c28d2d3e7aef0f83baf30eddee28a1f3328cefaec589161a34ac3a5a4832fe5c
- SHA256 c28d2d3e7aef0f83baf30eddee28a1f3328cefaec589161a34ac3a5a4832fe5c
Overview
overview
10Static
static
3RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...st.dll
windows10-2004-x64
1RFQ-Al NAS...sc.dll
windows10-2004-x64
1RFQ-Al NAS...it.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows7-x64
10RFQ-Al NAS...nt.dll
windows10-2004-x64
3RFQ-Al NAS...mu.dll
windows10-2004-x64
1RFQ-Al NAS...rs.dll
windows10-2004-x64
1RFQ-Al NAS...or.dll
windows10-2004-x64
1RFQ-Al NAS...sg.dll
windows10-2004-x64
1RFQ-Al NAS...AV.dll
windows10-2004-x64
1RFQ-Al NAS...er.dll
windows10-2004-x64
1RFQ-Al NAS...tp.dll
windows10-2004-x64
1RFQ-Al NAS...vc.dll
windows10-2004-x64
1RFQ-Al NAS...om.dll
windows10-2004-x64
1RFQ-Al NAS...cs.dll
windows10-2004-x64
1RFQ-Al NAS...nt.dll
windows10-2004-x64
1RFQ-Al NAS...88.exe
windows10-2004-x64
10RFQ-Al NAS...lp.dll
windows10-2004-x64
1RFQ-Al NAS...50.dll
windows7-x64
1RFQ-Al NAS...50.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RFQ-Al NASR-00388/AMMonitoringProvider.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
RFQ-Al NASR-00388/EppManifest.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
RFQ-Al NASR-00388/MpAsDesc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
RFQ-Al NASR-00388/MpAzSubmit.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
RFQ-Al NASR-00388/MpClient.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
RFQ-Al NASR-00388/MpCommu.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
RFQ-Al NASR-00388/MpDetours.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
RFQ-Al NASR-00388/MpEvMsg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
RFQ-Al NASR-00388/MpOAV.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
RFQ-Al NASR-00388/MpProvider.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
RFQ-Al NASR-00388/MpRtp.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
RFQ-Al NASR-00388/MpSvc.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
RFQ-Al NASR-00388/MsMpCom.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
RFQ-Al NASR-00388/MsMpLics.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
RFQ-Al NASR-00388/ProtectionManagement.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral19
Sample
RFQ-Al NASR-00388/endpointdlp.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
RFQ-Al NASR-00388/msvcp150.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target c28d2d3e7aef0f83baf30eddee28a1f3328cefaec589161a34ac3a5a4832fe5c
- Size 5.2MB
- Sample240923-ybvvdayfmk
- SHA256 c28d2d3e7aef0f83baf30eddee28a1f3328cefaec589161a34ac3a5a4832fe5c
- MD5 530eb1c86e66fbd09f591d02d100d94d
- SHA1 d7a6f841d6035f91336d014f0c8d458368c70716
- SHA512 62e927052451208c47b2683c5bc0074159636ac9ceebd856ac1f7730890998569f9b0572b9509f4cc466b299f6fbcccb4ba118d2d2d3b1fe8331c7c6864509f5
- SSDEEP 98304:FlzCf/IMBa9Yx7Hx+iujelfdGuZ0+VTTjTBdljDvQwaY:Fs/IMiY+iuKvGuZ0+VTTBdx4G
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RFQ-Al NASR-00388/MpClient.dll unpack001/RFQ-Al NASR-00388/msvcp150.dll
File Explorer
-
c28d2d3e7aef0f83baf30eddee28a1f3328cefaec589161a34ac3a5a4832fe5c.rar 5.2MB
-
RFQ-Al NASR-00388/AMMonitoringProvider.dll.dll 204KB
-
RFQ-Al NASR-00388/EppManifest.dll.dll 1.0MB
-
RFQ-Al NASR-00388/MpAsDesc.dll.dll 204KB
-
RFQ-Al NASR-00388/MpAzSubmit.dll.dll 1.3MB
-
RFQ-Al NASR-00388/MpClient.dll.dll 3.6MB
-
RFQ-Al NASR-00388/MpCommu.dll.dll 332KB
-
RFQ-Al NASR-00388/MpDetours.dll.dll 144KB
-
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll.dll 96KB
-
RFQ-Al NASR-00388/MpEvMsg.dll.dll 140KB
-
RFQ-Al NASR-00388/MpOAV.dll.dll 484KB
-
RFQ-Al NASR-00388/MpProvider.dll.dll 196KB
-
RFQ-Al NASR-00388/MpRtp.dll.dll 1.3MB
-
RFQ-Al NASR-00388/MpSvc.dll.dll 2.6MB
-
RFQ-Al NASR-00388/MsMpCom.dll.dll 104KB
-
RFQ-Al NASR-00388/MsMpLics.dll.dll 20KB
-
RFQ-Al NASR-00388/ProtectionManagement.dll.dll 708KB
-
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe.exe 165KB
-
RFQ-Al NASR-00388/cors95KB
-
RFQ-Al NASR-00388/endpointdlp.dll.dll 564KB
-
RFQ-Al NASR-00388/msvcp150.dll.dll 2.5MB
RFQ-Al NASR-00388/AMMonitoringProvider.dll
- IMPHASH 850250ba4c20d1bd815d8db26d10aae3
- SHA256 8da3d256ef7df249138d8e934fbd74fda8f31c5b5758f26a757f2c686e1debdf
- MD5 f2ae2445ac7eca1ee8480321b03241fa
- SHA1 21ab4051f98e1c1e1b4f415b5a8f0589a02137b1
- SHA512 6cde8462b6f63d881d74f40f7eb7336b9c86d0375e883b8665808c5e07818d9224c72597f63fc283c7e3e82d02fa6a5def17518ddd8fd0a23a4555af3ede88df
- SSDEEP 3072:PCUZghW+1ao8vg/i/Tp5Co0hTgk0sXMvmcJNa+BTKTeehWKx3UjpoYfAdK+:PVZgh91h8npohmvtaMuU5s
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cc:d5:22:7d:d5:37:86:64:31:4c:3a:2b:6b:a7:83:46:ce:ea:47:68:d1:e1:0c:7d:9f:e2:52:5b:66:3e:f9:41
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
119056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
AMMonitoringProvider.pdb
msvcrt
_vsnprintf
realloc
_errno
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
wcschr
_wcstoui64
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscat_s
wcscpy_s
memcpy_s
free
malloc
wcsncpy_s
__C_specific_handler
_purecall
_wchmod
wcsrchr
iswalpha
__CxxFrameHandler4
?terminate@@YAXXZ
_vsnwprintf
_vscwprintf
vswprintf_s
swscanf_s
_initterm
memset
kernel32
GetTickCount
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LeaveCriticalSection
EnterCriticalSection
SetThreadLocale
GetThreadLocale
Sleep
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
FindResourceExW
DecodePointer
EncodePointer
LoadResource
GetCurrentThread
CloseHandle
SwitchToThread
LockResource
SetLastError
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
RemoveDirectoryW
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateEventW
SetEvent
DeleteFileW
GetNativeSystemInfo
ResetEvent
LocalFree
CreateProcessW
GetExitCodeProcess
DisableThreadLibraryCalls
VirtualLock
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetLastError
FreeLibrary
GetTempFileNameW
CopyFileW
GetLocaleInfoW
CreateMutexW
ReleaseMutex
IsWow64Process
GetWindowsDirectoryW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindResourceW
FreeResource
K32GetModuleFileNameExW
GetSystemTimeAsFileTime
VerifyVersionInfoW
GetFileSize
GetLongPathNameW
MoveFileW
CreateThread
GetExitCodeThread
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
ProcessIdToSessionId
GetVersionExW
GetDriveTypeW
GlobalFindAtomW
user32
MessageBoxW
SetForegroundWindow
SetTimer
KillTimer
IsDialogMessageW
PostThreadMessageW
AdjustWindowRectEx
FindWindowW
GetSystemMetrics
SetWindowTextW
CharNextW
UnregisterClassA
PostMessageW
LoadStringW
ShowWindow
SendMessageW
DestroyWindow
CreateDialogParamW
LoadIconW
GetWindowThreadProcessId
advapi32
RegDeleteKeyW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
EnableTrace
ControlTraceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
RegQueryValueExW
GetUserNameW
GetTokenInformation
OpenThreadToken
DuplicateTokenEx
FreeSid
CloseServiceHandle
CreateProcessAsUserW
LookupPrivilegeNameW
InitiateSystemShutdownExW
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
QueryServiceStatus
ControlService
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
ChangeServiceConfigW
OpenServiceW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
GetSidSubAuthorityCount
ole32
CoImpersonateClient
CoRevertToSelf
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateGuid
oleaut32
SysStringByteLen
SysAllocStringLen
VariantClear
SysStringLen
VarBstrCat
SysFreeString
VariantInit
VarUI4FromStr
SysAllocString
mpclient
MpClientUtilExportFunctions
wtsapi32
WTSQueryUserToken
WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
ntdll
RtlGetVersion
RtlNtStatusToDosError
shell32
SHGetSpecialFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathIsRelativeW
PathAppendW
PathCombineW
PathRemoveFileSpecW
PathMatchSpecW
PathFileExistsW
PathIsDirectoryW
PathFindFileNameW
crypt32
CertVerifyCertificateChainPolicy
wintrust
CryptCATAdminReleaseCatalogContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
WinVerifyTrust
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=28900,
count=20, id=260, version=28900,
count=415, id=1, productName=Unmarked objects,
count=33, id=257, version=28900,
count=10, id=261, version=28900,
count=1, id=256, version=28900,
count=89, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/EppManifest.dll
- SHA256 5768486507ce07e7c387e409714244fe2a96b33d1666d24825aa181ac3cef5bc
- MD5 e1414283b5fb25e3a0aa034104e187d3
- SHA1 ca6b4f68ee7a0b17072962f9d93bb10ecfb3a46f
- SHA512 ca79757602b50d82790e8583187e4a18b8a1b9e81a4ad4f1233e0cadab3fe8ca874cb1bef267953ab5a0b82f0df8392a10dab68129249af9a210068e384f8717
- SSDEEP 6144:qmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVjVVJ2:4/6qa37L5
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
26:2d:65:6d:12:18:c5:eb:5c:ab:c6:87:6f:d1:b2:13:ef:51:25:9e:2d:ca:39:20:13:87:43:22:a3:ea:bd:cf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/MpAsDesc.dll
- SHA256 5bf78317f21a79e0e6d48d68c30532888a7f5b3b629ef240733befff3619e9a2
- MD5 ba2b29557ff5f4f3a7a55306d25b8d2b
- SHA1 ca5dd5da467c755daa8be068397936c8de41057d
- SHA512 00b643281b0b49113fc6aa7ff1d234089c184a4080213065d96a13e39fedfc6f066d313469726d373a8c962e730a264226cd682d41f03a2e0ca15e8eb4f5d30e
- SSDEEP 6144:vmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVjVVJ/:Nf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
32:72:d8:bd:fa:63:4e:19:56:32:d8:b1:f5:79:db:ad:23:e1:7e:ee:7a:91:ee:a4:7a:57:13:07:b1:5a:f3:bf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/MpAzSubmit.dll
- IMPHASH 561966a83f8102842f701746ffa86d40
- SHA256 f3b280576feb4afbcbde840007aa7be5ebce5e152256a65969d465f52b5a774e
- MD5 29fc71aa129a9497803a61161004aa61
- SHA1 caff58ec07fbbd4dfd1140c79d25f83b99e04943
- SHA512 dbe6f35ca7ef6cae6aad5dd4599ed60798dc30ae7bf7540acba0ca470cc046b059b7bd1e697b7676eaace7cce2ddf15b7207a60d62e81d3e60de498c78af9d12
- SSDEEP 24576:4nrdWCSqDgk/2SQXyWZTfKC6WQogiGCRku1kHfHdSHlTOaV:4nrdWCdDD25XyWZTfKC6WfTGCRH8VSN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b6:d0:1a:e0:71:9d:7e:9e:08:7c:2b:4c:54:7f:43:fb:96:5c:3c:10:99:f5:cd:27:c0:e5:70:3d:ca:10:f1:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
662128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpAzSubmit.pdb
advapi32
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventWriteString
EventRegister
kernel32
CloseHandle
LocalFree
FreeLibrary
FindNextFileW
WriteFile
FindClose
CreateFileW
CreateEventW
SetEvent
WaitForSingleObjectEx
ResetEvent
GetProcAddress
SetFilePointerEx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleExW
HeapAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
DecodePointer
LCMapStringEx
InitOnceComplete
InitOnceBeginInitialize
GetModuleFileNameW
FormatMessageA
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
RtlPcToFileHeader
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
GetLastError
InterlockedFlushSList
RtlUnwindEx
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
VerifyVersionInfoW
GlobalFree
InitializeCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleA
rpcrt4
RpcStringFreeW
UuidToStringW
UuidCreate
winhttp
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpSetTimeouts
WinHttpSetOption
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpWriteData
WinHttpReadData
ntdll
VerSetConditionMask
xmllite
CreateXmlWriter
CreateXmlReader
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptDestroyHash
BCryptHashData
BCryptGetProperty
crypt32
CertVerifyCertificateChainPolicy
CryptUnprotectMemory
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
MpAzSubmitBlobInitialize
MpAzSubmitBlobUninitialize
MpAzSubmitBlobUpload
Name
.text
Size
916KB
Virtual Size
915KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
248KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
104KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=257, version=29395,
count=323, id=1, productName=Unmarked objects,
count=20, id=259, version=29395,
count=43, id=260, version=29395,
count=212, id=261, version=29395,
count=2, id=253, version=29395,
count=1, id=256, version=29395,
count=165, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpClient.dll
- IMPHASH 3736a7fb8546cf5770aa6e65ed1840ce
- SHA256 0bcae13c3c6a956c31919b6e681362319235a0c7cbccaaea3ecb9e53f02004ab
- MD5 49f9c936bca301980b396c1e77dbfdc5
- SHA1 b244f22b9f0edd704208c70c5edcdeeb0f482785
- SHA512 b0b0a4a2b3534ad1312f64e5914464b0772a3fa3089dfc1108c60bff73b7305985a03c8975ac646a2fb19b2c63c768aa2a7c365e2d0f9e1a4b46255f26092426
- SSDEEP 49152:FERpO77Yn0cP2Sd2y8gikPsQy2a2mZDeP5mgFTiPejKDv:qrz1Uh2mZAiv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
405168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ey,Ex=xK1g@,.S8K1&4!Q=GJV0%OCj3<V(QMUwYO!Z0QX/rX-]HBpI
advapi32
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
EventWrite
EventRegister
EventEnabled
bcrypt
BCryptImportKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptHashData
BCryptDestroyHash
BCryptGenRandom
BCryptGetProperty
BCryptDestroyKey
BCryptCreateHash
BCryptEncrypt
BCryptDecrypt
BCryptCloseAlgorithmProvider
BCryptFinishHash
kernel32
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetCPInfoExW
SetLastError
GetConsoleMode
GetLastError
GetFileType
ReadFile
ReadConsoleW
WriteFile
WriteConsoleW
GetConsoleCP
GetConsoleOutputCP
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
ReadDirectoryChangesW
CreateFileW
K32EnumProcessModulesEx
CloseHandle
IsWow64Process
GetExitCodeProcess
TerminateProcess
OpenProcess
K32EnumProcesses
K32GetModuleInformation
K32GetModuleBaseNameW
K32GetModuleFileNameExW
GetProcessId
DuplicateHandle
GetCurrentProcess
FreeConsole
LocalFree
CloseThreadpoolIo
ExitProcess
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentProcessorNumber
GetCurrentThread
WaitForSingleObject
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
GetFullPathNameW
GetLongPathNameW
GetCPInfo
LocalAlloc
GetProcAddress
RaiseFailFastException
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
CopyFileExW
CreateDirectoryW
DeleteFileW
DeleteVolumeMountPointW
DeviceIoControl
ExpandEnvironmentStringsW
FindNextFileW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetFileAttributesExW
GetFileInformationByHandleEx
GetModuleFileNameW
GetOverlappedResult
LoadLibraryExW
MoveFileExW
QueryUnbiasedInterruptTime
RemoveDirectoryW
SetFileInformationByHandle
SetThreadErrorMode
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
SetEvent
ResetEvent
CreateEventExW
FlushProcessWriteBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetEnvironmentVariableW
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ole32
CoTaskMemFree
CoCreateGuid
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoWaitForMultipleHandles
secur32
GetUserNameExW
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
calloc
api-ms-win-crt-math-l1-1-0
ceil
pow
modf
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcsncmp
strcmp
strcpy_s
api-ms-win-crt-runtime-l1-1-0
abort
terminate
_cexit
_initterm
_initterm_e
_execute_onexit_table
_initialize_onexit_table
_seh_filter_dll
_initialize_narrow_environment
_configure_narrow_argv
MpAllocMemory
MpClientUtilExportFunctions
MpConfigInitialize
MpFreeMemory
MpUtilsExportFunctions
Name
.text
Size
418KB
Virtual Size
418KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
150KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
RFQ-Al NASR-00388/MpCommu.dll
- IMPHASH abc5cd2efb141964bfcdea8032c2c42d
- SHA256 ca77dd6e870173ab419d43e56fb4446c6cf4493707287864049ce8b5e951ddec
- MD5 5fb1ac615c3c72df4dec02a64b7fd379
- SHA1 f1491c11f9b793f758fdcd613a5e28b725f2d06a
- SHA512 c227c1f91dd8105e7bb6b52365199251438a3f85df20d513c2956455b607d3e10fd5e7d5c8cd7cc01a4bb24cf6a240c28e5ef0c8ae6fc0f42970a1c9efe82973
- SSDEEP 6144:AOpiJ7wnqa2EwPCaIAjB+9e20RG1yMuYLg4Ly:CJc2geH2r1xuey
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
80:75:b6:53:e4:da:ce:56:17:72:f2:19:3d:ae:e5:25:29:9d:c4:d9:5f:97:93:3b:c5:3f:31:f9:a2:c7:3e:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
194160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpCommu.pdb
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initialize_narrow_environment
terminate
abort
_invalid_parameter_noinfo
_errno
_beginthreadex
_configure_narrow_argv
_initterm_e
_seh_filter_dll
_cexit
_initterm
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vswprintf
__stdio_common_vsprintf
advapi32
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
kernel32
InitializeCriticalSectionEx
DeleteCriticalSection
LoadLibraryExW
GetThreadPriority
GetCurrentThread
SetThreadPriority
DeleteTimerQueueTimer
CreateFileW
FlsAlloc
GetFileAttributesW
GetTickCount
ExpandEnvironmentStringsW
Sleep
SetEvent
ResetEvent
WaitForSingleObject
SetLastError
GetSystemDirectoryW
GetLastError
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
GetTempPathW
GetEnvironmentVariableW
EnterCriticalSection
GetProcAddress
WaitForSingleObjectEx
CreateEventW
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableW
GetModuleHandleW
IsProcessorFeaturePresent
GetFileSizeEx
ReadFile
CreateDirectoryW
TryEnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCurrentThreadId
GlobalFree
SetEndOfFile
WriteFile
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
EncodePointer
FlsFree
FlsSetValue
GetCurrentProcessId
QueryPerformanceCounter
GetExitCodeProcess
DeleteFileW
CloseHandle
GetSystemTimeAsFileTime
FreeLibrary
LeaveCriticalSection
FlsGetValue
GetSystemTime
QueryPerformanceFrequency
GetNativeSystemInfo
ole32
CLSIDFromProgID
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoUninitialize
CoCreateGuid
slc
SLGetWindowsInformationDWORD
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
winhttp
WinHttpGetProxyForUrl
WinHttpSetTimeouts
WinHttpGetDefaultProxyConfiguration
WinHttpConnect
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpWriteData
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
shlwapi
PathIsURLW
mpclient
MpManagerOpen
MpClientUtilExportFunctions
MpFreeMemory
MpConfigGetValue
MpConfigClose
MpConfigOpen
MpUtilsExportFunctions
MpConfigUninitialize
MpConfigInitialize
MpAllocMemory
MpConfigSetValue
MpManagerVersionQuery
MpHandleClose
MpConfigGetValueAlloc
api-ms-win-crt-heap-l1-1-0
_calloc_base
free
malloc
_free_base
_callnewh
api-ms-win-crt-string-l1-1-0
wcsncmp
_wcsnicmp
iswspace
strcpy_s
_wcsicmp
oleaut32
SysAllocStringLen
SysAllocString
SysStringLen
SysStringByteLen
VariantClear
VarBstrCmp
VariantInit
SysAllocStringByteLen
SysFreeString
user32
CharLowerBuffW
api-ms-win-crt-math-l1-1-0
ceil
MpCommunicationCreateInstance
MpCommunicationDownloadFile
MpCommunicationInitialize
MpCommunicationUninitialize
Name
.text
Size
224KB
Virtual Size
221KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=28, id=257, version=29395,
count=14, id=260, version=29395,
count=9, id=259, version=29395,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=344, id=1, productName=Unmarked objects,
count=44, id=261, version=29395,
count=1, id=256, version=29395,
count=90, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpDetours.dll
- IMPHASH e7e92a2408c8a2349b72bc8776729dac
- SHA256 af54dac2f73f6fb212b5dcacfac67b531cf0b79fc1e2fa6b82c5b895d892ec9f
- MD5 f574acdcb210e1f8bbc4733d3af82d6f
- SHA1 378ac1d79194a8d7e9936a595bd9db2adadeb268
- SHA512 619b5ec15e3a310013405318ce61caa7cac94fcffa546e16069b59a22dff5261fb7d153c7e6e98976cc3ce04b55b54afa3ad2e9eef5e41660454ddb4aafc8978
- SSDEEP 1536:Lzg3khUUc4YEaW4D50FyMPwL08Tnd9A+DkLkI44PWwmTZ5JmofbHPl:Lc3WqVW4d0FyMPwL02dxBZlNHmofLN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5f:cd:ba:47:f6:f0:8c:ea:37:f7:67:66:f0:37:bf:a9:d7:80:24:f0:4f:09:bc:df:ba:17:5e:30:8c:74:9c:be
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
58608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpDetours.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_cexit
terminate
abort
api-ms-win-crt-string-l1-1-0
towlower
_wcsicmp
strcpy_s
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
kernel32
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThread
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapFree
Sleep
LoadLibraryExW
ResetEvent
WaitForSingleObjectEx
IsProcessorFeaturePresent
OpenProcess
WaitForSingleObject
SwitchToThread
DecodePointer
SetThreadContext
FlushInstructionCache
VirtualLock
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GlobalFree
SetLastError
SystemTimeToFileTime
DeleteFileW
CreateFileW
GetFileSizeEx
CompareFileTime
HeapUnlock
HeapLock
GlobalUnlock
GlobalLock
OpenThread
GetProcessHeap
GetThreadContext
GetLastError
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetProcessTimes
GetCurrentProcessId
GlobalAlloc
SetEvent
GetTickCount64
GetCurrentProcess
GetModuleHandleW
GetProcAddress
CloseHandle
CreateEventW
GetModuleFileNameW
FindStringOrdinal
TerminateProcess
ReleaseSemaphore
CreateSemaphoreW
ole32
OleFlushClipboard
ReleaseStgMedium
OleSetClipboard
DoDragDrop
user32
GetPriorityClipboardFormat
GetClipboardSequenceNumber
GetClipboardOwner
CountClipboardFormats
EmptyClipboard
EnumClipboardFormats
GetUpdatedClipboardFormats
GetWindowThreadProcessId
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
CloseClipboard
GetKeyboardLayout
SendMessageTimeoutW
winspool.drv
GetPrintExecutionData
SetJobW
StartDocPrinterW
EndPagePrinter
EndDocPrinter
GetJobW
WritePrinter
StartPagePrinter
GetPrinterW
shlwapi
StrStrIW
shell32
DragQueryFileW
ntdll
RtlGetVersion
RtlEqualUnicodeString
RtlNtStatusToDosError
api-ms-win-crt-heap-l1-1-0
free
_free_base
_calloc_base
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=257, version=29395,
count=12, id=260, version=29395,
count=8, id=259, version=29395,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=314, id=1, productName=Unmarked objects,
count=41, id=261, version=29395,
count=1, id=256, version=29395,
count=71, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpDetoursCopyAccelerator.dll
- IMPHASH 8e02fd15ca77e52683aebaf6fd6f3349
- SHA256 d85e1d836fb03807fece7c5868e206657e909762e3800d164dfbe90113495710
- MD5 40a4995ae0098699dd471f992b4b4258
- SHA1 d5e081ba5351b4cd19868f2cfd6962ee8f6aac10
- SHA512 185c225d7936c336d4a80c02d4d68045a1c942e7ed29dbc0f6b13ff9e52b845a80dfe25242dd1b91e62f4fd246093dd61563a8e8dfe0ad9fda3f3943415d7826
- SSDEEP 768:hNzheLdkDvic8/sNEOBtDi187q7ZsH8P2o4wp1tYjeVmQqiKaMSve2kN38cU+ZwE:okqcE22/7ZDe8p/YjoIh2kNdZU5HPY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
54:44:c2:8d:07:30:4a:75:95:12:85:b9:7e:b5:15:ca:66:71:ea:ad:5d:5c:97:54:b7:7b:1c:82:cb:e5:49:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
21952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpDetoursCopyAccelerator.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
abort
_crt_atexit
terminate
_cexit
_invalid_parameter_noinfo_noreturn
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
kernel32
DecodePointer
SetThreadContext
FlushInstructionCache
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapFree
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapUnlock
HeapLock
OpenThread
GetProcessHeap
GetCurrentProcessId
GetThreadContext
CloseHandle
GetLastError
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
SetLastError
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
GetCurrentThread
VirtualQuery
VirtualLock
GetFullPathNameW
CreateEventW
SetEvent
WaitForSingleObjectEx
ResetEvent
LoadLibraryExW
shlwapi
PathIsRelativeW
ntdll
RtlGetVersion
RtlNtStatusToDosError
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
_free_base
free
_calloc_base
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsprintf
Name
.text
Size
44KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=257, version=29395,
count=12, id=260, version=29395,
count=8, id=259, version=29395,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=274, id=1, productName=Unmarked objects,
count=40, id=261, version=29395,
count=1, id=256, version=29395,
count=62, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpEvMsg.dll
- SHA256 147e36a2c7b205cda744d7f7f7da17b9b60b26a4a62426fc169f82fd2687aca0
- MD5 9df51191844f79c00ad90076934496f8
- SHA1 87f560d1686d58403b9fe6887eaf50b502d41727
- SHA512 9c5acb22c545e47c391cb3701c56ffd6f1729788fddde88cc42b8f622190ff79d154a2ebd4436d5be1acbe8c1c60fe96021e68a0c3e95465dd7831d290112eaa
- SSDEEP 1536:OpD0UQih10Z/gnPH8iydExI6SqiyiS+2Jl5BBwugb81qz+4JbcMKPOVN:Od0UQJyQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
36:08:49:ab:77:a6:a8:da:46:53:18:44:a1:59:25:3d:9f:65:64:fe:c6:3c:b3:d9:29:8b:32:78:94:32:91:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
124KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/MpOAV.dll
- IMPHASH 5e99d9338a66701e0fb8f1477dde6ea9
- SHA256 f79c12abba8c5850906cb4d69a5b7f274786a7a4f6dcd94740c37fdf7fe0f290
- MD5 394c2ecad239aa887188a7c8fdfc44b8
- SHA1 0cc4f07cd5c2989efcd35f730a3690f9d1540a73
- SHA512 04171b4706d9ef3956635ed2d80ddacfef4e0396573af0da56b614dc821b2f5bf4ace94c26f1151636ee3732dbccba9a8d46fe6349950a4fe05c482494b1b636
- SSDEEP 6144:uzNxZHzwalKMy0kdi2b5zQTubTU1LhqJULrin5CJVA/miTVVmVVV8VVNVVVcVVVi:uZxekAbhQTMU1tqJULraeA9N
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6d:eb:74:02:4c:cd:ec:3d:cc:ad:cf:3b:21:90:d3:72:6e:d7:c0:43:40:27:4a:03:3e:9b:ab:8a:8c:e8:c9:69
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
133152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpOAV.pdb
advapi32
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventRegister
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
kernel32
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetProcessHeap
SetStdHandle
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetModuleFileNameW
SetFilePointerEx
CreateFileW
WriteConsoleW
QueryPerformanceCounter
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExW
HeapSize
LCMapStringW
GetProcAddress
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStartupInfoW
GetFileType
GetStdHandle
HeapFree
HeapAlloc
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetVersionExW
Sleep
GetLastError
GetProcessTimes
GetCurrentProcessId
FreeLibrary
LoadLibraryExW
CloseHandle
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
HeapReAlloc
GetFileSizeEx
FindNextFileW
FindClose
GetFileAttributesW
CreateEventW
GetTempPathW
GetSystemDirectoryW
SizeofResource
LockResource
LoadResource
FindResourceW
DecodePointer
ole32
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysStringLen
SysFreeString
ntdll
RtlGetVersion
RtlNtStatusToDosError
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
192KB
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=257, version=29395,
count=304, id=1, productName=Unmarked objects,
count=27, id=260, version=29395,
count=15, id=259, version=29395,
count=199, id=261, version=29395,
count=1, id=256, version=29395,
count=75, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpProvider.dll
- IMPHASH dfe0dec84410187ad137fa24212ce072
- SHA256 3c5f90cda4b1cb8d12639385eaacc69aa96ae87b6fe257e30462dce558f1ae9a
- MD5 497fddc79f3c2ccbc65ede5cdb35f9b2
- SHA1 1c2c2b6890ef6d94b29541d6a7bb5462164680b9
- SHA512 887d48d85f65ca9e4ebff6507bef4cc85016f5f26876948491bbbdc8ba46a991b56b9e610a12dc9f4ec3de56af186d6bf390ab786aef79d28a1f59cb63353902
- SSDEEP 3072:que5tMF2FF41ZzjFwDB8XRf2oCSoqGoVQqya+TQMKTecepGimhkpTUNucix:que5Q2FFiFUBeoSxiHadimhmyQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8c:d4:fc:ad:7f:a3:be:ab:98:83:e4:a7:d6:cb:f6:7b:19:69:e2:c5:d1:34:cf:25:a8:42:7d:d8:f2:8f:88:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
111376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpProvider.pdb
msvcrt
__CxxFrameHandler4
_vsnprintf
wcschr
_vscwprintf
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
memmove
memcpy
_CxxThrowException
memmove_s
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
malloc
memcpy_s
__C_specific_handler
_purecall
wcsncpy_s
wcscat_s
free
wcscpy_s
_wchmod
_vsnwprintf
iswalpha
wcsrchr
vswprintf_s
memset
kernel32
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetSystemTimeAsFileTime
InitializeCriticalSection
FindResourceExW
GetTickCount
RtlCaptureContext
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
FreeLibrary
CompareStringW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetLastError
DecodePointer
EncodePointer
GetCurrentThread
CloseHandle
SystemTimeToFileTime
FileTimeToSystemTime
SwitchToThread
LockResource
SetLastError
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
RemoveDirectoryW
GetTempPathW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
OpenProcess
CreateEventW
SetEvent
DeleteFileW
GetNativeSystemInfo
ResetEvent
LocalFree
CreateProcessW
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
DisableThreadLibraryCalls
VirtualLock
GetLocalTime
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
LeaveCriticalSection
EnterCriticalSection
SetThreadLocale
GetThreadLocale
RaiseException
DeleteCriticalSection
Sleep
OutputDebugStringA
GetTempFileNameW
CopyFileW
GetLocaleInfoW
CreateMutexW
ReleaseMutex
IsWow64Process
GetWindowsDirectoryW
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindResourceW
FreeResource
K32GetModuleFileNameExW
VerifyVersionInfoW
GetFileSize
GetLongPathNameW
MoveFileW
CreateThread
GetExitCodeThread
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
ProcessIdToSessionId
GetVersionExW
GetDriveTypeW
GlobalFindAtomW
user32
LoadIconW
DestroyWindow
SendMessageW
ShowWindow
LoadStringW
PostMessageW
UnregisterClassA
GetSystemMetrics
FindWindowW
GetWindowThreadProcessId
MessageBoxW
SetForegroundWindow
SetTimer
KillTimer
IsDialogMessageW
PostThreadMessageW
AdjustWindowRectEx
CharNextW
CreateDialogParamW
SetWindowTextW
advapi32
GetUserNameW
ReportEventW
DeregisterEventSource
RegisterEventSourceW
EnableTrace
ControlTraceW
RegDeleteKeyW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
OpenThreadToken
FreeSid
CloseServiceHandle
CreateProcessAsUserW
LookupPrivilegeNameW
InitiateSystemShutdownExW
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
QueryServiceStatus
ControlService
ChangeServiceConfigW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
OpenServiceW
OpenSCManagerW
CheckTokenMembership
AllocateAndInitializeSid
GetSidSubAuthority
DuplicateTokenEx
GetSidSubAuthorityCount
ConvertStringSecurityDescriptorToSecurityDescriptorW
ole32
CoImpersonateClient
CoCreateGuid
CoGetClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoRevertToSelf
oleaut32
VarUI4FromStr
SafeArrayLock
VarBstrCat
SafeArrayCreate
SysStringByteLen
SafeArrayUnlock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SysStringLen
SafeArrayGetVartype
VariantInit
VariantClear
SysFreeString
SysAllocString
SysAllocStringLen
wtsapi32
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
ntdll
RtlGetVersion
RtlNtStatusToDosError
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFolderPathW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
shlwapi
PathFileExistsW
PathAppendW
PathFindFileNameW
PathIsRelativeW
PathCombineW
PathMatchSpecW
PathIsDirectoryW
PathRemoveFileSpecW
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
crypt32
CertVerifyCertificateChainPolicy
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
116KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=259, version=28900,
count=20, id=260, version=28900,
count=420, id=1, productName=Unmarked objects,
count=31, id=257, version=28900,
count=10, id=261, version=28900,
count=1, id=256, version=28900,
count=92, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/MpRtp.dll
- IMPHASH 2885032f801d6fd1135f59079b0e3889
- SHA256 ceef3fa431feef63744a02f292e8435bfb9d02653ff5ca1e4e397a8eda9b8c25
- MD5 b09a6e712989c71682b0b1593e4321e5
- SHA1 526221185dfe858ffc50df59c102c53285732296
- SHA512 c70ce87e5825fc0bf5462f2eca3bedb5b7c4af7806eeb87d69fcd510411cb8c84ecdf9efb1db0d7593dc14599a4fc3fe6a49aece821139bf08e753bc57f109da
- SSDEEP 24576:p6sXqIv70PO2EU9aGvjPVHjIjrcWLOUpJtdcb1iehP:Ms6Iv7CE30LVHjIjwWiWJtdcb1iehP
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
4b:56:d8:c9:2e:bc:76:2d:4b:21:89:bf:c6:e2:7a:17:55:6f:71:4f:a0:77:cd:d6:f4:6f:40:54:05:73:fc:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
812016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpRTP.pdb
kernel32
GetVersionExW
GetModuleHandleW
GetProcAddress
ProcessIdToSessionId
GetLastError
GetTickCount64
OpenProcess
GetProcessTimes
CloseHandle
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThread
HeapFree
HeapAlloc
ExitProcess
FreeLibrary
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
GetProcessHeap
WideCharToMultiByte
HeapSize
HeapReAlloc
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
EncodePointer
RaiseException
InitializeCriticalSectionEx
RtlPcToFileHeader
SleepEx
WaitForSingleObject
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetExitCodeThread
CreateRemoteThread
WriteProcessMemory
GetLocalTime
Sleep
FlushFileBuffers
OpenThread
GetSystemInfo
GetTickCount
K32GetModuleInformation
FindClose
QueryDosDeviceW
DeviceIoControl
GetLogicalDriveStringsW
UnmapViewOfFile
CompareStringOrdinal
QueryFullProcessImageNameW
GetFileTime
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CompareFileTime
GetProcessId
GetExitCodeProcess
GetComputerNameExW
GlobalMemoryStatusEx
LocalFree
K32EnumProcessModules
VirtualQueryEx
K32GetMappedFileNameW
FindStringOrdinal
SystemTimeToFileTime
QueueUserAPC
ReadFile
CopyFileExW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
MoveFileExW
GetFileAttributesW
GetThreadPriority
SetThreadPriority
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateThread
SwitchToThread
CreateDirectoryW
FindFirstFileW
GetFileSizeEx
FindNextFileW
WriteFile
ExpandEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
SetFileAttributesW
DeleteFileW
LoadLibraryW
SetFilePointerEx
ReleaseSemaphore
GetModuleFileNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
CreateSemaphoreW
CreateFileMappingW
MapViewOfFile
VirtualQuery
FormatMessageA
GetDriveTypeW
VirtualProtect
LoadLibraryExA
GetFileInformationByHandleEx
FindFirstFileExW
GetFinalPathNameByHandleW
SetEndOfFile
GetFileAttributesExW
DecodePointer
CompareStringEx
LCMapStringEx
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
Module32FirstW
Module32NextW
VirtualFreeEx
IsWow64Process
VirtualAllocEx
wtsapi32
WTSEnumerateSessionsW
WTSQueryUserToken
WTSFreeMemory
tdh
TdhGetPropertySize
TdhGetProperty
TdhGetEventInformation
setupapi
SetupDiGetClassRegistryPropertyW
SetupDiSetClassRegistryPropertyW
ntdll
RtlNtStatusToDosError
NtClose
RtlPrefixUnicodeString
NtWaitForSingleObject
NtDeviceIoControlFile
NtCreateFile
RtlInitUnicodeString
RtlCompareUnicodeString
NtMapViewOfSection
RtlGetVersion
bcrypt
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptGetProperty
BCryptOpenAlgorithmProvider
mpclient
MpIsDeviceControlAvailable
MpShutdownCopyAcceleratorProcess
MpGetCopyAcceleratorProcessStatus
MpConfigSetValue
MpHandleClose
MpConfigUnregisterNotifications
MpConfigRegisterForNotifications
MpConfigGetValueAlloc
MpManagerOpen
MpManagerVersionQuery
MpUtilsExportFunctions
MpClientUtilExportFunctions
MpAllocMemory
MpFreeMemory
MpConfigOpen
MpConfigGetValue
MpConfigClose
MpPluginBypassDlpWarning
MpPluginCheckAccessForClipboardOperation
MpPluginCheckAccessForDragDropOperation
MpPluginCheckAccessForPrintOperation
MpPluginCheckExclusion
MpPluginConfigChange
MpPluginConfigDirectoryMonitoring
MpPluginConfigSyncMonitoring
MpPluginDismissDlpWarning
MpPluginDlpDelegateEnforcement
MpPluginEnableDlp
MpPluginEnforceDlpClipboard
MpPluginEnforceDlpReadClipboard
MpPluginFlushLogData
MpPluginGetConfigOperations
MpPluginGetCopyAcceleratorState
MpPluginGetDlpNotificationSettings
MpPluginGetHeartBeatData
MpPluginGetState
MpPluginGetThreatCategory
MpPluginGetThreatExecInfo
MpPluginGetThreatInfo
MpPluginInitialize
MpPluginIsSuspended
MpPluginNotifyRpcServerStateChange
MpPluginNotifySessionStateChange
MpPluginNotifySetupProgress
MpPluginQueryDlpState
MpPluginQueryRtpMonitoringInfoEx
MpPluginRefreshDlpPolicySettings
MpPluginRefreshPlatformKillbits
MpPluginRegisterFriendlyProcess
MpPluginReportClipboardOwner
MpPluginReportThreadStatus
MpPluginSendBrowserHeartbeat
MpPluginSendUserModeRegistryData
MpPluginSetDefaultConfigs
MpPluginSetDriverUnloadInProgress
MpPluginSetEngine
MpPluginSetState
MpPluginSetUserInformation
MpPluginShutdown
MpPluginSignatureChange
MpPluginStop
MpPluginUpdateBrowserActiveTab
MpPluginUpdateFolderGuardData
MpPluginUpdateMonitoringInfo
MpPluginUpdateMonitoringInfoEx
MpPluginUpdateTPState
Name
.text
Size
968KB
Virtual Size
964KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
40KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=257, version=29395,
count=438, id=1, productName=Unmarked objects,
count=20, id=259, version=29395,
count=41, id=260, version=29395,
count=215, id=261, version=29395,
count=1, id=256, version=29395,
count=194, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MpSvc.dll
- IMPHASH 7ceea8dd728f5932a45ab39a47267bb0
- SHA256 2e85cc2a6f6ddf3d42fc258a8a9f3bcdbf46716b3c1bed09fda7242de1b245c2
- MD5 86449a4a33d1e34d66e146d53e72fc3c
- SHA1 b8ed197af58656c6d2882e23aeccb08b1b214649
- SHA512 40ed419a70940aec9b8c4538ca9ed6bdbea6a2fde5f2d07777fba39c0566042ba5a0a37671331b832d83d88fa30e1a1034dd9355fd36e1a493dda20d797ebb2c
- SSDEEP 49152:ttOlyJu7/mLqqrrMmgGSUaUrhqgs2078QqLQaQRGcUeGvflwcN:brJjFM81P+c3N
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
16:fc:a6:c1:45:ed:86:a2:87:90:7b:62:c6:f7:34:7c:02:2f:fa:b9:b1:50:2c:98:36:c2:e4:fc:dd:4d:ff:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
1929264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MpSvc.pdb
api-ms-win-crt-runtime-l1-1-0
abort
_errno
_beginthreadex
_invalid_parameter_noinfo_noreturn
terminate
_invalid_parameter_noinfo
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
__stdio_common_vswscanf
__stdio_common_vsprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
iswspace
wcsnlen
iswupper
strncmp
iswalpha
isdigit
wcsncmp
iswxdigit
islower
iswlower
strcspn
towupper
towlower
_wcsnicmp
strcpy_s
_wcsdup
toupper
isupper
__strncnt
strnlen
_wcsicmp
iswdigit
wcscmp
wcspbrk
api-ms-win-crt-heap-l1-1-0
malloc
_malloc_base
calloc
_free_base
_calloc_base
_callnewh
realloc
free
api-ms-win-crt-convert-l1-1-0
wcstol
_ui64tow_s
_wcstod_l
_i64tow_s
_ui64toa_s
wcstoll
_wtol
_i64toa_s
wcstoull
_wtoi64
wcstoul
_itow_s
_wtoi
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-locale-l1-1-0
_free_locale
_create_locale
__pctype_func
___lc_locale_name_func
localeconv
___lc_codepage_func
_unlock_locales
___mb_cur_max_func
_lock_locales
setlocale
api-ms-win-crt-math-l1-1-0
ceilf
frexp
kernel32
QueryInformationJobObject
ExpandEnvironmentStringsW
InitOnceComplete
CopyFileExW
InitOnceBeginInitialize
GetVersionExW
LoadLibraryExA
VirtualProtect
RemoveDirectoryW
ConvertDefaultLocale
GetLocaleInfoW
VirtualQuery
GetSystemWindowsDirectoryW
CreateSemaphoreW
HeapSetInformation
GetNativeSystemInfo
GetSystemDirectoryW
OpenEventW
GetEnvironmentVariableW
UnregisterWaitEx
GetComputerNameExW
GetThreadPriority
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlPcToFileHeader
InterlockedFlushSList
ChangeTimerQueueTimer
RtlUnwindEx
CreateJobObjectW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RegisterWaitForSingleObject
WriteFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
CreateTimerQueueTimer
GetFileSizeEx
ReadFile
SetThreadpoolTimer
TryEnterCriticalSection
InitializeCriticalSection
LCMapStringW
SwitchToThread
InitializeCriticalSectionEx
SystemTimeToFileTime
SetFilePointerEx
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
FreeLibrary
DeleteTimerQueueTimer
SetEnvironmentVariableW
GetTempPathW
TerminateProcess
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SetEvent
GetFileAttributesW
MoveFileExW
CreateHardLinkW
GetExitCodeProcess
CopyFileW
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CreateEventW
CreateThread
LoadLibraryExW
lstrcmpiW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetFileAttributesExW
OpenThread
GetThreadTimes
LeaveCriticalSection
EnterCriticalSection
CreateFileW
LocalFree
MultiByteToWideChar
LoadLibraryW
InitializeCriticalSectionAndSpinCount
ResetEvent
DeleteCriticalSection
CreateMutexW
WaitForMultipleObjects
DuplicateHandle
GetDateFormatW
GetTimeFormatW
ProcessIdToSessionId
GetSystemTime
FindFirstChangeNotificationW
FindNextChangeNotification
GetTempFileNameW
FindCloseChangeNotification
GetLogicalDrives
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumePathNameW
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
RaiseException
GetTickCount64
GetProcessTimes
GetTickCount
WaitForMultipleObjectsEx
CompareFileTime
DeleteFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
UnmapViewOfFile
GetModuleFileNameW
CreateProcessW
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetSystemPowerStatus
DeviceIoControl
SleepEx
FlushFileBuffers
GetSystemInfo
GetFileInformationByHandle
SetEnvironmentVariableA
ReadProcessMemory
K32GetProcessMemoryInfo
WideCharToMultiByte
QueryDosDeviceW
CreateIoCompletionPort
SetInformationJobObject
AssignProcessToJobObject
GetQueuedCompletionStatus
SetFileAttributesW
PostQueuedCompletionStatus
SetErrorMode
FormatMessageA
TryAcquireSRWLockExclusive
GetStringTypeW
QueryPerformanceFrequency
GetFinalPathNameByHandleW
setupapi
SetupDiGetClassRegistryPropertyW
SetupDiSetClassRegistryPropertyW
wtsapi32
WTSEnumerateSessionsW
WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory
ntdll
RtlIpv6StringToAddressExW
RtlIpv4StringToAddressExW
NtQueryInformationProcess
mpclient
MpThreatLocalizedInfoQuery
MpScanControl
MpQueryEngineConfigDword
MpClientUtilExportFunctions
MpScanStart
MpConfigIteratorClose
MpFreeMemory
MpConfigInitialize
MpConfigIteratorEnum
MpConfigOpen
MpConfigGetValueAlloc
MpConfigClose
MpConfigGetValue
MpConfigSetValue
MpConfigIteratorOpen
MpAllocMemory
MpConfigRegisterForNotifications
MpManagerOpen
MpHandleClose
MpUpdateStart
MpUpdateControl
MpConfigUnregisterNotifications
MpNotificationRegister
MpConveySampleSubmissionResult
MpUtilsExportFunctions
MpDebugExportFunctions
MpManagerStatusQueryEx
MpIsRtpAutoEnable
MpErrorMessageFormat
MpManagerVersionQuery
MpConfigUninitialize
MpConfigDelValue
MpAddDynamicSignatureFile
MpDynamicSignatureEnumerate
MpDynamicSignatureOpen
ServiceCrtMain
ValidateDrop
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
556KB
Virtual Size
553KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=257, version=29395,
count=18, id=260, version=29395,
count=10, id=259, version=29395,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=561, id=1, productName=Unmarked objects,
count=48, id=261, version=29395,
count=2, id=253, version=29395,
count=1, id=256, version=29395,
count=333, id=265, version=29395,
count=6, id=126, version=50727,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/MsMpCom.dll
- IMPHASH 867fb73fa3ad8ce36341e39631dc1cdd
- SHA256 e96f24e730197d66ddb3f8a2f54a121523160187beb1bbccb5883ffe4b19fa0f
- MD5 a27e3c773d4800429a39263dbe98e24d
- SHA1 9f22ad93234749124b2fa5ac331ef4bb7662256d
- SHA512 94c24ca6e509a1df002cb93c5bf156d75e30d62ff9db0b570559f674e07d8b995fab622ce6ab057ac059030a3f53153e8205408924c31a6711af4d5a29e6cff4
- SSDEEP 1536:NgzKUT0gEuOIv/5z1CWiRyPY1QYiYq8dJsqfVNt+QhKTeuq4lMYe7Pg:4Km0g8IgJQhYqG7fVNt+QKTeuq4lMYOY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
0b:b1:2b:34:4f:c2:e0:f6:12:7a:75:38:94:9c:67:54:9d:05:28:78:b9:c4:0e:1b:ee:03:b9:fe:85:65:33:32
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ed:2c:45:e4:c1:45:cf:48:44:00:00:00:00:02:ed
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
37456
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MsMpCom.pdb
msvcrt
_wcsicmp
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@XZ
_callnewh
malloc
wcschr
_purecall
free
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler4
_vsnprintf
??3@YAXPEAX@Z
memcmp
kernel32
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetLastError
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetProcAddress
GetSystemDirectoryW
LoadLibraryExW
FreeLibrary
GetFileAttributesW
SetLastError
oleaut32
LoadTypeLi
SafeArrayGetDim
SafeArrayCreate
LoadRegTypeLi
SysStringLen
VariantInit
SysFreeString
VariantClear
advapi32
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetFileSecurityW
GetSecurityDescriptorOwner
GetFileSecurityW
InitializeSecurityDescriptor
IsValidSid
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
ole32
CoUninitialize
CoInitializeEx
IIDFromString
CoCreateInstance
user32
UnregisterClassA
mpclient
MpUpdateControl
MpElevationHandleActivate
MpOfflineScanInstall
MpScanControl
MpManagerEnable
MpThreatEnumerate
MpConfigSetValue
MpQuarantineRequest
MpManagerOpen
MpHandleClose
MpFreeMemory
MpConfigUninitialize
MpConfigInitialize
MpConfigGetValue
MpThreatHistoryRequest
MpConfigDelValue
MpClientUtilExportFunctions
MpConfigGetValueAlloc
MpConfigClose
MpUtilsExportFunctions
MpThreatOpen
MpConfigOpen
MpElevationHandleOpen
rpcrt4
UuidFromStringW
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=28900,
count=14, id=260, version=28900,
count=281, id=1, productName=Unmarked objects,
count=15, id=257, version=28900,
count=16, id=261, version=28900,
count=1, id=256, version=28900,
count=47, id=264, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
RFQ-Al NASR-00388/MsMpLics.dll
- SHA256 8135ee0b4e92fe29dc07884079e7bf2300982b690f80ef7698eef33e8d694c78
- MD5 c1fe13a9fbd581d6acf72afe3264fb3c
- SHA1 fc4f46a421bc2574876bdd9a5134b9a0973a05ba
- SHA512 6d90169e2d74ddc3a4a196a8844e314aaf77799af4d83356171a4095fc3f97838359e7b5559df9e7ae2a780b115bec2c957adbb994fe5bd1fd8ade8cf858c40d
- SSDEEP 192:cWgbHWQALc2Fu462TNvxjB1RDBQABJ3KNjpC52qnajOYa:cWgbHWQ1MJLRDBRJ0NliF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
24:3a:b2:fc:0f:53:fa:bb:e7:66:26:13:c5:28:d8:de:3b:0f:c9:44:1d:4e:48:f9:db:71:d3:08:fd:96:2f:42
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
4KB
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/ProtectionManagement.dll
- IMPHASH 014001c0f5045aa529e87c45f92fe834
- SHA256 f532f803a9040930b10a880ba4d1ed62d44a15756c31a487ea8e90a67bfd3078
- MD5 dae4004e0a642f88be3029dc4fe3b1ff
- SHA1 dae88a84f80247b0e6a952c3d5696b28916d259a
- SHA512 95d6d4b48a8e9f65cf4836b25bae6792fbacf9be6afd9fc5a5eb820095bd62bcc401201e1c9c5fd0b7837b0113ef90e1acec14dfc07844a67069cf6981c5757f
- SSDEEP 12288:mtmhr/XZihWuchRxWT53/gehV0XDU4KAZBj2G4W7q:FrYhWTl5XDPv1q
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
22:17:f3:4b:82:e7:cb:81:f6:b5:af:9b:53:41:40:cc:53:fb:13:07:04:68:35:16:fd:d3:28:b1:ac:ff:05:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
363088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ProtectionManagement.pdb
kernel32
GetSystemDirectoryW
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
SizeofResource
LockResource
LoadResource
FindResourceExW
CloseHandle
GetTimeZoneInformation
GetSystemTime
WaitForSingleObject
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
HeapDestroy
InitializeCriticalSection
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetSystemInfo
VirtualProtect
VirtualQuery
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetFileSizeEx
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadFile
CreateFileW
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionEx
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExW
FreeLibraryAndExitThread
ExitThread
GetFileAttributesExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExA
GetTickCount
WaitForSingleObjectEx
TryEnterCriticalSection
CompareFileTime
GetExitCodeProcess
CreateEventW
SetEvent
FileTimeToSystemTime
GlobalFindAtomW
GetDriveTypeW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
GetNativeSystemInfo
ProcessIdToSessionId
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetExitCodeThread
ResetEvent
CreateThread
MoveFileW
GetLongPathNameW
GetFileSize
VerifyVersionInfoW
K32GetModuleFileNameExW
FreeResource
FindResourceW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetDiskFreeSpaceExW
GetWindowsDirectoryW
Sleep
LocalFree
IsWow64Process
ReleaseMutex
CreateMutexW
CreateProcessW
CopyFileW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
SwitchToThread
FormatMessageW
mpclient
MpCleanStart
MpGetCallistoDetections
MpTriggerHeartbeatOnUninstall
MpOfflineScanInstall
MpUpdateStartEx
MpScanStartEx
MpCreateComInstance
MpGetTPStateInfo
MpGetRunningMode
MpConfigRegisterForNotifications
MpConfigUnregisterNotifications
MpAllocMemory
MpManagerVersionQuery
MpConfigIteratorEnum
MpConfigIteratorOpen
MpCleanOpen
MpConfigIteratorClose
MpThreatOpen
MpConfigGetValue
MpDetectionEnumerate
MpThreatRollup
MpThreatQuery
MpThreatEnumerate
MpManagerStatusQueryEx
MpNotificationRegister
MpManagerOpen
MpHandleClose
MpClientUtilExportFunctions
MpConfigOpen
MpConfigClose
MpConfigGetValueAlloc
MpConfigUninitialize
MpConfigInitialize
MpFreeMemory
MpElevationHandleAcquire
MpElevateCleanHandle
MpConfigSetValue
MpUtilsExportFunctions
wtsapi32
WTSQueryUserToken
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
GetProviderClassID
MI_Main
Name
.text
Size
408KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
208KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=257, version=29395,
count=392, id=1, productName=Unmarked objects,
count=26, id=260, version=29395,
count=15, id=259, version=29395,
count=207, id=261, version=29395,
count=1, id=256, version=29395,
count=141, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/RFQ-Al NASR-00388.exe
- IMPHASH f65431af005f2b765df7e8372bca5a9b
- SHA256 988ad96cba3b6d7aeb50c3c1c83e9abfc05e7bad5ae0e58d7d93ae55369e7a29
- MD5 be0f22a9ca20cf368fbd17e5afd29b75
- SHA1 0d4b2f8be1ad496961a0baf3210d074f471f3817
- SHA512 1f0f44173bf9d67d112fa2e1bdfcf7544027eb2c6df2a94c1e4f8559a8074d4435805888948eda011c7377372d68552ec65418c8de0f29cf2ee489cb1f223416
- SSDEEP 1536:FHtTzHtyfEpZeTHfFH1DCZ4ZjHSxANkKTeWC5HlhX/BQGOLPT:xtnhpYL51DpqANkKTeWC5HlhvilLL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
35:0b:4c:30:7b:4e:9c:0e:4f:a7:7e:26:3d:5f:95:d1:0a:78:8a:7a:0e:52:c0:71:2f:27:52:42:21:bb:39:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:9e:05:ca:b1:2e:ac:93:cf:b6:00:00:00:00:02:9e
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 24, 2020 - Sep 23, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
40640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpCopyAccelerator.pdb
kernel32
DebugBreak
WaitForSingleObject
SetErrorMode
CreateEventW
GetLastError
CloseHandle
LocalFree
CopyFileExW
CopyFile2
SetEvent
GetProcessHeap
HeapAlloc
GetSystemInfo
LoadLibraryExA
VirtualProtect
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExW
QueryPerformanceFrequency
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
Sleep
GetTickCount
FreeLibrary
GetFileInformationByHandle
SetFileInformationByHandle
GetDateFormatW
GetTimeFormatW
GetLocalTime
GetCommandLineW
MoveFileExW
CreateFileW
DeviceIoControl
GetModuleFileNameW
GetTempPathW
GetSystemDirectoryW
HeapSetInformation
VirtualQuery
GetFileSizeEx
WriteFile
GetFileAttributesW
OpenProcess
SetFilePointerEx
api-ms-win-crt-string-l1-1-0
strcpy_s
_wcsupr_s
_wcsicmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm_e
exit
_exit
_seh_filter_exe
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_initterm
_crt_atexit
_initialize_onexit_table
_register_onexit_function
abort
terminate
ntdll
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlCaptureContext
mpclient
MpAllocMemory
MpUtilsExportFunctions
MpConfigInitialize
MpFreeMemory
MpClientUtilExportFunctions
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vswprintf
_set_fmode
__stdio_common_vsprintf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
free
malloc
_callnewh
_set_new_mode
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=260, version=29395,
count=8, id=259, version=29395,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=261, version=29395,
count=7, id=257, version=29395,
count=337, id=1, productName=Unmarked objects,
count=61, id=265, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/cors
- SHA256 526d4491190c422241a236d7765488a5ee1ad3bf4a0b9678273624c5e78efe47
- MD5 f93b11f38931e5b281442b1a7249bbb6
- SHA1 037d18edfcdb20ecc979ef9548a07a235db2db35
- SHA512 c0af4dec9348993f354a497a06dbb616ac09c0b5913dc68bb6689cf42bca01af570f3787e9aa8e10c4eb50b07f117ac15da686b73444caa0e0a09935b746bba6
- SSDEEP 1536:Ashniacif5P24eEDpT0JmmTw+YJoUOlyJXML1RtKvMrI4MePsUq7YBm5noysUPxq:AOrcQ+QmJTTwRoZyts1RtKvfYPsUQ5o7
- MD5 SHA1 SHA512 SSDEEP
RFQ-Al NASR-00388/endpointdlp.dll
- IMPHASH 9c3fd1848ccdb144ff7cb14128b86363
- SHA256 4804ae834ca909178f3e9d6876209aa10851a36bc4edafd75a571e980013da1d
- MD5 4433f83c04f409eaea6e9d8e36708684
- SHA1 83f1d33c8babac4bb474ebd335f75a10d2971c64
- SHA512 87a4db85ad47bc148223a22972d08962a57db07adf0b1ba19d279c2b57aa063c981d4d55106ea1ba85f239902ce4ff83272f476aa6b6447bd49319bfe9c8eb94
- SSDEEP 12288:GPaUIpEjKRSSj6imoza9hzg1glUEv2k1ukJaFV4HojFQZLgc:AaJaKRx6XgUUm2kvaFs3gc
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f8:5e:cf:6a:05:20:5e:4a:f3:43:8f:e0:5f:bd:08:91:7d:ef:bc:bd:fb:a7:d2:fd:bd:7d:17:fa:fd:d7:d2:ba
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 23, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:ec:65:79:ad:1e:67:08:90:13:00:00:00:00:02:ec
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
302640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
endpointdlp.pdb
kernel32
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
CloseHandle
FlsAlloc
OutputDebugStringW
HeapSize
HeapReAlloc
RaiseException
CreateFileW
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionEx
HeapFree
ExitProcess
GetStartupInfoW
GetModuleHandleExW
GetCurrentThreadId
GetFileType
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetLastError
FreeLibrary
FormatMessageW
GetModuleFileNameA
HeapAlloc
GetProcAddress
GetProcessHeap
GetModuleHandleW
DebugBreak
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSemaphore
OpenSemaphoreW
Sleep
GetTickCount
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexExW
ReleaseMutex
CreateSemaphoreExW
WaitForSingleObjectEx
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
OpenProcess
K32GetModuleFileNameExW
GetProcessTimes
GetDriveTypeW
CreateEventExW
CreateThreadpoolWait
ExpandEnvironmentStringsW
FormatMessageA
LocalFree
InitOnceBeginInitialize
InitOnceComplete
DecodePointer
LCMapStringEx
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEvent
ResetEvent
CreateEventW
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
advapi32
CryptDestroyHash
CryptDestroyKey
CryptVerifySignatureW
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegCreateKeyExW
GetLengthSid
GetTokenInformation
OpenProcessToken
EventRegister
EventUnregister
EventWriteTransfer
ntdll
ZwQueryEaFile
crypt32
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertAddCertificateContextToStore
CryptImportPublicKeyInfo
CertCreateCertificateContext
CertCloseStore
CertFreeCertificateContext
CryptStringToBinaryW
CertOpenStore
CertFreeCertificateChain
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathIsNetworkPathW
user32
LoadStringW
AuditBrowserFileOperationEvent
AuditBrowserFileOperationEventEx
AuditBrowserOperationEvent
DlpAuditFileAccessEvent
DlpAuditOperationEnforcementEvent
DlpAuditOperationEnforcementEventEx
DlpDelegateEnforcement
DlpFreeArchiveFileTraceInfo
DlpGetArchiveFileTraceInfo
DlpGetFileApplicationAccess
DlpGetFileApplicationAccessEx
DlpGetFileApplicationAccessEx2
DlpGetFileCloudApplicationPolicy
DlpGetFileLocation
DlpGetNotificationSettings
DlpGetPolicyInfoFromRuleId
DlpGetPolicySettings
DlpGetQuarantineConfiguration
DlpInitialize
DlpInitializeFromCustomPolicy
DlpValidateCloudDomainsPolicyCmd
DlpValidateCloudPolicyCmd
DlpValidateCloudWebSitesPolicyCmd
GetBrowserExtensionConfiguration
ShouldCollectBrowsingActivities
Name
.text
Size
376KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
136KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=19, id=257, version=29395,
count=161, id=1, productName=Unmarked objects,
count=19, id=259, version=29395,
count=34, id=260, version=29395,
count=197, id=261, version=29395,
count=2, id=253, version=29395,
count=1, id=256, version=29395,
count=72, id=264, version=29395,
count=1, id=255, version=29395,
count=1, id=258, version=29395,
RFQ-Al NASR-00388/msvcp150.dll
- IMPHASH 45823c238836b2d3b2405effa1f9cf7f
- SHA256 6840c478bf1a0d427d1c592d5a2074bc3d4d114d8951238e6c0ee5660cf37d00
- MD5 b4b0085158f97323158ab8438782e550
- SHA1 e78baa7f2a611486196aa64485a1d762b9f88323
- SHA512 e88c88456ee9451cbcfa3732d725f54302bcd4228921057f571fc2c0d594f52a0786888c6a7ff539afeb8e89372bc845d7685353b321ee4ae331febb5d31f896
- SSDEEP 49152:yHTk0p9NWVfn/gm5Ohdl8gFrW5uuSvTzVD:F8dSuuc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
402920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
EcBVd~-Xftjuwo@sY3GH<KZHi>3g:-4|Bu)wBa+\=9g<O_%%ba5h'*8p~A_)XKP6S6|C(oXE8/*BY5/"'L
advapi32
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
EventWrite
EventRegister
EventEnabled
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
bcrypt
BCryptGenRandom
kernel32
TlsFree
TlsSetValue
ResumeThread
VirtualAllocEx
CreateProcessW
SetThreadContext
SetLastError
OpenProcess
GetLastError
TerminateProcess
CloseHandle
GetThreadContext
MultiByteToWideChar
GetStdHandle
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetTickCount64
GetCurrentProcessorNumber
GetCurrentProcess
GetCurrentThread
Sleep
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
LocalFree
EnterCriticalSection
SleepConditionVariableCS
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
LocalAlloc
GetConsoleOutputCP
WideCharToMultiByte
GetProcAddress
RaiseFailFastException
ExpandEnvironmentStringsW
FreeLibrary
LoadLibraryExW
DuplicateHandle
GetThreadPriority
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
SetEvent
CreateEventExW
FormatMessageW
GetCurrentThreadId
FlushProcessWriteBuffers
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleW
GetModuleHandleExW
GetProcessAffinityMask
InitializeContext
GetEnabledXStateFeatures
SetXStateFeaturesMask
VirtualQuery
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
GetEnvironmentVariableW
ResetEvent
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
InitializeSListHead
GetCurrentProcessId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ole32
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoWaitForMultipleHandles
CoCreateGuid
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
api-ms-win-crt-math-l1-1-0
modf
pow
ceil
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
strcmp
_wcsicmp
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
abort
terminate
_cexit
_configure_narrow_argv
_initterm
_initterm_e
_initialize_onexit_table
_seh_filter_dll
_execute_onexit_table
Annotate3065
Astound3261
Broadways6012
Crepe2737
Flashback7990
Graded7240
Guise1474
Heftiness9630
Kinswoman8001
Nemeses3610
Rarity0828
Speller3639
Tricolor9281
Name
.text
Size
414KB
Virtual Size
414KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
874KB
Virtual Size
873KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
89KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ