rpd.zip
- SHA256 f6cc0f77262feca3dc6efe46d69557dc072e5197f31182c71bdc099fdf1b4af5
Password
Rapid
Overview
overview
10Static
static
3rpd/OculusHelper.exe
windows10-2004-x64
3rpd/OculusHelper.exe
windows11-21h2-x64
1rpd/Rapid Rust.exe
windows10-2004-x64
10rpd/Rapid Rust.exe
windows11-21h2-x64
10rpd/System...es.dll
windows10-2004-x64
1rpd/System...es.dll
windows11-21h2-x64
1rpd/System...le.dll
windows10-2004-x64
1rpd/System...le.dll
windows11-21h2-x64
1rpd/System...ss.dll
windows10-2004-x64
1rpd/System...ss.dll
windows11-21h2-x64
1rpd/System.Memory.dll
windows10-2004-x64
1rpd/System.Memory.dll
windows11-21h2-x64
1rpd/System...ib.dll
windows10-2004-x64
1rpd/System...ib.dll
windows11-21h2-x64
1rpd/System...es.dll
windows10-2004-x64
1rpd/System...es.dll
windows11-21h2-x64
1rpd/System...me.dll
windows10-2004-x64
1rpd/System...me.dll
windows11-21h2-x64
1rpd/System...ns.dll
windows10-2004-x64
1rpd/System...ns.dll
windows11-21h2-x64
1rpd/System...ng.dll
windows10-2004-x64
1rpd/System...ng.dll
windows11-21h2-x64
1rpd/System.dll
windows10-2004-x64
1rpd/System.dll
windows11-21h2-x64
1rpd/clrjit.dll
windows10-2004-x64
1rpd/clrjit.dll
windows11-21h2-x64
1rpd/coreclr.dll
windows10-2004-x64
1rpd/coreclr.dll
windows11-21h2-x64
1rpd/hostfxr.dll
windows10-2004-x64
1rpd/hostfxr.dll
windows11-21h2-x64
1rpd/hostpolicy.dll
windows10-2004-x64
1rpd/hostpolicy.dll
windows11-21h2-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rpd/OculusHelper.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
rpd/OculusHelper.exe
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
rpd/Rapid Rust.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral4
Sample
rpd/Rapid Rust.exe
Resource
win11-20250610-en
windows11-21h2-x64
23 signatures
150 seconds
Behavioral task
behavioral5
Sample
rpd/System.ComponentModel.Primitives.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
rpd/System.ComponentModel.Primitives.dll
Resource
win11-20250502-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
rpd/System.Console.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
rpd/System.Console.dll
Resource
win11-20250610-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
rpd/System.Diagnostics.Process.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
rpd/System.Diagnostics.Process.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
rpd/System.Memory.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
rpd/System.Memory.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
rpd/System.Private.CoreLib.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
rpd/System.Private.CoreLib.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
rpd/System.Runtime.InteropServices.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
rpd/System.Runtime.InteropServices.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
rpd/System.Runtime.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
rpd/System.Runtime.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
rpd/System.Text.Encoding.Extensions.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
rpd/System.Text.Encoding.Extensions.dll
Resource
win11-20250502-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
rpd/System.Threading.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
rpd/System.Threading.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
rpd/System.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
rpd/System.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
rpd/clrjit.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
rpd/clrjit.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
rpd/coreclr.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
rpd/coreclr.dll
Resource
win11-20250610-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
rpd/hostfxr.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
rpd/hostfxr.dll
Resource
win11-20250610-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
rpd/hostpolicy.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
rpd/hostpolicy.dll
Resource
win11-20250619-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target rpd.zip
- Size 8.8MB
- Sample250705-ql79fszls4
- SHA256 f6cc0f77262feca3dc6efe46d69557dc072e5197f31182c71bdc099fdf1b4af5
- MD5 3fe451fab0077fbcd6468deaae5d5437
- SHA1 a29dd13e59356cc00a4009e268824c99a9f58091
- SHA512 2471614d3d54fb14299e958bfd92a274117eaad9e7d9e762358306711b286e856da64deec2e18d39ead88945114d755fd111049e26a2fedf813e81e653c2e1c4
- SSDEEP 196608:Ya+pCQnNBPsBU8rFYxGm1ByTRCaI4ApoObKXQywCTkemBOD5rw:5p2BPsBKGm1ByTI9n8XQAPmMJw
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/rpd/OculusHelper.dll unpack001/rpd/Rapid Rust.exe
File Explorer
-
rpd.zip.zip 8.8MB
-
rpd/OculusHelper.deps.json46KB
-
rpd/OculusHelper.dll.exe 17KB
-
rpd/Rapid Rust.exe.exe 148KB
-
rpd/System.ComponentModel.Primitives.dll.dll 73KB
-
rpd/System.Console.dll.dll 153KB
-
rpd/System.Diagnostics.Process.dll.dll 283KB
-
rpd/System.Memory.dll.dll 169KB
-
rpd/System.Private.CoreLib.dll.dll 10.1MB
-
rpd/System.Runtime.InteropServices.dll.dll 50KB
-
rpd/System.Runtime.dll.dll 41KB
-
rpd/System.Text.Encoding.Extensions.dll.dll 15KB
-
rpd/System.Threading.dll.dll 78KB
-
rpd/System.dll.dll 49KB
-
rpd/clrjit.dll.dll 1.4MB
-
rpd/coreclr.dll.dll 4.9MB
-
rpd/hostfxr.dll.dll 369KB
-
rpd/hostpolicy.dll.dll 385KB
-
rpd/mscorrc.dll.dll 143KB
-
rpd/msquic.dll.dll 504KB
rpd/OculusHelper.deps.json
- SHA256 0a80e5cd00297b6ea7b5763eec86664a871e9e2ca3f591b15dd9ddd5c0ff1322
- MD5 bf333ce34521bc1b04d94513cd38a3c3
- SHA1 5fa5cdfdb3602f7b8b15161037897d2565abbf9a
- SHA512 770d38c480b3214c5fc68c3ea46bc0c90454b73408678f136a560f6f15ecdc23680f6356e1c16efa5e619d44a809bba0c98271de7916a2b0248872900a717196
- SSDEEP 768:+IpXVEsIhKPMEPrT3XCGjDyiEc6BHa21Fe8kFN92uwtEeCJyDSLMVWlcQvw0:zXVEsIhKPMEPrT3XCGjDyiEc6BHa21Fk
- MD5 SHA1 SHA512 SSDEEP
rpd/OculusHelper.dll
- SHA256 8fed1915baea76b43e8d75bc49309fc2ab5b19ec6ee6bd86bbb7d5e7d5baeab9
- MD5 f8db10a4fe83f160df693b88c8ac0d94
- SHA1 8fb7dfe016d60d20b20c2e50fbec33fac80aa986
- SHA512 5776bcbfc5094be137234b7d84c54530d68a8663fb3644a3827cbdb7733494f46c96d4dfe5862a87d5d3d0e624ee3cf1bf99c847d9e7dc4222745f04e915a251
- SSDEEP 192:nzVOpVcd/bWWR9LY2+/T9adrMAFbA9m99u+HKEFxd+4vnmyTqiVlR8eNJZ/j:nBOGYnb9d59mzu/EFxFmypzZ/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Rapid
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
rpd/Rapid Rust.exe
- IMPHASH a8308de57fce070f4cb88c7f43bf4b27
- SHA256 563664af8d969e4a2433d927cde86c95d3ba42603b30fd3e50a8b8c53f763ae1
- MD5 c3fc0f96ee7d402a970190aced6fb910
- SHA1 5962ad00ea213220439e298d59e6ca8f53e66ecf
- SHA512 c19b5a88660f3e02e9afa5a28f9f2cdbd75f7d80f01a474e931cab38e7f94751eaeb6768e496adeab4c150898875ad07350f8adf07bdb69061f9fd32f149f4be
- SSDEEP 3072:85vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCmoU:8BKjK2LFzZNfIULf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Rapid
Minor OS version
0
Major OS version
6
Entry point
82000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_c_exit
exit
_cexit
_register_thread_local_exe_atexit_callback
_crt_atexit
_exit
_initterm_e
abort
_register_onexit_function
_initialize_onexit_table
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
setvbuf
_wfopen
_set_fmode
__stdio_common_vswprintf
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
__pctype_func
_unlock_locales
localeconv
_lock_locales
___lc_codepage_func
___mb_cur_max_func
_configthreadlocale
setlocale
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
frexp
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
_time64
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=83, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=205, id=1, productName=Unmarked objects,
count=10, id=265, version=30154,
count=1, id=258, version=30154,
rpd/System.ComponentModel.Primitives.dll
- SHA256 1b00f2d90f6830c6f4dd7bfade4edf41ab7a42f716223704ebb0b4b746e3625e
- MD5 3a25c91bcbf4970a6a27dbf2c0f8c6a8
- SHA1 be0e29c7bc269f4ee56f7b24b6968384315d57d7
- SHA512 bf1c5844b1d042b8968d1b51d75ac86e640bf4fe52c8a12ec5d3ab08658f993aed577d2962dd7bc58be927291b557a8d9d68fea0386ca72fc510bb13ec00fc0e
- SSDEEP 768:UxI98FwPKQAtTKNI6T1mb1yF0YDC2oKQ15h498Q8a7iFClJds9znCd6:2ITuP6kYFlC2oKQ6y8uiJdkznCc
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
b5:bb:a4:3c:4b:05:97:39:77:2b:8e:6f:9d:67:45:8c:74:e8:07:b5:f6:36:45:da:9f:ac:72:86:6c:4e:5c:ec
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.ComponentModel.Primitives.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.ComponentModel.Primitives\net6.0-Release\System.ComponentModel.Primitives.pdb
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Console.dll
- SHA256 509848bb0f4551253694749fc2a94b99e3d7414fb72110f31de3356859a1e800
- MD5 765d7a70783f0e3d7d93cf549ef4e1bc
- SHA1 45afcf5538bcadb6cb558be1865b04d74a456811
- SHA512 c3c1d1dd9c844c0487a25bf1115216ef0c4860b38afa7a978742aaab2eba796b090bad42e2b6fd2e159a72bcb38f2551f270720964e860869facf32204fc5f1f
- SSDEEP 3072:+9SMiIGbCwq+p14axXwbK80tmOaYMGK1T:eQj9RcclKB
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
e7:78:3d:19:fa:bf:8c:50:b6:e2:d2:f0:0a:6f:c9:91:0a:14:fb:4b:dc:61:74:0b:6e:ec:4c:96:58:46:33:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Console.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Console\net6.0-windows-Release\System.Console.pdb
Name
.text
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Diagnostics.Process.dll
- SHA256 1bcb92989f22b2d8efee51538f7f369d7cc61fcf17ea1bdda158cde557420853
- MD5 ba09f2ef8da85dfbc26f9e3f1f1cafec
- SHA1 3ed037953eeeba18668c38d2641f9fee2fddcf83
- SHA512 4244dce272bdced168bceb3f59376142e8cc04ffa7ee4f41c42f35aa51f2ae8e1ad4d71bc30df74f261c034d692c119153a7c30e0afe23200dd991ede6158404
- SSDEEP 6144:+4vmEeveJQADJujgkju83yxs9b3NX1PkxEqCS7s03Y12F:+4etveJQAdSvju8CjWb03Y1E
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
36:02:38:94:3b:ad:8c:e9:ac:b9:1f:a5:80:e3:5e:0d:14:b9:1e:78:fe:5f:b6:39:c2:d8:25:57:ab:45:8b:6d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.Process.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Diagnostics.Process\net6.0-windows-Release\System.Diagnostics.Process.pdb
Name
.text
Size
253KB
Virtual Size
252KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Memory.dll
- SHA256 2ee8e3efc4a7499d903da9829e88bba241f12a1c0a35e697f205f1de76aca762
- MD5 2ca529fbbed16eb3452080213b592c04
- SHA1 7688579d05bb2f7debb71e5255f07d6ee4f10e09
- SHA512 72393ddbaaaa22afd8b675981dfcafd3c38fed6373e61edefc7f9b2a577f5ca72ff5ed6046c601e01a84354d1f8b3bb8cd7d681cba816a4c9cbdb8a6579ba33e
- SSDEEP 3072:C0RPN4ab6HEuCKvSwOy6fM/vfovpPh/h/tmlIYrA6S1mUgMAxU:Zt+GKjtGPh/hwlU6EAG
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
80:a0:a0:2e:30:44:a6:c3:e6:8e:4e:9c:2e:22:41:9d:78:be:b3:44:92:4a:c7:ee:e9:8b:84:87:cd:ab:a0:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Memory.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Memory\net6.0-Release\System.Memory.pdb
Name
.text
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Private.CoreLib.dll
- SHA256 3ce6f27555e6ce2dc1d314012a5798a1a62b4527813c085548f7d937f83da74a
- MD5 5c013cbfce531163303352f70e120a38
- SHA1 012badfba622e533071610d6cba4cb10051bdebf
- SHA512 1a225963455b4876dc9b87e51468a9d9aab716d60ec142cdb59088f4698fc2f38b5f229d69ce0d7895b9f5e9251106b1395d53c45b835fa9ec6947d9f302575b
- SSDEEP 98304:KKd1eeIoZQsU+fRIwvUVvJS63bXYPrLAU4n/0v4/PyGvjv:tCoSsU+fRI/VvJSyXcOyGvj
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
dc:d9:f5:a1:9f:f2:26:74:8d:6d:0a:b8:56:f0:f1:3e:3a:fc:04:d7:b5:61:ff:b0:aa:4a:f1:e1:60:05:2d:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Private.CoreLib.ni.pdb
D:\a\_work\1\s\artifacts\obj\coreclr\System.Private.CoreLib\x64\Release\System.Private.CoreLib.pdb
Name
.text
Size
9.7MB
Virtual Size
9.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Runtime.InteropServices.dll
- SHA256 cab4e96d3ddf225acfb610a53ef299fb9e7deb74ab374e3976d799c77dfa8770
- MD5 8a6c9b36376252c6e6051e8a8c102a15
- SHA1 9a26de4bc0309dcfb301445132ec2de1721cc02e
- SHA512 97a3cb9cf801da36b75b92a00c6236d8aaaf9d819fcc8b8f3cca57b77426ccef692a17569c35ff6d59a631ea71735aa7d0265889bfb69f6ae2259e36d3e9be09
- SSDEEP 1536:34oWJIP8z2r1GqhwF3FMjyPPkmW9Iz0meJB:34oWikmgqhwNFMjyP9J9eP
- MD5 SHA1 SHA512 SSDEEP
Password
Rapid
PE Signature issue
Digest
41:8e:5b:c7:10:66:fb:1e:8b:87:3b:9f:75:05:49:be:e3:82:12:77:0b:3b:8a:81:87:00:12:dd:c7:f4:6c:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Runtime.InteropServices.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\net6.0-Release\System.Runtime.InteropServices.pdb
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f5aaf220b671a8a14a8511226037421935cb827440cae6e302a719d378e543e
- MD5 1ac3454854febde3852415303a39244a
- SHA1 90a948df5a1d983a3c75afde77ac6c7bf93f4c07
- SHA512 8a5fb2dc85be78f98fbcb8314ec179e6733ea9f0bb28e7df940b20cf9676db64c665dcabf2f613a9f6f0f0caaa2d8395ca601c05795001130582205b573bba70
- SSDEEP 768:Q0BV0jdpFKYl5f4bGRi2xVbcVT4pftsFCltVXC4dC9zVjDk:QIedGYl5f4bGR3G0BtoiHC4dezFo
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9e:80:cb:65:9a:e2:24:8a:80:62:6d:cd:94:a2:96:84:8e:90:4e:2e:00:b4:52:08:f3:c7:85:8b:21:d0:f6:2b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
37470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\System.Runtime\net6.0-Release\System.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
rpd/System.Text.Encoding.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67cb9174a2ce49e07d6653fb697ef7834847ac76be651a3df9a4d249bf55e606
- MD5 bd91048ac53ce4e78125ab6d4f9bdbd8
- SHA1 a100addbe8c1fef6b8ef8f59d08aee22cbd23e8a
- SHA512 49faf553486eacf71f579b929ccd35dfd9f7a25a72627e1080f5315a259fd65ee6875c10cfa73099d56f2027e48bb265852a4d8fdd823def38e404116b5a4754
- SSDEEP 192:7GZv4pxxhhW6YJWh4WxNzx95jmHnhWgN7agWKnOafKUSIX01k9z3AXxXk:7Iv0XhW6YJWhXX6HRN7H2IR9z6O
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2b:b7:08:a8:a3:bc:7f:db:ab:04:5d:da:f3:1e:46:15:14:da:47:32:c5:a2:c7:2c:8e:ec:fd:b0:76:e2:c9:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
10862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.Extensions\net6.0-Release\System.Text.Encoding.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
rpd/System.Threading.dll
- SHA256 dc2ac768bb9b05766b009b6efaef4479d5db5c768ee1d3de3eda136e420ff94c
- MD5 a2014966d8f40bafe07dd3a92ef0dbc0
- SHA1 1c68842050bef3d29dc3f3322ece3da4fac64e62
- SHA512 5e4659db98519b227cfef73c1ad7618f9f1e8e84e276276bc338d1f5263cdcc58651e0531fb386ccd2ea65a877652494b80fae01807dcefe4edc5413c90dbe77
- SSDEEP 1536:hk5RkjKu+ydo98uGxdzJERH7AveMWrJ9zC:hk5Rkdo9wxdzGKveMo3W
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a0:ae:d7:67:be:fe:f5:be:19:7f:31:4f:51:ce:5a:60:b9:8b:60:0c:98:38:59:51:fb:5b:52:02:a6:0c:bd:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Threading.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Threading\net6.0-Release\System.Threading.pdb
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rpd/System.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20864e27e43a327b96d26cfc46b7568f3f263c759ad7dac2395efff791727bc3
- MD5 2bebb27c3514d212eb44bc82e263fffd
- SHA1 c7d18aa44727c981b62e349dade1eec52433ef4f
- SHA512 3845e108c47dca73e9e8ef0caf5458a12383435031e1351339cd0756e82f4b9092d7378e9e4513594d9ced82f8dba59521c43be3390abdda694acba9b572e783
- SSDEEP 768:FQuoy1c6A2ZX8TRNH5JVbOd502zq1TntVx6WUCR7in9zp:FQuoO3ZX8Q5jzC3x6WUZ9zp
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
66:43:e8:3e:e6:36:1c:9b:63:b4:3d:c2:23:eb:35:e4:25:b0:11:49:43:45:42:79:46:28:cb:97:1f:cf:be:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
45822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/manual.System/net6.0-Release/System.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
rpd/clrjit.dll
- IMPHASH 49de661d6e15395302bd76ca71f37164
- SHA256 cdba2919e1f7288e8f07986d9d4927f1114433db7fb6fd352f8fab03c53668e0
- MD5 3cca64f0ea30143e44324f97d1830442
- SHA1 ac21268cb0855497af0341042eb999e096fea69e
- SHA512 437a66f4421deb2fa70c3037d1c3aa7c1399136b2eae31dcdef99541edb8de430754a1c7051fb7786973fd0185c7b1f7f7122c1fa3ac49b21fb4e7f217ee995c
- SSDEEP 24576:wLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGyqfj:wLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHgZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a0:a1:cd:2a:37:fd:4c:e9:1f:49:78:74:b2:33:31:58:f1:b4:ba:d8:01:fb:4c:59:e7:1f:d1:b6:66:08:00:e0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
914304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\jit\clrjit.pdb
kernel32
RaiseException
DebugBreak
OutputDebugStringA
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
QueryThreadCycleTime
GetCurrentThread
GetLastError
CloseHandle
UnmapViewOfFile
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
SetLastError
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlPcToFileHeader
api-ms-win-crt-math-l1-1-0
sinhf
sinh
sinf
sin
powf
pow
tanhf
_fdopen
logf
log10f
log10
log
fmodf
fmod
floorf
floor
expf
exp
coshf
cosh
_copysign
sqrtf
_isnanf
acosh
asinh
atanh
cbrt
log2
acoshf
asinhf
atanhf
cbrtf
log2f
ilogb
ilogbf
_finite
cosf
tan
tanf
cos
ceilf
ceil
atanf
atan2f
atan2
atan
asinf
asin
acosf
acos
sqrt
tanh
_isnan
_copysignf
api-ms-win-crt-stdio-l1-1-0
_wfopen
fclose
fseek
ftell
fflush
_fileno
__acrt_iob_func
_dup
setvbuf
__stdio_common_vfprintf
_setmode
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-runtime-l1-1-0
_cexit
terminate
abort
_execute_onexit_table
_register_onexit_function
_crt_atexit
_errno
_initialize_onexit_table
_initterm
_initterm_e
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo
api-ms-win-crt-string-l1-1-0
strcpy_s
_stricmp
strcat_s
strcmp
wcsncmp
strncmp
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
getJit
getLikelyClass
jitStartup
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
170KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=29395,
count=186, id=1, productName=Unmarked objects,
count=33, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=107, id=270, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
rpd/coreclr.dll
- IMPHASH 65c5b20007a0f8b5548613247a846600
- SHA256 fe0ae2120e2b298e1c40f8fda3845aa44d3da6afe3037af4f982b0dd63e4356e
- MD5 4bbe312359267a55988df83d4f9b8eb4
- SHA1 6297fbb90a87ffecf9d3460bf9ad945e9514e463
- SHA512 7ea2b5bd8a1641c5f144264485332943c9d36afccccbab5a633f27f2fc9f27a4fa866aff7b9823e2e0c3ba2e3a3fa3e4e3832b48af376a95ae95ccdce4ab04ff
- SSDEEP 49152:eRRteSC8CjfXq6EoB/SEsRfoSakEd9c6oWUqCJ0OTVRepih8IdCdTWOVxJYaHmnz:iRqXB/SEAKJspr8wKQXt
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d2:c6:f5:04:a7:17:6d:71:c3:2c:03:13:1e:29:3d:7b:82:8c:c2:08:05:b5:7c:e1:b3:71:2f:3b:b7:a9:7d:e9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
1434848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscoree\coreclr\coreclr.pdb
kernel32
RemoveVectoredExceptionHandler
MultiByteToWideChar
GetTickCount
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleW
FlushInstructionCache
RtlLookupFunctionEntry
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
GetTickCount64
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
ResumeThread
GetCurrentThreadId
Sleep
TlsAlloc
GetCurrentThread
CreateThread
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
SetEvent
GetCurrentProcessorNumber
GlobalMemoryStatusEx
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
GetQueuedCompletionStatus
InterlockedPopEntrySList
GetCurrentProcessorNumberEx
ExitProcess
CreateMemoryResourceNotification
GetProcessAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetLargePageMinimum
VirtualUnlock
GetLogicalProcessorInformation
SetThreadGroupAffinity
SetThreadAffinityMask
IsProcessInJob
QueryInformationJobObject
K32GetProcessMemoryInfo
VirtualAlloc
VirtualFree
VirtualProtect
SwitchToThread
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
GetFileSize
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
ReleaseMutex
GetThreadContext
SuspendThread
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
RtlRestoreContext
SetXStateFeaturesMask
SetUnhandledExceptionFilter
RtlInstallFunctionTableCallback
GetSystemDefaultLCID
GetUserDefaultLCID
RtlUnwind
LoadLibraryExW
HeapAlloc
HeapFree
GetProcessHeap
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
FormatMessageW
GetACP
LCMapStringEx
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetModuleFileNameW
VirtualAllocExNuma
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetSystemTimes
GetSystemTimeAsFileTime
CreateFileMappingW
CreateProcessW
GetCPInfo
CreateFileW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
OpenProcess
LoadLibraryExA
OpenEventW
ExitThread
HeapReAlloc
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
MapViewOfFile
GetActiveProcessorGroupCount
GetSystemTime
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
RtlAddFunctionTable
CreateFileMappingA
InitializeCriticalSectionAndSpinCount
RtlVirtualUnwind
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
TlsFree
RtlPcToFileHeader
AddVectoredExceptionHandler
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
RaiseFailFastException
FreeLibrary
RaiseException
WaitForSingleObject
TlsSetValue
TlsGetValue
GetSystemInfo
IsDebuggerPresent
LeaveCriticalSection
DebugBreak
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetProcessTimes
GetCommandLineW
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleExW
SetErrorMode
CloseHandle
GetCurrentProcess
FlushProcessWriteBuffers
SetLastError
GetLastError
OutputDebugStringW
advapi32
RegisterEventSourceW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
DeregisterEventSource
ReportEventW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
SetKernelObjectSecurity
ole32
CoCreateFreeThreadedMarshaler
CoGetClassObject
StringFromGUID2
CoGetObjectContext
CoUnmarshalInterface
CoMarshalInterface
CoGetContextToken
CreateStreamOnHGlobal
CLSIDFromProgID
IIDFromString
CoReleaseMarshalData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoGetMarshalSizeMax
oleaut32
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetElemsize
SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
VariantInit
VariantClear
VariantChangeTypeEx
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
QueryPathOfRegTypeLi
SafeArrayDestroy
SysFreeString
GetErrorInfo
SetErrorInfo
SysAllocString
SysStringLen
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
isspace
strtok_s
wcsncat_s
strcpy_s
strncmp
strncat_s
wcscmp
wcscat_s
towupper
iswascii
strnlen
wcsncmp
wcstok_s
isdigit
strlen
_strdup
_strnicmp
wcscpy_s
strncpy_s
strcmp
isalpha
_stricmp
strcat_s
_wcsicmp
wcsncpy_s
_wcsnicmp
wcsnlen
iswupper
iswspace
towlower
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
_putws
_flushall
__stdio_common_vfprintf
fopen
fflush
fputs
__stdio_common_vsnwprintf_s
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
__stdio_common_vsnprintf_s
__acrt_iob_func
fwrite
__stdio_common_vsscanf
fgets
fclose
_wfopen
api-ms-win-crt-runtime-l1-1-0
_errno
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
_invalid_parameter_noinfo
_controlfp_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_itow_s
atol
_atoi64
_ltow_s
_wcstoui64
strtoul
strtoull
_wtoi
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
sinhf
tan
tanf
tanh
logf
log10f
log10
cosh
cosf
cos
ceilf
ceil
atanf
atan2f
log
atan
asinf
sinf
acosf
fmodf
acos
sinh
sin
fmod
fmaf
log2f
acoshf
cbrtf
atanhf
ilogbf
powf
asinhf
asinh
cbrt
fma
ilogb
acosh
atanh
log2
asin
pow
floor
expf
exp
atan2
_copysign
_isnan
coshf
modff
modf
_finite
tanhf
api-ms-win-crt-time-l1-1-0
_time64
CLRJitAttachState
GetCLRRuntimeHost
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
817KB
Virtual Size
816KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=29395,
count=11, id=257, version=29395,
count=417, id=1, productName=Unmarked objects,
count=39, id=261, version=30034,
count=16, id=260, version=30034,
count=20, id=259, version=30034,
count=20, id=259, version=30154,
count=469, id=270, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
rpd/hostfxr.dll
- IMPHASH 865ad5dbb854b19f260b2101a8b4fef3
- SHA256 82ab369e059533eb7952855b7cc55916ab6b91fb36b2922f269037b1974be627
- MD5 5d8596283ce9ea677b1ffc73c5fdc536
- SHA1 956f1a5d5249011d6f95c127ec8d7dd145763334
- SHA512 35fe41b0db7100aee3102674649974ee9640134720e05ce4ce434f0e9230d207e5c36313ef55ed5920211a549710e8cbd1483b57e13a9941dbea70b58573911b
- SSDEEP 6144:oGr5uLf+w7dEtiODC3+Gr4iAOs2dEAh2gcmgrW0985D:vmf+qdEzD/iAOsVVH9MD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d7:8d:86:1d:ed:5a:ba:25:0e:0a:e6:31:4f:fe:48:bc:63:69:ba:c1:cf:dc:3c:e3:0d:b8:11:be:fe:8a:9f:d4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
235408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb
kernel32
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
FindFirstFileExW
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
GetFileSizeEx
GetLastError
OutputDebugStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetCurrentThreadId
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
WaitForSingleObjectEx
SwitchToThread
GetStringTypeW
QueryPerformanceCounter
advapi32
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
malloc
calloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_initterm_e
_initterm
_errno
_cexit
_crt_atexit
_configure_narrow_argv
_wcserror
_initialize_narrow_environment
terminate
abort
_initialize_onexit_table
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
api-ms-win-crt-string-l1-1-0
__strncnt
strcpy_s
wcsncmp
_wcsnicmp
tolower
_wcsicmp
isupper
wcsnlen
_wcsdup
islower
strcspn
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
fputwc
fputws
__stdio_common_vfwprintf
fclose
fgetc
fwrite
fgetpos
__stdio_common_vswprintf
_wfopen
ungetc
setvbuf
fsetpos
_wfsopen
fseek
__stdio_common_vsprintf_s
fread
_fseeki64
_get_stream_buffer_pointers
__acrt_iob_func
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
localeconv
_unlock_locales
__pctype_func
___lc_codepage_func
_lock_locales
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
frexp
ceilf
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
hostfxr_close
hostfxr_get_available_sdks
hostfxr_get_dotnet_environment_info
hostfxr_get_native_search_directories
hostfxr_get_runtime_delegate
hostfxr_get_runtime_properties
hostfxr_get_runtime_property_value
hostfxr_initialize_for_dotnet_command_line
hostfxr_initialize_for_runtime_config
hostfxr_main
hostfxr_main_bundle_startupinfo
hostfxr_main_startupinfo
hostfxr_resolve_sdk
hostfxr_resolve_sdk2
hostfxr_run_app
hostfxr_set_error_writer
hostfxr_set_runtime_property_value
Name
.text
Size
255KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=30034,
count=10, id=259, version=30034,
count=81, id=261, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=29395,
count=204, id=1, productName=Unmarked objects,
count=28, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
rpd/hostpolicy.dll
- IMPHASH 1e5a74a5130436a0712fd9e07de6e661
- SHA256 266d2ae85fff170eb2795b495b019264d5a0e1cbd7f3f1c6a9cfe0317928399f
- MD5 1ab67b2d47d7559f90dccf639dc944c8
- SHA1 62cb9aa4f0d768aef3c9ff6256f205f43ee092c1
- SHA512 3f27dfe73e9b00290e4e0242ecfad8455dd3c4ee61c029fe570303feab8f40c87f3164251b0f906c670645ce94b1a7e6b47e5e36138de2753655e3fda1710d5d
- SSDEEP 6144:wBGjtN9JhCdJeD1QL3sQy8XyV0l0gzPI37VPzBz3BU89GhOfBE/Xzd:wBGjtNlU/rsQy8XyxzNCOeXx
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f8:e8:87:05:02:f5:05:14:b1:73:c2:a0:ab:aa:fe:5c:2b:b9:d7:c2:16:93:f5:04:0d:55:32:aa:e2:9c:7f:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
254912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\hostpolicy\standalone\hostpolicy.pdb
kernel32
OutputDebugStringW
GetFileSizeEx
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetTempPathW
FindClose
CreateFileW
GetCurrentProcessId
GetLastError
GetFileAttributesExW
LoadLibraryA
CloseHandle
GetCurrentDirectoryW
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
IsWow64Process
LoadLibraryExW
UnmapViewOfFile
FreeLibrary
Sleep
RemoveDirectoryW
MultiByteToWideChar
CreateDirectoryW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
GetStringTypeW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
QueryPerformanceCounter
advapi32
RegOpenKeyExW
RegGetValueW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_wcserror
_register_onexit_function
_execute_onexit_table
_crt_atexit
_initialize_narrow_environment
abort
_cexit
_errno
_initterm
_configure_narrow_argv
_initterm_e
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_beginthreadex
terminate
api-ms-win-crt-string-l1-1-0
__strncnt
wcsnlen
strcpy_s
wcsncmp
_wcsnicmp
tolower
islower
_wcsdup
isupper
strcspn
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
calloc
realloc
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
fgetc
__stdio_common_vsprintf_s
fclose
fwrite
__stdio_common_vswprintf
_wfopen
__acrt_iob_func
fflush
fgetpos
fputwc
fputws
ungetc
__stdio_common_vfwprintf
_wfsopen
fseek
fsetpos
fputc
fread
_fseeki64
_get_stream_buffer_pointers
setvbuf
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
__pctype_func
_unlock_locales
_lock_locales
localeconv
___lc_locale_name_func
___lc_codepage_func
setlocale
api-ms-win-crt-math-l1-1-0
frexp
ceilf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_wremove
_wrename
_lock_file
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
corehost_initialize
corehost_load
corehost_main
corehost_main_with_output_buffer
corehost_resolve_component_dependencies
corehost_set_error_writer
corehost_unload
Name
.text
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=30034,
count=10, id=259, version=30034,
count=81, id=261, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=29395,
count=207, id=1, productName=Unmarked objects,
count=29, id=265, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=258, version=30154,
rpd/mscorrc.dll
- SHA256 acbc031209e59e7ece9aa362900590b65bea7f6b5d25900b44d9fcc7ace5881e
- MD5 9ba77170397d00425797d61cb332025d
- SHA1 a980f46fba1de13f1ba6d52cc276d83f0ba72e82
- SHA512 684507bdd5333e1dc3b229011f01d3cfacde78ffd825a44cd42b4a9ba48629f63ce8bbc376b6c47ef8e57e5d733d8267a3716009681770456336c2d2239d6e60
- SSDEEP 1536:pODZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXXNiQzaL:pODZ/aSKlZ4ZGnwmUS4ScNZ2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c0:3b:8e:ac:2b:95:60:07:06:9c:9c:11:0d:d2:b2:33:07:65:19:27:e5:61:90:f5:44:8d:40:1a:a4:2f:42:7e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb
Name
.rdata
Size
512B
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
132KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=30154,
count=1, id=258, version=30154,
rpd/msquic.dll
- IMPHASH 4e89b3526ae6bf9c5f012772cea5ae95
- SHA256 3d6d6e7a6f4729a7a416165beabda8a281afff082ebb538df29e8f03e1a4741c
- MD5 b5d0f85e7c820db76ef2f4535552f03c
- SHA1 91eff42f542175a41549bc966e9b249b65743951
- SHA512 5246ebeaf84a0486ff5adb2083f60465fc68393d50af05d17f704d08229ce948860018cbe880c40d5700154c3e61fc735c451044f85e03d78568d60de80752f7
- SSDEEP 6144:DD4t2kjj3Ueh/9WoJcDSdiA9HuUrUb9KcvYCxe3Rw42SISaVGxQJyRMq1KsLGjrT:DDrkjjUoJcDSdiw4QcO3RoS9MV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
28:16:c4:a9:ca:ac:67:66:0d:c3:76:1e:ec:f0:33:38:42:d1:7b:75:ee:53:5a:fe:ec:19:3d:3d:a7:02:02:8f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 3, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
148928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\msquic\artifacts\bin\windows\x64_Release_schannel\msquic.pdb
secur32
FreeCredentialsHandle
SetCredentialsAttributesW
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
AcquireCredentialsHandleW
InitializeSecurityContextW
ws2_32
setsockopt
htonl
getsockopt
WSARecv
GetAddrInfoW
connect
socket
getsockname
WSAStartup
WSASocketW
shutdown
WSASend
closesocket
WSAIoctl
bind
FreeAddrInfoW
WSACleanup
WSAGetLastError
ntdll
RtlNtStatusToDosError
NtSetInformationThread
RtlInitUnicodeString
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
bcrypt
BCryptGenRandom
BCryptDecrypt
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptSetProperty
BCryptCreateHash
crypt32
CertFindCertificateInStore
CertGetNameStringA
CertGetCertificateContextProperty
CertOpenStore
CertFreeCertificateContext
CertCloseStore
iphlpapi
GetCurrentThreadCompartmentId
SetCurrentThreadCompartmentId
advapi32
RegNotifyChangeKeyValue
RegQueryValueExA
RegOpenKeyExA
EventRegister
EventUnregister
EventWriteTransfer
RegCloseKey
kernel32
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetProcessHeap
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
WriteConsoleW
CreateFileW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
CreateEventA
TlsFree
GetCommandLineA
GetCurrentProcessorNumberEx
EnterCriticalSection
GetSystemTimeAdjustment
LeaveCriticalSection
InitializeCriticalSection
GetActiveProcessorCount
DeleteCriticalSection
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeSListHead
InterlockedPopEntrySList
InitializeSRWLock
ReleaseSRWLockExclusive
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InterlockedPushEntrySList
QueryDepthSList
WaitForSingleObject
CloseHandle
InterlockedFlushSList
GetCurrentThreadId
SetThreadPriority
GetLastError
CreateThread
SetThreadIdealProcessor
SetThreadGroupAffinity
HeapCreate
HeapFree
MultiByteToWideChar
GetLogicalProcessorInformationEx
QueryPerformanceFrequency
HeapAlloc
HeapDestroy
GlobalMemoryStatusEx
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CancelIo
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIoEx
GetCurrentProcessorNumber
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetStartupInfoW
ExitProcess
RaiseException
LoadLibraryExW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
IsDebuggerPresent
FreeLibrary
MsQuicClose
MsQuicOpen
MsQuicOpenVersion
Name
.text
Size
316KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=26715,
count=5, id=259, version=26715,
count=132, id=261, version=26715,
count=29, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=1, id=262, version=26715,
count=19, id=257, version=26715,
count=185, id=1, productName=Unmarked objects,
count=46, id=269, version=30140,
count=1, id=256, version=30140,
count=1, id=255, version=30140,
count=2, id=151,
count=1, id=258, version=30140,