DocuSign-DocuSign_o_backup_v8[.]3[.]0[.]85_oid56f276e1-bc4c-4284-a5ee-24c354e20059_fidBstz7oUXMUmco%21SuD2Kl4A[.]exe

resource
unpack001/SQLite.Interop.dll
unpack001/System.Data.SQLite.dll

resource
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack001/$PLUGINSDIR/processwork.dll
unpack001/CBFS6Net.dll
unpack001/Cloud.AzureClient.dll
unpack001/Cloud.Backup.DiskImage.BootImage.dll
unpack001/Cloud.Backup.DiskImage.dll
unpack001/Cloud.Backup.ESXiEngine.dll
unpack001/Cloud.Backup.ESXiEngine55.dll
unpack001/Cloud.Backup.ESXiEngine67.dll
unpack001/Cloud.Backup.ESXiEngine80.dll
unpack001/Cloud.Backup.Engine.Data.SQLite.dll
unpack001/Cloud.Backup.Engine.MBS.XmlSerializers.dll
unpack001/Cloud.Backup.Engine.MBS.dll
unpack001/Cloud.Backup.Engine.XmlSerializers.dll
unpack001/Cloud.Backup.Engine.dll
unpack001/Cloud.Backup.Exchange.dll
unpack001/Cloud.Backup.MSSQL.dll
unpack001/Cloud.Backup.VM.dll
unpack001/Cloud.Backup.dll
unpack001/Cloud.Base.XmlSerializers.dll
unpack001/Cloud.Base.dll
unpack001/Cloud.CbfsInterface.dll
unpack001/Cloud.Client.XmlSerializers.dll
unpack001/Cloud.Client.dll
unpack001/Cloud.GoogleClient.dll
unpack001/Cloud.OpenStackClient.dll
unpack001/Cloud.S3Client.dll
unpack001/Cloud.Wizard.dll
unpack001/Dapper.StrongName.dll
unpack001/DiskAccessLibrary.FileSystems.Abstractions.dll
unpack001/DiskAccessLibrary.dll
unpack001/Esent.Interop.dll
unpack001/ICSharpCode.SharpZipLib.dll
unpack001/ISCSI.dll
unpack001/LZ4.dll
unpack001/Lucene.Net.dll
unpack001/MurmurHash.dll
unpack001/SecureBlackbox.FTPS.dll
unpack001/SecureBlackbox.SFTP.dll
unpack001/SecureBlackbox.SFTPCommon.dll
unpack001/SecureBlackbox.SSHClient.dll
unpack001/SecureBlackbox.SSHCommon.dll
unpack001/SecureBlackbox.SSLClient.dll
unpack001/SecureBlackbox.SSLCommon.dll
unpack001/SecureBlackbox.dll
unpack001/System.Data.HashFunction.xxHash.dll
unpack001/ZstdNet.dll
unpack001/libzstd.dll

resource
DocuSign-DocuSign_o_backup_v8.3.0.85_oid56f276e1-bc4c-4284-a5ee-24c354e20059_fidBstz7oUXMUmco%21SuD2Kl4A.exe
unpack001/$_34_
unpack001/CBBackupPlan.exe
unpack001/Cloud.Backup.RM.Service.exe
unpack001/Cloud.Backup.Scheduler.exe
unpack001/Cloud.Backup.UI.dll
unpack001/Cloud.Backup.Wpf.dll
unpack001/Cloud.DiskImage.Flash.Launcher.exe
unpack001/Cloud.DiskImage.RestoreVerificationService.exe
unpack001/cbb.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

DocuSign-DocuSign_o_backup_v8.3.0.85_oid56f276e1-bc4c-4284-a5ee-24c354e20059_fidBstz7oUXMUmco%21SuD2Kl4A.exe

IMPHASH 12082e77cfc7e34f96f21f95764c8ac3
SHA256 403ebb72661a6f0eb4eeab8e4f27a8c37f30c64e6e456eb6ee0e540f78830d64
MD5 42503693c15326ab9add71f615f80e20
SHA1 3c0ba355d3c2ae4253e84488634fec75d454332d
SHA512 544ffdbfce79a3a7ff7a90b51352c90ae6a008dc2257a9ab976a1b844157b27c53bb2128bae281bd4fd7eab3097f30da53e940084fbe356ca7b6161db404afba
SSDEEP 786432:o3j+Q4HYqwhuVgW2v1fQRNobsf+BT26LkGkPRM6znBIdfo:o3Sh49hHv1IPT+1wZRvznBKg
TLSH
T14C472377E95654FEE47D43F269DC8FB2088C8D1F18C219D456ED2291C283BAA63E7234
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

72:98:75:04:79:d2:ed:0a:57:6e:02:16:0a:f4:cf:f0:41:5e:82:cc:37:e7:e5:b3:20:0b:23:ec:60:2c:a8:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetShortPathNameA GetFullPathNameA MoveFileA GetLastError SetCurrentDirectoryA GetFileAttributesA SearchPathA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime CompareFileTime lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetCommandLineA GetTempPathA GetProcAddress DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer ReadFile WriteFile GetPrivateProfileStringA WritePrivateProfileStringA MultiByteToWideChar FreeLibrary MulDiv LoadLibraryExA GetModuleHandleA

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SystemParametersInfoA RegisterClassA EndDialog TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA SetTimer OpenClipboard SetWindowTextA GetDC LoadImageA ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA SetClipboardData EmptyClipboard DestroyWindow ExitWindowsEx SetForegroundWindow PostQuitMessage CreateDialogParamA

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/INetC.dll

IMPHASH 8ef3613e48db9e7b48e33704238cd659
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
TLSH
T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16209

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA LocalFree lstrcpynA DeleteFileA CreateThread WideCharToMultiByte lstrcpyA TerminateThread LocalAlloc MulDiv WaitForSingleObject GetModuleHandleA ReadFile lstrlenA lstrcatA GetTickCount CreateFileA GetFileSize GetLastError lstrcmpiA CloseHandle GetProcAddress lstrcmpA WriteFile GlobalFree GlobalAlloc SleepEx SetFilePointer

user32

RedrawWindow GetMessageA wsprintfA DestroyWindow EnableWindow GetDlgItem UpdateWindow LoadIconA SetWindowTextA IsWindowVisible SystemParametersInfoA GetWindowLongA GetParent MessageBoxA SetWindowLongA DispatchMessageA KillTimer PostMessageA GetWindowTextA IsWindow SendDlgItemMessageA CreateDialogParamA TranslateMessage ShowWindow IsDialogMessageA GetWindowRect SetTimer SetDlgItemTextA SetWindowPos SendMessageA GetClientRect FindWindowExA

comctl32

ord17

wininet

InternetReadFile InternetErrorDlg HttpQueryInfoA InternetQueryOptionA InternetSetOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile InternetSetFilePointer FtpOpenFileA HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetOpenA InternetGetLastResponseInfoA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/NSISdl.dll

IMPHASH b97e796968a976ef8d35f255a7819e88
SHA256 6d95897f302bd75a8aefc8db32a826393bd52c30057bb157fdc68d97c47bb919
MD5 114e8d7f1eb28894ece784c8d1370398
SHA1 4858085fb0d3f4e941b237e483e7d9c69f3bf9eb
SHA512 41cf4fc9b7287c64ff036b7a347363a4a36d7feeca7f39213a358cea2d3c7e3cc2c28d406d2984300e6897187d9b88f423846cb2a4a20aaa7e1cbc93dda910b5
SSDEEP 192:tQpTobBDV6g67UmsEw9E5aZxwXTBa1uayR/H3p+57CvZZ2DDFVnF01Dwn2GRbgso:mRoT6gw51IE5aZOjBaAN/XpWzqNw2io
TLSH
T1AF624C11A92008F6C761153470E33BBF6BB34E72571481C3ABE3595EBE25703AA71AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 2274cc1534607459cdd304a928601ef9
SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
MD5 88ad3fd90fc52ac3ee0441a38400a384
SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
TLSH
T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA lstrcpynA GetVersionExA lstrcmpiA GetCurrentThreadId LoadLibraryA FreeLibrary GetLastError GetExitCodeProcess WaitForSingleObject DuplicateHandle Sleep GetCurrentProcessId CreateThread GetCommandLineA OpenProcess MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle SetLastError GetModuleFileNameA GetPrivateProfileIntA GetPrivateProfileStringA GetProcAddress GetModuleHandleA

user32

SendMessageW DialogBoxParamA CharNextA UnhookWindowsHookEx CallNextHookEx GetClassNameA SetWindowsHookExA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow GetWindowThreadProcessId MessageBoxA SetWindowLongA LoadImageA DestroyWindow GetWindowLongA EnableWindow ShowWindow SetWindowTextA wsprintfA GetDlgItem SendMessageA LoadStringA EndDialog

advapi32

RegCloseKey QueryServiceStatus OpenServiceA CloseServiceHandle OpenSCManagerA OpenProcessToken RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab
MD5 98aca846c2f9d4569cf3746159cf881e
SHA1 d088cf3e48c53d61aa792e90387c9bc50a85ee11
SHA512 780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035
SSDEEP 3072:2uwfYJ0ZclxW7Tk6lIwllZsllllLtq95ucp/jkfWfW:2uwQJkccifWfW
TLSH
T122E3E51942511DC4D852A5EBBB2E2E8F3C88BF9C5139F6F98C26B72BD1390FB8579101
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

IMPHASH ddfc5272f0f38c6d49db71b2dfaa312e
SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
MD5 0917ee492308b691326e6581e8c793c9
SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
TLSH
T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

9920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8abe046ef411de4d3e6e831b6b1ee264
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 67cfa491a15c2e6ae037612d4a7ef727
SHA256 15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8
MD5 b7878c46c342f851d35fb2dbc898a593
SHA1 dd0ebd231edcfdc0a561cbda733c58e22ce3156f
SHA512 d7f179d33695b62da5fc0643fac461129975e78a8694c02e8c8d74471d0ee4061b92f1010401209605146861b259d34079583b2080c8ba69382c2122d9b969c2
SSDEEP 384:QYUEEoUMA9RoB+cq4OJTv/ldPWUn2kaVC+DEbXG989qX6rMIZy9RrT:PeRoBXHoTXld3n2XubXf9+EMNvrT
TLSH
T152A25B566170A8F1F92618FAB9D26E237F7DF90834745897CB23056D2A91863BF3C312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/processwork.dll

SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
MD5 0a4fa7a9ba969a805eb0603c7cfe3378
SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
TLSH
T1F2343B36E1C0CC76D5672B7CDC49E3D8556EBA302E2898866BE91E8C9B3D391351C287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

208948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

147B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

47B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$TEMP/$R0

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
MD5 4a545dc7605e6bdf8e107173e5eba69c
SHA1 cf45cf7594e9970b4ffeda48ac728556e3d232cc
SHA512 3be7af94fd0b20ddfeedf3001991280e2da7a4c48763e6dc55ac8f3461ed4a200773cdb6f3b6cee47abd49680acd9377ddb6d539e2fa604da0b9df390de11fa5
SSDEEP 768:/T8ZI9YIHMfndz2dgKCsUoEBLhpX8Mmg2EIEMmk2Es:/TEeYIHMFydgKCsSLhpX8Mmg3Mmk+
TLSH
T1DA238D0277E84546DEEE4FB974F449390A71FB836D61C5CE16ACC0894E62BC16B603BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e2:3e:8c:ce:4b:67:a2:ea:6e:cd:15:67:bd:8f:fc:bb:f5:7f:fe:76:dd:a7:1f:bb:14:94:57:0a:bf:8c:3a:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

8f:bd:8b:71:72:a7:b0:72:19:31:ed:a0:9c:b4:7e:54:ce:65:a3:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Serial Number

50:1a:3d:4c:78:00:f1:71:1b:3f:14:e5:36:ea:ec:ab

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2021 - Dec 2, 2024

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

31030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Project\backup\Tools\CheckPlans\obj\Release\CheckPlans.pdb

$TEMP/$_65_

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
MD5 4a545dc7605e6bdf8e107173e5eba69c
SHA1 cf45cf7594e9970b4ffeda48ac728556e3d232cc
SHA512 3be7af94fd0b20ddfeedf3001991280e2da7a4c48763e6dc55ac8f3461ed4a200773cdb6f3b6cee47abd49680acd9377ddb6d539e2fa604da0b9df390de11fa5
SSDEEP 768:/T8ZI9YIHMfndz2dgKCsUoEBLhpX8Mmg2EIEMmk2Es:/TEeYIHMFydgKCsSLhpX8Mmg3Mmk+
TLSH
T1DA238D0277E84546DEEE4FB974F449390A71FB836D61C5CE16ACC0894E62BC16B603BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e2:3e:8c:ce:4b:67:a2:ea:6e:cd:15:67:bd:8f:fc:bb:f5:7f:fe:76:dd:a7:1f:bb:14:94:57:0a:bf:8c:3a:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

8f:bd:8b:71:72:a7:b0:72:19:31:ed:a0:9c:b4:7e:54:ce:65:a3:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Serial Number

50:1a:3d:4c:78:00:f1:71:1b:3f:14:e5:36:ea:ec:ab

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2021 - Dec 2, 2024

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

31030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Project\backup\Tools\CheckPlans\obj\Release\CheckPlans.pdb

$_34_

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c49239aaae1f352f8d831aaafcd51c697a2bb2e0043fc02d521a82e01e00bbbc
MD5 cb01447edb7fdc8a2f14c26488147d7a
SHA1 e31ac1c14de1b2c7768c43f14fed65a4308da70c
SHA512 0eaeea341f8f5afeac67ae820659d1389a83098900577579bc0cb8e7da8c71ac6173813ca1ce3a800d0e906d47b0bbe7a167ef6fb6506c21db6ef2833cb8c3df
SSDEEP 49152:y1q5jMJn3urQLgwxjwwH+wiQYp+hPqlpZwGjqSOMa:EWjMJ+2gWKt9CPyZbROMa
TLSH
T119C5BE973F41D139F4B7E5B22E88519016933D6A9767741826E2FC8E85F1BC20ECF226
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

b9:73:be:05:48:25:e2:33:61:6d:eb:18:1e:18:5c:42:89:44:c8:5b:ad:fb:bc:5c:16:59:b0:7c:49:fb:e9:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

2309198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$_34_.config

SHA256 43122919145f214a13add5f049654e916f272cb01ddef9a6ae52619e26661fdb
MD5 6c2fb466fab78e8ce5b5ec7bbfa6a1b8
SHA1 4e3e367f39f8c70c2152c0422111a86fa0a22bb3
SHA512 cf3c6003e1b2f14d68935e6f6f4393cbb30bc0ef38203bec64f160142b2f08e3c47c5ad6e58f68961069d65075652a0ccc2d134bf32fb6f9da980b0894d98642
TLSH
T1B451BE2291C8AFA50FB205A37E6BA458CF6903B3294C054DB1DE6BC7CF3699A0743077
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

CBBackupPlan.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7e8cb5d99ce3c7e16c2a9d645a1ef6c791e307a4ad4108b01a2580c2c09dedfc
MD5 609ea116c2cd8cbcacdb3f4a5b56988c
SHA1 ad93422f2c5d6f7078d9a8283b77ec0d35f00de6
SHA512 8efdac2a7be9a0001a1c2f6ed757b6d3fd4f92c272441d297647197b22ee15c9d520e7905853922b7147b33bf6b59d8116213063a9413dc74abc7f241211828a
SSDEEP 12288:SPmZh1mPOyD9yxP97/CSkROcI0Z0R2M7pA/+aaz2CC4e6/V3fDDUCwfB4MLREdAy:SPM1mPOmUP9GSpWGXxHrbIqwjArMwN
TLSH
T19D356B67BF259929D47F46782612004043F22CAB97DAF61A16F5FED921F23861CCF0A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

5d:c8:90:f6:be:82:8c:85:1e:c2:bb:bc:e1:ec:dd:95:2b:86:8e:13:5f:98:c7:69:5e:25:7a:13:bb:17:c6:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

705054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CBBackupPlan.exe.config

SHA256 51c87e3445ddde42069fe27d76688485d05b03f3b4a1c960abd57422ddb33448
MD5 182c410896ced951aab2e3a211112cc1
SHA1 c1a06d7191618e12543a0788ed9f6ae5a87cbce6
SHA512 57e2e1206e6471606ae39600e9d841c7acf96fadd13e36b95b6398cf94342003ff23ebfccf035638321719b9c42b2f1706fe1f514ec7084eee5ad4e3093351cd
TLSH
T18A514D1150C8BFA50B7209A23E6FA45CCB7E13B7294D068EB1DE6B8B8F2955A0647077
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

CBFS6Net.dll

IMPHASH bfe10e780260a385f9bf45fc42f211aa
SHA256 2ad750b27fdb15dd5ccd5a08d2e13d7ed844089f00482850cc6edfaf4c2726bb
MD5 1fc9aee5d9e43546fb263d0aea020822
SHA1 8cd4383cd578fbeda464166c14e36bc597d58081
SHA512 402953480a999b73c4763f4b9f1ee745ab57c03ad1cf41ccf893da4dc67399f067d51ee6c2088702b59bd8846811bc8a1a3b0868e9b646814e3fd40c2d31f107
SSDEEP 6144:OnO5KGJCY2iOEwuCeHPOLQDACVw7l8dWZNTDBVA0G8kpCe:OOQU2i8uCsWLRewxRZNTTA0GFC
TLSH
T1B4745B59AB200199EAAFC27C9473D603A673B1D9635B53CF4138CAA41F277C9B1793C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

174294

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Projects\CBFS\dotNet\x64\Release\CBFS6Net.pdb

msvcr100

??3@YAXPEAX@Z ??2@YAPEAX_K@Z __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __CxxQueryExceptionSize _cexit __FrameUnwindFilter memcpy memset memcmp _onexit _lock __dllonexit _unlock __clean_type_info_names_internal __crt_debugger_hook __CppXcptFilter __C_specific_handler _amsg_exit _encoded_null _initterm_e _initterm _malloc_crt _ultow wcsncmp memchr _wcsdup _ltow _wtol _wcsnicmp memmove _wcsicmp wcschr _itow wcsstr wcsrchr malloc free

advapi32

RegCloseKey SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor LsaNtStatusToWinError InitiateSystemShutdownW QueryServiceConfigW AdjustTokenPrivileges ControlService FreeSid QueryServiceStatus StartServiceW LookupPrivilegeValueW GetTokenInformation OpenServiceW OpenSCManagerW OpenThreadToken DeleteService OpenProcessToken CloseServiceHandle LookupPrivilegeNameW CreateServiceW RegEnumKeyExW RegEnumValueW RegDeleteValueW RegOpenKeyW GetSecurityDescriptorGroup GetLengthSid RegisterEventSourceW RegCreateKeyExW RegQueryValueExW DeregisterEventSource RegOpenKeyExW ReportEventW RegSetValueExW CopySid GetSecurityDescriptorControl EqualSid GetSecurityDescriptorOwner IsValidSid

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shell32

SHFileOperationW

setupapi

SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiGetActualSectionToInstallW SetupDiGetClassDevsW SetupIterateCabinetW SetupDiSetDeviceRegistryPropertyW SetupDiGetINFClassW SetupFindNextLine SetupGetSourceFileLocationW SetupGetIntField SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupCloseInfFile SetupGetSourceInfoW SetupGetStringFieldW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiCallClassInstaller SetupOpenInfFileW SetupFindFirstLineW SetupDiGetDeviceInstanceIdW

kernel32

FindFirstFileW GetModuleHandleW GetSystemDirectoryW MultiByteToWideChar CreateMailslotW FindClose FindNextFileW GetWindowsDirectoryW GetFileSize MapViewOfFile UnmapViewOfFile MoveFileExW GetCurrentProcess CopyFileW GetVersionExW GetFileAttributesW lstrlenW CreateFileMappingW lstrcatW GetFileInformationByHandle lstrcpyW SetFileAttributesW InitializeCriticalSection TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetComputerNameW GetLastError GetFullPathNameW ReleaseMutex TlsSetValue CreateMutexW ResumeThread DeleteFileW TlsAlloc GetCurrentThreadId OpenEventW GetThreadPriority CreatePipe DeviceIoControl GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess DecodePointer EncodePointer LocalFree WaitForMultipleObjects FreeLibrary LoadLibraryW SetThreadPriorityBoost SetLastError GetProcAddress WaitForSingleObject SetEvent VirtualFree Sleep VirtualUnlock VirtualAlloc CreateEventW GetSystemInfo CloseHandle CreateThread GetTempFileNameW TlsGetValue CreateProcessW CreateDirectoryW SetHandleInformation GetCurrentThread WriteFile GetExitCodeProcess ReadFile CreateFileW GetThreadPriorityBoost SetThreadPriority GetTempPathW GetLogicalDrives

netapi32

NetShareDel NetShareAdd

mscoree

_CorDllMain

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.AzureClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8ab396a5e64e5a5404666eec185c33d49e48723a0e5d0528608f9a05fae24a39
MD5 14fb627b506d9fe993d36cda13c7a1ef
SHA1 6f5e7ee1040fa93fab9f9f8f9a8a48d93948f92e
SHA512 4a580fa74550cb83fd552d2761844070411d21140a7b82a44b366b072370d62acf925bdba796e7219eae4e10124b47f174d1e1c601f08a31a3eb7b75fc685d54
SSDEEP 6144:OVlle5Jtn+rBjCo3gGLSVrv0CNj4KSHiReNjK3d0kLaOysrFZd:Elur+Z/+Bv0CNzvRDLByW
TLSH
T1CE745C015B708A1ED6AF4AB8D233050CA3F05D4B77B9F79B6AC29DA69C497CD9C011E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

367230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.DiskImage.BootImage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8dd1176ca8b501095544e8a1e7210924967f4d674955f39438a934f6b46e557b
MD5 1a803ed7a15a653cccd9fb01e96acbd7
SHA1 ed385e7152dd50ba98b712e532e10b8a5bd42f6e
SHA512 6d23eaf43310be110ed3857c82962e729af792844d45964d665fa14596007ce9a2c10f7330784b9ef1a3869be0d013e507560c345509841231053cae53ef4f6b
SSDEEP 3072:cvIrdinRAimkeVhqUweWzjxqgIpSF5MKbnw506cxVTGxmB1KddJDAebh1bV3zw1G:cYSAiyu3YyPDzpaT6BNU
TLSH
T14044319E4728CEB6C6B674B2EB197C94A12F878BA0C1EF08F1F86416D5A3DDD4710721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

273646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.DiskImage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 511da12200655aab4d05e012847e75c2fba3e5e252080236aad25de6856170db
MD5 58d02300fd33608c76527ca04647dfb9
SHA1 83c5bfb54a7a50768caac334ca219fbcf97b53ec
SHA512 5db6764f5df466c7eb299e1214fe593500aec499c4667fee1c680a54fbb6d204d92b7264714cf4bc4da803b6150f18c08b5edcab84d307703698ffb4eb57f20e
SSDEEP 24576:9qynzTpctJxPYJxLLvWQSyMJavUsY9NYucKessoovBMzFhr:9v7NyiMJav7Y9Nfsoow
TLSH
T103855B0527F4862BC16E4A799032111723F1E86BA773F78B368D69B99F83701DC62793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1748782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.ESXiEngine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 42ba5201b029448597386c6a0ddf350e7a3934a400c71abaaa671e60fc59ff6d
MD5 8bc6510a67c2bcec95a96cb7aa51a5be
SHA1 a9efa0949bd9652c792152752d03bb1b06fead66
SHA512 53648529c077d08f05e67c5b23cdd49384cc239d229aa3b312aae941dc9d8e162883cba2f3adb4e8f89ebf9693963c00c286de2f952eb40fe54f535fb465acb5
SSDEEP 384:8sdyAPNc8qRno031DO+jLnuNEhwLYJuhwEJm9mn+1WMK8v28JBx:3GoQDN2N2EOPv9
TLSH
T14D72E7158BE8871AF2FA0B745EB01AD50B35FE055D32C7AE69C4102F5867B088D63B7E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.ESXiEngine55.dll

IMPHASH 62fab5d8ef3bbc56e4e729355272e71a
SHA256 70f076572ee96e98a0a81574ade4744135e98127a9718ee5bbc3bcfbcaf7bee0
MD5 5c9062aaee54f367c5de2334cce53df4
SHA1 57c6be1f0b680be9152cb9e63bd841d08c7b2d13
SHA512 4b3aeb65f6ebe6a4351ff9948c104d3d3ca0fe28eb54a89f901fac53bda19466857bd52136f8a09afa2c17084ffe3d968132948a6c31f5537b0a144e795a38a6
SSDEEP 3072:qJypfuQSn2Mj/aPzk777NFmeBRF5hCIEeSmNb6:TOj/aPzk777pBH5hCIEeSmNb
TLSH
T139E308141772C967E67F83B42C77EA079133E6813B62934BD261E2640F7638CB513ADA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

25845

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine55.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset _CxxThrowException __std_exception_copy __CxxQueryExceptionSize __CxxExceptionFilter __CxxRegisterExceptionObject __CxxDetectRethrow __C_specific_handler __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __std_exception_destroy __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _crt_atexit abort _crt_at_quick_exit _invalid_parameter_noinfo_noreturn _execute_onexit_table _register_onexit_function _initialize_onexit_table _configure_narrow_argv _seh_filter_dll _initterm_e _initterm terminate _cexit

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

vixdisklib

VixDiskLib_GetInfo VixDiskLib_Open VixDiskLib_Connect VixDiskLib_Disconnect VixDiskLib_Close VixDiskLib_FreeInfo VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_GetErrorText VixDiskLib_PrepareForAccess VixDiskLib_FreeErrorText VixDiskLib_Write

msvcp140

?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.ESXiEngine67.dll

IMPHASH 9cd981fa32ba858fc21ed25e255dac09
SHA256 e15caf5e6b6ae8e61817e8d1679f056b55af2590684ecbd96be77366232d1bfa
MD5 0fd157d5c5ccf0a04a022e1bfa39008f
SHA1 ee30bf36b6b00f79d29e357040435be707ebb9e9
SHA512 8c3db3ce86f448e92c6d85ba5b62556af0391e79d720dec2ca82225edfd86cae83b56407ba89aacc84548dc0bd0b8e1374619204f173847293d4f7bda5f8e7d6
SSDEEP 3072:C01Ev6GP5UbQ6My74xE2tquR6yh1IHe1mxjmy:SSC6My74mg7syh1IHe1m5m
TLSH
T10BE33B116BA38493E65B13385C73EA038632984237B2575F9257F2B44EDB3CDB812AD7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

26609

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine67.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset __CxxDetectRethrow __std_exception_copy __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __CxxExceptionFilter __CxxQueryExceptionSize _CxxThrowException __C_specific_handler __std_type_info_destroy_list __std_exception_destroy __CxxRegisterExceptionObject

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit abort terminate _invalid_parameter_noinfo_noreturn _seh_filter_dll _initterm_e _initterm _configure_narrow_argv _cexit

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

vixdisklib

VixDiskLib_Close VixDiskLib_FreeErrorText VixDiskLib_GetErrorText VixDiskLib_FreeConnectParams VixDiskLib_FreeInfo VixDiskLib_GetInfo VixDiskLib_GetTransportMode VixDiskLib_Open VixDiskLib_Connect VixDiskLib_Disconnect VixDiskLib_AllocateConnectParams VixDiskLib_FreeBlockList VixDiskLib_QueryAllocatedBlocks VixDiskLib_Write VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_PrepareForAccess

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.ESXiEngine80.dll

IMPHASH dca595da2a7defae3953557b941b1ef4
SHA256 48bcc371cbba2b39fbe7e32c7c62066c766a9b837d8d9851711c097892d7d6b0
MD5 efb8754133b0fb2d4e9a242c6c8faa6f
SHA1 3689d61490fc91d8a676e223d6f70e99e0f9e1ea
SHA512 e4cc19858f6ba1c09cd8b000278fc77ffc62c69ffa3871c06f3bed9b30bff099030ff1df85d6694c6ce0060255b002f50c590955a46fb521a8fae87b9e543661
SSDEEP 3072:MnmIpqmxdENW8N5b8tCMImRd9hwIWehmwRJ7:M6NWk8CMhz9hwIWehmwR
TLSH
T159E33A4013A255E3F75B53316973D6038133A802A726979F8265FEA58F5A3CDF81BBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

26809

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine80.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset __CxxDetectRethrow __std_exception_copy __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __CxxExceptionFilter __CxxQueryExceptionSize _CxxThrowException __C_specific_handler __std_type_info_destroy_list __std_exception_destroy __CxxRegisterExceptionObject

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit abort terminate _invalid_parameter_noinfo_noreturn _seh_filter_dll _initterm_e _initterm _configure_narrow_argv _cexit

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

vixdisklib

VixDiskLib_Disconnect VixDiskLib_FreeErrorText VixDiskLib_GetErrorText VixDiskLib_FreeConnectParams VixDiskLib_FreeInfo VixDiskLib_GetInfo VixDiskLib_GetTransportMode VixDiskLib_Open VixDiskLib_ConnectEx VixDiskLib_Connect VixDiskLib_AllocateConnectParams VixDiskLib_Close VixDiskLib_FreeBlockList VixDiskLib_QueryAllocatedBlocks VixDiskLib_Write VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_PrepareForAccess

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.Engine.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f4ab85163ad6502e3f3c84c8c3ab93c1e6e6d70f719bde55233ff6b3fb9ec1a
MD5 d162bc0cd0e8dc263c52ba8e5e7b4cf3
SHA1 f5aecb17b2989374ae2eff3eb0c264e7a1969e16
SHA512 54d7a8e140b48046b48bd77f857aab4cb1252b473b2b1af289a7f9509911702410d4a6b7d2d243154a47f53538d3473ef068f49e0df94446d59dc0f7d4fa7ee2
SSDEEP 384:O5Uwj8LpqOHUfaqxCOh0Uet//XtYRT7RmzSkSOnQvuJzPWLkXfuY95FxKbH:EGUfaPOGUel/GRmzSD2XPrs
TLSH
T17AB21A4A9BA4823BC77E8BB974B2430103B5C7461013EBC95DD865EA8D533973E117AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

29134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.MBS.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 26f7d7b3bb622ca89a24b5789fa99ba3e708f0ae85a65531a3f5eec999e865a5
MD5 9e71b1432fe947edef954b1e838281ef
SHA1 abf13b430444f3c8f3110a80baf8223fa9df45ab
SHA512 89238beb8a98d55e471eb98e1f760b42ff1265b1402e4209487be852d91431dd7de00561a5aeacb488cd8867a3111e417f09eac4d65f1fd50b6d327259bfbe05
SSDEEP 6144:cK2WnBgf/htjsY6izl9c+wLyJg03veGFDQWQ:cKrY6izl9cdLAg03veGFDQ
TLSH
T12A64FC14F3FD4E06EEFF1EBEEAB510D04A7BB993D801D26D09A4005D16A4B448A63F97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

341518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.MBS.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 783d7330fdd644af10d7612d675074796811f75952d21abfb44337db8a4b6a8f
MD5 1543013db0f600cd815f030071237e51
SHA1 9bb2ce5b1d0c56e28387669d3555c8ea6818dbe6
SHA512 3d0ac29b57bafc408db82e7fc4280e9ccf05df2e70dd2ffe92fc25c59d8052058baf40d0dbb008df3a89a640f44420a4d495966c4293d7f08051183a4e853c74
SSDEEP 768:iXL4pL8gl8nIhrEBHqBQtaHm1v+TsUDcaSsqo3KfM9m3pgF12zzj1Qzn6Z+2AmAZ:iXMRzTavJUDdSSrI3pgF1eAG8
TLSH
T15D53C6698380C17EC7C20AFAF6725364137AD24031A1E7DB6FA67988F8C376353671A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de943408f49102d7fb28c8c5e979b49fa4c600eeefb3015a379f34163fa0f03f
MD5 226b19ed52ee1ad96d564c19ac0a0b87
SHA1 388a8a6e5acbba205ad46ba0e8d93ff97696c97a
SHA512 d9638e1c5661d582bfbf637600cdf5c7f82da465506662fe15d8292bd2895bc8dd9e3a4e75ef2953d0b39f834d11109abf11276a1618932ecd0316e5e45563cb
SSDEEP 24576:m0UUdPKQYpbAKwNsaUpLt2eQcWAmrUB67QGpQlOWcM5HXohghtlFiSU2I8mRjtQl:fxjsbABBOj0SEMcZHBspgrOmIDMRZ
TLSH
T1E0261D23BBFC1B0BEEFF136895B906658736BC5765C0F2AE5545006B29B07009A7C7E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4814798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d04c2e817c7963ae215a1cda3a59d8d274c2db25793d6396e129455dda3dae2b
MD5 6b312e1dc29a2a3a13a318fcd100c874
SHA1 cc7eeced347acf80f29d8260656bc6bf0b60f586
SHA512 b2a113ad5b8266a13b3f5b786914aca7529f5db5978dd7a08f19cc7f45300c7a3780ab203b2218788dcf29642699a8867010b85a20e0e625536439cac109058f
SSDEEP 49152:ANOVyQpNWNKI+7G93wet1ghHYNnBupezTj+7l1vUY7k0STeYaOKkxP266ueYe:AkVK3wetup7bETefkJ
TLSH
T1D0465C11E7F48A2ED17F49B6D53400150AF9EC0A2B73F78B7249D4582E723099D36BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5471822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Exchange.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 32933b4a85d4c6997c143e6f805e15fdc5a1c70a10c143e1fe9531eeb175ff9a
MD5 e6fbe3236e2450a9ba3e9b33fd7a3946
SHA1 c6ce05553f6014c9644a80c2b1e482c7f9f8b8bb
SHA512 16810e7be9a39e7dfece4b57d23244c77bdd39344192940da1967cd7e5187cf5d6861d948a7c6935e6303d043439f2351403ac258b553955241b4d144266ed57
SSDEEP 6144:Qc/J1TtE4K9r+VNPVTwGn96tuw6oaxEuFwE1M3v24IxOAfGKglmtjDdahzboqoS2:Qcvm45wqAsw6oiFwE1CUGMtjBUog
TLSH
T126942A2A32F9D52BD67D553881B31A25AAF10C4CA2E5F3CF36C29E689C4235D9DC41E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

427454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.MSSQL.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0adcd37fceb97978a3c396338676e143ee9a8700ce57e7ee9dbf7f6fc6678b3c
MD5 40f262cfaf050ff51f29614367931185
SHA1 0dda6e0f8ab6da6ddb8f5bc29f84c17ae0a17132
SHA512 163498b6a760e5d927ed3bc2cc30c6f0b121ae98068809099785529e69967c081d0121162d2db9d0ccceff867116893f12da31fc1e182f13e1a6afb1616239a7
SSDEEP 768:3tpGUuVWJCv+96+Bmd8V7ZmTkhePLbjt90YGQFLey6XJ7QAkygc:3tpSQMv+O8YoUbjtmQFLerXJE5
TLSH
T1CF333A3D632A9D3BC79E88BC726B41A143F4CD083532FB677E82195B56237C92D481E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

60206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.RM.Service.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ba56d286bee911972ee7385ff7129cd92a6ea125c863e116ba4395b87630d7c8
MD5 a8e841726899f44e1921a79fa266b806
SHA1 8d540b17c7838b8e7b8c9b4f50acbd0b22c78dec
SHA512 a999f2f501f572929a880296591cd4e4fa3a14c9808810572d6d47d11e262b848d490a936fe554ee33113ad42e466883530763c1a8d6a24ca600736f4e6d1a7c
SSDEEP 1536:Zq+Tb5MT9v7KUjd7KhxvJFlny3SYsELvfV/ZQ9fUk86jd+B15iqVRLZ43qK64:Zq+TAvu5bFly35V/u9f4f00LOP
TLSH
T191B30F3B67AEB441CB2DCB3981137292D1E52D2B2670FEBF6A560A5007415CE7ACD1CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7f:f7:03:af:84:c7:b4:b0:ca:c4:98:0e:13:6e:42:ac:43:b2:a1:88:38:14:44:65:38:d1:86:4d:bd:85:09:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

105934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.RM.Service.exe.config

SHA256 847c9b1504269b83374c7b41f4fb1b57cf90740771206747893bfb8ce379b538
MD5 1217df06681c2ffeeb4106577a5f8069
SHA1 e2f67120ec81ab098c24d545eacc6792e2559a51
SHA512 2a2e17ac3918a4cd4e4e255a8dd94c042e0bd424ad05b6b5ecc322b01f96e5b97344cdc70e77410d6c5d2579f05fe34e8161ac85b24c6fbcb6456339630fcc3c
TLSH
T10651A02190C8EFD14BB10AA23EBBA418CF7903B7194D058DF1DE6A878F7696A1707177
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Cloud.Backup.Scheduler.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4e1cf05a6ec8e12e552a5100374721297b095246e08d0e51b8bfe4b0a42336db
MD5 6b1a4fbe9e96363793d4713aa0a2d8c4
SHA1 e13a77804123cee755b5c94e6de07284ebd64a2b
SHA512 0d4edcdb36728d14033deed1d105778914f7168db532b62afb1e520979325cdf91b369ffe121df2a3d7df0e8f7cec3af0e0d8fff8851546ba428853b4ec45ffe
SSDEEP 3072:EX2r/ys2BiEoJDoFk6l5fVKOjW0vxJkZUW6s8nQFMGKyWhEC:9rmBADoFn50OjW8JkZUWMEC
TLSH
T1E9E35C6193A5C67EDBAF0C7CE272010197F15D0BD171F36A3A9968F41803396BA4E3E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c8:50:ba:91:99:da:05:51:c0:16:57:85:fb:b3:b3:b4:be:be:c1:66:90:8e:dd:2d:66:e4:cf:36:59:08:f9:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

142110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.Scheduler.exe.config

SHA256 dd818dbe332134cb8559a0d99d03d27962047fd753740e87bea5f65975275b5a
MD5 fda16a489cd9a90e0e2d2f6670bf97ef
SHA1 6a1716c24b79f9f4aac52e55e7cb3caf688a9a87
SHA512 a3f5e37933d079302eb56e2139e63412d6da88940632f2367a19494fd3dbaa97a240463dc1fc18d13927fa4255cbf89f3348fc7b8566a98ef6f64f3aec3d1884
TLSH
T133414E1154C8BF954B7209A23E6F645CCB7D03B7294C064EB1DE6A8B8F2A55A0647077
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Cloud.Backup.UI.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3915efd0bf7ef7ab5ef6640449c829b1b03b5f38d9710f1a191133ec621c440a
MD5 5396a2f663c4df076155f3b9d0027ebe
SHA1 2ddc21790e2b3f748e82e6c6a6de61065f3d35d5
SHA512 ecb4f347ba829c9752e9da8c4ea25a38d712aaf7b41837d1b7ace1b111adbc6f96eb962e2408d527ddd5c7a87394aa53764784c7caa7fbb2564cad676181f16a
SSDEEP 98304:DsACJeab3/A+3FmT1WzPOgl5WjMSiOsBlcVv3hTJbfGoi:DsACJeabPWWzPJPO4lcFRVrGoi
TLSH
T10BF65B2037A9921DD47B0B715C3591C117B6BE2B7B54CB2E2895361CACB37238B227B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

56:af:8f:22:9f:ff:8f:91:12:47:d8:4c:f9:78:27:fc:47:29:bd:6a:32:d2:84:ac:99:2c:c0:2f:1b:51:12:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

15442414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.VM.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9904060b2395e9291a12dc26193c618c9103ca4212633be13fee5afde960dd69
MD5 c00e9d9926c00f82424057b10628bdb2
SHA1 12834009306dd5f4bbf5636bec15a89c6205844b
SHA512 3f4b0aa2a1698fd4f0c300ded1008983832e7e12b446794ae897f984234afc38e24b77aac8ebec76d24581a53382b74ba452e582a4a2b0747d6cc1f7ef5b319f
SSDEEP 3072:S/qDSYRbM+qmrc9+Y+41F//8HqEkgqdc7cIcoFVfrjddcUWCME2BOe:S/YP7Yr/Gq+cIzFBXfWCMUe
TLSH
T121443A52A320B5C5DABF4A7C50170B4407F28A6F86F8B6076ED559D93E8234FFA870D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

276286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Wpf.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c49239aaae1f352f8d831aaafcd51c697a2bb2e0043fc02d521a82e01e00bbbc
MD5 cb01447edb7fdc8a2f14c26488147d7a
SHA1 e31ac1c14de1b2c7768c43f14fed65a4308da70c
SHA512 0eaeea341f8f5afeac67ae820659d1389a83098900577579bc0cb8e7da8c71ac6173813ca1ce3a800d0e906d47b0bbe7a167ef6fb6506c21db6ef2833cb8c3df
SSDEEP 49152:y1q5jMJn3urQLgwxjwwH+wiQYp+hPqlpZwGjqSOMa:EWjMJ+2gWKt9CPyZbROMa
TLSH
T119C5BE973F41D139F4B7E5B22E88519016933D6A9767741826E2FC8E85F1BC20ECF226
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

b9:73:be:05:48:25:e2:33:61:6d:eb:18:1e:18:5c:42:89:44:c8:5b:ad:fb:bc:5c:16:59:b0:7c:49:fb:e9:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

2309198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 923169932e79848bac79be60e8a1866d95441904991d9b5b68328663f430644a
MD5 da61147e0146a6c18a6377ab8190a243
SHA1 fc3c3b48960cdcd23d333fcc86f96f5606280467
SHA512 baaa33daa5470889263908f06b9483a3f5901c6703e62f64082b2cc4a55dba16f9937cbe13d87e8b5fca70a9955c5d0ca79b7dc138b5b952752031f66a81ccca
SSDEEP 6144:b+dNx5wFIEVSSd/+nOkm9HcVizW5t+XUe7h1pB+KPxjAKEjt:b+fxiFjbJ+nRszW5wUe7h1pB+X
TLSH
T1E0640241B7E0911CF52F0FB66D3215B08B3B7B525B21EAAF31C5328D29B6295CB24727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

324494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Git\cbgit\Backup\Brands\Resources\SimpleRebranding\obj\Release\Cloud.Backup.pdb

Cloud.Base.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4de1d015804d25f6cb31ca5cb0d6e3f259faad535ae28d6a063bb8250e06565e
MD5 4a0963460a38b1f410822db4c6907fe2
SHA1 25c83effee916fd706fef4d3692042b7ed2d0c5a
SHA512 1e1e8f3bb2e03cd0980e7ce1f1d11cd171ec210906d0ccb3de380109de0ee86208faf2bd9a1a2925d3e51bc96e71491895632b8de6c11b785fe5e710a91a6b93
SSDEEP 24576:dVzJcf/77lu4amVJKPwg0BmGpU86kotR0b+cS02Wpg4Tari+jNI/jNYfZPYm4jp8:6pU86kotR0b+cS02Wpg4Tari+jNI/jNB
TLSH
T179253E103BE85E7AF27F1A3A6EF24051C636B96BDB21DEAD4C61113909B5700F921F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1052094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Base.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a09af10729c2714c93e80d292bec5bd2e32cfce0d5b79f0a58aa96210931b365
MD5 b403ea94428fb7e18ce9575f499e692a
SHA1 a48b0d0cd8e5b4369b05fa2354d1f17bee95e8ac
SHA512 e2ab7a3494a9aee98cbed26ffad5302bd06cc76c143bd4d9665649f49d912a557d31e55517f84469aa0b6d1089638ff28bb0be21cf51ac57f2d0442b66e37f09
SSDEEP 24576:fGZrHF3WZl5IwzMQsXxqYINPPJbXpYBh7Rlx6G:tUw/JNMRl
TLSH
T161654B16E7E1D25BCA7D9AF8B537003413F4E9089336F35F275CA97468C272A6C492E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1430654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.CbfsInterface.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b0abd36360251d9eafaaa1c559832e1f8c064d3d6bfa8f1ab263108159391527
MD5 2559b44c4d1a7b0b9c10ee4a9c77e8db
SHA1 eda86c3aa4565cb71c17ef8d4ecdbcc778eb54b1
SHA512 ceb569d477855624b16320eb3277f2d666580a05134d1cee85b2093765c78c4857cee6e4db39d736428285c17b0c0573b02a608a49c0af43d8a7091cb5541304
SSDEEP 1536:E+TNlAqmg9/5jiP4cCT7+BCac+BRVqUI:HTNlwg9HnOBCacURVg
TLSH
T196535B7817EC8A92C2FE2775B977071243B1F29D1613E72E6C95A65FAE0270049137F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

70526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent_1\work\25c08f47025d0f1a\source\CbfsInterface\obj\ForBackupRelease\Cloud.CbfsInterface.pdb

Cloud.Client.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 521cdc1ded6afa3f161cc4af5daf9eb31af411e0fc390669afbfef96380b5d90
MD5 a2f2b2391e6a41f11eae4d92f5c53375
SHA1 f3521ccc6556cacf9390e6ab35eb2e72ec024fa4
SHA512 c53dc7c304429509f5ea70ee31052713b46757c44ab88dbb793b44fc43960e77fe9492581455d3f3501e8336902a9d24134901729c48bae0565931b8885d575a
SSDEEP 384:7vhfTfpvktDQ56WkszppiV55s30XTM5VSDhaeQrKasnIrTkWOUB9i6hbMhbGhe0S:LJpFkszppf30XVV5nn
TLSH
T18CB23F203BF85E17FA7E0FF92BB110914AB27952FD12D3BE5ED4048915A4B44E630F6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

29710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dd6a240a84a6cd3e4c47614da8943ee6035cbe1de63cceabc3638fee3c4d8f14
MD5 62cace05fdc8548e6e6215c8be37bac8
SHA1 be82b36b981ed6773c80e87833492f90f012f05f
SHA512 47eb364023949809f16136a3faa5293ff8cfc71361e1ba0ac71f5efaa6c7fd77059c2420fa0a64455db1e335b4bc2d98fc0c496eb5e0f807081d529c222a0d4f
SSDEEP 12288:Hgroi2JDVicK/8R4QuC/AFfd85JIo4JjWKK9udVLabeUlmXMBkd9nybX+lvRNWDZ:62JMcK/fYIFi5Wo2tuKUMgcyqo3YE
TLSH
T17B3539426BE4D73FC95E41BCB121422803F9D419B2A7F3A75F91A664BC8730E2CD9267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1149598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.DiskImage.Flash.Launcher.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a341687614343ed8d073efbc2039ce2716379fab3c7561308f3e84b4a82aabcb
MD5 0c5ed832841dab5c0fc7b703b5d2e43d
SHA1 c4d06f003600eefa5b6a090bd5208308a5670889
SHA512 2d5d0bc1c995326614594e23bcbc468a1c982ba9000281c599bd7958303e45d1a3b14c1ee9ab44984577256eda4917472345eaa011fd75721296b4cf2124590d
SSDEEP 3072:pndG7JOIacxv+UuqH/NSVS7zxrUR72i/8OBdZLxQ9hg53y/yVu0VZwo5zb4Z0YgV:p8eKEVSp+BdZFQo533L5zby0luZiz
TLSH
T1FA74F83133AAA209CD6A0B71183592C517BA7E677F14CB9D2859324D8D73B138B227F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

05:bc:81:a6:2a:f5:99:fb:db:42:c7:fd:b4:68:07:b9:de:c1:1f:ee:83:93:2a:87:e0:f9:47:26:f1:38:72:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

333278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.DiskImage.RestoreVerificationService.exe

IMPHASH 0923102362e3d6b015ad139d6aca98c1
SHA256 1d4a0b0518d7608620f0a1d22b0b7efaafa354844b6174d433a8b5124aab3d06
MD5 9346377f773dcdbbbf2fd442788cb9b8
SHA1 979bf97af9ac91ee07338a5e8541a00c77a8609d
SHA512 25355f328c41456285c540488f2a8a349c1ea43288053ccf4ff3fa21c59bacd10155967b7728a9ec0ad5a9f7472a0b28cb4722191f3e8639355f06440bfc0e59
SSDEEP 6144:sshOscBFo67QXGQxZzrVBgYLBHGe9r70LIo9AOwEJIOZTu9Z:s267xQxR8Ypnr7c9WhOZTS
TLSH
T19B349E1175D28472D9B3153509FCEBB64A3DB8600F2199EF63E40BBE9E343C19A31B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c0:d1:87:68:ad:e7:db:bf:07:be:5a:17:c0:34:0f:98:6c:0e:d1:10:24:a0:f5:c3:bb:64:1f:e3:6d:f6:62:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

27210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\a8597ef7bb7c4374\Source\Console\bin\Release\Cloud.DiskImage.RestoreVerificationService.pdb

user32

CharLowerBuffW

advapi32

DeregisterEventSource DeleteService RegCreateKeyExW RegSetValueExW RegCloseKey StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus RegisterEventSourceW ReportEventW ControlService OpenSCManagerW CreateServiceW StartServiceW CloseServiceHandle OpenServiceW QueryServiceStatus

kernel32

QueryPerformanceCounter WriteConsoleW CreateEventW GetLastError CloseHandle Sleep SetEvent WaitForSingleObject OpenProcess K32GetProcessImageFileNameW K32EnumProcesses QueueUserWorkItem GetModuleFileNameW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEndOfFile GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW HeapSize RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.GoogleClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ad19d35d7df725f2d2f61f4a627c80cf27ad645490f65689ebd7460cd420f77
MD5 c1b0d50c25e59f99f1ee001d478d0f25
SHA1 b73446051fbe795ec783ac38a488091a13f0ee00
SHA512 8da2b907c307a012ea7607569065e67e36edfd64f530eb2083b46b30dffd15bfbf407d4c8875b5150099ce44986f4a5472d2530192a67d3dedf54d2934cd092c
SSDEEP 6144:6fIjl2k2FeFAsi9bLqA/eYMQ+SwAjuZgtxPhzJ:eIjl2rFkAjOYMf9Zg/Pf
TLSH
T149644B6363F58A1BD6EE06B89021840417F05C4B9766EB9FAEC2D5FD5C023C9AD863D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

314750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.OpenStackClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4a5dc483db926876f9382a381b42ae57d0b5e638fdafca8511cab09a9cc9c676
MD5 e10cc3414394109971d718a28118062a
SHA1 49382f53fd28552aa2442984252979f3807a3343
SHA512 e77b29aa1dcea5f854e3f482aaa2cfd63e4c08afeef4742e3cf4c0a835417f34ca072d6334a365f2c1f00370d474db08b9b9739652e16e802ce759fff2161645
SSDEEP 1536:XlUtfgBRl0nvXsZjQJjUfX5KfDOMamu1ZM1ut0p1we6F3wpxQJ+zAvicYrUq8JLu:XaqX0vXfgXAha2ESxyi7Jo2TByjoj
TLSH
T13EC33B41235D5A2ADBAD48BDE112C101C7F08A5A9933F7A77DE3B9F51403389ED8A2D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

132622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.S3Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0527215df2d8f518b03f2c9c04e458fcf39b59a8e06ef94aa69a006e783a7f81
MD5 45e6582a4c6a4eab595c0239ca14d304
SHA1 d2e79075a811bd077ec0a6c1a4568fe266d5e2bb
SHA512 cf63b30425aa4a0ff7af685388b6c6e26ffcb40f0dcfe3b36c622306e2f62713c2026b287c61fbf9cae6ec01c6b48ae14493f0a448b8c6e6f9e320359c4057aa
SSDEEP 12288:gYjP2djH5KJ2SWIE47oKwb6/FDfBW723LHHbSWIEqfuY9OSdLqTebr:redjZKJ2SWdHMtk2bnbhafu6m8r
TLSH
T19F356C87ABE0FA5ED67D49B86123100907F4DC14E2A2F7436A43786E1D87F97CC491EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1098446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Wizard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20cf8908f8ac1258f66024bf015241e269e7b964696b5d0a7c748a4f7203bd63
MD5 a1baa147758ef9aadb6a6ccddf5d88ec
SHA1 cf36d3427abebe8c8a9f9f0a8ebefd4a3ed98878
SHA512 82c8b39f86f398aa6d754b1b837972952c1384fafb8b5be2694935c52fe629253efbf34c3d38555b68c2290c9abd2f859391e8c3f06019af81eca7e4f5072897
SSDEEP 768:TsUK/kA+hNZ4z1bQmr+6ubSUBKGDECKo99O1uNAc5jRzJCTkQ3eKi:2Un4z1bQmrK7wFuHjRJCTkieKi
TLSH
T1B053093033BE821AC9694B787C7591C517BAAB257B00DB6DAC89115CED633134B22BF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dapper.StrongName.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d72a8d7c13d5cd37fc4daf52c78f09d8199d72e3f3b4298c72c121b65ee6583
MD5 e1a11d2eb998eeef9d91055ffbea0132
SHA1 a8fa26d510b75436079e7ffbdfe705367c01c1c0
SHA512 a8bc95228c51f5835185ece4037b4807595641caa84bfb70d26007c2993f2c59f3d811f0c71b490309550e2a4e735cb12b6e1a2c2bdb3c7d58faf2a3952e364d
SSDEEP 3072:v6ZWd9g9mMzpGapZeEvizRYe2vDzZMCsdvqL+YS0YmIyb+g:yZWdHap1izRYe4sL4Pb+
TLSH
T1F9046C15639D8BA2CBEF0BBA7475800043B2A6A7F5D7F78E69DC91E568537801B003E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

180266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Dapper.StrongName.pdb

DiskAccessLibrary.FileSystems.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9b85093a7c8050a33f7382a85481e84a99cc6ca940ea8b640e1359a4530b09ba
MD5 45da5dfb10320aed21a9a9eb78043d12
SHA1 dd7d3ffbc207ab97ba34fde0c7663b3948b6921e
SHA512 8b832acb034f40ed3a68d6fb657d49da2894bc3bf17dbdb62e5b094a7ad92ac3fc10fdbe1978e3c992d1206b20c1e0a4ff354e1d3e7d2fe10c388301e8ccf8d3
SSDEEP 96:WchCFOTU/kz/xhV1ruVUytkt5/pPTKpOPR+Nwesmm:z8KU/O7uGytkt5/pTnn
TLSH
T131F1B411A7D8D323DDB70B3CBDAA97421235EB998D17CB4F1C49160EAC366582BB2760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DiskAccessLibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 13a3ba8d52fb800f1a0f4f371ad994b9070966596355272fe1f5164cc55a0063
MD5 6636dbc983bd69d7ad1c23f4a6fdd6f5
SHA1 23551ced0c07e4d75c770719c3c31969d029df4c
SHA512 647e1bf899f67ffbf78ed78352d7b6b199cd5f22e36c9002a37d24887815806d768ba04707e8f6d5cac5bb8a330c593d69b61d51b586ab3df56f8f9bf891f747
SSDEEP 6144:NWicmkog6d8D+odR6HcFxMVaFTXB8IiH7LE85MmnF:NxFkoOfB8h
TLSH
T19E543A2857E98921F8EF57BEE4B6044587B4F016DA2BE75E1BD424FB2D63364C8007A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

285902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Esent.Interop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a69c7365fb55db9740e886d6d8137c4a64f90e983e2a730037b5afba4c9f195
MD5 23cd57e1099c8356572c2b149661bcb7
SHA1 a43f26f9c54c5b040e3e368152118c47aec21bf5
SHA512 bda8abc988390731ca3bbdb4ee9d87396b4d139031391568d57dfa1d5f50e791e84b0dedacf64584ba0088fcfafcd23436b942b78d92a13f5e171c916a459279
SSDEEP 6144:qw9nwscyJjd1V04WCwtnRwtv1r3BFc9FSWGCX:xrhJjdnJ9tvZ3Pcn
TLSH
T1A4740A2063E44619F1FE7F74A6B4AD5D44B2FC4B6A3AD38D92009ADE5C62F50CD22393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

373518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ICSharpCode.SharpZipLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c287e9b07a8251828f35914364c89a37db606b0c1d64457f9eb8fa2258f0dee3
MD5 d59ef46a5f01ddfe7eb691e6c725a247
SHA1 edf2ab9ee284fa21dbb55e93d082848e800f068b
SHA512 8b5b622618ddc32695cef8f0744c548e5068a908794caeef3286f5a2f521ee2bdc91fb63e37ce211147dc1feb8777da1e029f0ae8c6dd04b061753832fea55db
SSDEEP 6144:E1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7s:LIzm6pOIgvr7
TLSH
T1E0142924B7FC4A67F6BE97B8E475908087F5B9A6313EE75E5C0094EE1C56B6089003B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

206806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdb

ISCSI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d10e28fa20ca82a19d0aca2c6c2af8e49f972650ff0c615fc1c3689361b2fb9d
MD5 43c677e816a52dd021b5bab12fae0fd5
SHA1 8b165e2773371137b8f155369dd03bc65cbeb22f
SHA512 4c02d4c808f0033d7cf49d16a955dc5dfedeab9332fb926aae699ec768e0269a102a14ad78f669cfde40243ac160ba45224eebe0ef6fd53e7edbf87dfd241d01
SSDEEP 3072:Ae5XHlADsxM3Mf0cQcBp7+1RQN+K+pU7vwxn7b:AbDsxM3zcQcBpqU2+7v
TLSH
T1A9B3299C5BEC0B65F86FA7FE90B48501C7B8B95A611FE30E1E8490FA2873391C5117A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

121646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LZ4.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de81e4ccb659ba85a4a6d1bad8742ba0af75aa6ff50a2f6330e78721681d3b14
MD5 031d50f8089f30c265a281b7f8d90e73
SHA1 6548799d247855279dd45bab863c08da4ba5018c
SHA512 3e1b8f9f854e4d4e805c495425a0ce6278bd2bc4a8db6da8b7cb2e797fbc78187727cabf185c44d5fbf144543e27814347f565337d4992868479bc16d366c833
SSDEEP 3072:zqndOlIdZmqtVioTf5vjJRzGc28SGHWEhpU/urue6mnFDy/:zBSdRioBjGc23GHWYhue/x
TLSH
T13DE3D02577D95597FBB69A38ADF551014338BEB2B9BAE38F710008393D26BC88D20753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

151822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lucene.Net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d3e374e75c33391e7d5a127e21a603f29241f6c3ac35b4f5766ea14ab49a8bda
MD5 38a3875f7a2169645fee066fd4e25572
SHA1 5e72581c0c0ece95bda361cc08d50c6a7a18602e
SHA512 4a54064bf78e8a506b5f8ae80f93be584420d82515044c0d5de8c294bc89653bdab54142e3c1e53ec934cbf6a016a9daeda2008dd9dd90e306d31e8285d85b0d
SSDEEP 12288:WZuUoUqrbs7TpCjxH4pxxo5CS06Nf637tBnN8JwqxhCbKjDp:WAUk0pCBgxxo8rWtjDp
TLSH
T152F43A4527F81A17F4AE5BB5E471092A83F5E416E7A7F74F6A50B8B42C67B90CC003A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

748542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Lucene.Net\FullRepo\trunk\src\core\obj\Release\Lucene.Net.pdb

Microsoft.Exchange.WebServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6dc1e364a5b9507d806e12b0d1c390ff8fd779749a57b51c8d37126889ee79b
MD5 b0ef1cca695fb3fd38b219f3b67974f5
SHA1 7b5bf10c7fd710a1cd5c3f43af352f31c9880cb1
SHA512 92c5a2c910bde00d379f0b33380c7328c672cf58bf90bae382afc2a6af429491dfb353b9dbe8388e47d0eae43386faa442d43192dd215f10e276571893907755
SSDEEP 12288:c8pomlMhnk/IfGUcbtYiwVz9Ou+O9GPxuZa/7lhyylVybnFBRRGQmEQF:Voma6I+UcKP2xuZafyyrszRRGQdQF
TLSH
T18C35271937E8131EE1FF1F39A5750424A6F5F92A3B16E32E0A15E69E1C62B40DC22377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

33:9b:35:d7:b7:ca:c0:19:e9:96:ce:c7:22:8f:b7:cc:52:e3:b7:d4:df:23:56:ee:98:7a:bd:22:e6:d9:6d:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

4e:33:ea:07:01:04:42:1f:10:d4:2f:cc:8b:c8:34:f3:c7:f1:bc:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 11, 2013 - Feb 11, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:29:97:4e:7c:82:cb:20:16:41:00:00:00:00:00:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

1106206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\15.00.0847\target\dev\ewsmanagedapi\ewsmanagedapi\retail\i386\Microsoft.Exchange.WebServices.pdb

MurmurHash.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e0a8687021f8ffbc5a09fa875deda2419b5246d15f4b1e6856b8d6a24a6f86c1
MD5 884ab9c5107e6e40cf6178c9d6877d0c
SHA1 8c7dcaa850cb4bf27de9c7725dad8be8495761cb
SHA512 66270e0bbef588ebedac7387e79aca178a3f69bd4cdfa45c58a2de39a6a9c1f55111eb8f5dc7b3f0307aa5735735f5f2337d0b3bb376bcc473b07604660f0785
SSDEEP 384:P9RkLcnj9h6C9ctoGwnkrJup//hWkk33j7me1rN9ptjv8XE:2cnph6C9ctNu233ueXY
TLSH
T16062B515D76881A7CBAE873A49E1321A4D39D247BFD69B3FD124B02E7E83BD102407A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\git\murmurhash-net\MurmurHash-net4\obj\Release\MurmurHash.pdb

SQLite.Interop.dll

IMPHASH 56568d263b8f0fbaf90fda41effb57f1
SHA256 10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d
MD5 a73fdfb6815b151848257eca042a42ef
SHA1 73f18e6b4d1f638e7ce2a7ad36635018482f2c55
SHA512 111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d
SSDEEP 24576:EpmVXSlb6q7SKjK2RMP1lfuqluu3cAG8WqMkXbbz38MJBbMNCoUpgLPNwEcIMK:6mVXy7SKjyfTFMwEkr3VJBbKCoUYt
TLSH
T17D858D4BB3B8009DD5A7C17CC627670BE7B174451710A7EB17A086AA2F23FE516BE324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

56:eb:de:df:9c:b8:0f:03:aa:7a:8e:2b:be:fb:9e:b5:82:f1:3b:e3:a8:2b:0d:7d:d8:d8:13:76:1d:fe:30:a2:29:e3:9b:e3:af:f0:d6:9e:98:d6:3a:da:ba:08:60:b9:bb:03:3a:3a:2c:dd:1d:96:30:f7:2e:d7:58:07:6f:fc

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

1f:32:3a:b8:eb:0f:7f:5b:71:c0:1c:37:0e:42:8f:20:8e:b1:e9:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2021 - Dec 12, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

mscoree

CorBindToRuntimeEx

wintrust

WinVerifyTrust

kernel32

GetFullPathNameW lstrlenW WriteFile GetDiskFreeSpaceW OutputDebugStringA GetModuleFileNameW SetEnvironmentVariableW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA GetEnvironmentVariableW SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DisableThreadLibraryCalls EnterCriticalSection lstrcatW WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile lstrcmpiW WriteConsoleW GetTickCount FlushFileBuffers SetStdHandle RaiseException HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryA QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA CompareStringW LCMapStringW GetACP GetTimeZoneInformation GetStringTypeW GetStdHandle GetFileType FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA

user32

wsprintfW

advapi32

CryptAcquireContextW CryptEncrypt CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptDestroyHash CryptReleaseContext CryptDestroyKey

SI01290ccda2c08117 SI013a90511e949b99 SI019bb1b0f8b88a4b SI01f2e1e38fd8dfcd SI0205288c09c4da1c SI05acf7f13d83ef68 SI05e4faf8d2d5065f SI06ad3f4f233fab5b SI074a26a6bce53634 SI08295ce2aca70863 SI0942bf2cdfbcbce1 SI0eec257817cfc527 SI0f45dfa7051356c4 SI1066e7ad782ea882 SI10e4ec2593e4bdd4 SI124a949911a522a1 SI12f9286f5bd6f098 SI12fe1f150b42ac38 SI14849b3d0e89b1e0 SI15e46d353ddec488 SI1647e559283d26e2 SI1686085452cb6c90 SI16e108f53793a43a SI16e172772b0b1706 SI1709fb0c78fe6bc7 SI17c3a78ecf9eff4c SI1818f2c8eadbcd54 SI18b9c7fd6d90deff SI1ad41a0e33dff249 SI1b8a3298ea828a3b SI1bf8975e567ea97a SI1bfa1d92146eadb1 SI1bfe410acac3c9be SI1e7babb0bb0adcc2 SI209d1bfbbab7da73 SI209eb0dd58fa77ae SI2102da665922f66a SI216a233b40cb7147 SI25ca8d2baaee0750 SI25d73a5ab4d6cacb SI28687b581b626bbf SI28a6405343e7bbd9 SI2a71c3377e6c357f SI2cc330551d123067 SI30455e90830ca460 SI33209d52126464ab SI34e0a4f84fed7ec1 SI353770fd94e573c1 SI3542aeff9c3855db SI367e45cee72bfd47 SI37012ee3c6dde764 SI38de1207a575b65a SI3bb401944414ce69 SI3e5389eb172bc856 SI3f65beeaaa0d85de SI4251c713c05a3b5e SI42669818b7978ed1 SI4490ba755e98e797 SI4507744386fcba0a SI457a7dc78746ca90 SI47cc739b3bdc3dc6 SI493bdcf3d13ad302 SI4b170c874686e4d8 SI525814a3c7849b6c SI527544a37185bd6a SI527c455c79b66da5 SI53af60c92476ad6f SI53d16af9fd9dc018 SI5492f6d28289950b SI558bdfe0e27562ea SI56ddcf38809cce55 SI58b3396e563758e2 SI58d9c9e758678014 SI596241adb70ce0e2 SI5b4aedd0c04bd151 SI5b914c29cf5a7984 SI6039a77d8b3fe4a1 SI63770fcd460a846c SI6423b87d77537d0e SI6448e5eb2ca66d9e SI644ad6803933fc53 SI64d795d8d6a5652c SI670a722dbc4b11ed SI681faac9c0128a40 SI68689a9b2961f1c3 SI688b887ce4a2e5bc SI6afceccab898a321 SI6c799e24bc9109fd SI6cff36399d6b8510 SI6da43f525fcc10f2 SI708dc027c2a0b01f SI71d54e41ee149c1b SI71da61fbbaaa7074 SI7501ae36b96de01e SI7559ce66b2a83683 SI7607824c610843ac SI769271af19a2299d SI77dfbddb9b6d65d2 SI783c2997f4bbe903 SI7b811ab87b7b7a6c SI7d8b2b5b65802a7c SI7e899b5a8ad87eab SI81c3656e0c2c152b SI821a25758b212c1b SI8259474343588db4 SI841b860ec95cb540 SI842d9c1989f08a60 SI8476de5ad2e1f63e SI86be81683e8ee826 SI87f584c5f9c8cd81 SI88473e35770c74fa SI8955d5517e10b3b8 SI8b0d9e6837e61abc SI8bd1a2ecd61e628f SI8bdbd256a7a800ee SI8c5d6a3d79dd16ae SI8cb1ce55b92259b1 SI8d503b48c50b0f0b SI8d98262fc9dcd199 SI8db78c75599d54bb SI8ea977f217df4eb6 SI905dcc543d48caab SI911c8a4b74b6de07 SI91da00d7298230f3 SI9383891d346ef4b7 SI93dfc8fa53d5b31f SI94ecb64e9dbb8338 SI952d22c6db518ea2 SI9555aa94e5464fb7 SI95d251bc4895e058 SI96516336c99ce75a SI96d7cc1e6c528820 SI9728956559a83c71 SI98fcda7827970a5d SI99449f6fa6d0dabc SI9a326fe0ddbebf12 SI9dbf9d88aa001ea6 SI9e5caf3f82afbec6 SIa07e0e87d9c86d40 SIa0b89be8ea9562cc SIa364946505687432 SIa7c1cd9b020850a4 SIa8a7ecc7b42638c6 SIa9bcec858971f4c7 SIaa0f8e0c251cfd1d SIab9b1bd6a4822cb2 SIabb2be07ffdb1945 SIae265b9a3e7ff7d8 SIaf003abaa59f4e17 SIb03c6e79afae3a3e SIb12933c5b4a9b1f8 SIb20222b622b9f6ae SIb378d0a537411fb9 SIb50fc3839c421869 SIb58d68e34259bb85 SIb61de3ea47c362fc SIb64c92262f98df4c SIb75bb703537e34a8 SIb80a1b71f58ea310 SIbdf2cc3159ddf9a9 SIbf02a0e02928adea SIbf5934dfe2a8d472 SIc14fb8a21feb2e94 SIc60c813695b0a929 SIc6ecc041c46c67c2 SIc73e44ad36c6c308 SIc9b8df374df75071 SIcaac088b33f92dac SIcaedf2c29ebe4e44 SIccd01f4d70f48acf SIcd51961be732e0d3 SIcfe1e5cf0035a8c9 SId17980a984b0df0a SId2ea6a764978b870 SId3575b24dfdbea5d SId61cfc777bf4f00a SId68f4562cd5aecf9 SId6f924c8ba3d05b2 SId95bb14c42234d8e SIda0491b2623dcc8d SIdac3904ec873f97d SIdace78b5300c999f SIdb45e174afb28e2c SIdbdaa654d0b26d40 SIdcfb39991ebbc7da SIdd048b2fedb74020 SIdd8123a9d5986c26 SIdd99c1c074d20b83 SIe1639e708407f10b SIe2f92b70742a9bc1 SIe609bd7d2871cbd6 SIe969e8d8137a8a33 SIeaf6f475f4e274e5 SIec8bf9affd85b987 SIee4a1cd279a7db69 SIeef348ae766c388c SIf0a08171cb5be57f SIf6e594a0ca15fef7 SIf7b501d343c24f69 SIfabc748b81ce8fcf SIfbde1ee423d263fe SIfc4b758a3d39aef3 SIfce41a414fc927fb SIffb8076c269e2a85 SIffcf65ff995c2367 sqlite3_cryptoapi_init sqlite3_fts5_init sqlite3_fts_init sqlite3_percentile_init sqlite3_regexp_init sqlite3_sha_init sqlite3_shathree_init sqlite3_totype_init sqlite3_vtshim_init

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SecureBlackbox.FTPS.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a4caae91bd5eb3c83cb8c20eeaa15971deb1a787aaea5f663f07c910497942e8
MD5 5ff81eb85c2f2351c8299cde2801f1ca
SHA1 ba0ea62509c625a204ef3e40a7f70305f4250e9c
SHA512 844ecb3f1b57c0da7804f9c3fde258687492bf3477afbaefd5088b4111435ed7d2c07de2f7da2bbc58906b6cc97a362a6c5bab63cd670e6614e6ba3b5df866b5
SSDEEP 1536:fYhRTUCY2mMWUsXHWlaVX7QpG8k2GltAorMAuqQsDjEDZs1ozboHQE+:f0TxmU4Wwmg2GpQsDQDZs1
TLSH
T149B35B482BF82627D6FE17B8F6B551A247F5EE284297F3AD1C5424F9086A711CB013B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.FTPS.pdb

SecureBlackbox.SFTP.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 068169d96fc7d9ea30f624dafc75d3eb89039a5e7a3c7df43ffea549c82c0a47
MD5 c51faed9946e3f39714371124de62452
SHA1 ed4667f714efaab38100a17184013713c5d14c86
SHA512 2a2399600ce1e0f44a40805ce9d14358bd8c100c5982c026671d564dc33d62108ca033b3125a8fe8ac35b6a08811796fd85e6dcd4c7ae07880d93a9216be6625
SSDEEP 1536:xmrEkuHs7YLK2nZ+hHXmdFUSRVA2xNrtSfLVTUGftQkm7FFFnF7BkBcbIacM3P2W:x0QHs7YLRy9wVAkNYTUGy3PpOCXD/RF
TLSH
T1D6D33B946FDC4507D9ED67FCE82C02508BF1E866E297F76A1DA0B1BD1C5732287422A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

146978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SFTP.pdb

SecureBlackbox.SFTPCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 150e513b0f5d54c9e68fdff92f6be632bee89837f58a7e8f4ddff446ac2aec62
MD5 54af6a13f63377e82c7f5cc597bd469c
SHA1 5b7a112411e6a62cfe89b95cf1911e04448db857
SHA512 e739b6385d155b0e8041a19ca222ca3c5804d63f41be93716679d7834b037d8f7e8f8f7ff9a8d4f090b77401f8cf99d4f670d912b2a1dcd8bdfb7f0a0b0cdb65
SSDEEP 1536:5Q8K0jT57h1obWnKnlroI05/acUVykgcdDOa8pAMB4A8crSAZqJ5:S8K6T5734WnKnZs5/HUwJpAM6A8crSA
TLSH
T1D69318258F46075BEBAD13BCF8490A9047B48247E24FF78E5529A8FD2D1E3508572AB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

99778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SFTPCommon.pdb

SecureBlackbox.SSHClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 958b90b9f8b2c3341fe936adfeca09bbf08601222a126f900786dd61723c723c
MD5 ea588d397c357548e93c0013bc260446
SHA1 864982ee6011319c09fbe65a30bc4a6f3b9669db
SHA512 5db19bffcf03e63ee3758eb63c8c08e81a870fe9b5a971332a821c3b0484104ec79d7ce6557198670696c71cafff43ebf250f3c807c5e037142ebf790cab593d
SSDEEP 6144:5zCyS5PE3fGxFfuHdW3rj32wNYWId3Qsfb:XYPQMWAr9NXIK
TLSH
T16E545BE02B679A07E2AE27FE9C3C615153F4E425D15FF7980EA464FA0C9633087291B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

295910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSHClient.pdb

SecureBlackbox.SSHCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b3db7148f6b531b3a7d11b66eccb4c4cbee37a185b2645861cb6394d1e467de2
MD5 1c55d29bf17d04e6b25cc9d62089690b
SHA1 8a135e4c4b0d9f78ca4da0cd050a4f72c9a6e684
SHA512 14f70868a6a96ee14712f7e0a75a39383d0793f6883a93756b206ca46efa38f020ef807243af3c218fc7b9df12d5cfa69cdcd475b3d985f241aebcd2c89b545c
SSDEEP 6144:oX3EYv5ZUw4ar1Q3uK+Q6cZpcAvNQVMOPSUoN5DL5NTpQB8+zS04pFHB2STgyy45:oX6Xf
TLSH
T14494083D1DBD123BE1A8D6F5CFC28823F454E0BB3112AA3958D693698747E4269C317E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

437126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSHCommon.pdb

SecureBlackbox.SSLClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 589ef3558a2d436fb003e87df1c7462c60963a4c32e9082dd3531c3778d1687e
MD5 b446e9cb9175e5244b1ef0385301455b
SHA1 52c36c5fcbc183b15159193cd6259ec8cd174aab
SHA512 20b8ed5070f4a7e720041c40850ff848ec8ac4f27839c819e44f145f1f874d483456d49bf7b84b8c38b4a3f24a5daf7819c5b9c87223a0f4b77d89bf7f345d40
SSDEEP 3072:KuWHJnDhH8QUdTDdXskGNiUhV6ie7PgOqFaoRSTZTpGA:PWHJn9H2XskehV+S0v9NGA
TLSH
T12A04188D73197B63D49D87FEE4BA608253F99536D347F3951EEAA4FE8C8231042502A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

195634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSLClient.pdb

SecureBlackbox.SSLCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d4c5cf996d9ea5547b56fba51c5505a137d60951273795b6a2148d5c3140aaa4
MD5 ba66f1c412a2dda2006e0e73239fcd51
SHA1 ed9359aa407f24bbdd3aaf8342d5e1f0bb571f34
SHA512 1bebf2f1e9118731d8a9a4e8caaf1fa7a6e2d73d47d0a95394e59b4bc48c2ebdd962134d19feec33701e7d89d0b1b95f16fd7a303ca42ac23bca4dc146e3cfa7
SSDEEP 1536:H28zVF+nGaCNCAlVXfKYckST6uEN+E6oBoQD/6tjYOYNIggoa7IAoTHfuJ1xXjaQ:/5wGaCNBrygua+E68z6d
TLSH
T115B3171A2AD85017F6FB63FEBE91208093F562E4F3A3D34909D605F91803F695D932A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSLCommon.pdb

SecureBlackbox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b90580f4974f9048a5ae2ccb0449e5048b74dfed795c0712b59273ed53e8619
MD5 f56bd4bca5849a15ccad45fb405c6dbd
SHA1 1e8ecc1a267e61b145e044ac8823a1c7e18236dd
SHA512 2fae8a29bf0064302a9776a7434ffbc15214ba1cf4b555b7bc7d577f497ca81673ae0205f485e63c56ece62e66d0abb4dd08762c6d88d4e85b714dfbc061eaab
SSDEEP 98304:8wudnMQPFE5MLqJ+EIbkRxUtOzui0Ap5OdVwAmYKae1YUpvVS20jfPTGi:VjQPFE5MLqJ+EIbkRxUtOzui0Ap5OdV7
TLSH
T19BF54B1A9ED06D13E07DB63094F3401293F1DD7E734BAB6B1598B2B88D2A70B5DC126B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3614946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.pdb

System.Buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3af1e07305bed0abe0cf32d9854e0a7f5f470216adee1b87d02350be09d31b35
MD5 b20c1ed526c9fd90569a340914864d32
SHA1 8c23283128d23f6cbc208e3a485a1cf1a9c0cb50
SHA512 c7de839aa129b73094678efea3da88073c3521c99e3533a0858ec8e0804db2004c4e84af12ecf4358ce134b12c66040fd04add9ab96c78414a247a7cbd0d75d5
SSDEEP 384:HRJyzxhqFAB5n55560IxEFuAUTcxR+sDWY82W6fX6HRN7gCJDtdQ5R9z1QUMtr:xJyYkx60IxeuSM2Wrds9z8
TLSH
T110B27E21C7DC421BCE7F5D7056B9DA862D3A43D5A503E62F108CE9081DE3789DB32AAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e3:fd:68:c9:ea:31:03:97:61:76:d7:4c:e4:86:cf:3c:be:86:85:7c:73:ee:69:b8:8e:fd:53:24:60:7d:38:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

System.Data.HashFunction.xxHash.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ebd5b9585529102ea1843ac2ec52b9072567ad9234b71180a2b3b3e0fcba982e
MD5 21d59b5aaf6b72d807079ee5e649a5e0
SHA1 a5a7ad860796330b94012a52f7257dbcac1f9bca
SHA512 bb61c7fc0f5b369c04ee664c6614211c283bf33aab209a5ef3f24b6d595ad8c552a306889afdab905454499b8061d5d3cb08922b89761379bc951e6e5656d034
SSDEEP 384:yemqD6czm+3F9DMfhN6vHz+STCpjYyvBo4SQlJ/ZPF3x1TS:56ci+3FlS6vT+STCpj9HPPFq
TLSH
T150A21B086B8DC637C7FE767458B25651E3B0FE16A437D71B2CDC9078290B7A83980B69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

27270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

H:\git\xxhash\obj\Release\System.Data.HashFunction.xxHash.pdb

System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 24043ef4472d9d035cd1a8294f68d2bbfdf76f5455af80c09c89e64f6ed15917
MD5 b0911d27918a1e20088b4e6b6ec29ad3
SHA1 93a285c96a4d391ea4fe6655caaa0bbf2ee52683
SHA512 518da2e73b849be38570d7db218adeb47f85fde89c15dac577eb1446a9a55bb4cfaf31d371428b9c4f0c69c0be3e2cb10fafcadbec24e8ab793b639392e3f029
SSDEEP 12288:ZGGoS+lVQ7ECFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cH:ZGGmlq7E
TLSH
T1C7945B9427EC250EE2FF5B74E4B0A841CB70F452AA66D34E38C4A0B96D21B44BE53777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

b8:e7:ef:64:1c:45:71:42:6a:b2:4f:b5:41:86:aa:d9:37:da:77:74:01:a3:88:02:03:43:7b:b8:74:cb:6b:5e:02:f6:2d:d6:a9:f5:ab:56:15:4c:ce:9c:22:a1:a8:c2:27:be:3b:d5:14:8d:88:01:fc:cc:3a:9a:7b:5c:6f:a0

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

29:1c:69:e2:88:90:cb:d8:49:3c:e0:a1:e7:d9:8a:eb:e5:8d:9d:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2021 - Dec 12, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

395186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb

System.Memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
MD5 35e6237ff5533342516bf01a46e4b7cd
SHA1 f8a118f07eea37ce732b487ab730646dedc46235
SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
TLSH
T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a4:39:e2:43:4e:c5:d8:14:7e:fb:ba:42:fc:56:b9:dd:2a:b9:0e:a1:5a:1a:ee:d1:46:3c:33:a1:91:9a:d7:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

System.Numerics.Vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22c84be385fe8ba6d0e0138952748f28d781fce36078b5a7aed91a6104bcd99b
MD5 7ab5dbdd2ace2a313392cff4f372e4b9
SHA1 8890ad1911448490526d2a45ac8cc518b6e886a2
SHA512 5bce867274f23694402e9f9f73f8c3ebf5d77114836f56d3cbf5cbdeef164a299091e1cd69fd7635e6b7bbacc7376193eb8daff32d5aeed0df72835a00baa4e2
SSDEEP 1536:cuIaashZlF/cLecJE3+DWG/E2NstmOz+aAKWGd7isnzP:czaashZzWeca3+DWG/E2it5GK7dnL
TLSH
T119B3EFE22F6C655AC7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9c:c9:af:38:85:33:7c:90:83:bf:34:2b:db:74:94:cd:b2:a9:55:e3:39:54:ef:b3:12:50:db:ca:eb:18:45:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ed:e1:5f:cb:d5:f7:a5:5d:73:00:01:00:00:01:ed

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

System.Runtime.CompilerServices.Unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d6f419d641682d8efc4a40e850d2e85de519d6823b93daf2aeee63206d4e32d
MD5 aa7a54f5a3ba48e60d51e6eeb378404d
SHA1 e5d644311a6087c6a500f0e79bae4af305430b3d
SHA512 b033330695b4edc1bef5d36d98e1a68f5862469598cd6a71cafb8f72732d29403d4e8b9e4df3809c2f49dcd59d5ca751ada97ea9b7e268298effd6e19eb52399
SSDEEP 384:hkGbUzdrbbxHKWgr2WXTX6HRN7K3/7R9zXL/Lq:WGAdlQTWoF9z7zq
TLSH
T1B7826D20C7D44543FE673B3055ACE583BE38E7D51806A3763585E97A2C963C8AF3562C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

84:fd:35:d4:54:3b:33:7a:ff:21:82:ef:df:40:6b:06:5c:9b:b3:15:61:2f:37:5c:a4:57:2f:31:81:4a:8f:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e6:d9:42:9e:ea:00:f8:7d:e1:00:01:00:00:01:e6

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

ZstdNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7a062c0c02179cf942ecfc3533bb6604a946dd3597abe80869549048e1307b6
MD5 db96103c6375a4a49fdee609f7ca7584
SHA1 e3f0005bef532690163f455d002a43cc3cb280b7
SHA512 8e726b29ec0b5b1495525c232e2189334a096f6b2ba0c2645ff4c005b632b5bb7498c5ab68de5e4f85ef6476b680f5aab44200fa78e63acc376de560932970e3
SSDEEP 768:ALAtyHfVGVGBgHeWnwwEgc8+9PRVYxpgP4VF:oAtYgV8da+NRuxpgPIF
TLSH
T107C20A55B3D8C137E4AF5AB8A472052543B5F5833933E78F65EC84A81D27B908E223D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

34238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

cbb.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 70f3319e62274b1f0a589dc6dcfdf1ec397a5a010164cfce526397927a05e3bd
MD5 b3d8f8ef6291fcb4c7b8c64e636eb346
SHA1 a91f55adab0df7f6861fc84ed802a506e2826699
SHA512 72c51d96853cc9b9694f6fc6515861d55dc0f9df2f01bbc7a4282904727606146337a7c94f78c487dc30b54fe67c8ba2b3da3d381afcd52ad21f795a68125b1d
SSDEEP 6144:nlT8B1frbItXZ1fqpMT8JBHdiVAcMeOjkfS4Rv2rVndePD6wPYwk1RsL5M5pQKHZ:sia2ROERGVndRqMvzH+WdJUSLB1E2
TLSH
T156D419E32BB6D115D67F7A3C602A5C1452E03C1B2375B22EFF4329E6994070E7A461EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c5:02:37:a1:f5:db:ce:4a:68:ec:b7:c5:3a:cf:bd:21:1e:88:4a:12:00:dc:68:4b:00:9e:42:92:69:16:b0:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

Jan 27, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

646158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cbb.exe.config

SHA256 d02f7c9dfbe6c2175f32a9694a29db68ceaaf0bd8b508aa9c320ffb52a64f74b
MD5 902ca4d097a0ca495456d453e6ddbd30
SHA1 c16875bec45fc8c8aa805b6b3d74e606310fde95
SHA512 d3b074c59d6ee6a43506fbeddb5359c62d8262c264aafea416186bb45367fbb277b47c7ba2074f39af0cb2fc4adc92c96eff3d66c0954464124c3111a59fbc8a
TLSH
T1F9413C1154CCBFA54B7209A23E6F645CCB6E03B7294C064EB1DE6A8B8F2555A460707B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

libzstd.dll

IMPHASH c47ad36ac72daf87a4f693877d7e903c
SHA256 0c245a3c93ad074469f675fb6f1401461f8d46d0ead253e459757d102b8ae562
MD5 b96a7091ed2b45c38ec8a97795152011
SHA1 178bf487e248e7bb3712ec4cd79b5f349111f7cb
SHA512 1b8fb4aa93b62ef068dbbd2e39ba3c2b87ef9a35aa9bf5ee7f12e795e48c4c6a29f5f4016606bb909e0ba3710428dba4476d0dad6fbc5b6b2ac3d6d6dcc2c866
SSDEEP 12288:2PHZyTfnngrA0n5bfAvLpLY2byCfwkp0wDvj+Xx4K:GigU05bfAvL5Y2bdfwkprDvyXx4K
TLSH
T1C5055C47E1E350DCC16BD9B4836BA273F9327C199124AA6B8BD0DB353D52F20E518F68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ZBUFF_compressContinue ZBUFF_compressEnd ZBUFF_compressFlush ZBUFF_compressInit ZBUFF_compressInitDictionary ZBUFF_compressInit_advanced ZBUFF_createCCtx ZBUFF_createCCtx_advanced ZBUFF_createDCtx ZBUFF_createDCtx_advanced ZBUFF_decompressContinue ZBUFF_decompressInit ZBUFF_decompressInitDictionary ZBUFF_freeCCtx ZBUFF_freeDCtx ZBUFF_getErrorName ZBUFF_isError ZBUFF_recommendedCInSize ZBUFF_recommendedCOutSize ZBUFF_recommendedDInSize ZBUFF_recommendedDOutSize ZDICT_addEntropyTablesFromBuffer ZDICT_finalizeDictionary ZDICT_getDictHeaderSize ZDICT_getDictID ZDICT_getErrorName ZDICT_isError ZDICT_optimizeTrainFromBuffer_cover ZDICT_optimizeTrainFromBuffer_fastCover ZDICT_trainFromBuffer ZDICT_trainFromBuffer_cover ZDICT_trainFromBuffer_fastCover ZDICT_trainFromBuffer_legacy ZSTD_CCtxParams_getParameter ZSTD_CCtxParams_init ZSTD_CCtxParams_init_advanced ZSTD_CCtxParams_reset ZSTD_CCtxParams_setParameter ZSTD_CCtx_getParameter ZSTD_CCtx_loadDictionary ZSTD_CCtx_loadDictionary_advanced ZSTD_CCtx_loadDictionary_byReference ZSTD_CCtx_refCDict ZSTD_CCtx_refPrefix ZSTD_CCtx_refPrefix_advanced ZSTD_CCtx_reset ZSTD_CCtx_setParameter ZSTD_CCtx_setParametersUsingCCtxParams ZSTD_CCtx_setPledgedSrcSize ZSTD_CStreamInSize ZSTD_CStreamOutSize ZSTD_DCtx_loadDictionary ZSTD_DCtx_loadDictionary_advanced ZSTD_DCtx_loadDictionary_byReference ZSTD_DCtx_refDDict ZSTD_DCtx_refPrefix ZSTD_DCtx_refPrefix_advanced ZSTD_DCtx_reset ZSTD_DCtx_setFormat ZSTD_DCtx_setMaxWindowSize ZSTD_DCtx_setParameter ZSTD_DStreamInSize ZSTD_DStreamOutSize ZSTD_adjustCParams ZSTD_cParam_getBounds ZSTD_checkCParams ZSTD_compress ZSTD_compress2 ZSTD_compressBegin ZSTD_compressBegin_advanced ZSTD_compressBegin_usingCDict ZSTD_compressBegin_usingCDict_advanced ZSTD_compressBegin_usingDict ZSTD_compressBlock ZSTD_compressBound ZSTD_compressCCtx ZSTD_compressContinue ZSTD_compressEnd ZSTD_compressStream ZSTD_compressStream2 ZSTD_compressStream2_simpleArgs ZSTD_compress_advanced ZSTD_compress_usingCDict ZSTD_compress_usingCDict_advanced ZSTD_compress_usingDict ZSTD_copyCCtx ZSTD_copyDCtx ZSTD_createCCtx ZSTD_createCCtxParams ZSTD_createCCtx_advanced ZSTD_createCDict ZSTD_createCDict_advanced ZSTD_createCDict_byReference ZSTD_createCStream ZSTD_createCStream_advanced ZSTD_createDCtx ZSTD_createDCtx_advanced ZSTD_createDDict ZSTD_createDDict_advanced ZSTD_createDDict_byReference ZSTD_createDStream ZSTD_createDStream_advanced ZSTD_dParam_getBounds ZSTD_decodingBufferSize_min ZSTD_decompress ZSTD_decompressBegin ZSTD_decompressBegin_usingDDict ZSTD_decompressBegin_usingDict ZSTD_decompressBlock ZSTD_decompressBound ZSTD_decompressContinue ZSTD_decompressDCtx ZSTD_decompressStream ZSTD_decompressStream_simpleArgs ZSTD_decompress_usingDDict ZSTD_decompress_usingDict ZSTD_endStream ZSTD_estimateCCtxSize ZSTD_estimateCCtxSize_usingCCtxParams ZSTD_estimateCCtxSize_usingCParams ZSTD_estimateCDictSize ZSTD_estimateCDictSize_advanced ZSTD_estimateCStreamSize ZSTD_estimateCStreamSize_usingCCtxParams ZSTD_estimateCStreamSize_usingCParams ZSTD_estimateDCtxSize ZSTD_estimateDDictSize ZSTD_estimateDStreamSize ZSTD_estimateDStreamSize_fromFrame ZSTD_findDecompressedSize ZSTD_findFrameCompressedSize ZSTD_flushStream ZSTD_frameHeaderSize ZSTD_freeCCtx ZSTD_freeCCtxParams ZSTD_freeCDict ZSTD_freeCStream ZSTD_freeDCtx ZSTD_freeDDict ZSTD_freeDStream ZSTD_getBlockSize ZSTD_getCParams ZSTD_getDecompressedSize ZSTD_getDictID_fromDDict ZSTD_getDictID_fromDict ZSTD_getDictID_fromFrame ZSTD_getErrorCode ZSTD_getErrorName ZSTD_getErrorString ZSTD_getFrameContentSize ZSTD_getFrameHeader ZSTD_getFrameHeader_advanced ZSTD_getFrameProgression ZSTD_getParams ZSTD_getSequences ZSTD_initCStream ZSTD_initCStream_advanced ZSTD_initCStream_srcSize ZSTD_initCStream_usingCDict ZSTD_initCStream_usingCDict_advanced ZSTD_initCStream_usingDict ZSTD_initDStream ZSTD_initDStream_usingDDict ZSTD_initDStream_usingDict ZSTD_initStaticCCtx ZSTD_initStaticCDict ZSTD_initStaticCStream ZSTD_initStaticDCtx ZSTD_initStaticDDict ZSTD_initStaticDStream ZSTD_insertBlock ZSTD_isError ZSTD_isFrame ZSTD_maxCLevel ZSTD_minCLevel ZSTD_nextInputType ZSTD_nextSrcSizeToDecompress ZSTD_resetCStream ZSTD_resetDStream ZSTD_sizeof_CCtx ZSTD_sizeof_CDict ZSTD_sizeof_CStream ZSTD_sizeof_DCtx ZSTD_sizeof_DDict ZSTD_sizeof_DStream ZSTD_toFlushNow ZSTD_versionNumber ZSTD_versionString

Name

.text

Size

725KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

956B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DocuSign-DocuSign_o_backup_v8.3.0.85_oid56f276e1-bc4c-4284-a5ee-24c354e20059_fidBstz7oUXMUmco%21SuD2Kl4A.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsArray.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsJSON.dll

wininet

kernel32

user32

generic

$PLUGINSDIR/processwork.dll

generic

$TEMP/$R0

mscoree

dotnet

$TEMP/$_65_

mscoree

dotnet

$_34_

PE Signature issue

mscoree

dotnet

$_34_.config

CBBackupPlan.exe

PE Signature issue

mscoree

dotnet