AVEVA PROII Simulation 2022 x64.7z
- SHA256 abe6ee58809430c655532be827752747d190a3137c117249b62aacc22d1f3880
Overview
overview
8Static
static
5AVEVA PROI...64.dll
windows10-2004-x64
5AVEVA PROI...64.dll
windows11-21h2-x64
5AVEVA PROI...on.dll
windows10-2004-x64
1AVEVA PROI...on.dll
windows11-21h2-x64
1AVEVA PROI...22.msi
windows10-2004-x64
8AVEVA PROI...22.msi
windows11-21h2-x64
8AVEVA PROI...ed.pdf
windows10-2004-x64
3AVEVA PROI...ed.pdf
windows11-21h2-x64
3AVEVA PROI...NU.exe
windows10-2004-x64
4AVEVA PROI...NU.exe
windows11-21h2-x64
4AVEVA PROI...64.exe
windows10-2004-x64
4AVEVA PROI...64.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
4AVEVA PROI...86.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
AVEVA PROI...86.exe
windows11-21h2-x64
AVEVA PROI...64.exe
windows10-2004-x64
7AVEVA PROI...64.exe
windows11-21h2-x64
7AVEVA PROI...86.exe
windows10-2004-x64
7AVEVA PROI...86.exe
windows11-21h2-x64
7AVEVA PROI...64.exe
windows10-2004-x64
4AVEVA PROI...64.exe
windows11-21h2-x64
4AVEVA PROI...86.exe
windows10-2004-x64
4AVEVA PROI...86.exe
windows11-21h2-x64
4AVEVA PROI...es.pdf
windows10-2004-x64
3AVEVA PROI...es.pdf
windows11-21h2-x64
3AVEVA PROI...up.exe
windows10-2004-x64
5AVEVA PROI...up.exe
windows11-21h2-x64
4AVEVA PROI...de.pdf
windows10-2004-x64
3AVEVA PROI...de.pdf
windows11-21h2-x64
3AVEVA PROI...EN.msi
windows10-2004-x64
6AVEVA PROI...EN.msi
windows11-21h2-x64
6Behavioral task
behavioral1
Sample
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
AVEVA PROII Simulation 2022 x64/Crack/version.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
AVEVA PROII Simulation 2022 x64/Crack/version.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral6
Sample
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
Resource
win11-20260130-en
windows11-21h2-x64
25 signatures
150 seconds
Behavioral task
behavioral7
Sample
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral11
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
Resource
win11-20250619-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral18
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral21
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
Resource
win11-20260130-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral28
Sample
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral29
Sample
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral30
Sample
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
Behavioral task
behavioral31
Sample
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral32
Sample
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target AVEVA PROII Simulation 2022 x64.7z
- Size 646.9MB
- Sample260506-bzsnlag16w
- SHA256 abe6ee58809430c655532be827752747d190a3137c117249b62aacc22d1f3880
- MD5 5574f69bd1f472135fb6ae8cb057c36d
- SHA1 d550d2603ea6b926e9c91e358b4e1072fa3349d0
- SHA512 570980b0ded0e7f3708c22c59ed3e7e95f44c48ad7abd5e28ff4a1599a894b152fcbc6bbd8c878e077027ee6b45666aaaa94a7c48db20bf73c9763448a2c9504
- SSDEEP 12582912:gkadyEm96LHUmKv8sFYMEscqDJtvuh1s9+/tUufvD:nInLHUFBisccPaC9q7fb
- TLSH T14A6933A8986F17368059EA30F64229155849B97A145CCC94FF24EF34DFBB6C338F25CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi - Malformed data in PDF
A PDF can contain malformed data to evade detection
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NOTEPAD/npp.7.8.4.Installer.exe - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll unpack001/AVEVA PROII Simulation 2022 x64/Crack/version.dll unpack005/$PLUGINSDIR/InstallOptions.dll unpack005/$PLUGINSDIR/System.dll unpack005/$PLUGINSDIR/nsDialogs.dll - Untrusted Codesign Signers 5 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe unpack001/AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe unpack001/AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe unpack001/AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/DiscoveryServer/setup.exe unpack001/AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/USB_Driver/Sentinel Protection Installer 7.6.8.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NIST/RefPropAddonSetup.exe innosetup
File Explorer
-
AVEVA PROII Simulation 2022 x64.7z.7z 646.9MB
-
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll.dll 1.2MB
-
AVEVA PROII Simulation 2022 x64/Crack/Readme.txt299B
-
AVEVA PROII Simulation 2022 x64/Crack/version.dll.dll 59KB
-
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi.msi 492.2MB
-
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf.pdf 5.0MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe.exe 80.1MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe.exe 24.1MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe.exe 13.1MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe.exe 4.3MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe.exe 5.4MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe.exe 4.8MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe.exe 6.9MB
-
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe.exe 6.2MB
-
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf.pdf 1.3MB
-
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe.exe 400KB
-
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf.pdf 567KB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi.msi 984KB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN64.msi.msi 984KB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/DiscoveryServer/OPC UA SDK 1.01 Local Discovery Server Setup.msi.msi 7.5MB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/DiscoveryServer/setup.exe.exe 475KB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NIST/RefPropAddonSetup.exe.exe 3.5MB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NOTEPAD/npp.7.8.4.Installer.exe.exe 3.6MB
-
$PLUGINSDIR/InstallOptions.dll.dll 15KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp150KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/USB_Driver/Sentinel Protection Installer 7.6.8.exe.exe 8.6MB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/VSTO4.0/vstor40_x64.exe.exe 2.6MB
-
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/VSTO4.0/vstor40_x86.exe.exe 2.3MB
-
AVEVA PROII Simulation 2022 x64/Setup/listofCommits.txt108B
AVEVA PROII Simulation 2022 x64/Crack/PYG64.dll
- IMPHASH 5e302aa4599d5db4ce09507f732f8def
- SHA256 2a58e9d0f41a5a043f146b079ab255d8954a8ecf0102de682cb1eceaa1424588
- MD5 e58a2e9c26b86954ce6e96a7f9e44989
- SHA1 d60cbbf0a288ee66b55508e7e374f705df38f9e5
- SHA512 6debeb92a97a238a8eed844d262b3027f3fd9fcd7fcfafc932e7ceff28e70fb1ad286764b37159b1a62fb5f645337e5bf32068fb926ce35512292919122e6b66
- SSDEEP 24576:6YPvPiECnLGEuDSOm6MUi/C1BUfUlxabtRRcG41kphEZ5GP48iv/fHoB8VD:6Y6iBSTaTlxGty18WD8awaD
- TLSH T15245226CACB52C52E32080FAF534E4607864C989E7A552DF1ECA3F94BF8B9F25D75081
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4209684
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\NsStudy\Home\Baymax\trunk\PatchUi\res\x64\PYG64.pdb
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
advapi32
RegDeleteValueW
shell32
ShellExecuteW
ole32
CoCreateInstance
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecW
version
VerQueryValueW
gdi32
ExtSelectClipRgn
ChinaPYG
e�[&#�C+�ҧc�y����ڒ�i�@~6�sg��*)f|�0J�H��3�i�ҙ;4-s D��ӷ��m9I�|���V�j��b�s����p��_�{�+օ˾��� �-!D��w����V�n�����1���BNֻ�-37��u@�ׂq'�]�N��ց����-����H���y > ��b`P�BK�t�O6κ�A3�rl��2r?R��
�����A0� a��!�d����22T�D�e���)�ݪ
�SIU�� ���TD9X��-D /t�!���"��H�����QxzƮ]A�>J0Svn>���5���� CV�B��ƻ�!��ll��g��4L A `k�T����Hԇ���9���6�o����A��T4��8Ktac¥�,�P�����W�N�|�Ƒ�/i�)����]�� ��t-�D((\T�9D�r~�3�\�X�Ժ�����0X�\�I�9�Գ����@T��J�O�( O��KȾ��Ep�+0O)JmRI��� �0�2��gh<Q������7M���;-�Jr��_S����PY�i�d�_��3w<�N ��~� �AId�Z,���/��18���p,����6h��A9�Z�I8c��y�W�&�(z�3&�5�z:92�zK�Q�)Q2C�N np�rR��]�=�h³]vc;���^(���q������b������HxPq��L��Gy���%��vR�܇�"�}��gM��u�S��f��QC��^w�FȽ~ʦ������9�$J� ��v���cQ��~�w�������w�bKMЩ�6d b�\$���1C �ο�V?ݞhm0�rQl3�'��+2[=��홗T+�ei}�^���ҡ�J�|��'�z1����Q� 0��s��ct�-w}��o?
^� ��� ���RI�� D�i !��"��K��o�ݝ-�ijfMRt%����Y�v�X��D��'ay^-a��&�A��c���|���={ݛ�<>fϦ�.�5���fF��ՠ+1�7�E3�����>ym[��"k�E�6� ���6'��m�e"�?�|T N�D�H�p��T��@�������h�+l�a��C�SD *�5Q� ��vHg�F���6ϦwQ�8qc�̔�����oe�=
�vDh�ߊL����sg��`�43�y��fR|~��E�87yZr '`\��.��3l��]��1�p��&����UO�+�����R���V���f ۾#QR����"�R_� ��jo������bU�� ��x�� NY�J����Z>� @�o����PSH>�'/c��u���(��y=���K ���n�z���튮J/�Z��\a��dT� {����Ӳ:NYJ�}��p�ؿ���LoBfW�zp#��Rn��yg������\p�O�"�U�3��B��[�-��b�G�\�A���l��>�[O��Ld �����K�uɝm���g��-]�Ȧ�.�u�G֙���z��"�s?�X���Qȧ�|\�\��E�Y�����9A҃'p^��Ot�{ 5�T�}���&-0��[���d}
�0[}ܴ����Ó2"a8Y�5�o����]ƈ�f����:#k|�
�\���Mr�oЮ��0 �y Js=֚K��v�� ���5�S�#[�-�S���� �l����=l������>��KohU���������`������s?���6Ω ���^� 4��3�5�B��-��O�k��%bT�<�'�E
�Lx�B��!����M@��"��Ʒhr��َ��������?<��D�`S6����g��ى���*c��\��7�g��l;�h�����-�S����Ԅm|��p�5���)_���(Z�ǬO�[.Ke(G��|r�
/��u����B��a�����YK�pN:���v�SY��벺P��Bx���N��>��8�YՀ����E��=�0��#/H��ʘ���i����R0�T>4E�q��$�=8�����vq 0S�� u:�� ���TDU��'7hD��Y��Z����w��{� W�d�j�{�3%Cםݴ�!�O!�@^l����LC
�wݑ�gţ�����_2NT � g�M;b*����2�c?W~�!���6�(��"�Ɣ]N�i�?����)�� O�$~�e��P�� wX��D@A.��g�ɝ,���m]"� U�q�q- ]��֖����M0�'�� �[��]sq���A��[.
� D� ������]�C`��Lխ��^���Z
�CC��ZF�Y�'aG���!��*��Ҩ� �A����VM)Y]�+����
v�9k�^RwN�d��|�Kq���q]��t�F�0����V5��]��8�
D�.8{35:�\F1[�+RF2;�$�H�b(�A �#�ZjO=<��|�8������[����.>�?
m�V�Z�g9��o��J|�$�#O;���/|�[���ց����� Z���C���$=Vg�T�� �MF�n�4>�ݿ�>����W�H�&�d'��<�K���瑋�
>X�1O�o=Ⱥ7��y��ݩ~Rw8�] ���L���~h��a�;?�?��@����1BW \xo�j]g��~��sSY��n�KK�ξ�t?�2�j$8/�.��}EE^�I|�"����Ee��! � rV��0 ef��v/�g_n2UO+e��
����x1��O�TW+>��&r�+����e���OJ�ۂd�yIfƗ<��zUf�̍�� 9\��i1B��7���M��娰 H� uzJ'�z��� � �ǀ����WLK����^O��\<TE��`�O¤ ��2 b!���cfK���5��Vf�)BZ���& _m� !b��ka����_=�Y���w��Y����B ��;DF�-��� �q�9_��*��K���� ���EU%�� ��~��VS�b�J'���y|B;Ɛ��[:�/�eq �����w� vo�5��V@�N�� ����H��-�߫�!��n��켬Ǿ����O�q��54��<2�#�_INsn�N���߳}Q)��
Ucݹ
̝�������.n�}�f�|�w�LWD߉q�9���˷�db�XZ.h�w97���'���o�iP�B��$��1" �󠅈i��
Name
.text
Size
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.Baymax0
Size
Virtual Size
764KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Baymax1
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.BaymaxN
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=150, version=20413,
count=80, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=201, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=251, id=1, productName=Unmarked objects,
count=52, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
AVEVA PROII Simulation 2022 x64/Crack/Readme.txt
- SHA256 1aab59e6e382089081addfc5ca33ddcb4526af6a52f76f2d50b503b214d74e61
- MD5 a665e899e2b5d815cb9c1f56c6ffacf1
- SHA1 13d337b486c92eaa8d176b61222b05d196065fa3
- SHA512 0608b2628995825f84aa8f8140446670c4c25e7a8fbc3c78c5285bdf391298f6d379ef0629a7bb09986adfd35e364e2571ada37b918cf22ad5656b4dc9eea637
- TLSH T175E0EB8A318ED3FAF9803145D87AC841724EC7C9441A301B7CEF52CC28383F700292C2
- MD5 SHA1 SHA512 TLSH
AVEVA PROII Simulation 2022 x64/Crack/version.dll
- IMPHASH 8b990a02d9eff7bd4479034e75c91c23
- SHA256 0e8aa99dcc3bd5ea08c4a9f3cfd4e460484403a9400f37d3fe484e11a0cd4598
- MD5 84909c57d52ec9e427972f0f4c3286fa
- SHA1 cd3e5bac9f4126b4b6e22d4e2136e66d74c4f959
- SHA512 1ad1e87b9467a9888144c0be1dffab3942d1fb0c87a9487a1d98fa3e0e44238f2a024b85d18e444d3c56fee20bc9ce4415db32e2aa400a010558def6d4f48fab
- SSDEEP 1536:aNU3jYEZ1kFqP9v8zdQIg3AyKzcIi5x/od5wmckVPxIiTPmckVPxIiT6tKTT:a2haqPZ8kog5bod53ckVPxIiTeckVPx/
- TLSH T1B2537C9DB35400B9E4978278C8F31F46F672F80A17B9438F5768C2695F333A1663A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
6792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d:\NsStudio\Tools\Baymax64\InjectDllx64\bin\version.pdb
kernel32
DisableThreadLibraryCalls
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetCommandLineW
GetTickCount
Sleep
ExitProcess
CreateThread
GetModuleFileNameW
LoadLibraryW
OutputDebugStringW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapSize
GetModuleHandleW
RtlUnwindEx
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapReAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
shlwapi
SHGetValueW
PathRemoveFileSpecW
user32
FindWindowW
RegisterWindowMessageW
SendMessageW
shell32
CommandLineToArgvW
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=92, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=98, id=1, productName=Unmarked objects,
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
AVEVA PROII Simulation 2022 x64/Setup/AVEVAPROIISimulation2022.msi
- SHA256 3ced877f32ab56749e254110e7f5100dc6273a4ed3cdfff18567c485c007f9ed
- MD5 33efe73b09830af8c87594db9a4c691c
- SHA1 724d55297524a20916c80dd239554dd14de84f4e
- SHA512 31104eb61aeaa8d7576a16732d35e826cfec6a6068c88934ff82748c260df57c0ce8d91ee466b788d4f609ef5c943b8f0bfd2bec66ef63f8565ba2427915faf9
- SSDEEP 12582912:+qve8E3PV8xKgJubFMg5+yrc3e9+vUxZNEE:pj+V80gOn639vQNr
- TLSH T1873933B07501CEA1C425B132D41872FF78206C1AF2108E976AE67FAB79F67C13AF4566
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
File Signature issue
Digest
b235d1876b21828d7416c05cd07c06282585170b464bbe6be9373d505c0e01fd
Digest Algorithm
sha256
Digest Matches
Not matched
Trusted
Prehash
Signing Certificate
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Chains
Jun 27, 2022
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Serial Number
0f:ba:08:86:5e:75:db:05:bf:78:5a:bd:96:ee:7b:46
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 3, 2021 - Sep 3, 2022
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
AVEVA PROII Simulation 2022 x64/Setup/Getting Started.pdf
- SHA256 6ec474e946f433589d90476a045ceb459beef6690d058e599995a90fc7490252
- MD5 ddedea57e049bb9f71995fee6202814e
- SHA1 01f8b153c83ee3cf838f263cf8ca25d976283234
- SHA512 b55c09fdb7a815b4f3bcea30aaab8de53d134280322ea42a511a516f59604fb082ff670a2da1a57447115b2366c51e2e4a37f97fb5735ef3a48e72820ee3006d
- SSDEEP 49152:b4OsZ5ynIWKNGC3EAKGboXYZC3owDimuruzoJrrW3a55UA9t1qfAHkvSR3+D/T22:bbQ5yIh0s8zWrWrAzMjvFD/TbKTC/
- TLSH T10E360138F3C3DB54CB0B813DA67C3D77639591E080C8995B668B4D897A81FB262532BD
- MD5 SHA1 SHA512 SSDEEP TLSH
AVEVA PROII Simulation 2022 x64/Setup/Microsoft .NET Framework 4.7.2 Setup/NDP472-KB4054530-x86-x64-AllOS-ENU.exe
- IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
- SHA256 c908f0a5bea4be282e35acba307d0061b71b8b66ca9894943d3cbb53cad019bc
- MD5 87450cfa175585b23a76bbd7052ee66b
- SHA1 31fc0d305a6f651c9e892c98eb10997ae885eb1e
- SHA512 36f295ed19a5bd5c5f05803ba26efd17d419abc7a791312ad011b63a4402492529aed0fb4d45ff1f74381079a310b33649c9c56c36e815b12e79ecd671897489
- SSDEEP 1572864:u6orjEvPz1cXD4hALCo8UXvOLKNnlv/iMqHzi8uGP0pBayi/7Js74etMyWUSS4g2:Z6jEpcXAo8UXvOuiMPNGsLE7Ji4SMlR
- TLSH T13D0833A66EF29671F1B324355570A8302523CEF22539E9CFC78A2C2CFD768C17572992
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3d:4e:35:65:d0:9f:8d:b6:c1:c1:51:ab:95:0a:cb:d8:0f:c4:ff:41:b0:e3:8d:59:9f:cd:b8:1c:05:66:b4:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 7, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
fc:3d:af:15:28:b5:1c:f5:0f:ae:1d:fa:37:f5:a3:a1:2d:6e:92:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 7, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a0:1a:98:78:3e:66:d8:aa:d7:00:00:00:00:00:a0
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
5
Entry point
102119
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb
advapi32
CreateWellKnownSid
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DecryptFileW
kernel32
GetTickCount
SetEnvironmentVariableW
GetLastError
ExpandEnvironmentStringsW
CreateProcessW
Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventW
GetEnvironmentVariableW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetCommandLineW
lstrlenW
CompareStringW
LocalFree
CreateDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
RemoveDirectoryW
MoveFileExW
GetProcAddress
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleW
CreateThread
LocalAlloc
RaiseException
ExitThread
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
GetVersionExA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
SetFilePointerEx
GlobalFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
FreeLibrary
InterlockedExchange
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
GlobalAlloc
LoadLibraryA
comctl32
ord17
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
shell32
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
shlwapi
PathRemoveExtensionW
user32
MessageBoxW
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageW
PostMessageW
DialogBoxParamW
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
LoadStringW
SetWindowLongW
GetWindowLongW
CharUpperW
oleaut32
SysAllocString
VariantClear
?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4
Name
.text
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.boxld01
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=206, version=65501,
count=46, id=171, productName=VS2010 build 30319, version=30319,
count=20, id=158, productName=VS2010 build 30319, version=30319,
count=105, id=170, productName=VS2010 build 30319, version=30319,
count=17, id=203, version=65501,
count=199, id=1, productName=Unmarked objects,
count=70, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x64.Runtime/vc_redist.x64.exe
- IMPHASH 1a5cdbf711fee14b077e599d13fddab2
- SHA256 5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
- MD5 0c86174ca06d892881301203cdf2c32d
- SHA1 2b7462bb7732725f011a085349d6d206eed40048
- SHA512 16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
- SSDEEP 786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
- TLSH T1E2473372A528413EC7B20577ED59F5202E6CA424331489BBE3DCDDAE6BB809162F7317
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:7d:72:56:c5:db:b7:e4:36:34:75:f2:84:bf:96:49:49:29:40:8b:d0:a2:2a:12:21:c3:24:e5:69:22:75:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 6, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:AE2C-E32B-1AFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:48:a2:88:45:56:bc:2f:80:bf:00:00:00:00:01:48
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
1
Major OS version
5
Entry point
188525
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\8\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
GetMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
TranslateMessage
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
CreateCompatibleDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
DeleteDC
shell32
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineW
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetEnvironmentStringsW
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetComputerNameW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
IsValidCodePage
FreeEnvironmentStringsW
TlsAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
SetCurrentDirectoryW
FindFirstFileExW
GetFileType
GetACP
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
SetLastError
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft..2015-2022.C++x86.Runtime/vc_redist.x86.exe
- IMPHASH 1a5cdbf711fee14b077e599d13fddab2
- SHA256 f02dea65ea65633d1718e6c5e5eee7d2df640d1fff332e4669dea530b8c4f0e7
- MD5 031dcfcaab554acd9a6d0ad252426411
- SHA1 23d7d69c27dc2781bb44b60359d9850e7bd73bb5
- SHA512 d6ae156cf6bab6aee72be07b4c752bdea78306d61dbdc54dde7f2e7e1ab0a94b408016d96336b626324b001b4cebd545bce7d9b997ad991f3aa1dee31a8327ca
- SSDEEP 393216:VwHQlptVYmfr7yBG/4U3J4CMxh6tLEuodNWvB:VCspttD7yBG/d367FKvB
- TLSH T179D63332A558003ADBF71873EA64F9241E79E528530449FBE3C8ED5E6E7804227FB752
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:ed:02:a5:a8:43:bb:32:d1:12:09:6c:a0:83:6e:9b:17:3c:62:e8:0a:16:86:da:0c:95:78:d2:93:bb:55:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 6, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:8c:01:97:62:47:36:76:66:3b:00:01:00:00:01:8c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
1
Major OS version
5
Entry point
188525
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\8\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
RegQueryValueExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DecryptFileW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
GetMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
TranslateMessage
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
CreateCompatibleDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
DeleteDC
shell32
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
CloseHandle
CreateFileW
GetProcAddress
LocalFree
HeapSetInformation
GetLastError
GetModuleHandleW
FormatMessageW
lstrlenA
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
Sleep
GetLocalTime
GetModuleFileNameW
ExpandEnvironmentStringsW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
GetFullPathNameW
CompareStringW
GetCurrentProcessId
WriteFile
SetFilePointer
LoadLibraryW
GetSystemDirectoryW
CreateFileA
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FindClose
GetCommandLineW
GetCurrentDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetEnvironmentStringsW
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetNativeSystemInfo
GetModuleHandleExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetComputerNameW
VerifyVersionInfoW
GetVolumePathNameW
GetDateFormatW
GetSystemDefaultLangID
GetUserDefaultLangID
GetStringTypeW
ReadFile
SetFilePointerEx
DuplicateHandle
InterlockedExchange
InterlockedCompareExchange
CreateEventW
ProcessIdToSessionId
OpenProcess
GetProcessId
WaitForSingleObject
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
InterlockedIncrement
InterlockedDecrement
ResetEvent
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
CreateFileMappingW
GetThreadLocale
IsValidCodePage
FreeEnvironmentStringsW
TlsAlloc
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
GetModuleHandleA
GlobalAlloc
GlobalFree
GetFileSizeEx
CopyFileW
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
SetCurrentDirectoryW
FindFirstFileExW
GetFileType
GetACP
ExitProcess
GetStdHandle
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
SetLastError
LoadLibraryExA
rpcrt4
UuidCreate
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2008.C++.Runtime/vcredist_x86.exe
- IMPHASH 092eb6daba2f17cbda102fd1a32acd00
- SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
- MD5 35da2bf2befd998980a495b6f4f55e60
- SHA1 470640aa4bb7db8e69196b5edb0010933569e98d
- SHA512 bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
- SSDEEP 98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
- TLSH T1982633EE1E32462AD70B42B2E4352783D578F0A68C7B8DD79D93553EE1E3266FA10046
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
d0:b8:36:c9:ae:3b:cb:20:6d:59:26:4f:5f:9c:95:6f:4b:15:75:3a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:b2:9b:00:00:00:00:00:15
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 21, 2011 - May 21, 2012
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
2
Major OS version
5
Entry point
22898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
kernel32
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
SetEvent
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
GetVersionExA
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
CreateFileA
FindNextFileA
FindFirstFileA
CopyFileA
SetFileAttributesA
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceA
QueryDosDeviceA
GetCurrentDirectoryA
SetEndOfFile
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetExitCodeProcess
CreateProcessA
ExpandEnvironmentStringsA
GetFileSize
CreateThread
CreateEventA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
CloseHandle
DeviceIoControl
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
SetErrorMode
GetTickCount
CreateDirectoryA
GetLastError
RemoveDirectoryA
MoveFileExA
SetFilePointer
FindClose
ReadFile
msvcrt
strchr
_strnicmp
_stricmp
strrchr
_strlwr
strncpy
strstr
_snprintf
sprintf
advapi32
AllocateAndInitializeSid
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
user32
ShowWindow
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
LoadStringA
EndDialog
SetParent
MessageBoxA
ntdll
NtShutdownSystem
NtAdjustPrivilegesToken
NtClose
NtOpenProcessToken
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.2MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=93, version=2179,
count=107, id=1, productName=Unmarked objects,
count=20, id=95, version=2190,
count=1, id=94, version=2179,
count=1, id=90, version=2179,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x64.Runtime/vcredist_x64.exe
- IMPHASH a1f6f100bff4507a3332f3f0cdfc24f5
- SHA256 c6cd2d3f0b11dc2a604ffdc4dd97861a83b77e21709ba71b962a47759c93f4c8
- MD5 cbe0b05c11d5d523c2af997d737c137b
- SHA1 027d0c2749ec5eb21b031f46aee14c905206f482
- SHA512 75280d721550c2fa19b4f8d42b87d2fc6017f42709d84d2162c7330f7a0338bbd72cdc3f78626b10edcc602e2d22b174039254824334b3173d0ea48b3c06d1df
- SSDEEP 98304:hsPj6quMcylIpk4nM6tmMUrfvEP0hcKju9Z/lTPU8UBHBKNpr1w36ZyY:+PjzDJ4M6tmXDsPKi1lTPmHipJwqL
- TLSH T1E24633B8E0119B3DEED925F4677F14E74228D1A0D20371C76BD8B1CE6EBF289B25A540
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7e:e6:b3:26:a0:5b:83:d2:4a:74:47:94:80:1b:e6:8c:ef:59:05:96
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 20, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
2
Major OS version
5
Entry point
25599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
sfxcab.pdb
msvcrt
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf
advapi32
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
kernel32
CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime
user32
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5.4MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2010.C++x86.Runtime/vcredist_x86.exe
- IMPHASH a1f6f100bff4507a3332f3f0cdfc24f5
- SHA256 66b797b3b4f99488f53c2b676610dfe9868984c779536891a8d8f73ee214bc4b
- MD5 cede02d7af62449a2c38c49abecc0cd3
- SHA1 b84b83a8a6741a17bfb5f3578b983c1de512589d
- SHA512 d2d99e06d49a5990b449cf31d82a33104a6b45164e76fbeb34c43d10bcd25c3622af52e59a2d4b7f5f45f83c3ba4d23cf1a5fc0c03b3606f42426988e63a9770
- SSDEEP 98304:TsPj6quMBYyuSFOMKykvYgS/ylTpHufHMpPbOZ39c7T3eeom2vJtPShg:wPjzayuSgMKykQgSaTkvMxEYT3OfPShg
- TLSH T1FC3633A46437D2F2C8462DB0EFAA5F416CFD48B00684A6D877EC41D876DBAE244F7361
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
5f:c8:53:53:4b:f3:8d:17:29:22:b7:77:39:d5:7a:e2:70:d6:a5:b8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 20, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:06:94:2d:00:00:00:00:00:09
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
2
Major OS version
5
Entry point
25599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
sfxcab.pdb
msvcrt
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf
advapi32
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
kernel32
CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime
user32
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4.7MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x64.Runtime/vcredist_x64.exe
- IMPHASH dcbe94b8cc54b8e53867c61cc96811d6
- SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
- MD5 96b61b8e069832e6b809f24ea74567ba
- SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
- SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12
- SSDEEP 196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
- TLSH T131763331E7B05023D6F201B2E411D528BD3DB2291F109CAAD794DD2D3AA9AD6E7F7213
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Digest
2b:f8:ab:c0:0e:bd:66:17:f3:88:d4:c2:ed:ee:9e:c8:b7:72:a3:88:31:d9:3b:3b:8f:74:9b:40:1e:cc:4a:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 1, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9f:b7:ab:91:35:d2:5f:20:d4:e3:b8:4e:41:38:9b:0b:57:4d:91:b9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 1, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2d:25:81:14:5f:a2:d5:f2:d3:00:00:00:00:00:2d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
1
Major OS version
5
Entry point
163358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\delivery\Dev\wix37\build\ship\x86\burn.pdb
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
QueryServiceConfigW
user32
GetMessageW
PeekMessageW
PostMessageW
PostThreadMessageW
PostQuitMessage
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
IsDialogMessageW
MessageBoxW
GetWindowLongW
RegisterClassW
IsWindow
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
LoadBitmapW
GetCursorPos
MonitorFromPoint
CreateWindowExW
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
DeleteDC
StretchBlt
shell32
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
ole32
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
CoCreateInstance
CoInitialize
StringFromGUID2
CoInitializeEx
CoUninitialize
kernel32
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
RtlUnwind
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
DuplicateHandle
SetThreadExecutionState
CopyFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
CompareStringA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetVersionExW
GetCurrentThreadId
TlsAlloc
TlsSetValue
ReleaseMutex
GetLastError
Sleep
TlsGetValue
CloseHandle
DeleteCriticalSection
GetTimeZoneInformation
GetACP
GetCPInfo
RaiseException
HeapAlloc
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
GlobalFree
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsFree
InitializeCriticalSection
GetCurrentProcess
HeapSetInformation
GetOEMCP
SetFileAttributesW
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
FormatMessageW
GetTempFileNameW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap
GetModuleHandleA
GetFileSizeEx
GetUserDefaultLangID
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
MoveFileExW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
CopyFileW
cabinet
ord23
ord22
ord20
crypt32
CryptHashPublicKeyInfo
CertGetCertificateContextProperty
msi
ord116
ord17
ord125
ord171
ord8
ord115
ord118
ord205
ord45
ord137
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
rpcrt4
UuidCreate
wininet
InternetCrackUrlW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetConnectW
InternetOpenW
wintrust
CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=101, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=322, id=1, productName=Unmarked objects,
count=103, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AVEVA PROII Simulation 2022 x64/Setup/Microsoft.2013.C++x86.Runtime/vcredist_x86.exe
- IMPHASH dcbe94b8cc54b8e53867c61cc96811d6
- SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
- MD5 0fc525b6b7b96a87523daa7a0013c69d
- SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
- SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
- SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
- TLSH T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Digest
3f:c4:25:81:d5:e9:9a:60:b6:34:e2:5c:4c:27:94:7c:7d:b2:b0:62:45:49:72:9f:27:6e:3a:f5:b9:e7:7f:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 1, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
85:c8:56:1b:b1:ff:1a:0a:28:75:4d:7c:00:d4:94:b5:a4:ea:82:68
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 1, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 22, 2014 - Jul 22, 2015
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 24, 2013 - Dec 24, 2014
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:72:aa:2e:f6:49:bb:ec:d7:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2013 - Jun 27, 2014
Minor OS version
1
Major OS version
5
Entry point
163358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\delivery\Dev\wix37\build\ship\x86\burn.pdb
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
GetUserNameW
InitiateSystemShutdownExW
CreateWellKnownSid
InitializeAcl
SetEntriesInAclW
DecryptFileW
ChangeServiceConfigW
ControlService
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
SetEntriesInAclA
SetSecurityDescriptorGroup
RegOpenKeyExW
GetTokenInformation
CheckTokenMembership
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
SetNamedSecurityInfoW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
QueryServiceConfigW
user32
GetMessageW
PeekMessageW
PostMessageW
PostThreadMessageW
PostQuitMessage
SetWindowLongW
DefWindowProcW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
IsDialogMessageW
MessageBoxW
GetWindowLongW
RegisterClassW
IsWindow
MsgWaitForMultipleObjects
WaitForInputIdle
LoadCursorW
LoadBitmapW
GetCursorPos
MonitorFromPoint
CreateWindowExW
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
gdi32
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
DeleteDC
StretchBlt
shell32
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
ole32
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
CoCreateInstance
CoInitialize
StringFromGUID2
CoInitializeEx
CoUninitialize
kernel32
ReadFile
SetFilePointerEx
CreateFileW
GetCurrentProcessId
GetProcessId
WriteFile
ConnectNamedPipe
SetNamedPipeHandleState
lstrlenW
CompareStringW
LocalFree
CreateNamedPipeW
WaitForSingleObject
OpenProcess
lstrlenA
RemoveDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
VerifyVersionInfoW
VerSetConditionMask
GetComputerNameW
GetTempPathW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetVolumePathNameW
GetWindowsDirectoryW
GetSystemDefaultLangID
RtlUnwind
GetDateFormatW
GetSystemTime
InterlockedExchange
LoadLibraryW
InterlockedCompareExchange
GetExitCodeThread
CreateThread
SetEvent
WaitForMultipleObjects
CreateEventW
ProcessIdToSessionId
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
CreateProcessW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetExitCodeProcess
DuplicateHandle
SetThreadExecutionState
CopyFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEndOfFile
ResetEvent
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
CompareStringA
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
DeleteFileW
GetThreadLocale
GetVersionExW
GetCurrentThreadId
TlsAlloc
TlsSetValue
ReleaseMutex
GetLastError
Sleep
TlsGetValue
CloseHandle
DeleteCriticalSection
GetTimeZoneInformation
GetACP
GetCPInfo
RaiseException
HeapAlloc
HeapFree
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GlobalAlloc
GlobalFree
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
TlsFree
InitializeCriticalSection
GetCurrentProcess
HeapSetInformation
GetOEMCP
SetFileAttributesW
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLocalTime
FormatMessageW
GetTempFileNameW
GetFullPathNameW
CreateDirectoryW
GetProcessHeap
GetModuleHandleA
GetFileSizeEx
GetUserDefaultLangID
GetTickCount
QueryPerformanceCounter
HeapCreate
SetLastError
EncodePointer
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
MoveFileExW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
DecodePointer
GetCommandLineW
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
CopyFileW
cabinet
ord23
ord22
ord20
crypt32
CryptHashPublicKeyInfo
CertGetCertificateContextProperty
msi
ord116
ord17
ord125
ord171
ord8
ord115
ord118
ord205
ord45
ord137
ord141
ord238
ord190
ord88
ord90
ord173
ord111
ord70
ord169
rpcrt4
UuidCreate
wininet
InternetCrackUrlW
HttpQueryInfoW
InternetCloseHandle
HttpAddRequestHeadersW
HttpOpenRequestW
InternetErrorDlg
InternetReadFile
HttpSendRequestW
InternetSetOptionW
InternetConnectW
InternetOpenW
wintrust
CryptCATAdminCalcHashFromFileHandle
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WinVerifyTrust
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=101, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=322, id=1, productName=Unmarked objects,
count=103, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AVEVA PROII Simulation 2022 x64/Setup/P2_RelNotes.pdf
- SHA256 fe028ba9c6b0e98034b959967bf9444731fc89ea89bbb7652c397d868a061924
- MD5 5b56cd9b4af4b2581e4c8d4a2f90c9fc
- SHA1 2937bf1556cbeac757bb134c463cb6666b04e8ab
- SHA512 92cbaae9a7262effb19ee8e00e7d979b0ffb70d42a73f1adfacf91c758ee8ca7ee11f6f2c1c5b27382e9687eef52c0a5df809a5ef06d2c5b35973a6b63fcae41
- SSDEEP 24576:leVBWp0IZkpytc9ff5vsWNYXYtSuNvFhXK2juq1O8vLeoHjNw5dtspVT/jl5cbhw:EViv6ytc9FBucSu9XKGI8vLfNw572T/p
- TLSH T1B755232AA382CA08DB3F883CA7BD9D36438991E014D56513758F4DD87790FB222576BF
- MD5 SHA1 SHA512 SSDEEP TLSH
AVEVA PROII Simulation 2022 x64/Setup/Setup.exe
- IMPHASH 784112ee3c1da4bbf1f4ee95a0d306fb
- SHA256 b71f73dbeef844fe695f41961a7c755c7b397b837377e4175e141bd7ce9b5a58
- MD5 c847a2172d271bc8f3220220e0786879
- SHA1 709e85a92bb0f54982dbcd1fc89533a9757d1e7f
- SHA512 cab3351e13961970307f538bc6a725c0ff90e236b363bee2160bffbc1d21720dd0a1c1489dc290e4918fc6eee606213007777a83952c1f605cd14dd149e6ad2f
- SSDEEP 6144:JXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qja/ojDuUls/hwFlT1/p:JYYuUx65QwDMq6TOU6eDuUljB
- TLSH T162944C2226D48031E4E316B45BAD623157BDFC712B3489E756C023DE99B27D2BE3079B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Digest
ca:fc:f8:5c:dc:5e:2c:b9:f3:b0:72:67:7d:e3:db:50:a7:91:94:fa:a8:78:5a:a8:ba:09:80:d1:36:ae:3d:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Chains
Jun 27, 2022
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Serial Number
0f:ba:08:86:5e:75:db:05:bf:78:5a:bd:96:ee:7b:46
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 3, 2021 - Sep 3, 2022
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
5
Entry point
167656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
setup.pdb
kernel32
CreateFileW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
SetFilePointer
HeapSetInformation
CreateEventA
SetEvent
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersionExA
CompareStringA
GetFileAttributesA
GetModuleFileNameA
DeleteFileA
MultiByteToWideChar
GetTempPathA
LocalFree
FormatMessageA
GetTimeFormatA
GetDateFormatA
CreateDirectoryA
CopyFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
GetCurrentProcess
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WideCharToMultiByte
GetEnvironmentVariableA
ReadFile
Sleep
GetDiskFreeSpaceExA
IsValidCodePage
EndUpdateResourceA
DeleteCriticalSection
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MulDiv
lstrlenW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetTickCount
FindFirstFileA
FindNextFileA
GetTempFileNameA
FindClose
GetProcessHeap
UpdateResourceA
BeginUpdateResourceA
LoadLibraryA
lstrlenA
UpdateResourceW
GetTempPathW
GetTempFileNameW
GetSystemDirectoryW
GetModuleFileNameW
GetFileAttributesW
FormatMessageW
FindResourceW
DeleteFileW
CreateDirectoryW
CopyFileW
BeginUpdateResourceW
GetVersion
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetEndOfFile
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
HeapAlloc
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetLastError
GetProcAddress
FreeLibrary
WriteFile
LocalAlloc
InterlockedExchange
RaiseException
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
gdi32
GetStockObject
GetObjectA
EnumFontFamiliesExA
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
GetDeviceCaps
GetObjectW
DeleteDC
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
ole32
CoInitialize
CoUninitialize
shell32
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA
ShellExecuteExA
user32
ShowScrollBar
GetClientRect
SetClassLongA
LoadCursorA
SetCursor
SetWindowTextA
CreateDialogIndirectParamA
CreateDialogParamA
SetForegroundWindow
EnableWindow
GetFocus
SetFocus
ScreenToClient
MoveWindow
LoadImageA
SetDlgItemTextA
SendMessageA
GetDlgItem
MsgWaitForMultipleObjects
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
ShowWindow
SendDlgItemMessageA
GetWindowRect
SystemParametersInfoA
ExitWindowsEx
CharNextA
MessageBoxA
DrawTextW
GetSystemMetrics
GetDC
GetDialogBaseUnits
ReleaseDC
MessageBoxW
LoadIconA
Name
.text
Size
291KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=335, id=1, productName=Unmarked objects,
count=34, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
AVEVA PROII Simulation 2022 x64/Setup/SilentInstallGuide.pdf
- SHA256 4dc6b241a45e3321d04d734a229162d3f088aaa43e80dc047141e9b8d08dd05b
- MD5 a9370abfde84e264ab466e8220fb7652
- SHA1 04af8d43b411f254a234740ba1d3940c3a0807f6
- SHA512 9a1ef09706ffb62454b31725a3a39609e99fdfcd7099a45dbb5053cb9722fc3df55cd878acb999510179c968ec448f56c46f981aeb0cbf6c00f8642095a274ba
- SSDEEP 12288:YxGVIRJMH+piGVNvKnIQT0XW7nnlAyR5NZsUCrrOqyiDH:Yx2cRprVNvKnIW0m7lAK9Craxiz
- TLSH T1CFC4127CF362D554DF4758B6AF2C0C9F22D2B5E4A681F009355ECC9A2782FA19412BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN.msi
- SHA256 790412ed06225f6908ece87d75c08d00d376cf25d5dcb2e8ae8015f108adec90
- MD5 87372f7b0014340126726043765b3b2e
- SHA1 d310c4c831f00ac99ae3743dfe8281016ffc7ab9
- SHA512 bfe4fc0f53a0544825028aa4e24da8c99f56924776ec3cd7f54b45a29c844bd17edc812f52af2d59a9db81773a1f39fed65f193527d1f9275a6e37d1bcb0cdd4
- SSDEEP 6144:1zPOBWsREaeSaRJ4JRpz/I/WP3M8XF9iyW1y48BxiKnWQ3:1zPOBbRmSxJb7I/Wk8Xle7Q
- TLSH T10B2519447AC601B8C65502774E3923B7E6979E1287D2A99A435C330CCEBFCF4A745ECA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dffab029015a5cadb6ed7129ca14c0314db644467584b0fd58902f9d281208d4
Digest Algorithm
sha256
Digest Matches
Trusted
Prehash
Signing Certificate
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
Chains
Sep 11, 2016
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
Serial Number
09:56:73:85:c5:c3:02:2d:2c:cf:d5:89:79:c9:66:29
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 24, 2016 - May 8, 2019
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/CAPE-OPEN/CAPE-OPEN64.msi
- SHA256 6726102de8b816a90115ca2d7091516bdea4fe5cce26d0fb4a0ad2c675154e75
- MD5 8ebd246c2a1bc2dd9874b0ee683bd51c
- SHA1 75e00d4adf2d89e820278d4bad365ffdcbdd4f61
- SHA512 a1c613e5645ff53c5de31f351590608d37e0113b8e64a35db68f3b902049503547d1e83b9c956d006df0024c81b369e00c810c9afd8396ef6db022988ab76e40
- SSDEEP 6144:ESPOBWsREaeSaRJ4JRLz/I/WP3M8XF9/yW1yA8BxiKzhcm:ESPOBbRmSxJ57I/Wk8XKeMcm
- TLSH T124254A4477D29510CA9246331D1123BBC6677E2ADF6A83AE5B1DB30EEC3DCA1A510DE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63117afd23c8e701d34751f3152bddff4eceb01585d64940f46c5007c6687cc0
Digest Algorithm
sha256
Digest Matches
Trusted
Prehash
Signing Certificate
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
Chains
Sep 11, 2016
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=CAPE OPEN Laboratories Network,O=CAPE OPEN Laboratories Network,L=Puteaux,ST=Ile-de-France,C=FR
Serial Number
09:56:73:85:c5:c3:02:2d:2c:cf:d5:89:79:c9:66:29
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 24, 2016 - May 8, 2019
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/DiscoveryServer/OPC UA SDK 1.01 Local Discovery Server Setup.msi
- SHA256 9720d689466cfd779b781da0af93a100124eb1815fc9b5c46f681afb9aaf1a7b
- MD5 89dfe8423a62eb73835f28d09d5c2e78
- SHA1 c955bd3699f4b048ee09e287b1e18217b297203a
- SHA512 65a31bc97cc78598712d8f24422129e4068f069d7dce86630cb31b0fc74a4f355717c2a9e5e9bd666511a6f9d166e6caeaba4556ec4022571fdd4b8978bee6d5
- SSDEEP 196608:9Hb4Fj0amPbTHCC010aPkuFSadg52oZem6+rUaPMBrY8lSnMCp:5klmz6P/rdgJwm7URrYOSM
- TLSH T1A586237570428331C1832375495EF61D4F39ED143BA292F3B259F2AC767ABA023B6B49
- MD5 SHA1 SHA512 SSDEEP TLSH
File Signature issue
Digest
73e33245cec2a76678bf6da14e0cdb18684508eb
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Chains
Jun 22, 2011
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Serial Number
cf:cc:9f:74:72:99:3c:62:4c:8f:d8:55:5f:60:c8:dd
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 26, 2010 - Apr 26, 2015
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/DiscoveryServer/setup.exe
- IMPHASH 784112ee3c1da4bbf1f4ee95a0d306fb
- SHA256 c710f2800aa173177fada922c68c9228e7b8f029e1414d68e70c6c55337764bd
- MD5 c70b6d0a482063b30662d3c185196014
- SHA1 150600954ba1ea99834f5f91737bf5cb3ca4ecdc
- SHA512 eb80db57e2c8dfe8dd10b58769942a042d841f71f98250c0731ac7e1380b994fb56b99495dda681ecc70fe94d4b438fa003ce5dd0ea9fb3e7ce069d05978e7d6
- SSDEEP 6144:OXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjayojDuUlmY/rgS9aAS17:mYYuUx65QwDMq6TOULeDuUlmovah7
- TLSH T1FFA45B2236D4C131E8E322B45AAC62315BBEFCB01B3489D7668423DD9D717D2AE3475B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
7b:c6:28:1b:0f:7b:05:58:cb:27:ea:6b:2a:6b:d0:6f:33:9f:1b:a4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Chains
Jun 22, 2011
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=OPC Foundation\, Inc.,O=OPC Foundation\, Inc.,POSTALCODE=85260-1868,STREET=Suite 3B+STREET=16101 N. 82nd Street,L=Scottsdale,ST=AZ,C=US
Serial Number
cf:cc:9f:74:72:99:3c:62:4c:8f:d8:55:5f:60:c8:dd
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 26, 2010 - Apr 26, 2015
Minor OS version
0
Major OS version
5
Entry point
167656
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
setup.pdb
kernel32
CreateFileW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
SetFilePointer
HeapSetInformation
CreateEventA
SetEvent
SizeofResource
LockResource
LoadResource
FindResourceA
GetVersionExA
CompareStringA
GetFileAttributesA
GetModuleFileNameA
DeleteFileA
MultiByteToWideChar
GetTempPathA
LocalFree
FormatMessageA
GetTimeFormatA
GetDateFormatA
CreateDirectoryA
CopyFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
GetCurrentProcess
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WideCharToMultiByte
GetEnvironmentVariableA
ReadFile
Sleep
GetDiskFreeSpaceExA
IsValidCodePage
EndUpdateResourceA
DeleteCriticalSection
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MulDiv
lstrlenW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetTickCount
FindFirstFileA
FindNextFileA
GetTempFileNameA
FindClose
GetProcessHeap
UpdateResourceA
BeginUpdateResourceA
LoadLibraryA
lstrlenA
UpdateResourceW
GetTempPathW
GetTempFileNameW
GetSystemDirectoryW
GetModuleFileNameW
GetFileAttributesW
FormatMessageW
FindResourceW
DeleteFileW
CreateDirectoryW
CopyFileW
BeginUpdateResourceW
GetVersion
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetEndOfFile
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
HeapAlloc
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetLastError
GetProcAddress
FreeLibrary
WriteFile
LocalAlloc
InterlockedExchange
RaiseException
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
gdi32
GetStockObject
GetObjectA
EnumFontFamiliesExA
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
GetDeviceCaps
GetObjectW
DeleteDC
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
ole32
CoInitialize
CoUninitialize
shell32
ShellExecuteExW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA
ShellExecuteExA
user32
ShowScrollBar
GetClientRect
SetClassLongA
LoadCursorA
SetCursor
SetWindowTextA
CreateDialogIndirectParamA
CreateDialogParamA
SetForegroundWindow
EnableWindow
GetFocus
SetFocus
ScreenToClient
MoveWindow
LoadImageA
SetDlgItemTextA
SendMessageA
GetDlgItem
MsgWaitForMultipleObjects
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
ShowWindow
SendDlgItemMessageA
GetWindowRect
SystemParametersInfoA
ExitWindowsEx
CharNextA
MessageBoxA
DrawTextW
GetSystemMetrics
GetDC
GetDialogBaseUnits
ReleaseDC
MessageBoxW
LoadIconA
Name
.text
Size
291KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
156KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=68, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=142, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=335, id=1, productName=Unmarked objects,
count=34, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NIST/RefPropAddonSetup.exe
- SHA256 fcaae1bc8200d9d0ac0a870448b0ecd7c2331ae8729a4eaa6ac5d3b62f8f93ab
- MD5 6a80c44420d14647e19ae02e463e2b18
- SHA1 7c675cde36be9f1b0293b7ba1c5ad8853e77ace0
- SHA512 ea42a30c09fdbed52b58c7de44cc0745fa2ec90fddcffc339c87353f0d996849ea480c31c84b1810fade88e212844fe5f710136f374d7cfc5ecf1ff96bbbbda2
- SSDEEP 49152:kaZBRGnmAi0s2ELT862Tu0+cOeiIsKXAliJRTmtfBj7VsLxObRAvDHXGRB2dXbfV:JZBUmAip8BuvTKXAEvMETYcThb
- TLSH T163F53309D273C47EC8B9DC709A1B4935D36F2D552CFCE0A0FE99885CEAB1421DA186B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
1d:19:6a:d2:55:50:9d:7f:b1:a9:27:90:81:d2:c8:99:52:67:13:08:6f:f6:60:39:68:ab:03:03:0e:05:31:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Chains
Jun 27, 2022
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=AVEVA Group plc,OU=LKF-T,O=AVEVA Group plc,L=Cambridge,C=GB
Serial Number
0f:ba:08:86:5e:75:db:05:bf:78:5a:bd:96:ee:7b:46
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 3, 2021 - Sep 3, 2022
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
1
Entry point
40000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/NOTEPAD/npp.7.8.4.Installer.exe
- IMPHASH 1f23f452093b5c1ff091a2f9fb4fa3e9
- SHA256 bda85bc0bb7beb11dbb9e9a964a2e2f0e4d35d0fc1e6b769e32b6847bfed8296
- MD5 0afa79bd21e4c9a4e91749d81097b501
- SHA1 41e08d28120a0aebd6234c865c36b0d0b28911f3
- SHA512 38bac2aabb95f381800747e2fd0b3af85c5c1a301aca8db1e7d995b2550dad5e04730951c4da633796d5d35bb93b8892be1935fd2d8935d3fdb55bece963a8c4
- SSDEEP 98304:MvGqPvPU7Ya+4pUepoQAjKNAfvnYDHbqjqToqIRjjbj5:MvXsdpUehpejqTXSjjv5
- TLSH T11906335630B6C07AD0154D311A7AD2EF8A337EC92EB2CB0B27E17A5BB9B4B116C14753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
bc:13:dc:4d:3d:e4:63:a3:6d:4b:67:02:05:78:70:b1:52:27:ae:ea
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Jan 29, 2020
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 3, 2019 - May 11, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
13477
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
SetCurrentDirectoryW
GetFileAttributesW
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
lstrcpynW
CopyFileW
GetShortPathNameW
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
WriteFile
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
lstrcmpiW
MoveFileW
GetFullPathNameW
SetFileTime
SearchPathW
CompareFileTime
lstrcmpW
CloseHandle
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GetDiskFreeSpaceW
GlobalAlloc
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
lstrlenA
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
EnableMenuItem
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ScreenToClient
GetWindowRect
GetDlgItem
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
GetDC
SetTimer
SetWindowTextW
LoadImageW
SetForegroundWindow
ShowWindow
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
EndPaint
CreateDialogParamW
SendMessageTimeoutW
wsprintfW
PostQuitMessage
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH 4b45b7e00344a87332fbd12653854d1a
- SHA256 ca092ba7f275b0c9000098cdd1a9876fe8dc050fcb40a0e8a1ab8335236e9dc5
- MD5 05bf02da51e717f79f6b5cbea7bc0710
- SHA1 07471a64ef4dba9dc19ce68ae6cce683af7df86d
- SHA512 c09e475babd5eb675cdf903b2b754b8b68450a731cb520f3dcbf9abe0ed03d19256f009429977d3a51decb3a2a938be0b28dbafeb407409fa85e54da6dbaaad6
- SSDEEP 384:ESC43tPegZ3eBaRwCPOYY7nNYXCv/Yosa:EbTgZ3eBTCmrnNAx
- TLSH T17A625D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E46281A5956E3C311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentDirectoryW
GlobalUnlock
GlobalLock
GetModuleHandleW
CloseHandle
SetEndOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
lstrcatW
lstrcpynW
WritePrivateProfileStringW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc
WriteFile
SetFilePointer
user32
LoadCursorW
SetWindowRgn
GetDlgCtrlID
CloseClipboard
DrawFocusRect
OpenClipboard
DrawTextW
SetCursor
LoadIconW
LoadImageW
SetWindowLongW
CreateWindowExW
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamW
GetClientRect
ShowWindow
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
CallWindowProcW
PostMessageW
MessageBoxW
GetSysColor
CharNextW
wsprintfW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
EnableMenuItem
PtInRect
MapWindowPoints
GetClipboardData
gdi32
SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW
shell32
SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
comdlg32
GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
dialog
initDialog
make_unicode
show
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=81, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10643
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
$PLUGINSDIR/modern-header.bmp
- SHA256 e6c5be8aba1f657fe77e8c9bbfac3536a69530aa5c1411cc3d6c235373203a46
- MD5 a70c3979ab1716c84969eb73618ca7d7
- SHA1 f0b4c8c1b8c59aa0382ae4f65263a389a3cc3996
- SHA512 3d0eba870b91f08a6e7b380d0137f6415d1184a77643521e7b2a01774272971853774b72517921a788ae7c606e3940c39fd36f03a7da76c972d1ef1adbc0e409
- SSDEEP 384:1oacST1ci4MZzWc5bgoUK+RQ0s6SLARs2v/C7zAkAFTqI+4TFWAWGQg5s:CaciEMZzPcoUK+a0sD52HCYkCTTmABw
- TLSH T1BCC29F527578003ED2B9823871A99B538D3B8ED82D5ED5771E363F3E2FB5E84181A1B0
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/modern-wizard.bmp
- SHA256 2125550c12fa512782f2016e802d70bc51f4a06017cfbd4176b4a994eb2542f0
- MD5 c2cf6928a3ab574a5548b4dc1c38b6c0
- SHA1 8860ff529f60b38a93912f88f234d46eebcf664f
- SHA512 fb6b28f2677b1418f8ebf621dd1e201b127b53b998c02300caa66a9f374f681961f5b9a7f843d6082821890df9e3d91a3403b4f83d70d155e9c841893e1f80e4
- SSDEEP 3072:NKrK243U6RNfWAKVZ17e28FTfWDG7wFlF9:NKW3UMfWTpe2eODG7UF9
- TLSH T1C1E3C05623F050244C08167BEA7A6ECC3761BCC2787D75A15F52C36FCAE43CAE6E91A4
- MD5 SHA1 SHA512 SSDEEP TLSH
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7527
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc
user32
DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW
gdi32
SetTextColor
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
638B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/USB_Driver/Sentinel Protection Installer 7.6.8.exe
- IMPHASH 2dd1f2ca3497e7bf3a3f47dd48596ca8
- SHA256 9d0902c7b616b87667400ccadae022403ead8dbdc1dec0b757ff10558a1892d9
- MD5 7bd5db83637f9106d544dac80d649529
- SHA1 ed73781b2d158296233b688e3cd30ffae520bf36
- SHA512 051c15fdbca3544b5445219f52267a3dd013f26ba16ebbbefe541f82345c9c85db184b34c9fe9a1da2104a22a1ef8cb29536ff39e7061e7bd16d4d68e6326712
- SSDEEP 196608:WsSRYj8nGcmR495CrXbR/SLL+qoDflM8DO2CkFNhEEI0i0IM:oSj8M25CrXbR/2LslsoBvZ
- TLSH T125969C3D0BC776ADD5D4A3786ADDCE757F120CF8A3C23B82E3A6849B45232657208539
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
96:ba:6d:da:fd:ce:50:6b:81:98:ab:cf:8f:5c:4c:58:74:6e:2c:1f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SafeNet\, Inc.,L=Belcamp,ST=Maryland,C=US
Chains
Jun 5, 2015
CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SafeNet\, Inc.,L=Belcamp,ST=Maryland,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=SafeNet\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SafeNet\, Inc.,L=Belcamp,ST=Maryland,C=US
Serial Number
0c:48:e2:29:a2:d8:06:0c:1b:40:34:a9:16:d4:01:12
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 13, 2014 - Apr 7, 2017
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
4
Entry point
121132
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
comctl32
ord17
kernel32
GetLastError
WideCharToMultiByte
DeleteFileA
lstrlenW
InterlockedIncrement
InterlockedDecrement
QueryPerformanceFrequency
CreateEventA
Sleep
lstrcatA
CompareStringA
CompareStringW
GetVersionExA
SetFilePointer
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateProcessA
GetSystemDefaultLCID
GlobalHandle
VerLanguageNameA
SetCurrentDirectoryA
WaitForSingleObject
GetSystemInfo
MulDiv
GetModuleFileNameA
IsValidCodePage
GetVersion
FlushFileBuffers
SetEndOfFile
LocalFree
FormatMessageA
GetDiskFreeSpaceA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
GetExitCodeProcess
GetCurrentProcess
GetCurrentThread
GetLocaleInfoA
UnhandledExceptionFilter
lstrlenA
GetACP
GetCPInfo
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
SetLastError
HeapDestroy
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
ExitProcess
RaiseException
RtlUnwind
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
GetShortPathNameA
SearchPathA
FindFirstFileA
VirtualProtect
VirtualQuery
GetStdHandle
FindClose
GetFileType
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
CopyFileA
MultiByteToWideChar
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
CreateThread
GetExitCodeThread
GetTickCount
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GetTempPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
GetFileAttributesA
GetProcessHeap
HeapAlloc
HeapFree
WriteFile
lstrcpynA
lstrcpyA
CreateFileMappingA
MapViewOfFile
HeapCreate
UnmapViewOfFile
GetEnvironmentStringsW
SetHandleCount
GetOEMCP
user32
GetParent
GetWindowTextLengthA
GetWindowTextA
MoveWindow
GetWindowPlacement
DrawIcon
DestroyIcon
GetDlgCtrlID
SetWindowTextA
FillRect
GetSysColor
GetSysColorBrush
IsDialogMessageA
EnableWindow
GetDlgItemTextA
GetWindow
SetCursor
UpdateWindow
GetClassInfoA
wvsprintfA
LoadStringA
SendMessageA
GetSystemMetrics
SetRect
FindWindowA
IntersectRect
SubtractRect
CharPrevA
DestroyWindow
CreateDialogParamA
CharNextA
MessageBoxA
WaitForInputIdle
GetWindowLongA
BeginPaint
EndPaint
SetWindowLongA
GetClientRect
ClientToScreen
SetWindowPos
GetWindowDC
EndDialog
GetDlgItem
ShowWindow
DialogBoxParamA
GetDesktopWindow
wsprintfA
MsgWaitForMultipleObjects
PeekMessageA
DefWindowProcA
PostMessageA
KillTimer
PostQuitMessage
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
ExitWindowsEx
SendDlgItemMessageA
IsWindow
CharLowerBuffA
GetWindowRect
gdi32
GetTextExtentPoint32A
SetBkMode
SetTextColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleDC
SelectObject
CreateFontA
DeleteDC
DeleteObject
GetStockObject
GetSystemPaletteEntries
CreatePalette
GetDeviceCaps
SelectPalette
RealizePalette
CreateDIBitmap
BitBlt
TranslateCharsetInfo
advapi32
RegQueryValueA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegEnumValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegDeleteValueA
ole32
StringFromCLSID
CoTaskMemFree
CoCreateGuid
CoCreateInstance
GetRunningObjectTable
StgIsStorageFile
StgOpenStorage
CoUninitialize
CoInitialize
CreateItemMoniker
oleaut32
VariantChangeType
SysAllocString
SysAllocStringLen
SysStringLen
SysReAllocStringLen
SysFreeString
VariantClear
Name
.text
Size
156KB
Virtual Size
155KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=29, id=14, version=7299,
count=128, id=10, version=8047,
count=1, id=12, version=7291,
count=13, id=11, version=8047,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=37, version=8755,
count=272, id=1, productName=Unmarked objects,
count=17, id=25, version=9210,
count=36, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/VSTO4.0/vstor40_x64.exe
- IMPHASH a1f6f100bff4507a3332f3f0cdfc24f5
- SHA256 ab1cea3737c48253f4b55acc61261973e2a6b28111f15a473629705ebfd641e2
- MD5 e6799c3f353da4ef171b2968c93761ee
- SHA1 596cf5bf90ba46a4828d608bd584d54c8201596c
- SHA512 9eb34c095b1ba2b5a4cdeece9956d11438e2c24d93928b5f7aee480525b0a3b3e4a374b36a787d21af3c62215718f9d4069ba4e39151b0ddb48d1d1a878c2278
- SSDEEP 49152:YsL4jN2ZJDx2Cxz8itV5sRnHW+mVD/KFL3O5UuABo7w4t/BqFsefgCmM9dQxist:vW2rxPxzPfwFkX771qFseJ9Gg2
- TLSH T1D2C53344136916B3DAF06632E1E49D281E2BA2A3C33503D99398F7B57E79785613CE0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
53:82:12:18:02:3c:0c:ee:b7:fa:38:cf:c9:ee:f6:9c:37:c6:b3:fe:81:42:84:c0:ab:97:25:50:ce:11:2f:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
4e:05:6a:fe:fc:cc:75:bc:5c:cc:e7:89:1f:76:79:2f:66:3e:28:c8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:54:4e:86:ab:83:93:72:d6:e9:00:00:00:00:00:54
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
2
Major OS version
5
Entry point
25599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
sfxcab.pdb
msvcrt
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf
advapi32
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
kernel32
CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime
user32
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.5MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
AVEVA PROII Simulation 2022 x64/Setup/ThirdPartySoftware/VSTO4.0/vstor40_x86.exe
- IMPHASH a1f6f100bff4507a3332f3f0cdfc24f5
- SHA256 0ad83a9a6be6b013e2b74a104591bdd53e4889e840d4aa59ddc3bbe9f3afa1bb
- MD5 b155da5c0363929c1a65aae15ab2960e
- SHA1 48697a0db509d1e282c0029590cf96ac5f41e535
- SHA512 fac977d346888abcbcb63026a8c281c66b7cc1ad351f7cb0ef13859cc4f1002bc191016e6c272f5ee31b11eb01e63e40557487801dcf8ffbe6d7fca6bb1d0562
- SSDEEP 49152:GJK4MhMRUfJKTakL9mNwNm1mWr4+/vDAAAriENxsn9GRJ+D7Q7TDTxhB:EehzBKakx+n/ARSQJ+D7Qp
- TLSH T10BB533B00B9AAA37C8D4EA7141D95D946D7F81A603332797F164F9A4E1EA7D1C32C20F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
02:4a:69:be:57:ae:3d:ce:81:03:6e:bc:4c:1f:5d:54:ed:d1:0f:d3:59:7b:ee:bd:8c:1c:51:b7:d8:85:3b:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
57:c4:15:eb:06:51:fb:f9:07:06:84:19:d0:c5:57:e5:fc:bb:11:bb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 24, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:55:6e:9d:da:5a:a6:f3:1c:5b:00:00:00:00:00:55
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
2
Major OS version
5
Entry point
25599
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
sfxcab.pdb
msvcrt
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_adjust_fdiv
_exit
_c_exit
strncpy
strstr
_strlwr
strrchr
_stricmp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_snprintf
sprintf
strchr
_strnicmp
_vsnprintf
advapi32
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
AllocateAndInitializeSid
OpenProcessToken
GetTokenInformation
GetLengthSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
kernel32
CreateThread
GetFileSize
ExpandEnvironmentStringsA
CreateProcessA
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LocalFileTimeToFileTime
SetFileTime
SetEndOfFile
CreateEventA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentDirectoryA
GetProcessHeap
CopyFileA
SetFileAttributesA
DosDateTimeToFileTime
SetEvent
GetVersionExA
ReadFile
SetFilePointer
MoveFileExA
RemoveDirectoryA
GetLastError
CreateDirectoryA
GetTickCount
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CloseHandle
DeviceIoControl
CreateFileA
GetDriveTypeA
HeapFree
FormatMessageA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
TerminateProcess
WaitForMultipleObjects
CreateEventW
FindFirstFileA
Sleep
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
HeapAlloc
SetLastError
WriteFile
MoveFileA
ExitProcess
DeleteCriticalSection
FlushFileBuffers
WaitForSingleObject
OpenEventA
GetCurrentProcess
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
FindClose
FindNextFileA
SystemTimeToFileTime
user32
SendDlgItemMessageA
SendMessageA
DialogBoxParamA
MessageBoxA
SetParent
EndDialog
LoadStringA
ShowWindow
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
NtShutdownSystem
comctl32
ord17
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.3MB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
AVEVA PROII Simulation 2022 x64/Setup/listofCommits.txt
- SHA256 8103f543f3b98fd65d5628e034dfd58aaf00da668fe3b3589fd8c29bf88daa80
- MD5 9af674b8caa1ad34cbeece923595d25e
- SHA1 efaacad9d1b3b90e7c2ef911af11c34f368595aa
- SHA512 3113f2a56767dd89376b9642a5c1da31728a2f65732fc16f53b605e07e9ecb72fa1734e940b6eab813cff0d0955089195e6861320ce049dab634d3b08b3c4f8a
- TLSH T14EB0128242FF0004F0F3388039F112380B11745CF83CC51C040004081EF1C208090753
- MD5 SHA1 SHA512 TLSH