7z2408x64.msix
- SHA256 2c59f3552a77d2c9527970ae99e204ec279756ac24815a899ab43356420057e7
Overview
overview
10Static
static
37z2408x64.appx
windows7-x64
7z2408x64.appx
windows10-2004-x64
10PsfLauncher32.exe
windows7-x64
1PsfLauncher32.exe
windows10-2004-x64
3PsfLauncher64.exe
windows7-x64
1PsfLauncher64.exe
windows10-2004-x64
1PsfRunDll32.exe
windows7-x64
1PsfRunDll32.exe
windows10-2004-x64
3PsfRunDll64.exe
windows7-x64
1PsfRunDll64.exe
windows10-2004-x64
1PsfRuntime32.dll
windows7-x64
3PsfRuntime32.dll
windows10-2004-x64
3PsfRuntime64.dll
windows7-x64
1PsfRuntime64.dll
windows10-2004-x64
1StartingSc...er.ps1
windows7-x64
3StartingSc...er.ps1
windows10-2004-x64
3VFS/Progra...13.exe
windows7-x64
3VFS/Progra...13.exe
windows10-2004-x64
3VFS/Progra...za.dll
windows7-x64
3VFS/Progra...za.dll
windows10-2004-x64
3VFS/Progra...xa.dll
windows7-x64
3VFS/Progra...xa.dll
windows10-2004-x64
3VFS/Progra...ar.dll
windows7-x64
3VFS/Progra...ar.dll
windows10-2004-x64
3VFS/Progra...64.dll
windows7-x64
1VFS/Progra...64.dll
windows10-2004-x64
1VFS/Progra...ar.dll
windows7-x64
1VFS/Progra...ar.dll
windows10-2004-x64
1VFS/Progra...za.dll
windows7-x64
1VFS/Progra...za.dll
windows10-2004-x64
1VFS/Progra...za.exe
windows7-x64
VFS/Progra...za.exe
windows10-2004-x64
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7z2408x64.appx
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
7z2408x64.appx
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
PsfLauncher32.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
PsfLauncher32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
PsfLauncher64.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
PsfLauncher64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
PsfRunDll32.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
PsfRunDll32.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
PsfRunDll64.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
PsfRunDll64.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
PsfRuntime32.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
PsfRuntime32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
PsfRuntime64.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
PsfRuntime64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
StartingScriptWrapper.ps1
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
StartingScriptWrapper.ps1
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
VFS/ProgramFilesX64/13/13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
VFS/ProgramFilesX64/13/7za.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
VFS/ProgramFilesX64/13/7zxa.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
VFS/ProgramFilesX64/13/arm64/7za.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
VFS/ProgramFilesX64/13/arm64/7za.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
VFS/ProgramFilesX64/13/arm64/7za.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 7z2408x64.msix
- Size 8.6MB
- Sample240926-mtklkssglp
- SHA256 2c59f3552a77d2c9527970ae99e204ec279756ac24815a899ab43356420057e7
- MD5 b32a3b7070b1715b38b39621c3957fdc
- SHA1 3633ccc1ccb35c1b0dfb2cbe2e3d281a9652f821
- SHA512 0a18a335c364e9a8b78f414fcc943397150028fe0133db21d22b750c9a9b5004b0893a4159f51b69424b2cefd1a22630f320a9319cfade29f0b10e33f52a30f1
- SSDEEP 196608:+zFuy7ANIXCjHhtK7hEjZr3MLoWM4J8wfwjPjnesXfX:+zjAnHm7hCr3UJVfwjbnesv
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/VFS/ProgramFilesX64/13/13.exe unpack001/VFS/ProgramFilesX64/13/7za.dll unpack001/VFS/ProgramFilesX64/13/7zxa.dll unpack001/VFS/ProgramFilesX64/13/Far/7-ZipFar.dll unpack001/VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll unpack001/VFS/ProgramFilesX64/13/x64/7za.dll unpack001/VFS/ProgramFilesX64/13/x64/7za.exe unpack001/VFS/ProgramFilesX64/13/x64/7zxa.dll
File Explorer
-
7z2408x64.msix.appx 8.6MB
-
AppxBlockMap.xml.xml 20KB
-
AppxManifest.xml2KB
-
AppxMetadata/CodeIntegrity.cat11KB
-
AppxSignature.p7x8KB
-
Assets/logo.png.png 1KB
-
PsfLauncher32.exe.exe 302KB
-
PsfLauncher64.exe.exe 370KB
-
PsfRunDll32.exe.exe 92KB
-
PsfRunDll64.exe.exe 115KB
-
PsfRuntime32.dll.dll 368KB
-
PsfRuntime64.dll.dll 467KB
-
Registry.dat48KB
-
Resources.pri5KB
-
StartingScriptWrapper.ps1.ps1 14KB
-
User.dat20KB
-
VFS/ProgramFilesX64/13/13.exe.exe 826KB
-
VFS/ProgramFilesX64/13/7za.dll.dll 283KB
-
VFS/ProgramFilesX64/13/7zxa.dll.dll 159KB
-
VFS/ProgramFilesX64/13/Far/7-ZipEng.hlf2KB
-
VFS/ProgramFilesX64/13/Far/7-ZipEng.lng3KB
-
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll.dll 273KB
-
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll.dll 458KB
-
VFS/ProgramFilesX64/13/Far/7-ZipRus.hlf2KB
-
VFS/ProgramFilesX64/13/Far/7-ZipRus.lng3KB
-
VFS/ProgramFilesX64/13/Far/7zToFar.ini2KB
-
VFS/ProgramFilesX64/13/Far/far7z.reg2KB
-
VFS/ProgramFilesX64/13/Far/far7z.txt2KB
-
VFS/ProgramFilesX64/13/GoogleChrome2.7z.7z 1.4MB
-
VFS/ProgramFilesX64/13/License.txt5KB
-
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll457KB
-
VFS/ProgramFilesX64/13/arm64/7za.dll434KB
-
VFS/ProgramFilesX64/13/arm64/7za.exe1.1MB
-
VFS/ProgramFilesX64/13/arm64/7zxa.dll281KB
-
VFS/ProgramFilesX64/13/history.txt11KB
-
VFS/ProgramFilesX64/13/readme.txt4KB
-
VFS/ProgramFilesX64/13/x64/7za.dll.dll 402KB
-
VFS/ProgramFilesX64/13/x64/7za.exe.exe 1.3MB
-
VFS/ProgramFilesX64/13/x64/7zxa.dll.dll 211KB
-
VFS/ProgramFilesX64/7-zip3.7z.7z 3.0MB
-
VFS/ProgramFilesX64/PsfRunDll64.exe.exe 115KB
-
[Content_Types].xml.xml 1KB
-
config.json373B
-
sarghsrtyjsrtyhjwsy.ps1.ps1 469B
AppxBlockMap.xml
- SHA256 08c6cb4e5522b0813de74ab5c0290a866714e6d29bac7d959e2d3f58d39482d6
- MD5 a4bdae1ff287cf2c8065c73dc4bb90ef
- SHA1 c500f5e3e508fb5cf53125c61d302f3407ce974b
- SHA512 36d4a69df26cb476d657e87861ef21a0ee30b51fecd11a899b21df4658eb5402db0c50ecd517f909765a67fb373ac8956018fa82fab5fbac5b18fdf5402986c4
- SSDEEP 384:aJNB70EgbU7HZ+SOjcD+qLW7AXfjZQ6nkzH:Iv70vgDZqjcV8aZQ66
- MD5 SHA1 SHA512 SSDEEP
AppxManifest.xml
- SHA256 66ff6f3dcac8823aacb61d85ba79eff43d642c74d1a3b7e174734a26d5214703
- MD5 8ffbcd8ff1e62129065115e5767799c3
- SHA1 7bd1b099b4956757ed278150faf565f255b8e48e
- SHA512 c2189db600684029fe0d2c0e9e1e0439600d3eb611f7b5684556600d9f4697c253554c0f3029a463a0690cc81fee5d158de8bbca5cd50355d7f501187bffee03
- MD5 SHA1 SHA512
AppxMetadata/CodeIntegrity.cat
- SHA256 173a26febf5f6c3c765179bd25a1033ebe386a1302ead155dac89122eff7e570
- MD5 360be592f9d3cd0c436852dcfe9cfc10
- SHA1 bbbb94b25cfe89d07e79185668637321d288a1b8
- SHA512 5cc2fa310e4421b56ce90a02d467023a94a3db28f2bf70590bd47b2c1cc251fa4a63674ff82b9bb977361bf79ead060285236dd82aac536c3cf05e121e4e7af8
- SSDEEP 192:lcqkh4F+thNOPXlkuTKDfxY+ynxjgvbhei3i64m/Zqn:ljkuF+thUdkueDZY+yt8hCm/Zi
- MD5 SHA1 SHA512 SSDEEP
AppxSignature.p7x
- SHA256 b8d481bfba169aa3d77b0c49cbb93d907417357d6db7ecdaa280623897c3ecec
- MD5 efaed620ba42dca7461880a97720303d
- SHA1 485afa08da1bf2be412bcc6f4b60ff41fde5ad5d
- SHA512 c9f6b1b116e998053ee18487fd255b329dfb47fbd0a975a2145a8ad9a33fb83553a45a64f2b1e6889f29f100952de21c99e1227e2b28fcaa7430626bc9fb80db
- SSDEEP 192:GcthNOPXlkuTKDfxY+ynxKssThei3i64m/gx:GcthUdkueDZY+yEssThCm/gx
- MD5 SHA1 SHA512 SSDEEP
Assets/logo.png
- SHA256 3fda410beca74ac232fbb20c3df3848c0d833c867563cd6b5120de44ad3e8b13
- MD5 19fc1a72d1446a66b032e23b6d4af313
- SHA1 6e9a75c7b9c42676eb90afd4b22fa89da437ed13
- SHA512 cf20c8621a4529c7e8b8d3ca024019ac3758b4a9499227cb3296191f77d462b9dfbebdd248fe219d9e085912b370e308f722e11cceb22947972fb89a692c3479
- MD5 SHA1 SHA512
PsfLauncher32.exe
- IMPHASH 7b63f97e8f0c360699c20e7c30842630
- SHA256 312bd304860f9865ed4073f5baffde8df9907a1ebfedd2d1d637ab48db3ca004
- MD5 e005414b82df848717581bd260725b02
- SHA1 6ad75f8152617858d463f36cf4b2ce432e0ad4df
- SHA512 be3d06d2049551e2d5acc3232c6d520236747d53dc49e388c6e616d1f7e1f6f7b6338a4e743773f5461589f2325a8a722af023009cc709f076f51e418382b562
- SSDEEP 6144:Z85jcjnYXSFt8NUBtirDpOzF2akGcoRJKCNWcWAOEOrCng:Z85jedFtOdEF2asjnzrag
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:d0:13:a7:5c:5d:ae:aa:c3:29:0e:40:43:a3:04:13:6f:c5:dc:11:70:6e:61:98:2b:51:5d:b4:82:d0:23:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
100367
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release\PsfLauncher32.pdb
kernel32
InitializeProcThreadAttributeList
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
UpdateProcThreadAttribute
OutputDebugStringW
WaitForSingleObjectEx
QueryPerformanceFrequency
OpenSemaphoreW
CloseHandle
DeleteProcThreadAttributeList
HeapAlloc
OutputDebugStringA
GetProcAddress
CreateMutexExW
VerSetConditionMask
GetCurrentPackageFullName
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
VerifyVersionInfoW
DebugBreak
QueryPerformanceCounter
IsDebuggerPresent
GetExitCodeProcess
HeapSize
GetConsoleMode
GetCurrentApplicationUserModelId
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetCurrentPackageFamilyName
GetModuleFileNameA
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LocalFree
FormatMessageA
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
WriteConsoleW
user32
WaitForInputIdle
MessageBoxExW
advapi32
RegDeleteKeyExW
EventWriteTransfer
EventRegister
RegCreateKeyExW
EventSetInformation
EventUnregister
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
psfruntime32
_PSFQueryAppMonitorConfig@0
_PSFQueryConfigRoot@0
_PSFQueryCurrentAppLaunchConfig@4
_PSFReportError@4
_PSFQueryPackageRootPath@0
_PSFQueryStartScriptInfo@0
_PSFQueryEndScriptInfo@0
_PSFQueryExeConfig@4
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=164, id=261, version=30795,
count=22, id=260, version=30795,
count=18, id=260, version=30034,
count=22, id=259, version=30034,
count=83, id=261, version=30034,
count=2, id=257, version=30152,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=191, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfLauncher64.exe
- IMPHASH 8e9b7caff9376bbdc8b416a414b64656
- SHA256 338fc84d0b309a726bae061ae7ef727884fd43a71aff70900dbce27de07791ea
- MD5 bfcb4275530e99a5e3fca4614a645fb5
- SHA1 622421f44db52d39947e8229f7fa44a98339957f
- SHA512 21cab7c56f53305038fa5603720853a38aeddf0dde2e02c9f1d0e83d6dbf9983f755b11a00d487bb8356b0ab69cf9e953a9786cd89e2180b7d428e038271c41b
- SSDEEP 6144:thxzPfoMtkmiZqfrnZSG85YhDFohEUMaWT4I+wKn:tnzPLtbWqDUsNFoOaGKn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2a:cd:2b:db:ff:a7:68:4f:c2:5f:f0:a2:a0:60:28:15:f6:47:23:6c:9f:05:81:18:52:9c:1e:da:d3:52:e0:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
109980
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfLauncher64.pdb
kernel32
InitializeProcThreadAttributeList
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
UpdateProcThreadAttribute
OutputDebugStringW
WaitForSingleObjectEx
QueryPerformanceFrequency
OpenSemaphoreW
CloseHandle
DeleteProcThreadAttributeList
HeapAlloc
OutputDebugStringA
GetProcAddress
CreateMutexExW
VerSetConditionMask
GetCurrentPackageFullName
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
VerifyVersionInfoW
DebugBreak
QueryPerformanceCounter
IsDebuggerPresent
GetExitCodeProcess
WriteConsoleW
HeapSize
GetCurrentApplicationUserModelId
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetCurrentPackageFamilyName
GetModuleFileNameA
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LocalFree
FormatMessageA
GetStringTypeW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
user32
WaitForInputIdle
MessageBoxExW
advapi32
RegDeleteKeyExW
EventWriteTransfer
EventRegister
RegCreateKeyExW
EventSetInformation
EventUnregister
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitializeEx
psfruntime64
PSFQueryAppMonitorConfig
PSFQueryConfigRoot
PSFQueryCurrentAppLaunchConfig
PSFReportError
PSFQueryPackageRootPath
PSFQueryStartScriptInfo
PSFQueryEndScriptInfo
PSFQueryExeConfig
Name
.text
Size
242KB
Virtual Size
242KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
94KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=164, id=261, version=30795,
count=18, id=260, version=30795,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=85, id=261, version=30034,
count=2, id=257, version=30152,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=196, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRunDll32.exe
- IMPHASH b1a931f51b30b56b60ecdb5d25bf3458
- SHA256 324f1db0dbe4a6577425d0c3dd72d4681e5000cca9d17cc62a2af0fcce12eca2
- MD5 96376177175a1b23a95c6498e9ffb2b5
- SHA1 f9d41e74bf714ed8ba60eac4f99060a5d5f92b26
- SHA512 f792432ac0c675548849ea238934ea84eadc44cd94eb9e2e7859267e20ea18a52a9d562602d96f61c5080e0fa94caa4ef6a41e49bafb670b7dd29e35490b48df
- SSDEEP 1536:IU5eCS6ZrIb3BIh7iCH+E+MteSQ40X/qchNXQDGdl0S6gsWRUchcdesCkwcmSZ0l:/eCh23BIhWCMSQ40XCMNl0F6kesCkwcu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
27:7e:36:6a:87:38:f0:2d:f9:50:ec:7d:2e:ce:46:5c:7b:f6:e0:42:cf:ba:4c:97:d2:a9:53:57:4a:67:a3:d7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
4873
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\1\s\Win32\Release\PsfRunDll32.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
DecodePointer
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=30034,
count=17, id=260, version=30034,
count=20, id=259, version=30034,
count=3, id=257, version=30795,
count=82, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRunDll64.exe
- IMPHASH 0e5c9a29fdcee2791341cd303678be64
- SHA256 b37f6780adc7c7534ab474c1a9b8a5fbc1a8e9df105be9be7a9e13d96385dbe4
- MD5 8466f69926a22670dcf6515a4fc3c054
- SHA1 fd7a2d377cce9545fff272905af7016bd512aefc
- SHA512 5be11238923613169a2627b01db76a09b83e8215dd1872f8e96d8f646171bd9e365fa653da221671fd46258f661794b846ed09aa4369b5d55b3ac27f0b96b0e7
- SSDEEP 3072:poN2YAE6yqki92M43MBaxRjn+ryYA/M5sfhew:pgAE6yq0MBBijDM5sfd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cb:df:4d:bb:88:21:a0:92:0e:ed:70:53:11:a3:0f:3a:6c:39:80:c1:ce:0d:af:38:4e:b7:e3:f9:e3:b8:97:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfRunDll64.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=39, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=30795,
count=90, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRuntime32.dll
- IMPHASH f229992937d1d790b50a1cb368509a49
- SHA256 11d6916d6066e481f5d19bb503f654dcf9cac80aef818c2b52a2a1f0ca2efd5a
- MD5 a9f0eeb621dd5883258113cc4b490929
- SHA1 3c84cdde573eb0f94865f749d9095940cdef409e
- SHA512 336709007cb4723227f47ff153c99630209995315c8ecbbbe1ca24a48a133ed74ad6e557a123886dbb9a2022c752c67ef7c26524e6a59e8f0e125753a264c2fd
- SSDEEP 6144:gkIVNQKH9HisvT9/taRJ9AONndrKV1UaMCk7KxAOOCyXjmw:gkIVDvT9/t6nAuEMjOxICQjmw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
89:87:ff:46:cb:36:89:89:f5:08:c5:c9:86:65:9d:76:b5:64:22:07:4f:0f:05:e1:8a:e4:9d:b7:ac:77:5f:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
135680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\Win32\Release\PsfRuntime32.pdb
kernel32
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentPackagePath
MultiByteToWideChar
GetLastError
OutputDebugStringW
CloseHandle
HeapAlloc
GetCurrentPackageFamilyName
GetProcAddress
GetCurrentPackageFullName
GetProcessHeap
GetModuleHandleW
OutputDebugStringA
DebugBreak
LoadLibraryExW
IsDebuggerPresent
SetLastError
TerminateProcess
GetFileAttributesW
ResumeThread
GetFileAttributesA
CreateProcessW
QueryFullProcessImageNameW
CreateProcessA
GetCurrentThread
LoadLibraryW
FreeLibrary
HeapSize
GetConsoleOutputCP
GetCurrentApplicationUserModelId
GetModuleHandleExW
HeapFree
WideCharToMultiByte
WriteFile
FlushFileBuffers
SetStdHandle
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
SuspendThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
WriteProcessMemory
GetEnvironmentVariableW
WaitForSingleObject
OpenProcess
VirtualAllocEx
ExitProcess
ReadProcessMemory
IsWow64Process
GetExitCodeProcess
LocalFree
FormatMessageA
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
CompareStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
GetStdHandle
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
user32
MessageBoxW
advapi32
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
?PSFQueryPackageFamilyName@@YGPB_WXZ
DetourFinishHelperProcess
_PSFQueryAppLaunchConfig@8
_PSFQueryAppMonitorConfig@0
_PSFQueryApplicationId@0
_PSFQueryApplicationUserModelId@0
_PSFQueryConfig@8
_PSFQueryConfigRoot@0
_PSFQueryCurrentAppLaunchConfig@4
_PSFQueryCurrentExeConfig@0
_PSFQueryDllConfig@4
_PSFQueryEndScriptInfo@0
_PSFQueryExeConfig@4
_PSFQueryFinalPackageRootPath@0
_PSFQueryPackageFullName@0
_PSFQueryPackageRootPath@0
_PSFQueryStartScriptInfo@0
_PSFRegister@8
_PSFReportError@4
_PSFUnregister@8
Name
.text
Size
254KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
psf
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=170, id=261, version=30795,
count=22, id=260, version=30795,
count=15, id=260, version=30034,
count=24, id=259, version=30034,
count=70, id=261, version=30034,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=154, id=1, productName=Unmarked objects,
count=7, id=265, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
PsfRuntime64.dll
- IMPHASH de350c6095b02fd305afdbe337b14afd
- SHA256 495b13461b13c3ce1c766d9899b860add4dfcd9e6b2dc5815389aed6e26cda0e
- MD5 61863b4c1aeefe10d69f54c03d373fd5
- SHA1 4b448f7b4358945b3e9d744d97d6b7c860e5c5b8
- SHA512 f97b69a5567e477ca67ad7f41933b00a57f74bb4f69c01161c17735b8bb35590cf06aff0fafe8308104e9385a0eb808d8735be9a744c8d2d100c9a9ea5f842a8
- SSDEEP 12288:ybYu1g7I2hxD54yFTuWwp6wYcoDvbAfE63U4:qg7I2hZDFTuW/wx+kHU4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d2:15:c1:18:dd:d2:e4:0f:e9:3c:98:fe:7d:bd:b3:e7:65:c6:9c:82:be:d6:03:16:20:98:4d:f6:56:3a:d1:f2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
160092
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\x64\Release\PsfRuntime64.pdb
kernel32
GetFinalPathNameByHandleW
GetModuleFileNameW
CreateFileW
GetCurrentThreadId
GetCurrentPackagePath
MultiByteToWideChar
GetLastError
OutputDebugStringW
CloseHandle
HeapAlloc
GetCurrentPackageFamilyName
GetProcAddress
GetCurrentPackageFullName
GetProcessHeap
GetModuleHandleW
OutputDebugStringA
DebugBreak
LoadLibraryExW
IsDebuggerPresent
SetLastError
TerminateProcess
GetFileAttributesW
ResumeThread
GetFileAttributesA
CreateProcessW
QueryFullProcessImageNameW
CreateProcessA
GetCurrentThread
LoadLibraryW
FreeLibrary
WriteConsoleW
HeapSize
GetCurrentApplicationUserModelId
GetModuleHandleExW
HeapFree
WideCharToMultiByte
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
SuspendThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
VirtualQueryEx
WriteProcessMemory
GetEnvironmentVariableW
WaitForSingleObject
OpenProcess
VirtualAllocEx
ExitProcess
ReadProcessMemory
IsWow64Process
GetExitCodeProcess
LocalFree
FormatMessageA
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
CompareStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
GetStdHandle
GetFileType
ReadFile
GetConsoleMode
ReadConsoleW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
MessageBoxW
advapi32
EventSetInformation
EventUnregister
EventWriteTransfer
EventRegister
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
?PSFQueryPackageFamilyName@@YAPEB_WXZ
DetourFinishHelperProcess
PSFQueryAppLaunchConfig
PSFQueryAppMonitorConfig
PSFQueryApplicationId
PSFQueryApplicationUserModelId
PSFQueryConfig
PSFQueryConfigRoot
PSFQueryCurrentAppLaunchConfig
PSFQueryCurrentExeConfig
PSFQueryDllConfig
PSFQueryEndScriptInfo
PSFQueryExeConfig
PSFQueryFinalPackageRootPath
PSFQueryPackageFullName
PSFQueryPackageRootPath
PSFQueryStartScriptInfo
PSFRegister
PSFReportError
PSFUnregister
Name
.text
Size
310KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
108KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
psf
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=170, id=261, version=30795,
count=18, id=260, version=30795,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=72, id=261, version=30034,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=163, id=1, productName=Unmarked objects,
count=7, id=265, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
Registry.dat
- SHA256 5bb72db198eb3e79f63ab569f1dec2ebc613f29ca7d26f2bf1f503094ce64d88
- MD5 400108107ef08b117b57605dc5ea6a0f
- SHA1 32e3e75449604e9769776f6b71e13097299a002f
- SHA512 6f3f14944be86af36600f56c78251f471e2720c51faa0ab6438b69c083b7e0b577e0d79244b9900da19465ffab6da3ce21785a650d13d72cc7415cf490e790b9
- SSDEEP 384:xoTvCV/HR1mcK5EUHcKtyT87MlKYJqlXhSIP5tKsCw74lJBaByRd:xV1WEUHrteUK7atKsh74zBaB
- MD5 SHA1 SHA512 SSDEEP
Resources.pri
- SHA256 ae0e328618800983358b154262102ea2e73823108d7f86c62a37dc91377f5df3
- MD5 ce102c4b1736bf61f34e14f0173fee89
- SHA1 d166e454ca33520e0c76efecadac0224b93e60cc
- SHA512 5f3bfa7f4f12047a95b71a44da3f1cd06357d0a06b8257eded0de40fd1e6d650f892a529f6ae9368e4ac5b6f9b5a17213fb5f641500f6a6075d1cf5c4a8c05a3
- SSDEEP 96:WPDIBImIIIFICItiIPIuiImIjiIxIUiIYIpiIS6/37LCOXT4aICInowoq8RI6I64:WP5I7j0Xowoq8NqsOqC
- MD5 SHA1 SHA512 SSDEEP
StartingScriptWrapper.ps1
- SHA256 7778c658411a2f1649ced14cdfe8a92145c1c7fa53b1ce5b14920000fe99bd98
- MD5 da5bf3010154020db9db4cf8832b42ea
- SHA1 15ba3dc3bbcb16a26839862d79b3519e74a5e03a
- SHA512 d70c6df571a069797f5eb1ac9a3e30293914b8f1378714e97ae0b881ee5a833f0944ee7246e2768ed74747637deade85306e837a25b1757a1bc3abb7d6eaa9e2
- SSDEEP 384:wrBzBV4OHcvFcYlu2V8uMcg5apqpBw2qFA5WFQExxR/c/mZ1:KBr4DSYlu2VzMcgwgBLqJQO/ceD
- MD5 SHA1 SHA512 SSDEEP
User.dat
- SHA256 4d476e8f8d5450cf99188acf1fa1892b29be281372209e97166e4ad7b3742b0b
- MD5 b3b1ed06a4b1c7ff5c4cca9a48f384af
- SHA1 5f5bfae2f46bc740013a6383bc2a10f5b3616466
- SHA512 01f3f8f3eed853890e241930364f2eab5aa4c811c6a610bfc6cbfb5b559c62c6ca5468dfe4d0d8bd8b83a14ccedc3d9fd3a4970fbac2e7dfb5d2713893e9c02f
- SSDEEP 192:0iQ7drhOhy2Fm1Ayy4aL13q9f9XmC9Yqmx/T4apIfkP5tKsCw76rQmlJCWVVkB1Q:HQPWMAyYJqlgBFP5tKsCw74lJBaByRd
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/13.exe
- IMPHASH 6f18dc28cf1faef40cedf506a5685aac
- SHA256 bf2ec1a2ea0242a24bb9c5b7bcaee3f335edcc384aabd07bbfe93e74888cb26c
- MD5 e58073e04563ee374ac9d33d64292b12
- SHA1 2fce424fe45978693610d0226c73648932cc1005
- SHA512 045d7b4f55aff32f15b0673dde1ba545fa81b4c8036b2a5dea5981ef1a7a103f40617bd5b66997e0658a9c7b51cf3c5978a625261d5e9e7c20670fe6abd81c2c
- SSDEEP 24576:e8VzM+vWJXYXuT7i0k/i0Rt5w4VrpMzLnODs:eAgCWJoBD/pPQis
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
676420
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
oleaut32
VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear
user32
CharPrevExA
CharUpperW
advapi32
OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
realloc
_ftol
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno
kernel32
SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateHardLinkW
InterlockedIncrement
GetVersion
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
SetEndOfFile
ResumeThread
Name
.text
Size
701KB
Virtual Size
701KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=3, id=11, version=8047,
count=9, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=157, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=192, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=260, version=33523,
count=4, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=35, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
VFS/ProgramFilesX64/13/7za.dll
- IMPHASH edb01ced967d1545f46e4d8d004d088e
- SHA256 3fc4ade77fa6207c646ca3906bb8c0f21b3472ca8dfcde6635ad6da5ab5491ea
- MD5 ef65428f79e120e5fc10e3eecb843d17
- SHA1 4428930e17bccef34298826756c9af43106c3178
- SHA512 9d312179ff1b7c692252bdfd241d245e8d57b0cae6ce5c8c7755f9f074f8e31c63d93e4fae341f0af8824fc0b6c278bfe3efdb8c27e36f87a4375bd3d27caedb
- SSDEEP 6144:o2ymhthvdTJ65E44h/84s+Eol8p/wReA+H6Y7hby4xPuAM6QJ3yV:olmhthvdTJ65EVg1uETH6uzxmAMLo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
230919
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear
user32
CharUpperW
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
realloc
memset
strlen
wcscmp
memcpy
memmove
free
_CxxThrowException
malloc
memcmp
_purecall
__CxxFrameHandler
kernel32
GetTempPathW
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
GetVersion
IsProcessorFeaturePresent
GetModuleHandleW
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
WriteFile
ReadFile
GetLastError
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=100, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=91, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=260, version=33523,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=25, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/7zxa.dll
- IMPHASH cd3731e16c560eee547e3c651dae4f7f
- SHA256 b20a579d21ec7d3bc3c80c5f0a4d6921b78f6af3b6e285e013f84220e143405c
- MD5 5c4408747f4bb3e3e65669004db8f8ec
- SHA1 7ac6b8a217dca16deb60c7132a0aa3e5a1b8dd9a
- SHA512 a8c6ed02ba46d8f57c756d5dc279ce84b56a44bb5e3130ae475b400d551f055f30209a7cc9fb6d54569750724921077dfa21c5e1e35943deb7de731dfcef8245
- SSDEEP 3072:o/W7sa+jaIQG8eBqcDbOWR3EHmG1xW2AdNw6bvw/9jQm6ibMdGptziybUT:onX8eIcDSq3EHmG1dAdNw6zw/9p6ibeR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
128391
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
msvcrt
__dllonexit
_onexit
_initterm
_adjust_fdiv
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_beginthreadex
memset
strlen
free
malloc
_CxxThrowException
memcpy
memmove
memcmp
_purecall
__CxxFrameHandler
_except_handler3
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
IsProcessorFeaturePresent
GetModuleHandleW
VirtualFree
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExW
GetModuleHandleA
GetProcAddress
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
GetVersion
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
128KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=11, version=8047,
count=8, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=61, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=72, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=260, version=33523,
count=16, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/Far/7-ZipEng.hlf
- SHA256 bd47a48183384d5f1d1d4a3ba357abe1464c567c84f8bc75ced56b81c99e1fe4
- MD5 4d6f189cbb89bda3d202e72d3a6460ec
- SHA1 6057d259ffc7fdcb3e64fcb662dfd9022aee16b3
- SHA512 9df3edeeedb41e15fe6f63b60b879b33730fca9fb7017cc8df8ca9c901d289ce203305c74518eb527138295588851696fb9afec3135ba2378f4a9d492eaf0d5d
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipEng.lng
- SHA256 02b06a71d9c7442724eeeacf3683d015b3b868b1df098c2ba4667b9a2d0f8a21
- MD5 3162638b475f8674db5ad3c2af15d2ed
- SHA1 813ee34dbf4029f8f8eaf0c74ccef6fd26088435
- SHA512 78d704f8add80161775313dba0815663b7339d7013e081858d0678818cf3832c2be42724f2a869342d01ec417fa9af8e198651aa603a72a65d6a4a0d257f21ce
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipFar.dll
- IMPHASH ea76c211bceaa0b3e988007ef472c487
- SHA256 8e6d2b5bdfc4c1d3b88643a47aa13ab15005039456a7d4ebb078a42568a341b4
- MD5 d04533fdbb455465721f437a2d849b8b
- SHA1 bd8217249cf01e86b44d2ec17280de79d19dfcfd
- SHA512 2ec1d78b4e3e65db7b2ccea768e7f1964347198af1b276bebf00a91125c2fc2c3649e54f1fc61cb94d3b03fc9091abe3cf220d515e501f4c2fcc7f06a22b70ff
- SSDEEP 6144:pIVsh0MxpsgoXiDlHU5N0CHzx6KyJzE0LMtSlzNhnrgWWgOf71q:vVmiZ05N0CHz85JYvkNh+gOT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
208281
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
oleaut32
VariantCopy
SysFreeString
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocString
VariantClear
user32
CharUpperW
advapi32
RegOpenKeyExW
GetFileSecurityW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
msvcrt
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
wcsstr
strstr
free
malloc
memmove
strlen
memset
wcscmp
strcmp
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
kernel32
InitializeCriticalSection
GetModuleFileNameW
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GetCurrentProcess
lstrlenW
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetDriveTypeW
DeviceIoControl
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetStdHandle
GetVersionExW
GetTickCount
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetLastError
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
GetProcAddress
GetModuleHandleA
GetFileAttributesW
ClosePlugin
Configure
DeleteFiles
ExitFAR
FreeFindData
GetFiles
GetFindData
GetOpenPluginInfo
GetPluginInfo
OpenFilePlugin
OpenPlugin
ProcessKey
PutFiles
SetDirectory
SetStartupInfo
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sxdata
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=14, version=7299,
count=3, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=95, version=2190,
count=126, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=73, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=260, version=33523,
count=4, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VFS/ProgramFilesX64/13/Far/7-ZipFar64.dll
- IMPHASH de297ca23880e1543f5c5121dfbab235
- SHA256 05c932f7c7391ba29b3dec39a7e273a9b51f1c6bd75b0aa942c08e1fa91dced8
- MD5 f8c737ca365dbbae5e0010e75bd641b3
- SHA1 997b00a5807ffff06298b11e6c5cd427dc8d2402
- SHA512 5f632dc5f85eab78ba7030be0347e497e309c4ebf109fb765368171ad5e56361f797bc742b25b1296240a02ed55eb4c14b76be849149b3b6367a00792fcdc7be
- SSDEEP 12288:SkQxAVquWibWM1ysXvTz4NaGVg/6k+VrKk:lqni6M1yovTz4NaGY6nRK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
324688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysAllocString
SysStringLen
SysAllocStringLen
VariantClear
VariantCopy
SysStringByteLen
SysFreeString
user32
CharUpperW
advapi32
RegDeleteKeyW
GetFileSecurityW
SetFileSecurityW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
msvcrt
free
malloc
strlen
memset
memmove
strstr
strcmp
memcmp
_CxxThrowException
memcpy
__CxxFrameHandler
wcsstr
__C_specific_handler
__dllonexit
_onexit
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
wcscmp
kernel32
InitializeCriticalSection
Sleep
FormatMessageW
VirtualFree
VirtualAlloc
GetProcAddress
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GetCurrentProcess
lstrlenW
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetDriveTypeW
DeviceIoControl
SetEndOfFile
WriteFile
ReadFile
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetStdHandle
GetLastError
GetTickCount
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetFileSize
SetFilePointer
ClosePlugin
Configure
DeleteFiles
ExitFAR
FreeFindData
GetFiles
GetFindData
GetOpenPluginInfo
GetPluginInfo
OpenFilePlugin
OpenPlugin
ProcessKey
PutFiles
SetDirectory
SetStartupInfo
Name
.text
Size
315KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=125, id=1, productName=Unmarked objects,
count=76, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=260, version=33523,
count=9, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/Far/7-ZipRus.hlf
- SHA256 5f78f1ad25860ef28fe3b73f915e357035176dc91b7013c554e5f8d1cab1cee0
- MD5 b3c605a5aebda78e12e39fc873470d04
- SHA1 499a7737a36c4436a83fbbd396b3b2c10977282b
- SHA512 a41caf844f4df8eaf4c005f7756d941dfb906903107b5c67d8db499e875eda6417d0a751f9be8879ce134cd2f14fe0099364d5557142762be1922a913ba895b0
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7-ZipRus.lng
- SHA256 69e005acb0215a3cecf960eb180af0079533b46b8bd5a30e7ca1c4dc23ce5ab8
- MD5 8c389a621e0786a41c8619b02d70b005
- SHA1 71d761f46ac735fe2634fdae830d6b283bc0a481
- SHA512 299f356a2704a096b153b630e2345799c02fde7e246e50af2f30dda7a31750b6066c23288bab58131dffbb3ecef61c43428e6f7701de703145aa34ed46083c21
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/7zToFar.ini
- SHA256 483a1db874153ac9f2a1098a5ac6c05676940f90af4f8e9c903d6fc13848a118
- MD5 a7656301a8349c626452ea76cac9fa33
- SHA1 5f537aa414bcf923ca978eb047a7b99152d9857f
- SHA512 f4892f5f36aee60620307a470f52bde83754b3fc5cc8f7eb93fed93f666ffade2b1c311631c33015037d52c0f107de2bb1fabc6b1c9035f4aa91e116ce265026
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/far7z.reg
- SHA256 cab398fb2e704a8d6eb486ded87b57375414c4eba9df6f05333d041033ab1968
- MD5 6f60a13b4574fcdc675d21054499b85d
- SHA1 9ebafbadeeb4851c4496b59cf28819495a8e7e98
- SHA512 060fec36f161673d0e38dfb717111492ac08d62defd9aa8ff3b369d03038be9352eee4a5c071955ba4762dd546e02a68c779bb98434b529c5b22afbf5cb37a30
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/Far/far7z.txt
- SHA256 b4039132a22acc7f05eb48152ccb01c54c603addb121918996c8356912404008
- MD5 7b2d14f1cd85dcdf098cf909749c48a8
- SHA1 dd96b69f3728d783d4f42522a8a3abea414f3e6b
- SHA512 861c3fdb34a092c02c816d22c5b762169433842444d4f844a21f8288b33c3e378007434daa9c333bcd9718ffaea3c1b6c8d21c31156a3c3622900182a9ace51e
- MD5 SHA1 SHA512
VFS/ProgramFilesX64/13/GoogleChrome2.7z
- SHA256 3ec04b5c60939209c5d19dd525e53425aef8803d242d9ad63346445ebe09398c
- MD5 99732fb703c4d1e51ddabde2c96975e8
- SHA1 4fbff9403124dc7f5a5c1ae6252c9ffacdb1df72
- SHA512 09bd5f55b25b243d695a4f91f65bd9559f27d122d5da180312d38e83d983d743f8db2a7883aa3550f2efbad7b71510ce87393c89ee0d04c854a957788f96e10d
- SSDEEP 24576:sPkEzUSYY7iMv1BKENeII6Jz3/A1PIhus8SWQZSGzDQlEpHPCEZD8Bz7zTVw/80C:36Hti7nII6N/v4QZSGzDQlul98Bz7/VP
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/License.txt
- SHA256 d34a018bd862e4eb96d5995a06b7d922b32f37f3006a647b488e07dfbca18895
- MD5 8cd6549be1b079383db37b8c1f0809bc
- SHA1 0715015ea6349d09fe7aeccb27ea6add108588ed
- SHA512 3e288bef120982f6baea004340efebeb772d4846663efb81d56a921fd09296bd501b4ad20d82d4544c7ebb94683e2fbbee9f7330fce28bf4bd27a8756a5c07bd
- SSDEEP 96:W1hu+xLgOrLJIJzDJu3S3zVSZOrLJIJzAu3S3zVSX:ShuoLgOrNcXJu3S3JSZOrNccu3S3JSX
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/arm64/7-ZipFar.dll
- SHA256 6ad01b9d823c3fa3c623483e302d04568e35230091aa8af7750715b9739ce3ca
- MD5 75e8535d87e708b53f20d0bb4707129f
- SHA1 72ef3279ec34e404eb1b9db21cc1139d8b547eb0
- SHA512 8d5c865668e17ef129e274487eadc375325c7d8e8685108a1752f95f6526253a8ab000af8815b567358542b9326a44fa966bf9d8bc22e095f2dc770dbbca8cd4
- SSDEEP 6144:Esmzrvdw2gRlFmdT/oJ8A244PZ35wDDXjvfgNsNTeekilpi4lPbuOF4YSmCB7BLj:Oxgd+T/68AJeKANsZnaRnT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7za.dll
- SHA256 49e0503b316076b9e0c90c9e3a0c475ef5d9b4376d33d702e0469029a0008e88
- MD5 ae6a4f422e16e45b5dd0ab6da1a82d8e
- SHA1 3fe04a626232b0c3de6770f8e2c600aeb4c626e8
- SHA512 940fe46e357ba3601998e4639a30c8df49d6ea92562afda65decd13f7c3d9b3a72c9d89cf1246d9a1bd97e5b8a7197cb789ce752f5dbbe0c1586bc0b2549b120
- SSDEEP 6144:QxU19008UrXRzK2xELbGQscTe8xRuKX/hyTSfUp1sL5T0:F19Z8UrX+Lb6/8r+SM7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7za.exe
- SHA256 e94aef071141c4178fac4ccc584a12ef6301ea0d8cabe7200c2234646baaecbb
- MD5 8f456c574478339fb77ad580b50998ad
- SHA1 6c1edb83a34319090b40abbcf0fc208f80c99099
- SHA512 ef0a37e9633bb71fc31fd61c9e0fe1f12284aee9b4794ac314271424c522fd1b25acef40ffa099802a2ff31068770552e8396e5a3d08029bae1dfd271076bdd2
- SSDEEP 12288:/7THLZP31Bu7Vu/oviZcx+dQS4BTNBbpWf95n21gxEJApu6JUVKIHbw0LNG/VUNb:TLLp3ruR0J2Tza9wgxEJBc5Izcq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/arm64/7zxa.dll
- SHA256 a81e4ee586e31a3ecab3ccf0e41b41d56cb1686fdd38469aac08d9421d82bfd1
- MD5 afbf2157c80490945745f6367abb5528
- SHA1 813a03edd5fe1d28d57fd86d0e7ef00b3ae6858e
- SHA512 7e065199bec9111de62dba34d0e36ded2e9a339fe957c3cbc0c7e278544b6427f3c0644c9bd3d538fb41e8e34058058f6d9a96c53b66f6dc1532af6b37096ecd
- SSDEEP 3072:Vfe0Q+QHyx4nDoA6gD0tmhdSe5DjxHjYgXt37k0m154jCbGQakvQu9Iy:VfCyQErO+mhdSe5PxHcgXt37kWGuXY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
VFS/ProgramFilesX64/13/history.txt
- SHA256 382dfb627c44831e17ab9c5b2680a264afdd43600d074ee27734a12f742717a9
- MD5 adad8b0e892b4be1518445ddfa0fc8dc
- SHA1 bd22582f4a1f56a87cdd9e8c470a20e3d0ff45c8
- SHA512 0c0061c0d7b447dfc129528d6e61189a7fc228ada90e472b9e7bbc577653454078f3449b0d40a12edb9a0ea7ce965285c5988fbc133db1ccd869a0f97511834c
- SSDEEP 96:WfuPWkoSwcf53P1HbhvJE5um6YK5DthWTWQvJAmsD4h/roLF0KDoTf0jZ0kU8AUV:WfuP71wcfDEaYGS3h/roLeKyfz8Aqt
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/readme.txt
- SHA256 e433f4361ab01cb33099b4b721012db1460ec6767276cc6f3629b2d22e9df043
- MD5 c46bfaa3cacec7aa8cf1725c95cecddf
- SHA1 f15b4bd89ad5effa66184c6628f0a5362b6346fc
- SHA512 07cb3f620b8852f54b59579d60062addeb287aa5b7b91d00832f754c74d5e600ba6c152b92b9e6eac410990889bb9695fa60b245f291673e43bbbce0e37b09d3
- SSDEEP 96:HjujFI5LAFUm352xAT6nKXSAEOUrHeVjZlFq+L7R8cvTODoAlSJuKF:HihI50F3352xAGnKXS217RzHJuu
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/13/x64/7za.dll
- IMPHASH 18bc3b4099180bc67dd68352a0d42b48
- SHA256 583f67ca7b7301f5524fda8405afcb1d38b481556799d80a633978024577ebab
- MD5 967497e77171ac87ce0d9a306a7702b5
- SHA1 48270d2f65c448b362898b972b3775fd859f0fb3
- SHA512 498f3faefdbbb12d3b0170d06b954cffed6cb28889328a85a9394583b22c43908fc0b4debaff717e62e63f9b1e1dd60e73a6acf712e8e0f7b1f1853da20ec116
- SSDEEP 6144:XZQPeCI4eVX65RxgmxcI4l6ghclhu2mzt20yhwBdLPrzDh8JHVsmvUw:pQPN/eVX65bgFI4l6J7hhwBVzDK1N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
295312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
user32
CharUpperW
advapi32
SystemFunction036
msvcrt
memset
strlen
__CxxFrameHandler
wcscmp
_purecall
memmove
memcpy
free
_CxxThrowException
malloc
memcmp
realloc
__C_specific_handler
_beginthreadex
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
kernel32
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Sleep
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
SetEvent
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
WriteFile
ReadFile
GetLastError
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=97, id=1, productName=Unmarked objects,
count=94, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=260, version=33523,
count=31, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/x64/7za.exe
- IMPHASH 8122af7382bf626d4b6d8f35f0d8143e
- SHA256 199c64ad672453e98d86ad2c4ea88212eafd6f7c4070dfcb7609ab7a9bd5df11
- MD5 33aaf6621cc4b441c335327c1e02a952
- SHA1 cbf58e9e35ef72c9f271200bf1056410caac9086
- SHA512 66c90ae091be3ad7e3023d4ae14efd1253c44995add3273af8350e52a8f6e825abeeced9c0b4e0d145b547d77b4b921f8f21fef999d554113b88218f51945baa
- SSDEEP 24576:f7xctZMwfCK4tJSTV0Tu5ZlyjzeG/JEt:fKtZM5K4tEByWG/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
953984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
oleaut32
SysStringLen
VariantClear
VariantCopy
SysAllocString
SysFreeString
SysAllocStringLen
user32
CharUpperW
CharPrevExA
advapi32
OpenProcessToken
SystemFunction036
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
msvcrt
_exit
_c_exit
_XcptFilter
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
realloc
_purecall
_isatty
memset
strlen
_cexit
wcscmp
strcmp
memmove
fflush
fputc
fputs
_iob
fgetc
free
malloc
memcmp
__CxxFrameHandler
_CxxThrowException
memcpy
exit
__getmainargs
__initenv
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
wcsstr
kernel32
ResumeThread
SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
GetVersion
RemoveDirectoryW
WaitForSingleObject
GetLargePageMinimum
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
SetFileAttributesW
MoveFileW
CreateHardLinkW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
FindFirstStreamW
FindNextStreamW
GetFileAttributesW
GetLogicalDriveStringsW
DeviceIoControl
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
Name
.text
Size
955KB
Virtual Size
954KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
257KB
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=156, id=1, productName=Unmarked objects,
count=195, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=3, id=260, version=33523,
count=49, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/13/x64/7zxa.dll
- IMPHASH 1353ce6b26348ac6f792fe77a59eff9d
- SHA256 7454cd03cfa197b979cb62360f69143a48a8be86227f06538c546a70a14cde2c
- MD5 5eab00f912824ebdc5aa47ebe863b63e
- SHA1 8e2391668cebcf2aa6c7efecb3911895fbb98aa0
- SHA512 6027a55536eca2724edf1e6687c6251ef9913590ebac44507b58fd9d92074ddba39d38c743cd0ef43d382f6b45d4276b1ec790108503fe6f2a85e1f4884edddb
- SSDEEP 3072:LftOtcS7lCZc9Ltue1C+zV2zUmiRvgWDFSaRPQIDCuPK1gSBvAGfPFjaRv+PB7PW:LtViwgLtun+soC1vx2Hr0/NG1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringLen
VariantClear
SysAllocStringLen
msvcrt
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
_purecall
memset
strlen
_initterm
malloc
__CxxFrameHandler
_CxxThrowException
memmove
memcpy
memcmp
free
_onexit
kernel32
GetProcessAffinityMask
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatusEx
Sleep
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
IsProcessorFeaturePresent
GetLargePageMinimum
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetModuleProp
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode
Name
.text
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=9, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=58, id=1, productName=Unmarked objects,
count=75, id=110, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=260, version=33523,
count=22, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=4, id=259, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
VFS/ProgramFilesX64/7-zip3.7z
- SHA256 92ae29dfda91a8cfcce63d9797992cdc5a0837905a072fa9ed2c06598bf6af4d
- MD5 cd91b9cb21facd4ae41c9c713c1c9f06
- SHA1 5c74c643090ed552c177016cb7fc735726a214ff
- SHA512 e09cb8f9abc6e24c0ec0f42918a5b7c801bf09016d12a78c015ec732116e75439f9c07da482fba6e201cc57399d0e7d6c28280a365eed333fb3b79fe23be1f6a
- SSDEEP 49152:GAX/0KQq6c/KQe8nommSVbgvadYmWMKSUFgIlNpo4wnJdK/JlryU4S:xl6c/P4cbgvvmWM6pcTn2hFP
- MD5 SHA1 SHA512 SSDEEP
VFS/ProgramFilesX64/PsfRunDll64.exe
- IMPHASH 0e5c9a29fdcee2791341cd303678be64
- SHA256 b37f6780adc7c7534ab474c1a9b8a5fbc1a8e9df105be9be7a9e13d96385dbe4
- MD5 8466f69926a22670dcf6515a4fc3c054
- SHA1 fd7a2d377cce9545fff272905af7016bd512aefc
- SHA512 5be11238923613169a2627b01db76a09b83e8215dd1872f8e96d8f646171bd9e365fa653da221671fd46258f661794b846ed09aa4369b5d55b3ac27f0b96b0e7
- SSDEEP 3072:poN2YAE6yqki92M43MBaxRjn+ryYA/M5sfhew:pgAE6yq0MBBijDM5sfd
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cb:df:4d:bb:88:21:a0:92:0e:ed:70:53:11:a3:0f:3a:6c:39:80:c1:ce:0d:af:38:4e:b7:e3:f9:e3:b8:97:cd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
5000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\1\s\x64\Release\PsfRunDll64.pdb
kernel32
GetLastError
LoadLibraryA
GetProcAddress
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=39, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=30795,
count=90, id=1, productName=Unmarked objects,
count=1, id=265, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
[Content_Types].xml
- SHA256 edbaa22b4410145f34916fffbbfea3cd95f1ed2f5691af0a6c6167f484feb3e6
- MD5 e5aa9e7d1b2817fac56161e42db87df4
- SHA1 acfb122712a410a7d46f95a4a7eba27902dd87c2
- SHA512 13085477820c92fd583deaca357475a8d87d7d8c7ac4416781941a7ba2cdbcb18fe01def8c9e472f438dfddcdb1ade486654dfaf9a593b0d868906318d1e2960
- MD5 SHA1 SHA512
config.json
- SHA256 07676610bfe418202994b7b06f4cfbba0c5c750489d66a4bdb5d8465e25ee25a
- MD5 35193a78db88a622354ae96c33a0e269
- SHA1 26ce8e8eb4065509d18b92baa462371d01101c3e
- SHA512 7aeadef8d361f3a28273a79b02b7747a2c2848e4d144c21f56f3d6ffdbbd8b108d1a85d1ab9b4cf00d93af561d9e179ec40405bc16508b176b26a36045bb906d
- MD5 SHA1 SHA512
sarghsrtyjsrtyhjwsy.ps1
- SHA256 6fdeb1c2f4b5bc4ff6ea9635ca72d8670c07cfd17d3b7779caee22b96727f732
- MD5 48f426f5bd963cead1b35041d379c088
- SHA1 0b9c53c2fd8053dbea12a1622c2493d630cb0779
- SHA512 70fb2033fea873e0fdded971182fff93713f5c440f369149804144baccd3a402fee37b942e9c5ee42bea8951bddd42de57b5303251ad8c0ddd63ee72f7302ed7
- MD5 SHA1 SHA512