Microsoft_Publisher_2021.zip
- SHA256 e784509445be18d50cd6a4d1e3d5751f9ce6c4ce15b456640046f9d2b3ed61b2
Overview
overview
5Static
static
1Microsoft_...un.bat
windows10-2004-x64
3Microsoft_...un.bat
windows11-21h2-x64
3Microsoft_...up.exe
windows10-2004-x64
5Microsoft_...up.exe
windows11-21h2-x64
4Microsoft_...rt.bat
windows10-2004-x64
3Microsoft_...rt.bat
windows11-21h2-x64
3Microsoft_...un.bat
windows10-2004-x64
3Microsoft_...un.bat
windows11-21h2-x64
3Microsoft_...up.exe
windows10-2004-x64
5Microsoft_...up.exe
windows11-21h2-x64
4Microsoft_...rt.bat
windows10-2004-x64
3Microsoft_...rt.bat
windows11-21h2-x64
3Static task
static1
Behavioral task
behavioral1
Sample
Microsoft_Publisher_2021/Install 32 bit/package/Click To Run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft_Publisher_2021/Install 32 bit/package/Click To Run.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Microsoft_Publisher_2021/Install 32 bit/package/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Microsoft_Publisher_2021/Install 32 bit/package/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Microsoft_Publisher_2021/Install 32 bit/start.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
Microsoft_Publisher_2021/Install 32 bit/start.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Microsoft_Publisher_2021/Install 64 bit/package/Click To Run.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
Microsoft_Publisher_2021/Install 64 bit/package/Click To Run.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft_Publisher_2021/Install 64 bit/package/setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft_Publisher_2021/Install 64 bit/package/setup.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Microsoft_Publisher_2021/Install 64 bit/start.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Microsoft_Publisher_2021/Install 64 bit/start.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Microsoft_Publisher_2021.zip
- Size 6.6MB
- Sample260601-pl343aby5v
- SHA256 e784509445be18d50cd6a4d1e3d5751f9ce6c4ce15b456640046f9d2b3ed61b2
- MD5 db8f02d5b1c1d69bbb7f40819c1714b2
- SHA1 5046237536778e6626ec960140f0b3f70b3b0fe0
- SHA512 ebc060592b45a33e0ab397dce839e5dbebe61ca5f0534e9014a862599be3ac575e91cad370f7a855f733cabbcd5ef7691940f1cf63ded852af7c0fe9321e4085
- SSDEEP 98304:9scexRwDTxoSSJmZ0Hf/NqrwNZmk7BWHXNIVw1gsuscexRwDTxoSSJmZ0Hf/Nqrt:9j2wqYwNo9t1gsuj2wqYwNo9t1gsR
- TLSH T1276633C2643DE58C86B25BF56449A5C32EBD1CFB9F3B0DA4E9DF0C91781F245824928B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
Microsoft_Publisher_2021.zip.zip 6.6MB
-
Microsoft_Publisher_2021/Install 32 bit/package/Click To Run.bat34B
-
Microsoft_Publisher_2021/Install 32 bit/package/configuration.xml187B
-
Microsoft_Publisher_2021/Install 32 bit/package/setup.exe.exe 7.4MB
-
Microsoft_Publisher_2021/Install 32 bit/start.bat49B
-
Microsoft_Publisher_2021/Install 64 bit/package/Click To Run.bat34B
-
Microsoft_Publisher_2021/Install 64 bit/package/configuration.xml187B
-
Microsoft_Publisher_2021/Install 64 bit/package/setup.exe.exe 7.4MB
-
Microsoft_Publisher_2021/Install 64 bit/start.bat49B
Microsoft_Publisher_2021/Install 32 bit/package/Click To Run.bat
- SHA256 413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14
- MD5 ad3ed1d41f9b51f7f203d56597c05958
- SHA1 724822195edeff84c01f298212dbaebf1b55a0d2
- SHA512 dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290
- MD5 SHA1 SHA512
Microsoft_Publisher_2021/Install 32 bit/package/configuration.xml
- SHA256 c466286192e0060a9bbb3bca47b194a23c074d1467cdde757b70e74d379e2d9f
- MD5 6b3772ce531d053d49b82a19d2e7cd66
- SHA1 71e335ecdcdaaa51f0ab7093de622987c1662992
- SHA512 698714ec448f4932b5faaba83dd191d0fc4297080675dce415250873d11d81fc712d5ae70035433d8f71ab81701d948241332af94198936f6969a9ad2eab7bdc
- TLSH T152C012D2F686145775364227D1D54A547DB2920389255E04F06F756B8666121630311E
- MD5 SHA1 SHA512 TLSH
Microsoft_Publisher_2021/Install 32 bit/package/setup.exe
- IMPHASH 9e71e4eb9e5e4331174aa2b57e2ff185
- SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
- MD5 7488d696f9a3d74e093b4c31ef7282c6
- SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
- SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
- SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
- TLSH T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
5
Entry point
4159692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupODT.pdb
advapi32
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
RegNotifyChangeKeyValue
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
EqualSid
RegEnumValueA
RegDeleteValueA
RegGetValueA
EventWrite
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
ole32
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
CoCreateFreeThreadedMarshaler
IIDFromString
CoInitializeSecurity
CoInitializeEx
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoUninitialize
oleaut32
GetErrorInfo
SysFreeString
VariantInit
VariantClear
SetErrorInfo
SysAllocString
SysStringLen
gdi32
CreateFontW
SetBkColor
SetTextColor
DeleteObject
Rectangle
SetDCPenColor
CreatePen
GetTextExtentPoint32W
SelectObject
CreateSolidBrush
SetDCBrushColor
GetTextMetricsW
GetStockObject
GetDeviceCaps
kernel32
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer
CloseThreadpoolWork
CreateTimerQueueTimer
ExitProcess
GetOEMCP
CloseHandle
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CompareStringEx
LocalFree
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
CreateThread
GetCurrentThreadId
GetExitCodeThread
SetProcessMitigationPolicy
CreateEventExW
WriteFile
DeleteFileW
WideCharToMultiByte
IsWow64Process
GetModuleHandleExW
ExpandEnvironmentStringsW
GlobalFree
MultiByteToWideChar
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CreateMutexW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLocaleName
FlsFree
FlsAlloc
AttachConsole
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
LocaleNameToLCID
FindClose
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingW
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FormatMessageA
RaiseException
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
GetExitCodeProcess
GetProcessTimes
GetTickCount64
GetSystemTimeAsFileTime
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
GlobalMemoryStatusEx
GetVersionExW
IsValidCodePage
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetSystemDirectoryW
HeapAlloc
CreateEventW
SetEvent
WaitForSingleObject
EnumSystemLocalesW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
QueryUnbiasedInterruptTime
OpenEventW
ReleaseMutex
CreateMutexExW
OpenMutexW
GetTempPathW
GetLongPathNameW
GetFinalPathNameByHandleW
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
SetFileAttributesW
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
GetFileInformationByHandleEx
GetCurrentDirectoryW
GetTempFileNameW
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
WaitForMultipleObjects
K32EnumProcessModulesEx
OpenThread
GetFileType
SetFilePointer
GetOverlappedResult
GetFileAttributesW
GetFileTime
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
LockResource
LCIDToLocaleName
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
OutputDebugStringW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
CreateFileMappingA
LocalAlloc
GetLocaleInfoEx
LCMapStringEx
IsValidLocale
GetSystemDefaultLCID
ResolveLocaleName
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetFileAttributesA
LoadLibraryExA
GetUserGeoID
GetLocaleInfoW
GetUserPreferredUILanguages
GetACP
GetTimeZoneInformation
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetCommandLineW
SetEnvironmentVariableW
GetPriorityClass
K32EnumProcesses
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
InitOnceComplete
InitOnceBeginInitialize
CreateSymbolicLinkW
DeleteTimerQueueTimer
GetThreadTimes
FreeLibraryAndExitThread
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
RemoveDirectoryW
GetFileInformationByHandle
GetStringTypeW
CompareStringW
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
VirtualQuery
GetLocalTime
ReleaseSemaphore
TryAcquireSRWLockExclusive
GetSystemPreferredUILanguages
K32GetProcessImageFileNameW
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
setupapi
SetupIterateCabinetW
gdiplus
GdipDeleteGraphics
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageRectI
GdipLoadImageFromStream
GdipAlloc
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipFree
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
227KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
377KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=216, id=261, version=30795,
count=20, id=260, version=33030,
count=28, id=259, version=33030,
count=7, id=109, version=41204,
count=2, id=125, version=41204,
count=21, id=257, version=30795,
count=47, id=260, version=30795,
count=2, id=262, version=30795,
count=993, id=1, productName=Unmarked objects,
count=151, id=261, version=33030,
count=2394, id=265, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Microsoft_Publisher_2021/Install 32 bit/start.bat
- SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
- MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
- SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
- SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
- MD5 SHA1 SHA512
Microsoft_Publisher_2021/Install 64 bit/package/Click To Run.bat
- SHA256 413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14
- MD5 ad3ed1d41f9b51f7f203d56597c05958
- SHA1 724822195edeff84c01f298212dbaebf1b55a0d2
- SHA512 dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290
- MD5 SHA1 SHA512
Microsoft_Publisher_2021/Install 64 bit/package/configuration.xml
- SHA256 d11a7920a4765c10f51e817413496e2763cafd77a00b34805ed063f89bf86cfd
- MD5 aad9bb66cc83e24414f954615b28b239
- SHA1 86591e2133715ea145576cb5156e8d7f0724ca85
- SHA512 ea72cb304167d27a0bf02411d317abd29356d4b4173ce643ce58c9664ff6867da29bd5b644307cc4519d0f609a4fa5d77cebe65cc87d61b6b58272b8e0b1fce8
- TLSH T13BC012D2F686145775324267D1D58A547DB2920389255A04F06F756B86A5121630311E
- MD5 SHA1 SHA512 TLSH
Microsoft_Publisher_2021/Install 64 bit/package/setup.exe
- IMPHASH 9e71e4eb9e5e4331174aa2b57e2ff185
- SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
- MD5 7488d696f9a3d74e093b4c31ef7282c6
- SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
- SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
- SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
- TLSH T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
2
Major OS version
5
Entry point
4159692
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupODT.pdb
advapi32
ConvertSidToStringSidW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CreateWellKnownSid
CheckTokenMembership
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegDeleteValueW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
EventWriteTransfer
EventRegister
EventUnregister
EventSetInformation
RegNotifyChangeKeyValue
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
EqualSid
RegEnumValueA
RegDeleteValueA
RegGetValueA
EventWrite
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
CloseServiceHandle
OpenServiceW
QueryServiceStatusEx
QueryServiceConfigW
StartServiceW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
ole32
CoInitialize
CLSIDFromString
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
StringFromGUID2
CoCreateFreeThreadedMarshaler
IIDFromString
CoInitializeSecurity
CoInitializeEx
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoUninitialize
oleaut32
GetErrorInfo
SysFreeString
VariantInit
VariantClear
SetErrorInfo
SysAllocString
SysStringLen
gdi32
CreateFontW
SetBkColor
SetTextColor
DeleteObject
Rectangle
SetDCPenColor
CreatePen
GetTextExtentPoint32W
SelectObject
CreateSolidBrush
SetDCBrushColor
GetTextMetricsW
GetStockObject
GetDeviceCaps
kernel32
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer
CloseThreadpoolWork
CreateTimerQueueTimer
ExitProcess
GetOEMCP
CloseHandle
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
SetLastError
GetModuleFileNameW
OutputDebugStringA
CompareStringEx
LocalFree
HeapFree
GetProcessHeap
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
CreateThread
GetCurrentThreadId
GetExitCodeThread
SetProcessMitigationPolicy
CreateEventExW
WriteFile
DeleteFileW
WideCharToMultiByte
IsWow64Process
GetModuleHandleExW
ExpandEnvironmentStringsW
GlobalFree
MultiByteToWideChar
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
CreateMutexW
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLocaleName
FlsFree
FlsAlloc
AttachConsole
AllocConsole
GetStdHandle
WriteConsoleW
FreeConsole
LocaleNameToLCID
FindClose
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingW
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FormatMessageA
RaiseException
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
OpenProcess
GetExitCodeProcess
GetProcessTimes
GetTickCount64
GetSystemTimeAsFileTime
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
GlobalMemoryStatusEx
GetVersionExW
IsValidCodePage
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetSystemDirectoryW
HeapAlloc
CreateEventW
SetEvent
WaitForSingleObject
EnumSystemLocalesW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
QueryDepthSList
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
TzSpecificLocalTimeToSystemTime
QueryUnbiasedInterruptTime
OpenEventW
ReleaseMutex
CreateMutexExW
OpenMutexW
GetTempPathW
GetLongPathNameW
GetFinalPathNameByHandleW
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
ResetEvent
IsDebuggerPresent
GetFileAttributesExW
FindFirstFileExW
MoveFileExW
FindNextFileW
CreateDirectoryW
SetFileAttributesW
ReadFile
SetFilePointerEx
SetEndOfFile
GetFileSizeEx
FlushFileBuffers
LockFileEx
UnlockFileEx
GetFileInformationByHandleEx
GetCurrentDirectoryW
GetTempFileNameW
CopyFileExW
GetVolumePathNamesForVolumeNameW
SetFileInformationByHandle
WaitForMultipleObjects
K32EnumProcessModulesEx
OpenThread
GetFileType
SetFilePointer
GetOverlappedResult
GetFileAttributesW
GetFileTime
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
LockResource
LCIDToLocaleName
SetFileTime
CancelIoEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetCurrentThread
GetQueuedCompletionStatus
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
OutputDebugStringW
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
CreateFileMappingA
LocalAlloc
GetLocaleInfoEx
LCMapStringEx
IsValidLocale
GetSystemDefaultLCID
ResolveLocaleName
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetFileAttributesA
LoadLibraryExA
GetUserGeoID
GetLocaleInfoW
GetUserPreferredUILanguages
GetACP
GetTimeZoneInformation
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
InitializeCriticalSection
GetFullPathNameA
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
FlushViewOfFile
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
K32GetProcessMemoryInfo
GetPhysicallyInstalledSystemMemory
GetProductInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
FindFirstFileW
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetCommandLineW
SetEnvironmentVariableW
GetPriorityClass
K32EnumProcesses
FreeLibraryWhenCallbackReturns
IsProcessorFeaturePresent
InitOnceComplete
InitOnceBeginInitialize
CreateSymbolicLinkW
DeleteTimerQueueTimer
GetThreadTimes
FreeLibraryAndExitThread
ExitThread
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
RemoveDirectoryW
GetFileInformationByHandle
GetStringTypeW
CompareStringW
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
VirtualQuery
GetLocalTime
ReleaseSemaphore
TryAcquireSRWLockExclusive
GetSystemPreferredUILanguages
K32GetProcessImageFileNameW
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
setupapi
SetupIterateCabinetW
gdiplus
GdipDeleteGraphics
GdiplusStartup
GdipCreateFromHDC
GdipDrawImageRectI
GdipLoadImageFromStream
GdipAlloc
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipCloneImage
GdipFree
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
227KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
377KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=259, version=30795,
count=216, id=261, version=30795,
count=20, id=260, version=33030,
count=28, id=259, version=33030,
count=7, id=109, version=41204,
count=2, id=125, version=41204,
count=21, id=257, version=30795,
count=47, id=260, version=30795,
count=2, id=262, version=30795,
count=993, id=1, productName=Unmarked objects,
count=151, id=261, version=33030,
count=2394, id=265, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Microsoft_Publisher_2021/Install 64 bit/start.bat
- SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
- MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
- SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
- SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
- MD5 SHA1 SHA512