_o___libm_sse2_asin
_o___libm_sse2_asinf
_o___libm_sse2_atan
_o___libm_sse2_atan2
_o___libm_sse2_atanf
_o___libm_sse2_cos
_o___libm_sse2_cosf
_o___libm_sse2_exp
_o___libm_sse2_expf
_o___libm_sse2_log
_o___libm_sse2_log10
_o___libm_sse2_log10f
_o___libm_sse2_logf
_o___libm_sse2_pow
_o___libm_sse2_powf
_o___libm_sse2_sin
_o___libm_sse2_sinf
_o___libm_sse2_tan
_o___libm_sse2_tanf
_o___p___argc
_o___p___argv
_o___p___wargv
_o___p__acmdln
_o___p__commode
_o___p__environ
_o___p__fmode
_o___p__mbcasemap
_o___p__mbctype
_o___p__pgmptr
_o___p__wcmdln
_o___p__wenviron
_o___p__wpgmptr
_o___pctype_func
_o___pwctype_func
_o___std_exception_copy
_o___std_exception_destroy
_o___std_type_info_destroy_list
_o___std_type_info_name
_o___stdio_common_vfprintf
_o___stdio_common_vfprintf_p
_o___stdio_common_vfprintf_s
_o___stdio_common_vfscanf
_o___stdio_common_vfwprintf
_o___stdio_common_vfwprintf_p
_o___stdio_common_vfwprintf_s
_o___stdio_common_vfwscanf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsprintf_p
_o___stdio_common_vsprintf_s
_o___stdio_common_vsscanf
_o___stdio_common_vswprintf
_o___stdio_common_vswprintf_p
_o___stdio_common_vswprintf_s
_o___stdio_common_vswscanf
_o___timezone
_o___tzname
_o___wcserror
_o__access
_o__access_s
_o__aligned_free
_o__aligned_malloc
_o__aligned_msize
_o__aligned_offset_malloc
_o__aligned_offset_realloc
_o__aligned_offset_recalloc
_o__aligned_realloc
_o__aligned_recalloc
_o__atodbl
_o__atodbl_l
_o__atof_l
_o__atoflt
_o__atoflt_l
_o__atoi64
_o__atoi64_l
_o__atoi_l
_o__atol_l
_o__atoldbl
_o__atoldbl_l
_o__atoll_l
_o__beep
_o__beginthread
_o__beginthreadex
_o__cabs
_o__callnewh
_o__calloc_base
_o__cexit
_o__cgets
_o__cgets_s
_o__cgetws
_o__cgetws_s
_o__chdir
_o__chdrive
_o__chmod
_o__chsize
_o__chsize_s
_o__close
_o__commit
_o__configthreadlocale
_o__configure_narrow_argv
_o__configure_wide_argv
_o__controlfp_s
_o__cputs
_o__cputws
_o__creat
_o__create_locale
_o__crt_atexit
_o__ctime32_s
_o__ctime64_s
_o__cwait
_o__d_int
_o__dclass
_o__difftime32
_o__difftime64
_o__dlog
_o__dnorm
_o__dpcomp
_o__dpoly
_o__dscale
_o__dsign
_o__dsin
_o__dtest
_o__dunscale
_o__dup
_o__dup2
_o__dupenv_s
_o__ecvt
_o__ecvt_s
_o__endthread
_o__endthreadex
_o__eof
_o__errno
_o__except1
_o__execute_onexit_table
_o__execv
_o__execve
_o__execvp
_o__execvpe
_o__exit
_o__expand
_o__fclose_nolock
_o__fcloseall
_o__fcvt
_o__fcvt_s
_o__fd_int
_o__fdclass
_o__fdexp
_o__fdlog
_o__fdopen
_o__fdpcomp
_o__fdpoly
_o__fdscale
_o__fdsign
_o__fdsin
_o__fflush_nolock
_o__fgetc_nolock
_o__fgetchar
_o__fgetwc_nolock
_o__fgetwchar
_o__filelength
_o__filelengthi64
_o__fileno
_o__findclose
_o__findfirst32
_o__findfirst32i64
_o__findfirst64
_o__findfirst64i32
_o__findnext32
_o__findnext32i64
_o__findnext64
_o__findnext64i32
_o__flushall
_o__fpclass
_o__fputc_nolock
_o__fputchar
_o__fputwc_nolock
_o__fputwchar
_o__fread_nolock
_o__fread_nolock_s
_o__free_base
_o__free_locale
_o__fseek_nolock
_o__fseeki64
_o__fseeki64_nolock
_o__fsopen
_o__fstat32
_o__fstat32i64
_o__fstat64
_o__fstat64i32
_o__ftell_nolock
_o__ftelli64
_o__ftelli64_nolock
_o__ftime32
_o__ftime32_s
_o__ftime64
_o__ftime64_s
_o__fullpath
_o__futime32
_o__futime64
_o__fwrite_nolock
_o__gcvt
_o__gcvt_s
_o__get_daylight
_o__get_doserrno
_o__get_dstbias
_o__get_errno
_o__get_fmode
_o__get_heap_handle
_o__get_initial_narrow_environment
_o__get_initial_wide_environment
_o__get_invalid_parameter_handler
_o__get_narrow_winmain_command_line
_o__get_osfhandle
_o__get_pgmptr
_o__get_stream_buffer_pointers
_o__get_terminate
_o__get_thread_local_invalid_parameter_handler
_o__get_timezone
_o__get_tzname
_o__get_wide_winmain_command_line
_o__get_wpgmptr
_o__getc_nolock
_o__getch
_o__getch_nolock
_o__getche
_o__getche_nolock
_o__getcwd
_o__getdcwd
_o__getdiskfree
_o__getdllprocaddr
_o__getdrive
_o__getdrives
_o__getmbcp
_o__getsystime
_o__getw
_o__getwc_nolock
_o__getwch
_o__getwch_nolock
_o__getwche
_o__getwche_nolock
_o__getws
_o__getws_s
_o__gmtime32
_o__gmtime32_s
_o__gmtime64
_o__gmtime64_s
_o__heapchk
_o__heapmin
_o__hypot
_o__hypotf
_o__i64toa
_o__i64toa_s
_o__i64tow
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__isatty
_o__isctype
_o__isctype_l
_o__isleadbyte_l
_o__ismbbalnum
_o__ismbbalnum_l
_o__ismbbalpha
_o__ismbbalpha_l
_o__ismbbblank
_o__ismbbblank_l
_o__ismbbgraph
_o__ismbbgraph_l
_o__ismbbkalnum
_o__ismbbkalnum_l
_o__ismbbkana
_o__ismbbkana_l
_o__ismbbkprint
_o__ismbbkprint_l
_o__ismbbkpunct
_o__ismbbkpunct_l
_o__ismbblead
_o__ismbblead_l
_o__ismbbprint
_o__ismbbprint_l
_o__ismbbpunct
_o__ismbbpunct_l
_o__ismbbtrail
_o__ismbbtrail_l
_o__ismbcalnum
_o__ismbcalnum_l
_o__ismbcalpha
_o__ismbcalpha_l
_o__ismbcblank
_o__ismbcblank_l
_o__ismbcdigit
_o__ismbcdigit_l
_o__ismbcgraph
_o__ismbcgraph_l
_o__ismbchira
_o__ismbchira_l
_o__ismbckata
_o__ismbckata_l
_o__ismbcl0
_o__ismbcl0_l
_o__ismbcl1
_o__ismbcl1_l
_o__ismbcl2
_o__ismbcl2_l
_o__ismbclegal
_o__ismbclegal_l
_o__ismbclower
_o__ismbclower_l
_o__ismbcprint
_o__ismbcprint_l
_o__ismbcpunct
_o__ismbcpunct_l
_o__ismbcspace
_o__ismbcspace_l
_o__ismbcsymbol
_o__ismbcsymbol_l
_o__ismbcupper
_o__ismbcupper_l
_o__ismbslead
_o__ismbslead_l
_o__ismbstrail
_o__ismbstrail_l
_o__iswctype_l
_o__itoa
_o__itoa_s
_o__itow
_o__itow_s
_o__j0
_o__j1
_o__jn
_o__kbhit
_o__ld_int
_o__ldclass
_o__ldexp
_o__ldlog
_o__ldpcomp
_o__ldpoly
_o__ldscale
_o__ldsign
_o__ldsin
_o__ldtest
_o__ldunscale
_o__lfind
_o__lfind_s
_o__libm_sse2_acos_precise
_o__libm_sse2_asin_precise
_o__libm_sse2_atan_precise
_o__libm_sse2_cos_precise
_o__libm_sse2_exp_precise
_o__libm_sse2_log10_precise
_o__libm_sse2_log_precise
_o__libm_sse2_pow_precise
_o__libm_sse2_sin_precise
_o__libm_sse2_sqrt_precise
_o__libm_sse2_tan_precise
_o__loaddll
_o__localtime32
_o__localtime32_s
_o__localtime64
_o__localtime64_s
_o__lock_file
_o__locking
_o__logb
_o__lsearch
_o__lsearch_s
_o__lseek
_o__lseeki64
_o__ltoa
_o__ltoa_s
_o__ltow
_o__ltow_s
_o__makepath
_o__makepath_s
_o__malloc_base
_o__mbbtombc
_o__mbbtombc_l
_o__mbbtype
_o__mbbtype_l
_o__mbccpy
_o__mbccpy_l
_o__mbccpy_s
_o__mbccpy_s_l
_o__mbcjistojms
_o__mbcjistojms_l
_o__mbcjmstojis
_o__mbcjmstojis_l
_o__mbclen
_o__mbclen_l
_o__mbctohira
_o__mbctohira_l
_o__mbctokata
_o__mbctokata_l
_o__mbctolower
_o__mbctolower_l
_o__mbctombb
_o__mbctombb_l
_o__mbctoupper
_o__mbctoupper_l
_o__mblen_l
_o__mbsbtype
_o__mbsbtype_l
_o__mbscat_s
_o__mbscat_s_l
_o__mbschr
_o__mbschr_l
_o__mbscmp
_o__mbscmp_l
_o__mbscoll
_o__mbscoll_l
_o__mbscpy_s
_o__mbscpy_s_l
_o__mbscspn
_o__mbscspn_l
_o__mbsdec
_o__mbsdec_l
_o__mbsicmp
_o__mbsicmp_l
_o__mbsicoll
_o__mbsicoll_l
_o__mbsinc
_o__mbsinc_l
_o__mbslen
_o__mbslen_l
_o__mbslwr
_o__mbslwr_l
_o__mbslwr_s
_o__mbslwr_s_l
_o__mbsnbcat
_o__mbsnbcat_l
_o__mbsnbcat_s
_o__mbsnbcat_s_l
_o__mbsnbcmp
_o__mbsnbcmp_l
_o__mbsnbcnt
_o__mbsnbcnt_l
_o__mbsnbcoll
_o__mbsnbcoll_l
_o__mbsnbcpy
_o__mbsnbcpy_l
_o__mbsnbcpy_s
_o__mbsnbcpy_s_l
_o__mbsnbicmp
_o__mbsnbicmp_l
_o__mbsnbicoll
_o__mbsnbicoll_l
_o__mbsnbset
_o__mbsnbset_l
_o__mbsnbset_s
_o__mbsnbset_s_l
_o__mbsncat
_o__mbsncat_l
_o__mbsncat_s
_o__mbsncat_s_l
_o__mbsnccnt
_o__mbsnccnt_l
_o__mbsncmp
_o__mbsncmp_l
_o__mbsncoll
_o__mbsncoll_l
_o__mbsncpy
_o__mbsncpy_l
_o__mbsncpy_s
_o__mbsncpy_s_l
_o__mbsnextc
_o__mbsnextc_l
_o__mbsnicmp
_o__mbsnicmp_l
_o__mbsnicoll
_o__mbsnicoll_l
_o__mbsninc
_o__mbsninc_l
_o__mbsnlen
_o__mbsnlen_l
_o__mbsnset
_o__mbsnset_l
_o__mbsnset_s
_o__mbsnset_s_l
_o__mbspbrk
_o__mbspbrk_l
_o__mbsrchr
_o__mbsrchr_l
_o__mbsrev
_o__mbsrev_l
_o__mbsset
_o__mbsset_l
_o__mbsset_s
_o__mbsset_s_l
_o__mbsspn
_o__mbsspn_l
_o__mbsspnp
_o__mbsspnp_l
_o__mbsstr
_o__mbsstr_l
_o__mbstok
_o__mbstok_l
_o__mbstok_s
_o__mbstok_s_l
_o__mbstowcs_l
_o__mbstowcs_s_l
_o__mbstrlen
_o__mbstrlen_l
_o__mbstrnlen
_o__mbstrnlen_l
_o__mbsupr
_o__mbsupr_l
_o__mbsupr_s
_o__mbsupr_s_l
_o__mbtowc_l
_o__memicmp
_o__memicmp_l
_o__mkdir
_o__mkgmtime32
_o__mkgmtime64
_o__mktemp
_o__mktemp_s
_o__mktime32
_o__mktime64
_o__msize
_o__nextafter
_o__open_osfhandle
_o__pclose
_o__pipe
_o__popen
_o__purecall
_o__putc_nolock
_o__putch
_o__putch_nolock
_o__putenv
_o__putenv_s
_o__putw
_o__putwc_nolock
_o__putwch
_o__putwch_nolock
_o__putws
_o__read
_o__realloc_base
_o__recalloc
_o__register_onexit_function
_o__resetstkoflw
_o__rmdir
_o__rmtmp
_o__scalb
_o__searchenv
_o__searchenv_s
_o__seh_filter_dll
_o__seh_filter_exe
_o__set_abort_behavior
_o__set_app_type
_o__set_doserrno
_o__set_errno
_o__set_fmode
_o__set_invalid_parameter_handler
_o__set_new_handler
_o__set_new_mode
_o__set_thread_local_invalid_parameter_handler
_o__seterrormode
_o__setmbcp
_o__setmode
_o__setsystime
_o__sleep
_o__sopen
_o__sopen_dispatch
_o__sopen_s
_o__spawnv
_o__spawnve
_o__spawnvp
_o__spawnvpe
_o__splitpath
_o__splitpath_s
_o__stat32
_o__stat32i64
_o__stat64
_o__stat64i32
_o__strcoll_l
_o__strdate
_o__strdate_s
_o__strdup
_o__strerror
_o__strerror_s
_o__strftime_l
_o__stricmp
_o__stricmp_l
_o__stricoll
_o__stricoll_l
_o__strlwr
_o__strlwr_l
_o__strlwr_s
_o__strlwr_s_l
_o__strncoll
_o__strncoll_l
_o__strnicmp
_o__strnicmp_l
_o__strnicoll
_o__strnicoll_l
_o__strnset_s
_o__strset_s
_o__strtime
_o__strtime_s
_o__strtod_l
_o__strtof_l
_o__strtoi64
_o__strtoi64_l
_o__strtol_l
_o__strtold_l
_o__strtoll_l
_o__strtoui64
_o__strtoui64_l
_o__strtoul_l
_o__strtoull_l
_o__strupr
_o__strupr_l
_o__strupr_s
_o__strupr_s_l
_o__strxfrm_l
_o__swab
_o__tell
_o__telli64
_o__timespec32_get
_o__timespec64_get
_o__tolower
_o__tolower_l
_o__toupper
_o__toupper_l
_o__towlower_l
_o__towupper_l
_o__tzset
_o__ui64toa
_o__ui64toa_s
_o__ui64tow
_o__ui64tow_s
_o__ultoa
_o__ultoa_s
_o__ultow
_o__ultow_s
_o__umask
_o__umask_s
_o__ungetc_nolock
_o__ungetch
_o__ungetch_nolock
_o__ungetwc_nolock
_o__ungetwch
_o__ungetwch_nolock
_o__unlink
_o__unloaddll
_o__unlock_file
_o__utime32
_o__utime64
_o__waccess
_o__waccess_s
_o__wasctime
_o__wasctime_s
_o__wchdir
_o__wchmod
_o__wcreat
_o__wcreate_locale
_o__wcscoll_l
_o__wcsdup
_o__wcserror
_o__wcserror_s
_o__wcsftime_l
_o__wcsicmp
_o__wcsicmp_l
_o__wcsicoll
_o__wcsicoll_l
_o__wcslwr
_o__wcslwr_l
_o__wcslwr_s
_o__wcslwr_s_l
_o__wcsncoll
_o__wcsncoll_l
_o__wcsnicmp
_o__wcsnicmp_l
_o__wcsnicoll
_o__wcsnicoll_l
_o__wcsnset
_o__wcsnset_s
_o__wcsset
_o__wcsset_s
_o__wcstod_l
_o__wcstof_l
_o__wcstoi64
_o__wcstoi64_l
_o__wcstol_l
_o__wcstold_l
_o__wcstoll_l
_o__wcstombs_l
_o__wcstombs_s_l
_o__wcstoui64
_o__wcstoui64_l
_o__wcstoul_l
_o__wcstoull_l
_o__wcsupr
_o__wcsupr_l
_o__wcsupr_s
_o__wcsupr_s_l
_o__wcsxfrm_l
_o__wctime32
_o__wctime32_s
_o__wctime64
_o__wctime64_s
_o__wctomb_l
_o__wctomb_s_l
_o__wdupenv_s
_o__wexecv
_o__wexecve
_o__wexecvp
_o__wexecvpe
_o__wfdopen
_o__wfindfirst32
_o__wfindfirst32i64
_o__wfindfirst64
_o__wfindfirst64i32
_o__wfindnext32
_o__wfindnext32i64
_o__wfindnext64
_o__wfindnext64i32
_o__wfopen
_o__wfopen_s
_o__wfreopen
_o__wfreopen_s
_o__wfsopen
_o__wfullpath
_o__wgetcwd
_o__wgetdcwd
_o__wgetenv
_o__wgetenv_s
_o__wmakepath
_o__wmakepath_s
_o__wmkdir
_o__wmktemp
_o__wmktemp_s
_o__wperror
_o__wpopen
_o__wputenv
_o__wputenv_s
_o__wremove
_o__wrename
_o__write
_o__wrmdir
_o__wsearchenv
_o__wsearchenv_s
_o__wsetlocale
_o__wsopen_dispatch
_o__wsopen_s
_o__wspawnv
_o__wspawnve
_o__wspawnvp
_o__wspawnvpe
_o__wsplitpath
_o__wsplitpath_s
_o__wstat32
_o__wstat32i64
_o__wstat64
_o__wstat64i32
_o__wstrdate
_o__wstrdate_s
_o__wstrtime
_o__wstrtime_s
_o__wsystem
_o__wtmpnam_s
_o__wtof
_o__wtof_l
_o__wtoi
_o__wtoi64
_o__wtoi64_l
_o__wtoi_l
_o__wtol
_o__wtol_l
_o__wtoll
_o__wtoll_l
_o__wunlink
_o__wutime32
_o__wutime64
_o__y0
_o__y1
_o__yn
_o_abort
_o_acos
_o_acosh
_o_acoshf
_o_acoshl
_o_asctime
_o_asctime_s
_o_asin
_o_asinh
_o_asinhf
_o_asinhl
_o_atan
_o_atan2
_o_atanh
_o_atanhf
_o_atanhl
_o_atof
_o_atoi
_o_atol
_o_atoll
_o_bsearch
_o_bsearch_s
_o_btowc
_o_calloc
_o_cbrt
_o_cbrtf
_o_ceil
_o_clearerr
_o_clearerr_s
_o_cos
_o_cosh
_o_erf
_o_erfc
_o_erfcf
_o_erfcl
_o_erff
_o_erfl
_o_exit
_o_exp
_o_exp2
_o_exp2f
_o_exp2l
_o_fabs
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgets
_o_fgetwc
_o_fgetws
_o_floor
_o_fma
_o_fmaf
_o_fmal
_o_fmod
_o_fopen
_o_fopen_s
_o_fputc
_o_fputs
_o_fputwc
_o_fputws
_o_fread
_o_fread_s
_o_free
_o_freopen
_o_freopen_s
_o_frexp
_o_fseek
_o_fsetpos
_o_ftell
_o_fwrite
_o_getc
_o_getchar
_o_getenv
_o_getenv_s
_o_gets
_o_gets_s
_o_getwc
_o_getwchar
_o_hypot
_o_is_wctype
_o_isalnum
_o_isalpha
_o_isblank
_o_iscntrl
_o_isdigit
_o_isgraph
_o_isleadbyte
_o_islower
_o_isprint
_o_ispunct
_o_isspace
_o_isupper
_o_iswalnum
_o_iswalpha
_o_iswascii
_o_iswblank
_o_iswcntrl
_o_iswctype
_o_iswdigit
_o_iswgraph
_o_iswlower
_o_iswprint
_o_iswpunct
_o_iswspace
_o_iswupper
_o_iswxdigit
_o_isxdigit
_o_ldexp
_o_lgamma
_o_lgammaf
_o_lgammal
_o_llrint
_o_llrintf
_o_llrintl
_o_llround
_o_llroundf
_o_llroundl
_o_localeconv
_o_log
_o_log10
_o_log1p
_o_log1pf
_o_log1pl
_o_log2
_o_log2f
_o_log2l
_o_logb
_o_logbf
_o_logbl
_o_lrint
_o_lrintf
_o_lrintl
_o_lround
_o_lroundf
_o_lroundl
_o_malloc
_o_mblen
_o_mbrlen
_o_mbrtoc16
_o_mbrtoc32
_o_mbrtowc
_o_mbsrtowcs
_o_mbsrtowcs_s
_o_mbstowcs
_o_mbstowcs_s
_o_mbtowc
_o_memcpy_s
_o_memset
_o_modf
_o_nan
_o_nanf
_o_nanl
_o_nearbyint
_o_nearbyintf
_o_nearbyintl
_o_nextafter
_o_nextafterf
_o_nextafterl
_o_nexttoward
_o_nexttowardf
_o_nexttowardl
_o_pow
_o_powf
_o_putc
_o_putchar
_o_puts
_o_putwc
_o_putwchar
_o_qsort
_o_qsort_s
_o_raise
_o_rand
_o_rand_s
_o_realloc
_o_remainder
_o_remainderf
_o_remainderl
_o_remove
_o_remquo
_o_remquof
_o_remquol
_o_rename
_o_rewind
_o_rint
_o_rintf
_o_rintl
_o_round
_o_roundf
_o_roundl
_o_scalbln
_o_scalblnf
_o_scalblnl
_o_scalbn
_o_scalbnf
_o_scalbnl
_o_set_terminate
_o_setbuf
_o_setlocale
_o_setvbuf
_o_sin
_o_sinh
_o_sqrt
_o_srand
_o_strcat_s
_o_strcoll
_o_strcpy_s
_o_strerror
_o_strerror_s
_o_strftime
_o_strncat_s
_o_strncpy_s
_o_strtod
_o_strtof
_o_strtok
_o_strtok_s
_o_strtol
_o_strtold
_o_strtoll
_o_strtoul
_o_strtoull
_o_system
_o_tan
_o_tanh
_o_terminate
_o_tgamma
_o_tgammaf
_o_tgammal
_o_tmpfile_s
_o_tmpnam_s
_o_tolower
_o_toupper
_o_towlower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcrtomb
_o_wcrtomb_s
_o_wcscat_s
_o_wcscoll
_o_wcscpy
_o_wcscpy_s
_o_wcsftime
_o_wcsncat_s
_o_wcsncpy_s
_o_wcsrtombs
_o_wcsrtombs_s
_o_wcstod
_o_wcstof
_o_wcstok
_o_wcstok_s
_o_wcstol
_o_wcstold
_o_wcstoll
_o_wcstombs
_o_wcstombs_s
_o_wcstoul
_o_wcstoull
_o_wctob
_o_wctomb
_o_wctomb_s
_o_wmemcpy_s
_o_wmemmove_s
_open
_open_osfhandle
_pclose
_pipe
_popen
_purecall
_putc_nolock
_putch
_putch_nolock
_putenv
_putenv_s
_putw
_putwc_nolock
_putwch
_putwch_nolock
_putws
_query_app_type
_query_new_handler
_query_new_mode
_read
_realloc_base
_recalloc
_register_onexit_function
_register_thread_local_exe_atexit_callback
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotl64
_rotr
_rotr64
_scalb
_searchenv
_searchenv_s
_seh_filter_dll
_seh_filter_exe
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_SSE2_enable
_set_abort_behavior
_set_app_type
_set_controlfp
_set_doserrno
_set_errno
_set_error_mode
_set_fmode
_set_invalid_parameter_handler
_set_new_handler
_set_new_mode
_set_printf_count_output
_set_purecall_handler
_set_se_translator
_set_thread_local_invalid_parameter_handler
_seterrormode
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_sopen
_sopen_dispatch
_sopen_s
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp
_spawnvpe
_splitpath
_splitpath_s
_stat32
_stat32i64
_stat64
_stat64i32
_statusfp
_statusfp2
_strcoll_l
_strdate
_strdate_s
_strdup
_strerror
_strerror_s
_strftime_l
_stricmp
_stricmp_l
_stricoll
_stricoll_l
_strlwr
_strlwr_l
_strlwr_s
_strlwr_s_l
_strncoll
_strncoll_l
_strnicmp
_strnicmp_l
_strnicoll
_strnicoll_l
_strnset
_strnset_s
_strrev
_strset
_strset_s
_strtime
_strtime_s
_strtod_l
_strtof_l
_strtoi64
_strtoi64_l
_strtoimax_l
_strtol_l
_strtold_l
_strtoll_l
_strtoui64
_strtoui64_l
_strtoul_l
_strtoull_l
_strtoumax_l
_strupr
_strupr_l
_strupr_s
_strupr_s_l
_strxfrm_l
_swab
_tell
_telli64
_tempnam
_time32
_time64
_timespec32_get
_timespec64_get
_tolower
_tolower_l
_toupper
_toupper_l
_towlower_l
_towupper_l
_tzset
_ui64toa
_ui64toa_s
_ui64tow
_ui64tow_s
_ultoa
_ultoa_s
_ultow
_ultow_s
_umask
_umask_s
_ungetc_nolock
_ungetch
_ungetch_nolock
_ungetwc_nolock
_ungetwch
_ungetwch_nolock
_unlink
_unloaddll
_unlock_file
_unlock_locales
_utime32
_utime64
_waccess
_waccess_s
_wasctime
_wasctime_s
_wassert
_wchdir
_wchmod
_wcreat
_wcreate_locale
_wcscoll_l
_wcsdup
_wcserror
_wcserror_s
_wcsftime_l
_wcsicmp
_wcsicmp_l
_wcsicoll
_wcsicoll_l
_wcslwr
_wcslwr_l
_wcslwr_s
_wcslwr_s_l
_wcsncoll
_wcsncoll_l
_wcsnicmp
_wcsnicmp_l
_wcsnicoll
_wcsnicoll_l
_wcsnset
_wcsnset_s
_wcsrev
_wcsset
_wcsset_s
_wcstod_l
_wcstof_l
_wcstoi64
_wcstoi64_l
_wcstoimax_l
_wcstol_l
_wcstold_l
_wcstoll_l
_wcstombs_l
_wcstombs_s_l
_wcstoui64
_wcstoui64_l
_wcstoul_l
_wcstoull_l
_wcstoumax_l
_wcsupr
_wcsupr_l
_wcsupr_s
_wcsupr_s_l
_wcsxfrm_l
_wctime32
_wctime32_s
_wctime64
_wctime64_s
_wctomb_l
_wctomb_s_l
_wctype
_wdupenv_s
_wexecl
_wexecle
_wexeclp
_wexeclpe
_wexecv
_wexecve
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst32
_wfindfirst32i64
_wfindfirst64
_wfindfirst64i32
_wfindnext32
_wfindnext32i64
_wfindnext64
_wfindnext64i32
_wfopen
_wfopen_s
_wfreopen
_wfreopen_s
_wfsopen
_wfullpath
_wgetcwd
_wgetdcwd
_wgetenv
_wgetenv_s
_wmakepath
_wmakepath_s
_wmkdir
_wmktemp
_wmktemp_s
_wopen
_wperror
_wpopen
_wputenv
_wputenv_s
_wremove
_wrename
_write
_wrmdir
_wsearchenv
_wsearchenv_s
_wsetlocale
_wsopen
_wsopen_dispatch
_wsopen_s
_wspawnl
_wspawnle
_wspawnlp
_wspawnlpe
_wspawnv
_wspawnve
_wspawnvp
_wspawnvpe
_wsplitpath
_wsplitpath_s
_wstat32
_wstat32i64
_wstat64
_wstat64i32
_wstrdate
_wstrdate_s
_wstrtime
_wstrtime_s
_wsystem
_wtempnam
_wtmpnam
_wtmpnam_s
_wtof
_wtof_l
_wtoi
_wtoi64
_wtoi64_l
_wtoi_l
_wtol
_wtol_l
_wtoll
_wtoll_l
_wunlink
_wutime32
_wutime64
_y0
_y1
_yn
abort
abs
acos
acosh
acoshf
acoshl
asctime
asctime_s
asin
asinh
asinhf
asinhl
atan
atan2
atanh
atanhf
atanhl
atof
atoi
atol
atoll
bsearch
bsearch_s
btowc
c16rtomb
c32rtomb
cabs
cabsf
cabsl
cacos
cacosf
cacosh
cacoshf
cacoshl
cacosl
calloc
carg
cargf
cargl
casin
casinf
casinh
casinhf
casinhl
casinl
catan
catanf
catanh
catanhf
catanhl
catanl
cbrt
cbrtf
cbrtl
ccos
ccosf
ccosh
ccoshf
ccoshl
ccosl
ceil
cexp
cexpf
cexpl
cimag
cimagf
cimagl
clearerr
clearerr_s
clock
clog
clog10
clog10f
clog10l
clogf
clogl
conj
conjf
conjl
copysign
copysignf
copysignl
cos
cosh
cpow
cpowf
cpowl
cproj
cprojf
cprojl
creal
crealf
creall
csin
csinf
csinh
csinhf
csinhl
csinl
csqrt
csqrtf
csqrtl
ctan
ctanf
ctanh
ctanhf
ctanhl
ctanl
div
erf
erfc
erfcf
erfcl
erff
erfl
exit
exp
exp2
exp2f
exp2l
expm1
expm1f
expm1l
fabs
fclose
fdim
fdimf
fdiml
feclearexcept
fegetenv
fegetexceptflag
fegetround
feholdexcept
feof
ferror
fesetenv
fesetexceptflag
fesetround
fetestexcept
fflush
fgetc
fgetpos
fgets
fgetwc
fgetws
floor
fma
fmaf
fmal
fmax
fmaxf
fmaxl
fmin
fminf
fminl
fmod
fopen
fopen_s
fputc
fputs
fputwc
fputws
fread
fread_s
free
freopen
freopen_s
frexp
fseek
fsetpos
ftell
fwrite
getc
getchar
getenv
getenv_s
gets
gets_s
getwc
getwchar
hypot
ilogb
ilogbf
ilogbl
imaxabs
imaxdiv
is_wctype
isalnum
isalpha
isblank
iscntrl
isdigit
isgraph
isleadbyte
islower
isprint
ispunct
isspace
isupper
iswalnum
iswalpha
iswascii
iswblank
iswcntrl
iswctype
iswdigit
iswgraph
iswlower
iswprint
iswpunct
iswspace
iswupper
iswxdigit
isxdigit
labs
ldexp
ldiv
lgamma
lgammaf
lgammal
llabs
lldiv
llrint
llrintf
llrintl
llround
llroundf
llroundl
localeconv
log
log10
log1p
log1pf
log1pl
log2
log2f
log2l
logb
logbf
logbl
longjmp
lrint
lrintf
lrintl
lround
lroundf
lroundl
malloc
mblen
mbrlen
mbrtoc16
mbrtoc32
mbrtowc
mbsrtowcs
mbsrtowcs_s
mbstowcs
mbstowcs_s
mbtowc
memchr
memcmp
memcpy
memcpy_s
memmove
memmove_s
memset
modf
nan
nanf
nanl
nearbyint
nearbyintf
nearbyintl
nextafter
nextafterf
nextafterl
nexttoward
nexttowardf
nexttowardl
norm
normf
norml
perror
pow
powf
putc
putchar
puts
putwc
putwchar
qsort
qsort_s
quick_exit
raise
rand
rand_s
realloc
remainder
remainderf
remainderl
remove
remquo
remquof
remquol
rename
rewind
rint
rintf
rintl
round
roundf
roundl
scalbln
scalblnf
scalblnl
scalbn
scalbnf
scalbnl
set_terminate
set_unexpected
setbuf
setlocale
setvbuf
signal
sin
sinh
sqrt
srand
strcat
strcat_s
strchr
strcmp
strcoll
strcpy
strcpy_s
strcspn
strerror
strerror_s
strftime
strlen
strncat
strncat_s
strncmp
strncpy
strncpy_s
strnlen
strpbrk
strrchr
strspn
strstr
strtod
strtof
strtoimax
strtok
strtok_s
strtol
strtold
strtoll
strtoul
strtoull
strtoumax
strxfrm
system
tan
tanh
terminate
tgamma
tgammaf
tgammal
tmpfile
tmpfile_s
tmpnam
tmpnam_s
tolower
toupper
towctrans
towlower
towupper
trunc
truncf
truncl
unexpected
ungetc
ungetwc
wcrtomb
wcrtomb_s
wcscat
wcscat_s
wcschr
wcscmp
wcscoll
wcscpy
wcscpy_s
wcscspn
wcsftime
wcslen
wcsncat
wcsncat_s
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcspbrk
wcsrchr
wcsrtombs
wcsrtombs_s
wcsspn
wcsstr
wcstod
wcstof
wcstoimax
wcstok
wcstok_s
wcstol
wcstold
wcstoll
wcstombs
wcstombs_s
wcstoul
wcstoull
wcstoumax
wcsxfrm
wctob
wctomb
wctomb_s
wctrans
wctype
wmemcpy_s
wmemmove_s
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=253, version=25711,
count=21, id=260, version=25711,
count=1, id=256, version=25711,
count=110, id=259, version=25711,
count=90, id=261, version=25711,
count=621, id=270, version=25711,
count=1, id=255, version=25711,
count=1, id=258, version=25711,
uninst.exe.nsis
- SHA256 c3210a641a5fd779788bcc9accef52d7b533ddc6d5cbc4d6ed88269362e4dd97
- MD5 070b47bd0e0cca9c2c0ffc9817a53826
- SHA1 890c2e2b44eba2343190a4941544a397518a74e7
- SHA512 e36ca9205830a7f7f646b8b722520008258a44ef9d1e99771014027ae205cc7841562654bf109e12b2a88176200f227c56710d3824ea04aa0bba36978cb53a84
- SSDEEP 1536:+HUnKuHPueW20e7ZaG/oFK3vxct4TwNQh1JnXZ:+HCKM220YZ36WZFbxXZ
- MD5 SHA1 SHA512 SSDEEP
urldrv/tdi/amd64/webshieldfilter.sys
- IMPHASH b5514f7ee33e61e55bebf7ca20955200
- SHA256 b5ff1ea46318772e179c56e8e386f9b6c5831a304ebc4783501304aa2a9f8d33
- MD5 21a332af5c8e929415dbde71db19b8ca
- SHA1 dd908daf05b0fa89de836110e68f97cc54859d21
- SHA512 c0dad463aa71c1cfe2cf7de1b605be36f57fc49028a68b37e823ab5449f985b07d4c7b66e828aecbb2fffd240bab3f51d75a2d4ba43fb14674c0af50684d40be
- SSDEEP 1536:9iwOws+rmFBi9rsWsZBey3EV+tj6scdDUfI:9VOwso9QHBeyEV+tj6scr
- MD5 SHA1 SHA512 SSDEEP
Digest
a3:d1:d0:a0:2d:5b:f1:3b:73:56:b3:32:a7:24:94:d6:14:46:5f:0c:ba:f8:4f:3e:df:a9:f5:c2:00:d9:7b:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
47:58:2d:1d:c2:72:92:8b:e3:82:5a:4e:d7:83:a0:c8:e7:34:a4:40
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 6, 2020 - Feb 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 9, 2018 - Feb 10, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
69732
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\repos\netfilter2\driver_tdi\std\objfre_wnet_amd64\amd64\webshieldfilter.pdb
ntoskrnl.exe
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
IoDeleteSymbolicLink
PsLookupProcessByProcessId
RtlInitUnicodeString
IoDeleteDevice
MmGetSystemRoutineAddress
ZwClose
IofCompleteRequest
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ObOpenObjectByPointer
IoDetachDevice
IofCallDriver
IoBuildDeviceIoControlRequest
RtlDowncaseUnicodeString
KeInitializeEvent
MmBuildMdlForNonPagedPool
IoFreeMdl
KeInsertQueueDpc
KeWaitForSingleObject
PsGetCurrentProcessId
IoAllocateMdl
ExFreePoolWithTag
IoFreeIrp
IoReleaseCancelSpinLock
MmMapLockedPagesSpecifyCache
IoAllocateIrp
RtlAppendUnicodeToString
KeInitializeDpc
KeInitializeTimer
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
MmUnmapLockedPages
MmAllocatePagesForMdl
KeSetTimer
ObfReferenceObject
MmFreePagesFromMdl
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
ZwQueryValueKey
ZwSetSecurityObject
SeExports
RtlLengthSid
RtlCreateSecurityDescriptor
ZwOpenKey
KeBugCheckEx
ObReferenceObjectByHandle
ExAllocatePoolWithTag
__C_specific_handler
tdi.sys
TdiMapUserRequest
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=18, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
urldrv/tdi/i386/webshieldfilter.sys
- IMPHASH f5c3ef1e88aabef8ecd0616cd29873f3
- SHA256 3282e62445815de2e45092d9476f6ba5625dc50c96077845c2e32afbf8c9d2bd
- MD5 2aa6d30e357b9a3e63d178f244482150
- SHA1 44577e1a2fbc916fc8acca1ae5c7958ff64f8da4
- SHA512 57964eb6f0e36a4eaf41e7586d1fb37e36896fa26687767012443898c1b59f8bd4900da1f639251ae726e60be8df97812a9b700d5064fcccc0343e59bbb2e0fe
- SSDEEP 1536:8+wIzEJyjGTyUvtarIHl6v4Pm37sc6BUvCnUf:HwIzYyjA10IHl6gO37f6B
- MD5 SHA1 SHA512 SSDEEP
Digest
84:9b:2e:fc:e7:33:ff:46:4d:07:47:50:ba:f2:ad:cc:86:cc:70:ce:b6:62:04:9b:72:34:f2:f8:59:e2:31:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
88:49:c6:b2:d2:7b:17:8a:9b:af:73:38:43:61:42:23:86:c3:db:06
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 6, 2020 - Feb 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 9, 2018 - Feb 10, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
47038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\repos\netfilter2\driver_tdi\std\objfre_wxp_x86\i386\webshieldfilter.pdb
ntoskrnl.exe
IoCreateSymbolicLink
IoCreateDevice
IoDeleteSymbolicLink
IofCompleteRequest
ZwClose
ObfDereferenceObject
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoDetachDevice
IofCallDriver
IoFreeMdl
memcpy
MmBuildMdlForNonPagedPool
IoBuildDeviceIoControlRequest
IoAllocateMdl
RtlDowncaseUnicodeString
PsGetCurrentProcessId
KeWaitForSingleObject
KeInitializeEvent
KeInsertQueueDpc
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoDeleteDevice
MmMapLockedPagesSpecifyCache
IoAllocateIrp
KeInitializeTimer
KeInitializeDpc
RtlAppendUnicodeToString
IoAttachDeviceToDeviceStack
IoGetDeviceObjectPointer
ObfReferenceObject
KeSetTimer
MmUnmapLockedPages
MmFreePagesFromMdl
MmAllocatePagesForMdl
ZwQueryValueKey
ZwOpenKey
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
SeExports
RtlLengthSid
KeTickCount
KeBugCheckEx
_aullrem
ExFreePoolWithTag
memset
IoFreeIrp
ExAllocatePoolWithTag
RtlUnwind
hal
KfAcquireSpinLock
KfReleaseSpinLock
tdi.sys
TdiMapUserRequest
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
640B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=22, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
urldrv/wfp/win10/amd64/webshieldfilter.sys
- IMPHASH c089b867a4b799a2ece4dca0900e084b
- SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
- MD5 b797771c87184870eb95d2e50e17a9e7
- SHA1 b303acad4220542c3150bb979aa966c2640434af
- SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
- SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3b:cd:6b:d8:3b:c6:71:b8:fe:00:00:00:00:00:3b
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Minor OS version
2
Major OS version
6
Entry point
67504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb
fwpkclnt.sys
FwpmFreeMemory0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowAbort0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsRedirectHandleCreate0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsPendClassify0
FwpsAllocateNetBufferAndNetBufferList0
ndis.sys
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
ntoskrnl.exe
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
__C_specific_handler
SeExports
RtlGetVersion
RtlCompareMemory
RtlValidSid
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=187, version=30716,
count=108, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=7, id=188, version=30716,
count=9, id=206, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
urldrv/wfp/win10/i386/webshieldfilter.sys
- IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
- SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
- MD5 709ae7d4bb1817abf5b22bd5eb6d1943
- SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
- SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
- SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Minor OS version
2
Major OS version
6
Entry point
62392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb
fwpkclnt.sys
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowAbort0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpmTransactionBegin0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsFlowAssociateContext0
FwpsAcquireClassifyHandle0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsPendClassify0
FwpsFreeCloneNetBufferList0
ndis.sys
NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
ntoskrnl.exe
memset
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
SeExports
RtlGetVersion
KeQuerySystemTime
_allmul
_aulldiv
_aullrem
RtlCompareMemory
RtlValidSid
RtlUnwind
memcpy
ExUuidCreate
ExAllocatePoolWithTag
swprintf_s
hal
KeReleaseInStackQueuedSpinLock
KeGetCurrentIrql
KeAcquireInStackQueuedSpinLock
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=187, version=30716,
count=7, id=188, version=30716,
count=114, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=9, id=206, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
urldrv/wfp/win7/amd64/webshieldfilter.sys
- IMPHASH 22602cf9c9696e7b40d9844e9d493520
- SHA256 16399d8faf4a30ed463b8db7900fe0e67aa981a519d324f32349ba2abd779647
- MD5 36a5f7f6601d2427426588ffd415ea89
- SHA1 e69a5cfde38c82a6b0081e476fd83f1e3211337c
- SHA512 3379adcfbcb23cbdfc62390a0ebedde75810b1f90c19bb66ce142594994a11545090583cc9d71e4e28fb2bf875fd5798f9adb9e339ba9a146513734fb74693dd
- SSDEEP 1536:sGKnLHVUPDbU08dqnBtZ1ZPM1QubbE3CIXkuTtWuUf:mLHqDQZiaQA7IX5tW
- MD5 SHA1 SHA512 SSDEEP
Digest
38:31:bf:f5:3a:ed:5f:8d:53:f1:74:d6:9b:a0:53:81:c4:68:d4:38:ee:9f:14:b2:ca:df:24:6e:6c:99:9e:f8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
77:8a:12:df:b3:22:57:23:07:ce:80:80:10:99:23:b0:8b:02:25:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 6, 2020 - Feb 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 9, 2018 - Feb 10, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
77924
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\repos\netfilter2\driver_wfp\std\objfre_win7_amd64\amd64\webshieldfilter.pdb
ntoskrnl.exe
KeBugCheckEx
ExUuidCreate
swprintf_s
RtlCreateSecurityDescriptor
RtlLengthSid
IoAllocateMdl
ObOpenObjectByPointer
IoReleaseCancelSpinLock
IoCreateDevice
MmFreePagesFromMdl
ObfDereferenceObject
PsGetCurrentProcessId
IoCreateSymbolicLink
SeExports
ZwSetSecurityObject
KeWaitForSingleObject
ObReferenceObjectByHandle
ZwSetInformationThread
IofCompleteRequest
PsTerminateSystemThread
ZwQueryValueKey
MmMapLockedPagesSpecifyCache
PsCreateSystemThread
RtlAddAccessAllowedAce
MmBuildMdlForNonPagedPool
MmAllocatePagesForMdl
KeInitializeEvent
RtlAppendUnicodeToString
MmGetSystemRoutineAddress
KeSetEvent
IoDeleteDevice
RtlSetDaclSecurityDescriptor
PsLookupProcessByProcessId
RtlCreateAcl
IoDeleteSymbolicLink
MmUnmapLockedPages
RtlCompareMemory
RtlValidSid
ExDeleteNPagedLookasideList
ExQueryDepthSList
IoFreeMdl
ExpInterlockedPopEntrySList
KeAcquireInStackQueuedSpinLock
ExpInterlockedPushEntrySList
KeReleaseInStackQueuedSpinLock
ExInitializeNPagedLookasideList
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwOpenKey
ZwClose
RtlInitUnicodeString
__C_specific_handler
fwpkclnt.sys
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpmSubLayerAdd0
FwpsQueryPacketInjectionState0
FwpmSubLayerDeleteByKey0
FwpmSubLayerEnum0
FwpmTransactionCommit0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerDestroyEnumHandle0
FwpmProviderContextDeleteByKey0
FwpmCalloutAdd0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmEngineOpen0
FwpsAcquireClassifyHandle0
FwpmFilterAdd0
FwpsPendClassify0
FwpsCalloutRegister1
FwpmTransactionBegin0
FwpmEngineClose0
FwpmFreeMemory0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsInjectNetworkReceiveAsync0
FwpsFreeCloneNetBufferList0
FwpsInjectionHandleDestroy0
FwpsConstructIpHeaderForTransportPacket0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectionHandleCreate0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkSendAsync0
FwpsCopyStreamDataToBuffer0
FwpsInjectTransportSendAsync0
FwpsFlowRemoveContext0
FwpsCloneStreamData0
FwpsCompleteClassify0
FwpsStreamInjectAsync0
FwpsReleaseClassifyHandle0
FwpsDiscardClonedStreamData0
FwpsFreeNetBufferList0
FwpmBfeStateUnsubscribeChanges0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
ndis.sys
NdisAllocateGenericObject
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisInitializeEvent
NdisFreeGenericObject
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
494B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=104, id=1, productName=Unmarked objects,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
urldrv/wfp/win7/i386/webshieldfilter.sys
- IMPHASH 57038502f0601ba9f99e8f3d4355bb56
- SHA256 3512260c75fe5ab584e7c072c38a9b17f4603c7b735d9e9e1e0b2f0ff901abbd
- MD5 9508031dacfbbaf2595fdc9dacdb3b2a
- SHA1 7b85a2830535a53068a8167093de36a3d3176e26
- SHA512 a27287409313bd084510f92677111b92424c6a39eaf20e53519f563fe5a8d3a339b5e5d7399713164b41e1e22fc6ad87f6161f602ebdc74f9785f87e0bafc01e
- SSDEEP 1536:heDMC9wA1lHT6pmrnPWxtbHoncn3Ii62NOtwFqGuPUfM:AqOMpmrPWxFonXi628OAhP
- MD5 SHA1 SHA512 SSDEEP
Digest
16:fe:47:46:39:5e:71:c2:f3:bf:e4:c5:ca:06:fa:a2:f5:12:2a:e5:9b:d2:87:9d:62:99:a4:3a:81:64:5d:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
PE Signature issue
Digest
ed:ad:4d:c2:1f:66:63:34:6c:b5:1e:71:99:fc:ef:2d:bb:53:41:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Chains
May 28, 2020
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Denmead,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
02:2f:04:e9:89:68:b7:b2:96:3b:7f:0b:9d:27:d0:99
Issuer
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 6, 2020 - Feb 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
SERIALNUMBER=11173270,CN=Protected Antivirus Limited,O=Protected Antivirus Limited,L=Fareham,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
Serial Number
08:24:71:bd:dc:aa:40:6b:41:1e:36:b8:0a:c3:e6:5a
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 9, 2018 - Feb 10, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
6
Entry point
61502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\repos\netfilter2\driver_wfp\std\objfre_win7_x86\i386\webshieldfilter.pdb
ntoskrnl.exe
memcpy
RtlValidSid
IoFreeMdl
RtlUnwind
KeBugCheckEx
RtlCompareMemory
KeTickCount
_allmul
_aulldiv
KeQuerySystemTime
ExUuidCreate
swprintf_s
KeInitializeEvent
PsCreateSystemThread
ZwSetInformationThread
ObReferenceObjectByHandle
RtlAppendUnicodeToString
IoCreateDevice
IoCreateSymbolicLink
PsTerminateSystemThread
MmGetSystemRoutineAddress
PsLookupProcessByProcessId
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoReleaseCancelSpinLock
PsGetCurrentProcessId
IofCompleteRequest
IoDeleteSymbolicLink
IoDeleteDevice
KeWaitForSingleObject
ObfDereferenceObject
MmAllocatePagesForMdl
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
MmUnmapLockedPages
KeSetEvent
ObOpenObjectByPointer
RtlLengthSid
SeExports
RtlCreateAcl
RtlAddAccessAllowedAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
ZwSetSecurityObject
ZwQueryValueKey
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
InterlockedPushEntrySList
InterlockedPopEntrySList
_aullrem
ExFreePoolWithTag
memset
ExAllocatePoolWithTag
RtlInitUnicodeString
ZwOpenKey
ZwClose
hal
KeReleaseInStackQueuedSpinLock
KeGetCurrentIrql
KeAcquireInStackQueuedSpinLock
fwpkclnt.sys
FwpsStreamInjectAsync0
FwpmEngineOpen0
FwpmProviderAdd0
FwpmSubLayerDeleteByKey0
FwpmProviderContextDeleteByKey0
FwpsAcquireClassifyHandle0
FwpsQueryPacketInjectionState0
FwpsFlowAssociateContext0
FwpmSubLayerAdd0
FwpmSubLayerCreateEnumHandle0
FwpmFreeMemory0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpmTransactionBegin0
FwpmEngineClose0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpsCalloutRegister1
FwpsCalloutUnregisterByKey0
FwpsPendClassify0
FwpsInjectionHandleCreate0
FwpsCopyStreamDataToBuffer0
FwpsInjectNetworkReceiveAsync0
FwpsAcquireWritableLayerDataPointer0
FwpsApplyModifiedLayerData0
FwpsAllocateNetBufferAndNetBufferList0
FwpsInjectTransportSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectNetworkSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsFreeCloneNetBufferList0
FwpsInjectionHandleDestroy0
FwpsFlowRemoveContext0
FwpsCloneStreamData0
FwpsCompleteClassify0
FwpsReleaseClassifyHandle0
FwpsDiscardClonedStreamData0
FwpsFreeNetBufferList0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
ndis.sys
NdisFreeGenericObject
NdisInitializeEvent
NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisAllocateNetBufferListPool
NdisAllocateGenericObject
NdisWaitEvent
Name
.text
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=111, id=1, productName=Unmarked objects,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
urldrv/wfp/win8/amd64/webshieldfilter.sys
- IMPHASH c089b867a4b799a2ece4dca0900e084b
- SHA256 c190a676d707f290a0f6fccb60ecbc4b3b5dea5ea27d552095acd4110aff51bc
- MD5 b797771c87184870eb95d2e50e17a9e7
- SHA1 b303acad4220542c3150bb979aa966c2640434af
- SHA512 60ced524fa3bb611b6a73734b7aa6bc30d10fdbf9914a8e4c79e1b79c6402a678fb4963a29f237418affba806ca39bdf766b229b7679d50431aa834e6fa99341
- SSDEEP 1536:WMd62uktOfNwZHmussJFDEI6rzztE3yT/hdf5YrSuuKGvq9Q:WMdNOf+FfQI65YluKGSi
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
12:be:60:b6:6a:cb:05:01:df:51:df:6d:97:b2:43:df:19:ab:f2:2c:56:28:20:c2:19:c2:54:90:ae:ea:d6:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3b:cd:6b:d8:3b:c6:71:b8:fe:00:00:00:00:00:3b
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Minor OS version
2
Major OS version
6
Entry point
67504
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\repos\netfilter2\driver_wfp\Win8\Win8Release\x64\webshieldfilter.pdb
fwpkclnt.sys
FwpmFreeMemory0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowAbort0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsRedirectHandleCreate0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsAcquireClassifyHandle0
FwpsFlowAssociateContext0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsPendClassify0
FwpsAllocateNetBufferAndNetBufferList0
ndis.sys
NdisFreeNetBufferListPool
NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
ntoskrnl.exe
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
__C_specific_handler
SeExports
RtlGetVersion
RtlCompareMemory
RtlValidSid
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=187, version=30716,
count=108, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=7, id=188, version=30716,
count=9, id=206, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
urldrv/wfp/win8/i386/webshieldfilter.sys
- IMPHASH f0d95f2a52d65547aaaf71fdce71ca9f
- SHA256 7a8748b1531e99f3549f579534e193fd9e2b1a96042313037d2aa6ad9c1e140d
- MD5 709ae7d4bb1817abf5b22bd5eb6d1943
- SHA1 4123eb3773d91e5294abb1d1ad3cac52a34d5a48
- SHA512 dc1f66be19368e7c9325a4f52e47b9d813912d06257a670ae42ba26206c751918fdf3a61eb2e383230ba6bb6a25865e594c5df80cb244ae1137e517d4dcc24c2
- SSDEEP 1536:pHUU8fa7XUXG/jsc4CVkl5jpGt7xu6tKJp6NbUzWE3dlsl48jStEF:j8y7k4jsc4CM5jpKwAKJwo3lZW
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d5:f1:8c:9e:97:59:77:23:d0:a2:65:3e:da:34:44:36:bc:2b:ae:37:27:35:b6:f0:71:3b:b5:eb:a9:04:9e:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Issuer
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 11, 2020 - Mar 5, 2021
Subject
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 15, 2014 - Oct 15, 2029
Minor OS version
2
Major OS version
6
Entry point
62392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\repos\netfilter2\driver_wfp\Win8\Win8Release\Win32\webshieldfilter.pdb
fwpkclnt.sys
FwpmTransactionCommit0
FwpmTransactionAbort0
FwpmProviderAdd0
FwpmProviderContextDeleteByKey0
FwpmSubLayerAdd0
FwpmSubLayerDeleteByKey0
FwpmSubLayerCreateEnumHandle0
FwpmSubLayerEnum0
FwpmSubLayerDestroyEnumHandle0
FwpmCalloutAdd0
FwpmFilterAdd0
FwpsFlowAbort0
FwpsInjectionHandleCreate0
FwpsInjectionHandleDestroy0
FwpsAllocateNetBufferAndNetBufferList0
FwpsFreeNetBufferList0
FwpmTransactionBegin0
FwpsInjectNetworkSendAsync0
FwpsConstructIpHeaderForTransportPacket0
FwpsInjectTransportSendAsync0
FwpsInjectTransportReceiveAsync0
FwpsInjectNetworkReceiveAsync0
FwpsStreamInjectAsync0
FwpsCopyStreamDataToBuffer0
FwpmBfeStateGet0
FwpmBfeStateSubscribeChanges0
FwpmBfeStateUnsubscribeChanges0
FwpsFlowRemoveContext0
FwpsCompleteClassify0
FwpsRedirectHandleDestroy0
FwpsCloneStreamData0
FwpsDiscardClonedStreamData0
FwpmEngineClose0
FwpmEngineOpen0
FwpmFreeMemory0
FwpsRedirectHandleCreate0
FwpsQueryPacketInjectionState0
FwpsApplyModifiedLayerData0
FwpsAcquireWritableLayerDataPointer0
FwpsReleaseClassifyHandle0
FwpsFlowAssociateContext0
FwpsAcquireClassifyHandle0
FwpsCalloutUnregisterByKey0
FwpsCalloutRegister1
FwpsPendClassify0
FwpsFreeCloneNetBufferList0
ndis.sys
NdisAllocateNetBufferListPool
NdisWaitEvent
NdisInitializeEvent
NdisFreeGenericObject
NdisAllocateGenericObject
NdisGetDataBuffer
NdisAdvanceNetBufferDataStart
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListPool
ntoskrnl.exe
memset
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeInitializeSpinLock
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
SeExports
RtlGetVersion
KeQuerySystemTime
_allmul
_aulldiv
_aullrem
RtlCompareMemory
RtlValidSid
RtlUnwind
memcpy
ExUuidCreate
ExAllocatePoolWithTag
swprintf_s
hal
KeReleaseInStackQueuedSpinLock
KeGetCurrentIrql
KeAcquireInStackQueuedSpinLock
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=187, version=30716,
count=7, id=188, version=30716,
count=114, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=9, id=206, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
vcruntime140_cor3.dll
- IMPHASH b06d4116da69a513992d529f84731e6f
- SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
- MD5 1a84957b6e681fca057160cd04e26b27
- SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
- SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
- SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a6:9d:85:b1:34:64:a0:a9:69:70:90:5b:bb:98:00:b8:16:3e:b7:c6:a4:68:de:cd:a5:02:95:79:5e:4b:ae:bf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
58816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb
api-ms-win-crt-runtime-l1-1-0
terminate
abort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
strncmp
wcsncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-convert-l1-1-0
atol
kernel32
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
GetProcAddress
FreeLibrary
RtlUnwind
VirtualQuery
EncodePointer
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__TypeMatch
__current_exception
__current_exception_context
__intrinsic_setjmp
__processing_throw
__report_gsfailure
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_destroy_list
__std_type_info_hash
__std_type_info_name
__telemetry_main_invoke_trigger
__telemetry_main_return_trigger
__unDName
__unDNameEx
__uncaught_exception
__uncaught_exceptions
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_InitializeCriticalSectionEx
__vcrt_LoadLibraryExW
_chkesp
_except_handler2
_except_handler3
_except_handler4_common
_get_purecall_handler
_get_unexpected
_global_unwind2
_is_exception_typeof
_local_unwind2
_local_unwind4
_longjmpex
_purecall
_seh_longjmp_unwind
_seh_longjmp_unwind4
_set_purecall_handler
_set_se_translator
_setjmp3
longjmp
memchr
memcmp
memcpy
memmove
memset
set_unexpected
strchr
strrchr
strstr
unexpected
wcschr
wcsrchr
wcsstr
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=28900,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=1, productName=Unmarked objects,
count=19, id=259, version=30034,
count=21, id=260, version=30034,
count=28, id=261, version=30034,
count=1, id=256, version=30034,
count=1, id=255, version=30034,
count=1, id=258, version=30034,
wpfgfx_cor3.dll
- IMPHASH 5514d2d9b95c73162286e973c6f47da0
- SHA256 69c03db89ad14cdf2c05db284d1452a517d7127bafd871334685d715f662d203
- MD5 52d8f7f0ab9d679209b707c7ebc8377e
- SHA1 7042a8788ea40f29b2fab2ec249dfd9e8c6ed7e6
- SHA512 8617663d2292ca05d1873cbf9cf2397a0e56214c5bf5d66d5b1c8e95658a5604e1d27656ce853d1306c4a21575e3fe45934a0b8e5bb256644cd064b8d8269c87
- SSDEEP 24576:jA4+95hzAxEvPcYCUhGU6YVjfB458Yqj0ggwBklV3SFyyTNjnm81d1:k4+fxAxEvPXG+Ig0GFycND9d1
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
04:21:d5:d2:3e:09:dc:80:72:2c:dc:1d:7d:45:c3:c8:5d:10:f1:50:f6:e7:ec:e0:45:ff:af:01:22:d0:6f:8e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 12, 2022 - May 11, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
335440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\bin\WpfGfx\Win32\Release\wpfgfx_cor3.pdb
kernel32
GetCurrentThreadId
ResetEvent
TryEnterCriticalSection
MulDiv
QueryPerformanceCounter
Sleep
FindResourceW
LoadResource
LockResource
GlobalUnlock
QueryPerformanceFrequency
InitializeSListHead
InterlockedPushEntrySList
QueryDepthSList
InterlockedFlushSList
SleepEx
RtlCaptureStackBackTrace
IsDebuggerPresent
ExitProcess
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
TerminateThread
GetCurrentThread
GetCurrentProcessId
SetThreadPriority
CreateEventW
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
WaitForSingleObjectEx
RaiseException
CloseHandle
WaitForSingleObject
SetEvent
LoadLibraryExW
FindClose
FindFirstFileW
GetSystemDirectoryW
SystemTimeToFileTime
LoadLibraryA
LoadLibraryExA
GetVersionExW
DebugBreak
GetModuleFileNameW
CreateThread
FreeLibrary
OutputDebugStringW
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetLastError
DisableThreadLibraryCalls
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
UnhandledExceptionFilter
GetModuleHandleW
GetProcAddress
GetSystemInfo
VirtualProtect
WaitForMultipleObjects
GetTickCount
SizeofResource
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualFree
VirtualAlloc
VerSetConditionMask
VirtualQuery
advapi32
UnregisterTraceGuids
RegQueryValueExW
RegCloseKey
AllocateLocallyUniqueId
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
TraceEvent
RegOpenKeyExW
user32
ClientToScreen
EnumDisplayMonitors
GetMonitorInfoW
SystemParametersInfoW
EnumDisplayDevicesW
MonitorFromWindow
SetLayeredWindowAttributes
WindowFromDC
GetWindowRect
EnumDisplaySettingsW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
OffsetRect
GetWindowLongW
GetGuiResources
EqualRect
IntersectRect
SetRect
IsRectEmpty
PostMessageW
RegisterWindowMessageW
GetDesktopWindow
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
IsWindow
UpdateLayeredWindow
ScreenToClient
GetParent
GetWindowDC
gdi32
CreateCompatibleBitmap
CreatePalette
OffsetRgn
RealizePalette
GetSystemPaletteEntries
GetDIBits
GetRandomRgn
CreateCompatibleDC
SelectPalette
CreateRectRgn
GetRgnBox
SetRectRgn
GetRegionData
RectInRegion
CombineRgn
CreateRectRgnIndirect
SelectObject
CreateDIBSection
DeleteObject
CreateICW
GetDeviceCaps
DeleteDC
BitBlt
SetLayout
ole32
CoUninitialize
PropVariantClear
PropVariantCopy
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
CoCreateInstance
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
d3dcompiler_47_cor3
D3DCompile
api-ms-win-crt-runtime-l1-1-0
abort
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
terminate
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-math-l1-1-0
floor
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
_libm_sse2_log_precise
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_CIfmod
_CIatan2
nextafterf
modf
_finite
_isnan
_copysign
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
api-ms-win-crt-string-l1-1-0
strcpy_s
memset
wcsncmp
ntdll
DbgPrintEx
RtlInitializeBitMap
RtlFindClearBitsAndSet
DbgPrompt
RtlClearBits
NtQuerySystemInformation
RtlUnwind
RtlInterlockedFlushSList
DbgBreakPoint
RtlSetBits
api-ms-win-crt-utility-l1-1-0
qsort
GetNextPerfElementId
IWICColorContext_GetExifColorSpace_Proxy
IWICColorContext_GetProfileBytes_Proxy
IWICColorContext_GetType_Proxy
InteropDeviceBitmap_AddDirtyRect
InteropDeviceBitmap_Create
InteropDeviceBitmap_Detach
InteropDeviceBitmap_GetAsSoftwareBitmap
MIL3DCalcProjected2DBounds
MILAddRef
MILCreateEventProxy
MILCreateFactory
MILCreateStreamFromStreamDescriptor
MILFactoryCreateBitmapRenderTarget
MILFactoryCreateMediaPlayer
MILFactoryCreateSWRenderTargetForBitmap
MILIStreamWrite
MILLoadResource
MILMediaCanPause
MILMediaClose
MILMediaGetBufferingProgress
MILMediaGetDownloadProgress
MILMediaGetMediaLength
MILMediaGetNaturalHeight
MILMediaGetNaturalWidth
MILMediaGetPosition
MILMediaHasAudio
MILMediaHasVideo
MILMediaIsBuffering
MILMediaNeedUIFrameUpdate
MILMediaOpen
MILMediaProcessExitHandler
MILMediaSetBalance
MILMediaSetIsScrubbingEnabled
MILMediaSetPosition
MILMediaSetRate
MILMediaSetVolume
MILMediaShutdown
MILMediaStop
MILQueryInterface
MILRelease
MILRenderTargetBitmapClear
MILRenderTargetBitmapGetBitmap
MILSwDoubleBufferedBitmapAddDirtyRect
MILSwDoubleBufferedBitmapCreate
MILSwDoubleBufferedBitmapGetBackBuffer
MILSwDoubleBufferedBitmapProtectBackBuffer
MILUpdateSystemParametersInfo
MilChannel_AppendCommandData
MilChannel_BeginCommand
MilChannel_CloseBatch
MilChannel_CommitChannel
MilChannel_EndCommand
MilChannel_GetMarshalType
MilChannel_SetNotificationWindow
MilChannel_SetReceiveBroadcastMessages
MilCompositionEngine_DeinitializePartitionManager
MilCompositionEngine_EnterCompositionEngineLock
MilCompositionEngine_ExitCompositionEngineLock
MilCompositionEngine_GetComposedEventId
MilCompositionEngine_InitializePartitionManager
MilCompositionEngine_UpdateSchedulerSettings
MilComposition_PeekNextMessage
MilComposition_SyncFlush
MilComposition_WaitForNextMessage
MilConnection_CreateChannel
MilConnection_DestroyChannel
MilContent_AttachToHwnd
MilContent_DetachFromHwnd
MilGlyphRun_GetGlyphOutline
MilGlyphRun_ReleasePathGeometryData
MilPlayer_Create
MilPlayer_Process
MilResource_CreateCWICWrapperBitmap
MilResource_CreateOrAddRefOnChannel
MilResource_DuplicateHandle
MilResource_GetRefCountOnChannel
MilResource_ReleaseOnChannel
MilResource_SendCommand
MilResource_SendCommandBitmapSource
MilResource_SendCommandMedia
MilUtility_ArcToBezier
MilUtility_CopyPixelBuffer
MilUtility_GeometryGetArea
MilUtility_GetPointAtLengthFraction
MilUtility_GetTileBrushMapping
MilUtility_PathGeometryBounds
MilUtility_PathGeometryCombine
MilUtility_PathGeometryFlatten
MilUtility_PathGeometryHitTest
MilUtility_PathGeometryHitTestPathGeometry
MilUtility_PathGeometryOutline
MilUtility_PathGeometryWiden
MilUtility_PolygonBounds
MilUtility_PolygonHitTest
MilVersionCheck
MilVisualTarget_AttachToHwnd
MilVisualTarget_DetachFromHwnd
RenderOptions_ForceSoftwareRenderingModeForProcess
RenderOptions_IsSoftwareRenderingForcedForProcess
SetMilPerfInstrumentationFlags
WgxConnection_Create
WgxConnection_Disconnect
WgxConnection_SameThreadPresent
WgxConnection_ShouldForceSoftwareForGraphicsStreamClient
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
217KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=263, version=25711,
count=1, id=261, version=25711,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=261, version=30034,
count=14, id=260, version=30034,
count=14, id=259, version=30034,
count=7, id=260, version=25711,
count=17, id=257, version=25711,
count=258, id=1, productName=Unmarked objects,
count=422, id=265, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=3, id=151,
count=1, id=258, version=30140,
wscf.exe
- IMPHASH e756a2c7ee0dd3d54f8bcc5d0d1200ac
- SHA256 266d4d9769b1498992fc953f2c82b9b6853b311f06adca63825a07c4dce72da0
- MD5 25330672ddf4763c86f65438ea2561d6
- SHA1 94a602fffe514fdc9d3824263f6491f1342a9cf2
- SHA512 0cb2aea5155843e9ba4a5657acb8451665a722720f0e1d4a66935752aaaabcb56b032f31a5dbf4e5f4f310f28ca0d9e597c2f3f12a9a162e56063338db018630
- SSDEEP 6144:TFb5y9XQG2/4xIdIevQiwhnFPEuEORXaRsRZKoAOWL8DYrS:TZ5GQG2/4xIxBhuEORXaRsRZKoAYYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
45501
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\repos\protected_elam\protected_elam\Release\wscf.pdb
shell32
ShellExecuteW
kernel32
GetCPInfo
WriteConsoleW
MultiByteToWideChar
LocalFree
FormatMessageA
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CloseHandle
GetLastError
SetLastError
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
GetFileSizeEx
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
Name
.text
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=27412,
count=172, id=261, version=27412,
count=22, id=260, version=27412,
count=17, id=260, version=29118,
count=20, id=259, version=29118,
count=78, id=261, version=29118,
count=5, id=257, version=27412,
count=107, id=1, productName=Unmarked objects,
count=1, id=265, version=29335,
count=1, id=255, productName=VS2019 v16.8.3 build 29335, version=29335,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.8.3 build 29335, version=29335,
x86/update.dll
- IMPHASH b35ddd7b181110cc0604ac6c7b6d05ea
- SHA256 fc85d8cc5fe0327be1253c1f69ca48eaa30d9aa583becb6f1e678e7960e33022
- MD5 8fcfabdf2458336b061a06d7362f1c37
- SHA1 ed669e2c73292d3a6510ed9d670bdf56cb7ca92d
- SHA512 056eb2071e33efaa7ac52002a906008baf0f8c59f8fcc99c500510c327a6b2917922706c9ec05e12f716573d6d9321e28190f1a911f765d596fd4c0d4c882dec
- SSDEEP 49152:Clg4XDo+apyPH5kscRzpBvMXBoHI1LFQQ2W9gtxWhToexMX+tPTqH8dO0t3z6XJh:Clg8oskscR/MRoHI1L0tiTVhqHuO0a
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
26:df:a1:0b:ac:00:44:53:53:db:db:cd:fb:40:3e:78:99:fb:3e:6e:5f:20:be:90:a1:65:8b:4a:d7:0c:49:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Chains
Aug 22, 2024
Subject
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Serial Number
54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 16, 2020 - Apr 16, 2045
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:0f:14:d2:35:88:fc:d5:b3:27:d8:00:00:00:00:0f:14
Issuer
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2023 - Jun 7, 2023
Subject
CN=Avira Operations GmbH,O=Avira Operations GmbH,L=Tettnang,ST=Baden-Württemberg,C=DE
Serial Number
33:00:00:0f:14:d2:35:88:fc:d5:b3:27:d8:00:00:00:00:0f:14
Issuer
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2023 - Jun 7, 2023
Subject
CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Issuer
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 13, 2021 - Apr 13, 2026
Subject
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Apr 1, 2021 - Apr 1, 2036
Minor OS version
0
Major OS version
6
Entry point
2236960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\bamboo-build\WPPSDK-UPD-WINDX86\build-windows\src\update.pdb
crypt32
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertOpenStore
ws2_32
getsockopt
send
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
inet_ntop
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
kernel32
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetConsoleOutputCP
GetModuleFileNameW
CreateProcessW
DuplicateHandle
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
Sleep
CreateFileW
CloseHandle
GetLastError
MoveFileExW
GetShortPathNameW
FlushFileBuffers
ReadFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetUserDefaultLCID
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoW
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentVariableW
WriteFile
DeleteFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSection
GetModuleFileNameA
LoadLibraryExA
FormatMessageA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
LoadLibraryExW
InterlockedFlushSList
EnumSystemLocalesW
HeapReAlloc
SetStdHandle
WaitForSingleObject
GetExitCodeProcess
CreatePipe
GetTimeZoneInformation
DeleteFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
IsValidLocale
QueryPerformanceFrequency
RtlUnwind
LocalFree
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
GetTempPathW
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
GetStringTypeW
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
advapi32
CryptEnumProvidersW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
SystemFunction036
CryptAcquireContextW
bcrypt
BCryptGenRandom
UpdateCreate
UpdateCreateV2
UpdateCreateV3
UpdateCreateV4
UpdateCreateV5
UpdateCreateV6
UpdateDestroy
UpdateDestroyV2
UpdateGetLastUpdatedFiles
UpdateGetUpdateVersion
UpdateModuleUpdate
UpdateModuleUpdateV3
UpdateModuleUpdateV4
UpdateModuleUpdateV5
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
623KB
Virtual Size
623KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=48, id=259, version=30795,
count=223, id=261, version=30795,
count=33, id=260, version=30795,
count=6, id=253, version=31328,
count=19, id=260, version=31328,
count=27, id=259, version=31328,
count=77, id=261, version=31328,
count=13, id=257, version=30795,
count=242, id=1, productName=Unmarked objects,
count=3, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,
count=21, productName=Unmarked objects (old),
count=695, id=260, version=31335,
count=37, id=261, version=31335,
count=1, id=256, version=31335,
count=1, id=255, version=31335,
count=1, id=258, version=31335,
avast_free_antivirus_setup_online.exe
- IMPHASH d692b06eb88ecd849f7778fde1ba5c2b
- SHA256 611b4671419f50dcd8591946aab80075db0a46cb7aecb5beccc0814034b6d9c1
- MD5 997908c2cdf9c7e6285185b7dbeab10f
- SHA1 1a771ab814842802852d4fe5069856cab3a51824
- SHA512 2479f66feeb08ad0f87b3707f78651d7c1d4a814c7bb169fdc5fe8a23db5d8c7e48f0d270ed1188daf4ddd71b5c0af6c6dc4ebdb75b6efc4c9492f1014a46d86
- SSDEEP 6144:7kDOZargxSHmQv2+B9EwCzVQMeQ6qQ/7:7kDOymC2+7MpCX/7
- MD5 SHA1 SHA512 SSDEEP
Digest
04:20:c7:42:f6:e5:99:da:05:10:12:9f:59:74:46:5c:89:34:54:56:26:2a:82:d3:0f:75:59:df:33:ba:4a:c7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ
Chains
Aug 13, 2024
CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ
Serial Number
01:5a:6b:ec:4d:7f:54:9f:e5:25:c8:52:df:67:0e:13
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 16, 2023 - Jan 15, 2026
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb
kernel32
InterlockedExchangeAdd
HeapFree
GetLastError
SetLastError
Sleep
GetFileSizeEx
WriteFile
SetEndOfFile
SetFilePointerEx
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
FindResourceExW
EnumResourceNamesW
GetWindowsDirectoryW
CreateDirectoryW
CreateFileW
MultiByteToWideChar
CreateThread
GetSystemTimeAsFileTime
GetNativeSystemInfo
lstrcatA
lstrlenA
GetVersionExA
GetCurrentProcess
GetExitCodeProcess
ResumeThread
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateProcessW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetDiskFreeSpaceExW
CopyFileW
MoveFileExW
CreateHardLinkW
LocalFree
HeapAlloc
GetProcessHeap
HeapSetInformation
ExitProcess
IsProcessorFeaturePresent
lstrcpyW
GetModuleHandleW
GetCommandLineW
GetSystemDirectoryW
SetDllDirectoryW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
FindResourceW
LoadLibraryW
SizeofResource
LoadResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExW
FreeLibrary
LockResource
GetFileType
GetStringTypeW
InterlockedExchange
GetUserDefaultLangID
GetProcAddress
GetACP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryA
DecodePointer
GetVersion
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
OutputDebugStringW
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
user32
ReleaseDC
GetMessageW
TranslateMessage
DispatchMessageW
AllowSetForegroundWindow
PostMessageW
wsprintfA
LoadStringW
MessageBoxExW
wsprintfW
SystemParametersInfoW
IsDialogMessageW
LoadImageW
DestroyIcon
FindWindowW
FillRect
GetWindowRect
InvalidateRect
SendMessageW
BeginPaint
EndPaint
GetDC
SetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
SetFocus
SetWindowPos
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
gdi32
GetObjectW
CreateDIBSection
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectW
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetSidSubAuthorityCount
GetSidSubAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
ole32
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
comctl32
ord17
shlwapi
StrStrW
StrToIntW
Name
.text
Size
139KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=128, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=260, version=26706,
count=22, id=259, version=26706,
count=2, id=260, version=27051,
count=48, id=261, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=218, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
avg_antivirus_free_setup.exe
- IMPHASH d692b06eb88ecd849f7778fde1ba5c2b
- SHA256 a7119691aa5417533ca800c5cb2211b4a93c720645bdecaa20613b4e03ad424e
- MD5 8508adb992089e7bbfbc210315e3bf3e
- SHA1 1b0c3d9ae8a0211ecf286d572924368674c8febe
- SHA512 26b77552cf78caf1888e2ae209bb03709481be463256cd5c7b3c3987c2e6770f97c4c70e1ea4795ad60c19076b22d39d2b8d85a9f8b7c388c3bc727e81b8d304
- SSDEEP 6144:GtgJcB7RG80fGwvDBn9Egw70j3EVLQc7:GtgJORaGiDB9yRLB7
- MD5 SHA1 SHA512 SSDEEP
Digest
1b:5a:0c:57:1b:2a:42:b2:f2:c7:be:96:ad:05:89:3a:01:87:c7:25:e6:bd:59:32:b3:47:ee:a1:14:20:92:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=AVG Technologies USA\, LLC,O=AVG Technologies USA\, LLC,L=Redwood City,ST=California,C=US
Chains
Aug 13, 2024
CN=AVG Technologies USA\, LLC,O=AVG Technologies USA\, LLC,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=AVG Technologies USA\, LLC,O=AVG Technologies USA\, LLC,L=Redwood City,ST=California,C=US
Serial Number
06:4b:79:66:14:d5:eb:90:86:cb:11:3d:91:4b:cc:dc
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 16, 2023 - Jan 15, 2026
Subject
CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB
Serial Number
3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89
Issuer
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 15, 2024 - Apr 14, 2035
Subject
CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB
Serial Number
7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 22, 2021 - Jan 18, 2038
Minor OS version
1
Major OS version
5
Entry point
4128
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb
kernel32
InterlockedExchangeAdd
HeapFree
GetLastError
SetLastError
Sleep
GetFileSizeEx
WriteFile
SetEndOfFile
SetFilePointerEx
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
FindResourceExW
EnumResourceNamesW
GetWindowsDirectoryW
CreateDirectoryW
CreateFileW
MultiByteToWideChar
CreateThread
GetSystemTimeAsFileTime
GetNativeSystemInfo
lstrcatA
lstrlenA
GetVersionExA
GetCurrentProcess
GetExitCodeProcess
ResumeThread
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateProcessW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetDiskFreeSpaceExW
CopyFileW
MoveFileExW
CreateHardLinkW
LocalFree
HeapAlloc
GetProcessHeap
HeapSetInformation
ExitProcess
IsProcessorFeaturePresent
lstrcpyW
GetModuleHandleW
GetCommandLineW
GetSystemDirectoryW
SetDllDirectoryW
WriteConsoleW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
FindResourceW
LoadLibraryW
SizeofResource
LoadResource
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetVersionExW
FreeLibrary
LockResource
GetFileType
GetStringTypeW
InterlockedExchange
GetUserDefaultLangID
GetProcAddress
GetACP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryA
DecodePointer
GetVersion
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
OutputDebugStringW
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
user32
ReleaseDC
GetMessageW
TranslateMessage
DispatchMessageW
AllowSetForegroundWindow
PostMessageW
wsprintfA
LoadStringW
MessageBoxExW
wsprintfW
SystemParametersInfoW
IsDialogMessageW
LoadImageW
DestroyIcon
FindWindowW
FillRect
GetWindowRect
InvalidateRect
SendMessageW
BeginPaint
EndPaint
GetDC
SetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
SetFocus
SetWindowPos
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
gdi32
GetObjectW
CreateDIBSection
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateFontIndirectW
advapi32
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetSidSubAuthorityCount
GetSidSubAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
ole32
CoInitializeEx
CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
comctl32
ord17
shlwapi
StrStrW
StrToIntW
Name
.text
Size
139KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=128, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=260, version=26706,
count=22, id=259, version=26706,
count=2, id=260, version=27051,
count=48, id=261, version=26706,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=218, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
bitdefender_avfree.exe
- IMPHASH 027ea80e8125c6dda271246922d4c3b0
- SHA256 45f2c84fda64d0d6153d2c3b33109e15f47644d86c90edae00890c2e085d94e6
- MD5 cd33f5fc0f471e1760a6b8f6be353d17
- SHA1 8f6412cf0aa3bcdaf723fea4d9bc4ecb76687656
- SHA512 1f7524db251852064f09f57ae6be094d8363c2bf988ef736ac9f97331bfe3061a3218af8176cff4a643b1010257b06ca9d938a5df9aca227984f33e8ca6973db
- SSDEEP 393216:iWEw6YknUFrbgYyAj8iadZfIQLP0ZCcPmk21yFbZzoTEw:JEw6YY+bgYyAwpd11LP0ZCcPc1ybzeZ
- MD5 SHA1 SHA512 SSDEEP
Digest
ea:0c:a0:a6:76:5b:92:f9:fd:db:8b:33:4a:f8:4f:e2:4f:b7:c4:9e:3a:b2:99:87:a0:0f:ad:42:cb:23:76:83
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Chains
Jul 9, 2024
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Bitdefender SRL,OU=DEVSUP CLINSTALLER,O=Bitdefender SRL,L=Bucharest,C=RO
Serial Number
07:d4:81:0d:1e:19:76:8a:e3:0b:fd:ea:22:9a:d1:05
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 25, 2023 - Apr 24, 2026
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
5
Entry point
117429
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GetTickCount
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
Name
.text
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=22, id=259, version=23907,
count=19, id=260, version=23907,
count=45, id=261, version=23907,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,