xcontrol_taknazyvaemy.zip
- SHA256 de1ba2691fac41c4a727ce60921078a9011f015ec7441d805bf690dc5d8db28c
Behavioral task
behavioral1
Sample
net10.0-windows10.0.17763.0/cl_default0/Stub.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
net10.0-windows10.0.17763.0/resources/upx packer/upx.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
General
- Target xcontrol_taknazyvaemy.zip
- Size 15.3MB
- Sample260602-phfvcsc12z
- SHA256 de1ba2691fac41c4a727ce60921078a9011f015ec7441d805bf690dc5d8db28c
- MD5 29f8e8bb903ad144a7d231e1b01fb3fe
- SHA1 75424c1fe20ae19c20ff6c719907cf4d2cbf799f
- SHA512 103c07420803c6e0ae88a7a5dacee0c78d55d1a91218660f9b0ea6cd115744d97357a3b2d4991b99625d86b1be1246232342c5c7ad367855723191f0d355bfa8
- SSDEEP 393216:2v0FDksyL4G9xpWt3rqMkc9poowoyJ7H8sQvjY9jguSpy:iIksy4G92PNwBj8sQbluSpy
- TLSH T1F2F63311B7C2BF157DB7CD32E7A0BC24868847ADDA969C691739439A0F8F70249FC921
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/net10.0-windows10.0.17763.0/resources/upx packer/upx.exe upx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/net10.0-windows10.0.17763.0/CommandServer.dll unpack001/net10.0-windows10.0.17763.0/CommandServer.exe unpack001/net10.0-windows10.0.17763.0/DDOSPlugin.dll unpack001/net10.0-windows10.0.17763.0/DLLInjector.dll unpack001/net10.0-windows10.0.17763.0/FirebaseAdmin.dll unpack001/net10.0-windows10.0.17763.0/Google.Api.Gax.Rest.dll unpack001/net10.0-windows10.0.17763.0/Google.Api.Gax.dll unpack001/net10.0-windows10.0.17763.0/Google.Apis.Auth.dll unpack001/net10.0-windows10.0.17763.0/Google.Apis.Core.dll unpack001/net10.0-windows10.0.17763.0/Google.Apis.dll unpack001/net10.0-windows10.0.17763.0/NAudio.Asio.dll unpack001/net10.0-windows10.0.17763.0/NAudio.Core.dll unpack001/net10.0-windows10.0.17763.0/NAudio.Midi.dll unpack001/net10.0-windows10.0.17763.0/NAudio.Wasapi.dll unpack001/net10.0-windows10.0.17763.0/NAudio.WinForms.dll unpack001/net10.0-windows10.0.17763.0/NAudio.WinMM.dll unpack001/net10.0-windows10.0.17763.0/NAudio.dll unpack001/net10.0-windows10.0.17763.0/Plugins/DDOSPlugin.dll unpack001/net10.0-windows10.0.17763.0/Plugins/DLLInjector.dll unpack001/net10.0-windows10.0.17763.0/Plugins/XControl.API.dll unpack001/net10.0-windows10.0.17763.0/Vestris.ResourceLib.dll unpack001/net10.0-windows10.0.17763.0/XControl.API.dll unpack001/net10.0-windows10.0.17763.0/cl_default0/Stub.exe unpack001/net10.0-windows10.0.17763.0/dnlib.dll unpack001/net10.0-windows10.0.17763.0/resources/upx packer/upx.exe unpack002/out.upx - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/net10.0-windows10.0.17763.0/Newtonsoft.Json.dll
File Explorer
-
xcontrol_taknazyvaemy.zip.zip 15.3MB
-
net10.0-windows10.0.17763.0/CommandServer.deps.json15KB
-
net10.0-windows10.0.17763.0/CommandServer.dll.exe 606KB
-
net10.0-windows10.0.17763.0/CommandServer.dll.config2KB
-
net10.0-windows10.0.17763.0/CommandServer.exe.exe 158KB
-
net10.0-windows10.0.17763.0/CommandServer.runtimeconfig.json968B
-
net10.0-windows10.0.17763.0/DDOSPlugin.dll.dll 8KB
-
net10.0-windows10.0.17763.0/DLLInjector.dll.dll 24KB
-
net10.0-windows10.0.17763.0/FirebaseAdmin.dll.dll 292KB
-
net10.0-windows10.0.17763.0/Google.Api.Gax.Rest.dll.dll 26KB
-
net10.0-windows10.0.17763.0/Google.Api.Gax.dll.dll 78KB
-
net10.0-windows10.0.17763.0/Google.Apis.Auth.dll.dll 240KB
-
net10.0-windows10.0.17763.0/Google.Apis.Core.dll.dll 84KB
-
net10.0-windows10.0.17763.0/Google.Apis.dll.dll 82KB
-
net10.0-windows10.0.17763.0/Microsoft.Bcl.AsyncInterfaces.dll.dll 15KB
-
net10.0-windows10.0.17763.0/Microsoft.Extensions.DependencyInjection.Abstractions.dll.dll 42KB
-
net10.0-windows10.0.17763.0/Microsoft.Toolkit.Uwp.Notifications.dll.dll 159KB
-
net10.0-windows10.0.17763.0/Microsoft.Windows.SDK.NET.dll.dll 22.5MB
-
net10.0-windows10.0.17763.0/NAudio.Asio.dll.dll 34KB
-
net10.0-windows10.0.17763.0/NAudio.Core.dll.dll 183KB
-
net10.0-windows10.0.17763.0/NAudio.Midi.dll.dll 45KB
-
net10.0-windows10.0.17763.0/NAudio.Wasapi.dll.dll 176KB
-
net10.0-windows10.0.17763.0/NAudio.WinForms.dll.dll 34KB
-
net10.0-windows10.0.17763.0/NAudio.WinMM.dll.dll 57KB
-
net10.0-windows10.0.17763.0/NAudio.dll.dll 7KB
-
net10.0-windows10.0.17763.0/Newtonsoft.Json.dll.dll 706KB
-
net10.0-windows10.0.17763.0/Plugins/DDOSPlugin.dll.dll 8KB
-
net10.0-windows10.0.17763.0/Plugins/DLLInjector.dll.dll 24KB
-
net10.0-windows10.0.17763.0/Plugins/XControl.API.dll.dll 4KB
-
net10.0-windows10.0.17763.0/Profiles/BetterMC.json971B
-
net10.0-windows10.0.17763.0/System.Management.dll.dll 72KB
-
net10.0-windows10.0.17763.0/System.Speech.dll.dll 302KB
-
net10.0-windows10.0.17763.0/Vestris.ResourceLib.dll.dll 78KB
-
net10.0-windows10.0.17763.0/WinRT.Runtime.dll.dll 516KB
-
net10.0-windows10.0.17763.0/XControl.API.dll.dll 4KB
-
net10.0-windows10.0.17763.0/cl_default0/Stub.exe.exe 16.0MB
-
net10.0-windows10.0.17763.0/dnlib.dll.dll 1.1MB
-
net10.0-windows10.0.17763.0/resources/upx packer/COPYING17KB
-
net10.0-windows10.0.17763.0/resources/upx packer/LICENSE5KB
-
net10.0-windows10.0.17763.0/resources/upx packer/NEWS25KB
-
net10.0-windows10.0.17763.0/resources/upx packer/README3KB
-
net10.0-windows10.0.17763.0/resources/upx packer/THANKS.txt2KB
-
net10.0-windows10.0.17763.0/resources/upx packer/upx-doc.html.html .vbs 37KB
-
net10.0-windows10.0.17763.0/resources/upx packer/upx-doc.txt.vbs 36KB
-
net10.0-windows10.0.17763.0/resources/upx packer/upx.1.vbs 39KB
-
net10.0-windows10.0.17763.0/resources/upx packer/upx.exe.exe 609KB
-
out.upx.exe 2.4MB
-
net10.0-windows10.0.17763.0/runtimes/win/lib/net10.0/System.Management.dll.dll 307KB
-
net10.0-windows10.0.17763.0/runtimes/win/lib/net10.0/System.Speech.dll.dll 671KB
-
net10.0-windows10.0.17763.0/server.pfx2KB
net10.0-windows10.0.17763.0/CommandServer.deps.json
- SHA256 aa2b6a6012c35e703517552633aa52f3a37cd7d99c140f5e06ae1b86223c0780
- MD5 1558dc0e1a0eadbe0a0a842276f571ab
- SHA1 93446a3dc303d8e3726229d2c79299cd45aaddcf
- SHA512 fe569ad147b29ae38b179f2c5a0f60e45053afb5fc9adb8c306c8abd2af01e10401ef6c5a02f9eb8cf8512acec56d20bc0b0f82e2643d53a9c813cd23c3fffea
- SSDEEP 96:tfjV+wGF6ArDmWdIv/wYvr9hVAAOe68G4oW/qK3i2q3YvmJ9FsoHwngVvZMfHNnQ:tfjOgAKWdr0Oe6V4Pj/s8iqjcok
- TLSH T118625816D4944EA746B1A7E624365281FB32932F6244188F78FC249ECF73F9B6086F34
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/CommandServer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 462062c4b0b2b3c29a03f037e3af24fab15f7ec88a006025173e087f668b146c
- MD5 a81e9bbdd362be1e273c1bf9181e01e4
- SHA1 ad03a7b444a338e81d2dd42e7b5fd604ad345ea3
- SHA512 d8f2ea52399b6121f9b6761a6db71d14ac2bd2db8b887bd713b3c17c0b27d8cb001c79ddfaca7b1aff30daeb843b794fce11714a61d5c7cd2e82c4af1b609ee5
- SSDEEP 12288:yWi4ubneQsIjZaswQESEvVAYvwAX79eP8aVAq3L1:yEu5XjZfwQESEvVAYvHX79ePvA
- TLSH T12DD4BE4E22FC0E51D46F63B1E5174346C3B6E64282EBD38D4ACDA8E92DE63729F01257
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
626150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
603KB
Virtual Size
603KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/CommandServer.dll.config
- SHA256 0bbf9edafe05e8b82f8e92d1118cd224fd3340771571d637420dd7acb25b981f
- MD5 e60352678e182fa86527028c626103f6
- SHA1 fd9ed2f775c5bae08f9cda2deebe8ddb13612e66
- SHA512 8fc003eb6bdbed10c5ed542a0dfaae4a6d6ed9317599f731388e9f3467f8693ade41037b4c84153275e6e83144b72e5fa263b227aeebfd65865211a2655545cb
- TLSH T1AE41A20CB2C1AE9A01366631E6315681EEF006634176B4F0B8FD32675F71CCA0BA37A6
- MD5 SHA1 SHA512 TLSH
net10.0-windows10.0.17763.0/CommandServer.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 d450069517736fc08b4b3cc5e14c15091c0c2d1e11abd8871f9ccd2a1dfd9172
- MD5 9cf9eb0997eb4f053991117f509aff22
- SHA1 ec32702f68bef3bd0b2ec3e5ba67c644c47c9923
- SHA512 fb4caf731fa90ce170eccc7e80106358b2f1b3bd6cf6632a405319fb921fbbeec111f79a79c2865abe632b2b6a5b3efca883d90e1986c31db58332ff360df812
- SSDEEP 3072:1lDJk88wN1QI7sxrYL1peQ3lOY9SkHNwmlgzaAT5R3:zAIwxrI14Q3kYBlrC
- TLSH T127F33C13A6A811BEE1B3D678C9924941FB7278594B71A7CF07504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
net10.0-windows10.0.17763.0/CommandServer.runtimeconfig.json
- SHA256 d4cff5efde82ba9531a1642de110c37b15d2bb03a4d06477a821790dd7d231d8
- MD5 6aa570f900ca15cb305edc19c14c087d
- SHA1 25e96212594d6f49f86ad3a5031e1dac4cfb47f4
- SHA512 df1d2133bfce12796795b12938a4047db1f98cf266ab994b0cd1de7e424b16f1bd888c303019dc88ce1a79a56c5c0c07b2994b75ad5359318c60bbda348430a3
- TLSH T18011E339CA10ADFA18B921AA9225D093DB30273B20047D66B5FD090CAF765A52237F96
- MD5 SHA1 SHA512 TLSH
net10.0-windows10.0.17763.0/DDOSPlugin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc18375d1123649a167d2b41663da3326fcba8a1feab866af6168ece28cf5410
- MD5 8dd30b91cda2bd3e440499732232d02f
- SHA1 0ba11d8bfd5c8052344e831755705c98cd139ef6
- SHA512 9deb6dac97c4eee7204831d333ef220a1de12774bb813b3fa82f4b6c117a6ce13675407b59b2421879fece0f25c1361f9cf95882e680a5fc643597bc788c51c4
- SSDEEP 96:b6Fe2TbxDr6HzpmInoY7CdRlNj4lmJ0v97lxUdF72LYPjOrKnD8TlM6:b+TcnSr4lmJlwYPjPsV
- TLSH T10402C409A3FC9521F5AA1736ADAB4790573FBA504A73CA1F14CDA40E1FB3B100960BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\DDOSPlugin\DDOSPlugin\obj\Debug\net10.0\DDOSPlugin.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/DLLInjector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 431b98643118f3d981e2a4e92dad2d6f4484fbc99f6636477f557268159499ca
- MD5 14a8575341bb86a4b7915fd75577464d
- SHA1 dc0242b7cb8afdc7795bbc367cafe7496e208edf
- SHA512 ecde6ba0cd9ef39c5a490349937eccd87b6eda0c0b1f1f9a6db8dc7f6a3254354034b5ef40d306043e2d52343e8693e0ecddf08f46e44675acb3ba614f6de8ce
- SSDEEP 384:4CGwbt+WhZwJ3v4YVWN7quUui45PWOlmKncZ/1CABNw2om91BYtthezQxYHjxZI4:PGiepwYVQdBRWzuxWjxZx
- TLSH T1EFB2A509F3F45215F4BA0B74AA7784A107B37E661A34D65D0A8C689E0FB3F148A317B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\DLLInjector\DLLInjector\obj\Debug\net10.0-windows\DLLInjector.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/FirebaseAdmin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 827684c193e65094c117cf79923cc271f7baef5b715c28ee24b894bf785f3127
- MD5 bce3ddc448efdd40a096e9b9040d58fa
- SHA1 0345e3518eef078ed93c47af29d60ecda0eafb21
- SHA512 d2568413c762d20165bcf52ad1e488d473482ad8efa79ce33697b76c173ae73d934a9b21d3e42069ff46ac751d44db3199dd9a7cf059ca44055fa917773a639d
- SSDEEP 3072:gT9+4oaRxgYp71WzSlSa90dbv4zbJe2HN/yGwe7RPEanKa9Y2LS4tJ9rsvvv:gTIcp7c239zJZqGwaR3Vvrs
- TLSH T1B5543B4013F8C315D6FFBA75F4304AEE5AB6B5466867D39D570CA5F9A933B82A800323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/home/runner/work/firebase-admin-dotnet/firebase-admin-dotnet/FirebaseAdmin/FirebaseAdmin/obj/Release/net6.0/FirebaseAdmin.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Google.Api.Gax.Rest.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d3564784c98568f9d784ce4aa0430b69a27e43cd3b6b99906d030ce259436b0
- MD5 eeae724d22120f44e13d18568f90f3c4
- SHA1 481d149138d07511d8c4781afe9777b159151203
- SHA512 6990167f81ffe98ee9f1dd8e2040744d04c1c47eb57e1b08460de335decc8c05229d78ba4a968ceb335195cda4000b27f36d55502a7a5908aa2c42eeebaee7aa
- SSDEEP 768:FcnDLEpg2R1QYmWYThtEaHkWxr///ju0TCcWEjU0R74pWx:UqUbWYThtRHkWla0TCcWEjU0R74pWx
- TLSH T102C2290663DCA737D9BF573FFD7211400170E782A987E79929CCA2E62C967001E587B9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Google.Api.Gax.Rest/obj/Release/netstandard2.0/Google.Api.Gax.Rest.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Google.Api.Gax.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1adedac4a241a93c34a41a8939151cccf35381fc6c4d4cc890216eb191032639
- MD5 3cc6c20060f4699368ff46c93a39d43a
- SHA1 e437c447632dc86e58befd9540b105700b4d1106
- SHA512 e27473f49daf1e51a695e0a087dcb8ac9a3983598de88e38214d9008a876333bd8409c6d5dc0d589ddf09b2b279247aaab10e9b30d4bdeb0e84996f415a362cb
- SSDEEP 1536:S/n7ZRub7p2lq/Q2zOupdk+zV/89x7qTmbL+2y2zLV1ISGYyvK5CyeOajuyk:Ylkb7p2lqf6YdJV/89x7qqbC2ByvK5CG
- TLSH T1F1733A50B3F84B2BEBFF2B7DA47061410B73F55B7463D71EA84865D91826B800E91BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Google.Api.Gax/obj/Release/netstandard2.0/Google.Api.Gax.pdb
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Google.Apis.Auth.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2a4f688c1e34bca248c2a589e73a20ac3c834a9615c13bcb08a317a78842609
- MD5 56b4f7f40efb5265af9d15576a0b03a4
- SHA1 716dad0802d71544d3e1bb873f4b84e273e3402d
- SHA512 8f791929d7d7ac21009c614e6a3b81966ca179d59376a75028fbf43b21822dee6489b1203331b1580c7d2c580f5edc51008520a512d5749d9d56ab6a31a23466
- SSDEEP 3072:iBdI+tgmvDXP9GzIk01GZys81KcuX3YeGsR2bV1oKznhAbzIWRVO8X8gk0Qt27LM:GdltgmP9jkMG3tVIeGs+bObzb/Nb
- TLSH T1D2342B0163F88B21F7EF6778E5B04121CAB6F646F87EEF9D1A88D1ED19127429844723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
251850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Support/Google.Apis.Auth/obj/Release/net6.0/Google.Apis.Auth.pdb
mscoree
_CorDllMain
Name
.text
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Google.Apis.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 198f959ef53b86d9c6f4b3305503960995cfaaa096252dc7bbbb803c57c58bc7
- MD5 32b235caaddc83cdf23708bc7592ee38
- SHA1 72cc51243fec3530bab4cf6b656648d31a4f5da1
- SHA512 086f02d953dd6ca8eab9c2ff8636dee4ad6908c4eb37891f2051627a32e6ae7c8721899eb6ebec7c49a8622215eb6329b018b2bada061e5325f8ee0ecea74ed5
- SSDEEP 1536:4DcIyUpC8WPjQQPSrQ+U5KH7fn/GGwnD:4DvzpOP0mSrQ+uKH7fn/GGW
- TLSH T12A835A1563EC4A97D7FF6AB8B0B041358372FD0D6417E78F994CA1CD189AB8188607A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
91874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Support/Google.Apis.Core/obj/Release/net6.0/Google.Apis.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Google.Apis.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d9abc7e9b29b2414d7ddee9286a4ce997d12cb6a55badcc1eb975ed5e1d4092
- MD5 0a8358340a205daa492d8bb1078cf532
- SHA1 ccee1965d4092b548262d7d8c93b3f86aa7b7150
- SHA512 69bf0e8f1518f39b5107c5b561f82ce47ee908ac0dca767becef5845a39f00e6619bba2b41b5021bf6c6c6b39d447286da18b6de4ef2568091c0e9c22f09d978
- SSDEEP 1536:OdPCVuo40vApOKMWSNblq0BW+FfkzHk07rCjZ:OkF40vAVR0JFfcHvo
- TLSH T133834A1263ACCFB3DBDF9B7CA83056A24771F606F502E78E4D4C99D918A379019913A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
89934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Support/Google.Apis/obj/Release/net6.0/Google.Apis.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Microsoft.Bcl.AsyncInterfaces.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5705d245072d3eb78400547b32147dbb6e2c8b02ba8bda76729798f5efdeaecb
- MD5 8074b0eeb2d4cf9b1a6b26865bf91aa5
- SHA1 2e438aef830795b2d240cf3160a3353bc6cb0232
- SHA512 05f7d9003427e611f011018844fb8180403cd6ca807e4c5a8beeed03e4cd7fd8babd89dec51a14510eef7c266ba4505b731eb065606d066b061751c89a1d772a
- SSDEEP 192:mzuPwZ40ytyqjaWeb/WIWOL8/pCuPHnhWgN7aAWDr/MqFCfvXqnajJ72h/j:7G40ywqjaWeb/Wg/uPHRN7yM9Xl172hb
- TLSH T10C722A91C7A84203EDB57FB05679D5463C3CB6D26C31922D1189E29A1CE7BC1EB31B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8e:7e:f2:5e:12:89:94:a4:49:bb:ee:3f:25:b9:95:26:a0:eb:2b:62:d5:1c:de:26:01:e7:d8:a8:bb:f2:47:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:3e:ce:ca:77:52:c5:f7:34:2b:00:00:00:00:01:3e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2020 - Jan 12, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
11386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/netstandard2.1-Release/Microsoft.Bcl.AsyncInterfaces.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Microsoft.Extensions.DependencyInjection.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ccd830351aa28bc683d4f8d1cefd9e724161f972d25bfb64eee5bf55c48c5e3
- MD5 d6cfda4e1c948aeb3e5d57376334375f
- SHA1 cb8c35306afd15358104ecfe70e724ad9c753e6f
- SHA512 93a7571c4d186243d78641630b8997fdb69d411df307d95c86aed556102369a98b9a13ca5c7ca8d593244cf0b0f039bc37d330b86194b07b2c9f0bcec3c06b2e
- SSDEEP 768:o8+cxuPn//hpz2XCkCkCdvAb4b4qox06OoV0F8l0HCTpw0wo0emDMtj:/+cxuPn/bvvE0Q0HCNfBsDMZ
- TLSH T170133C4577FC8366D5BE5AB065F191149D3BFAC72802E7062948D0AC1CA7FCC2A62FB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:44:d2:12:a3:fa:19:78:e9:74:93:78:44:12:1b:43:4a:85:4e:bc:f7:e4:bf:1d:0e:c7:1a:32:18:49:6b:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:5c:86:d2:e3:ec:39:f6:8b:38:00:00:00:00:01:5c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 14, 2021 - Apr 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
39418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/net6.0-Release/Microsoft.Extensions.DependencyInjection.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Microsoft.Toolkit.Uwp.Notifications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6676557727bc03cf7bceb1cb7b46ec4623ed7eb57813e8f04785bcd9d868b05
- MD5 337150c55ef9c107fe65e51ce4fc9709
- SHA1 60a7acce3c339665e1f5fef99b8d2cd848436511
- SHA512 aee99ab3e51aae4285e8a717cd2400db7826c79f0e404c37949ce944fc8aa1229e781a0851fb4b29c79052c5ae8b8b71c73006cff66480d150bba677c5abadf7
- SSDEEP 1536:vXR9sdzDjgvdVWTEXGy59h/Wd6GWgYOHeLoS3jFbcJe5W+Q7MNQzZfx/IMfyfBTK:vByhUlIQT46JceLoS3jS1+fNiZf2HxQ
- TLSH T13EF36C12D3E88BB9FEEF173AF8B411254EB1E91F7421E7598A08EDA99823740C551373
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
51:ca:e1:63:f0:dc:46:6e:98:d2:cd:7b:43:a7:3f:1d:76:5a:f2:93:2a:24:75:a6:03:e8:c0:2a:4b:c6:f6:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
Chains
Nov 1, 2022
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Windows Community Toolkit (.NET Foundation),O=Windows Community Toolkit (.NET Foundation),L=Redmond,ST=Washington,C=US
Serial Number
0b:a6:99:c3:81:1b:a1:6a:ba:92:38:65:ba:32:f7:14
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 28, 2021 - Jul 19, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
158074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Microsoft.Toolkit.Uwp.Notifications/obj/Release/net5.0-windows10.0.17763.0/Microsoft.Toolkit.Uwp.Notifications.pdb
mscoree
_CorDllMain
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Microsoft.Windows.SDK.NET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 43b12f190d22f258039df567ef407333dc41dc95ac7b232dbf94aab069c65bbb
- MD5 4d96303222f4ccc86a7d55b904b3ba7f
- SHA1 384419bea960a2d3a51ab145d452465109f1d53c
- SHA512 37600b1e4ffefc5482f3005522bde6799c8409be3ec5f4f1cf494d9df5e417ee35485a10ffd13f30fb23a115244be1831785670c702bdef93c49787dc7f975b9
- SSDEEP 196608:PQhPlaviiGD4FjXWPgXzDTjzND/GyCyLnSJ:wne7WqzDTjzND/GyaJ
- TLSH T182373B4293A74F3DDA9F1B79E0C412260739C00A9F866337193CDAA93DD3396065A7F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
29:9d:0f:f0:5a:4f:83:d7:ba:f1:e8:1a:e8:40:81:47:42:fb:b7:13:f5:2a:ec:18:3f:ab:2c:cf:9c:1d:b8:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
23551922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\__w\1\s\NetSDKProjection\Windows\obj\Release\net8.0\Microsoft.Windows.SDK.NET.pdb
mscoree
_CorDllMain
Name
.text
Size
22.5MB
Virtual Size
22.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.Asio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 035c653468ac70370f51fb5bb2001b4cf868e479846ccc8c7a09789aa22e2606
- MD5 ecc97e0779537d8b9069be2515d11fbd
- SHA1 b80f567d786caf8bbd3c48c1ab959a9ad1dc346f
- SHA512 8cc55f96ed44313d00a96e8f5f6c8ad81d8aa0e92cae6fb036471614f618f144f497c543681ad32383b66c3915f64f8d2b31e51bf9b1f879ddf1bf741f3f1a96
- SSDEEP 768:7bmAzhPO8oDBf5hKhaJbLeeicKEturvBbf:fzhP/oDBf5whaJbLvuAurZbf
- TLSH T188F23BB4E7E44627C67D1BBDA4F701060BBDF181D923E70F5E48A09A6EE731486A1363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\net8.0-windows\NAudio.Asio.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
- MD5 4e4302ce791e48f985a3a221a19a272b
- SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
- SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
- SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
- TLSH T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.Midi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
- MD5 f6940019dad6c782bcb645c2f7d52db5
- SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
- SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
- SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
- TLSH T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.Wasapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
- MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
- SHA1 6dbd30a9216590d012a7feb802831f538345756e
- SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
- SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
- TLSH T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
186238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb
mscoree
_CorDllMain
Name
.text
Size
174KB
Virtual Size
173KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7029d547c9da7fad6d32b6fc4fb9120a52f596f6a1c86485ae050a2e971ae4b0
- MD5 bc833a66485ac36dc35c94f05530283f
- SHA1 1faa4ad6a60e2c3891ad77a0b840488e92732800
- SHA512 c37ebb92c90c99a3e68e004b2a9a82a3e816c228823b17807d9415a6b4ec7addc1718f282734e8a02e6f35ef99467683c0f6461b6c3a055b521fe7065ece27a1
- SSDEEP 768:XGRcd/kDtaVj9ugB/0p4wCPREb4DmHBR9QeX:4aVj9ugQhMOb4DmJ1
- TLSH T1B7F22919639CC36BC67F0FBA40A521431336E681F542EBEDAD8831E99E937510761AE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\netcoreapp3.1\NAudio.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.WinMM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 80807335ee64d5bb26a9de0d1f966a902b5adf32c53b853c8b871937d12b437b
- MD5 1b1d3322ddce5eb32c59486910602068
- SHA1 247bf1750eaff673d4eb3930a6703a2cf62ed4ab
- SHA512 b41c1ae1dfa276362028a0c0b8e91e92b40b6c046866df4d983a02b63464e112f3714df4258d29c1d84123eaaae6eac51624e0dfd6c37fdf863ba940560166a3
- SSDEEP 1536:0WVGj/N4HIhMBYN1nRfEfEs8Ve56qMDrg:0+Gj/+HINvbVKP
- TLSH T163433B016BD8427BD6BE1B3EB0B60A130B74B9E2766BF74F549CB2DA885279004417B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
64354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\net6.0\NAudio.WinMM.pdb
mscoree
_CorDllMain
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99f690cf6cdc829f815c06c27fcda9bd18f85b475a8b1b00898fb669fe39f98c
- MD5 701249dcdc4d0bbb0f0297d30644b511
- SHA1 587b0cd3e106028345cf3c46604a1ab3450c4f30
- SHA512 b2ab3ec44416b88acf6be92a60f646a1ec89eb2f97bfec93d04ac04c5c64827f3152bfd0bd676a07bb89f0031df2bf67b38d491d3b5a4ff8da5d496352f31e27
- SSDEEP 192:dKHBYhRQzpGaAIaShUMW2Son1MRlLGQXStY:dKHC4zpG/rShUx2KQQit
- TLSH T1C6F1D735AB98C633CAA60F79EC1707D41774FB40E943CF2E0D8CA09AA9533495B627D2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13786
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net6.0-windows\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
db:69:79:e3:5c:70:08:83:fe:bc:7e:9a:7d:cc:6b:4a:a2:9f:06:b4:df:02:3b:79:7d:fb:2f:07:8c:1c:fe:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 4, 2024 - Nov 3, 2027
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 26, 2024 - Nov 19, 2025
Minor OS version
0
Major OS version
4
Entry point
715818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
692KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Plugins/DDOSPlugin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc18375d1123649a167d2b41663da3326fcba8a1feab866af6168ece28cf5410
- MD5 8dd30b91cda2bd3e440499732232d02f
- SHA1 0ba11d8bfd5c8052344e831755705c98cd139ef6
- SHA512 9deb6dac97c4eee7204831d333ef220a1de12774bb813b3fa82f4b6c117a6ce13675407b59b2421879fece0f25c1361f9cf95882e680a5fc643597bc788c51c4
- SSDEEP 96:b6Fe2TbxDr6HzpmInoY7CdRlNj4lmJ0v97lxUdF72LYPjOrKnD8TlM6:b+TcnSr4lmJlwYPjPsV
- TLSH T10402C409A3FC9521F5AA1736ADAB4790573FBA504A73CA1F14CDA40E1FB3B100960BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\DDOSPlugin\DDOSPlugin\obj\Debug\net10.0\DDOSPlugin.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Plugins/DLLInjector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 431b98643118f3d981e2a4e92dad2d6f4484fbc99f6636477f557268159499ca
- MD5 14a8575341bb86a4b7915fd75577464d
- SHA1 dc0242b7cb8afdc7795bbc367cafe7496e208edf
- SHA512 ecde6ba0cd9ef39c5a490349937eccd87b6eda0c0b1f1f9a6db8dc7f6a3254354034b5ef40d306043e2d52343e8693e0ecddf08f46e44675acb3ba614f6de8ce
- SSDEEP 384:4CGwbt+WhZwJ3v4YVWN7quUui45PWOlmKncZ/1CABNw2om91BYtthezQxYHjxZI4:PGiepwYVQdBRWzuxWjxZx
- TLSH T1EFB2A509F3F45215F4BA0B74AA7784A107B37E661A34D65D0A8C689E0FB3F148A317B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\DLLInjector\DLLInjector\obj\Debug\net10.0-windows\DLLInjector.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Plugins/XControl.API.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 17e0f656df1692db71c33a0330160a2e88c52d13f842568b27a99690d1309ab0
- MD5 616fbd2383bbdccd418a29d3de4bfcbe
- SHA1 82e3b87670304a47a72813a1f1330e32d3a514ce
- SHA512 fd5f2c1f064cd88e7ccb82c089898dabd1f0f9368c5bae84487a3f07e4e38ab7635f6a83425a53ce15a333b1a4e94952d7bee12590d9afd9dce0d949adf8bddf
- SSDEEP 48:6J+lIkG2Sh41Ubc23fm39DdVSd9Df3rXEss/TzqX1rpqwmYfJlYsq0msGG+L:T42ShZPe9DdA161+JGsq0msn
- TLSH T1B491851177E48776EC21077AFBA717990335FB204F929B1E258438AF2DA36240E31F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\XControl.API\XControl.API\obj\Debug\net10.0\XControl.API.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Profiles/BetterMC.json
- SHA256 5365beac51aa20d1a6471b8d75bb3c18e8f7bf52b4229f27a4689d45a0f2e62c
- MD5 c3cb7d9f01ac0640143b8576ee281304
- SHA1 e52d90a8318e50a41cd36e5ed85743ca1efec0dc
- SHA512 dd1c0ed39d86cce6bf4d51c0a8205bbb8d299ddc71a16ad9e2d8d44f89054ca04d2b460185d28a98148e9863354ac6b26fd80356c293580dd7854bf676b197bd
- TLSH T1931157A6D012846B3CB93651E2350D0EB6221F1FC474CE2F3ABB3143E183D2542063A1
- MD5 SHA1 SHA512 TLSH
net10.0-windows10.0.17763.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 527ff1125d7b4a3ebe76c7c28a0eb524678abcf00108fe0166c9e8c22ef4da9a
- MD5 5c9d4a80197231cce87e8b05d3b6de3a
- SHA1 55e06ee5daee171c9845ad81e818e4b8bbeadaba
- SHA512 2636b7323fbf873a75b0c9acc0bdf1c7572ec7cd4b421946e97bee21dbec63dfac8ea838981a2f590c6840d0a6b8307faeade97cd708fa27345a8a57c4a81b97
- SSDEEP 768:D3d7FaaAo2k+jsRaRF1S9h6ukVFDGooZFkiSLJKdbRDUDjxI9zM8X:DN7FaaAFk7aRFy6rnvoZFxS9ydDGCz5X
- TLSH T1B473B5105FE8571FCAE70672F4BC8234EB74B6C72C11DA4B2A3B51190876FE04B657AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
61:4f:7e:de:f1:f2:86:e2:c5:e2:30:13:10:32:85:e1:b9:01:86:65:d3:ac:bf:df:8f:37:6a:ef:a9:5c:d0:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:7F00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:06:d7:bc:51:38:98:23:ec:2c:00:01:00:00:02:06
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
68938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/System.Speech.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9486209b44c23ac9a1e931d4cba6150f6e5fc9e440f272f97bbd645cb7f13dd
- MD5 225d7c43e0b52ec49d2cea9ac55c851b
- SHA1 10708f92b35297bdea7179229578515d4b9c279d
- SHA512 d36d0e582f847634a3319e80d3900307baa74770f4d7dba2215363d6b29c486c9dfaa22c4f31b9e1852a53387fb2edf59d692606267e992f9c634370ef98699d
- SSDEEP 3072:g2WSLbSKJhpqvW84D2JWRAOKOCc/3j6c/OpRqjAkk9Ds1X5+Xgr39Iy+jfQpXz9S:g2WidpqvW8M2JWtTvPLUp
- TLSH T14F64705A7BF54249ECB2023C64DF69353B39FD8A3612D44F0756B13E3863B44E2A096B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a2:bb:78:73:dc:4a:c1:57:a1:eb:36:fc:f5:03:ec:78:3a:8e:dd:a6:62:ed:2c:c7:22:84:22:06:ea:b7:51:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
305034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Speech/Release/net10.0/System.Speech.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ab016af030fd5698eda88b7bd4083b06f2670df218290209d1f40c492e781ea8
- MD5 97c95c10a3cde4529e990d9a54508b5e
- SHA1 9c534ddaf630b692e174edd447ff175da55674ff
- SHA512 9e29fb811fdcc11748f079dc03cdf962a982fbd5454d3bab4793969418adb7991f0b1af25b271145953e2e58ddc53dd09cc6d9e5fd6704b22535de4e8f180a81
- SSDEEP 1536:VjJXs7CpOC0aEm3WYTVLC2YEWnQxpVRGP1MttAodXEJYb:VjBH0aE4522YXQxpiP1WAodXsG
- TLSH T1E6733A5897BC8B36DAFE47BEF022445953B0D502F36BF38E8D9CF8D6659239006142A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Thomas\source\repos\resourcelib\Source\ResourceLib\obj\Release\netstandard2.0\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/WinRT.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
- MD5 edb1f8d15fe41838cd449141187ae032
- SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
- SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
- SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
- TLSH T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
76:8b:0e:cb:49:f8:03:dc:83:d0:6b:9a:fc:b5:4e:a4:af:1a:bc:73:6c:7d:76:5b:48:87:e6:c6:4c:bc:a0:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 11, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ef:89:3f:56:a1:58:cc:a8:da:00:01:00:00:01:ef
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
522118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\src\WinRT.Runtime\obj\Release\net8.0\WinRT.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
504KB
Virtual Size
503KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/XControl.API.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 17e0f656df1692db71c33a0330160a2e88c52d13f842568b27a99690d1309ab0
- MD5 616fbd2383bbdccd418a29d3de4bfcbe
- SHA1 82e3b87670304a47a72813a1f1330e32d3a514ce
- SHA512 fd5f2c1f064cd88e7ccb82c089898dabd1f0f9368c5bae84487a3f07e4e38ab7635f6a83425a53ce15a333b1a4e94952d7bee12590d9afd9dce0d949adf8bddf
- SSDEEP 48:6J+lIkG2Sh41Ubc23fm39DdVSd9Df3rXEss/TzqX1rpqwmYfJlYsq0msGG+L:T42ShZPe9DdA161+JGsq0msn
- TLSH T1B491851177E48776EC21077AFBA717990335FB204F929B1E258438AF2DA36240E31F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Администратор\source\repos\XControl.API\XControl.API\obj\Debug\net10.0\XControl.API.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/cl_default0/Stub.exe
- IMPHASH 922925c6d0612eb528f8f7dd82b32198
- SHA256 694da08024ef5b3b235e26bfd225396d7ed18bd0a58129b0399459e7cd22ab7a
- MD5 09353fb64b8996fd49291b62bcf8f1b9
- SHA1 712897cbf72334610769e26ebfdbfd17af9fc5ad
- SHA512 3e5953a19ac43fc71bf304e577a09e56d9ae4251e2c445a43ea6c9b600b78f5be071c5660becb1a376b9f5f79603c846626ee5fe8544daf450d09f4aeb2a53c5
- SSDEEP 98304:KUMYsabSjCmrVHmRcAcTNJsDgbqMD195DjbPghwC51a/H2Sg3cpU/CmV0Nb1BCRu:KzgomRcAMbqQaa/H2Sg3cs0JKoCOtd
- TLSH T10FF6BE1893880AFBD52BC674C665D332E7F178864735DB4B1988D24F2F7F6908E6E221
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5615496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
AdjustTokenPrivileges
CheckTokenMembership
CloseServiceHandle
ControlService
DeregisterEventSource
DuplicateTokenEx
GetTokenInformation
ImpersonateLoggedOnUser
LookupAccountNameW
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegisterEventSourceW
ReportEventW
RevertToSelf
SetKernelObjectSecurity
StartServiceA
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptHashData
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptExportKey
BCryptImportKeyPair
BCryptFinishHash
BCryptDestroyKey
crypt32
CertVerifyCertificateChainPolicy
CertOpenStore
CertNameToStrW
CertGetNameStringW
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChainEngine
CertFreeCertificateChain
CryptImportPublicKeyInfoEx2
CryptFormatObject
CryptFindOIDInfo
CertAddCertificateContextToStore
CertAddCertificateLinkToStore
CertCloseStore
CertControlStore
CertCreateCertificateChainEngine
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CryptDecodeObject
iphlpapi
GetAdaptersAddresses
GetExtendedTcpTable
ConvertInterfaceLuidToIndex
GetNetworkParams
GetPerAdapterInfo
GetTcpTable
ConvertInterfaceNameToLuidW
kernel32
GetProcessHeap
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
RtlPcToFileHeader
FlsFree
EncodePointer
InitializeCriticalSectionEx
AllocConsole
Beep
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CloseHandle
CloseThreadpoolIo
CloseThreadpoolWait
CloseThreadpoolWork
CompareStringEx
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventExW
CreateFileW
CreatePipe
CreateProcessW
CreateThread
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
DeleteCriticalSection
DeleteFileW
DeleteVolumeMountPointW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
EnumCalendarInfoExEx
EnumSystemLocalesEx
EnumTimeFormatsEx
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNLSStringEx
FindNextFileW
FindStringOrdinal
FlushFileBuffers
FormatMessageW
FreeConsole
FreeLibrary
GetCPInfo
GetCPInfoExW
GetCalendarInfoEx
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoEx
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessId
GetProcessTimes
GetStdHandle
GetSystemDefaultLCID
GetSystemDirectoryW
GetSystemTime
GetThreadLocale
GetThreadPriority
GetTickCount64
GetTimeZoneInformation
GetUserPreferredUILanguages
GetVolumeInformationW
GlobalAlloc
GlobalFree
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
IsWow64Process
K32EnumProcessModulesEx
K32EnumProcesses
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
LCIDToLocaleName
LCMapStringEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LocalAlloc
LocalFree
LocaleNameToLCID
MoveFileExW
MultiByteToWideChar
OpenProcess
OpenThread
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ReadConsoleW
ReadFile
RemoveDirectoryW
ResetEvent
ResolveLocaleName
ResumeThread
SetConsoleCtrlHandler
SetEndOfFile
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetProcessShutdownParameters
SetThreadErrorMode
SetThreadPriority
SetThreadpoolTimer
SetThreadpoolWait
Sleep
SleepConditionVariableCS
StartThreadpoolIo
SubmitThreadpoolWork
SystemTimeToFileTime
TerminateProcess
TzSpecificLocalTimeToSystemTime
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForThreadpoolWaitCallbacks
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
RaiseException
AddVectoredExceptionHandler
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
WaitForSingleObjectEx
CreateEventW
SwitchToThread
SuspendThread
FlushProcessWriteBuffers
GetThreadContext
SetThreadContext
FlushInstructionCache
GetSystemTimeAsFileTime
VirtualProtect
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
SleepEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
ncrypt
NCryptOpenKey
NCryptImportKey
NCryptGetProperty
NCryptOpenStorageProvider
NCryptSetProperty
NCryptFreeObject
NCryptDeleteKey
ole32
CoGetContextToken
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoCreateInstance
CoUninitialize
PropVariantClear
CoGetApartmentType
CoWaitForMultipleHandles
oleaut32
SafeArrayGetRecordInfo
OleCreatePictureIndirect
SafeArrayCreate
SafeArrayCreateEx
SafeArrayDestroy
SysFreeString
SysAllocStringLen
SafeArrayUnlock
SafeArrayPutElement
SafeArrayLock
SafeArrayGetVartype
SafeArrayGetElement
LoadRegTypeLi
secur32
GetUserNameExW
user32
LoadStringW
ws2_32
recv
getsockopt
FreeAddrInfoW
select
send
setsockopt
shutdown
GetAddrInfoExW
WSAGetOverlappedResult
GetAddrInfoW
GetNameInfoW
WSACleanup
WSAConnect
WSAIoctl
WSARecv
WSASend
WSASocketW
WSAStartup
bind
ioctlsocket
FreeAddrInfoExW
closesocket
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
calloc
free
_set_new_mode
_callnewh
_aligned_free
realloc
malloc
api-ms-win-crt-math-l1-1-0
sin
sinf
sinhf
tan
tanf
tanhf
powf
acosf
acoshf
asinf
asinhf
atan
atan2
atan2f
pow
atanhf
__setusermatherr
cbrtf
ceil
ceilf
cos
cosf
coshf
exp
expf
floor
floorf
fmaf
fmod
fmodf
atanf
log
log10f
log2f
logf
modff
modf
api-ms-win-crt-string-l1-1-0
strcpy_s
_stricmp
strcmp
strcpy
strncpy_s
strlen
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
_cexit
_set_app_type
__p___wargv
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argc
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_seh_filter_exe
_initterm
abort
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_c_exit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9.1MB
Virtual Size
9.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
704KB
Virtual Size
855KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
415KB
Virtual Size
415KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
267KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=35403,
count=13, id=260, version=35403,
count=47, id=261, version=35403,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=257, version=33145,
count=428, id=1, productName=Unmarked objects,
count=10, id=259, version=35220,
count=44, id=260, version=35220,
count=1, productName=Unmarked objects (old),
count=65, id=261, version=35220,
count=1, id=256, version=35728,
count=1, id=258, version=35728,
net10.0-windows10.0.17763.0/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b88e0948e2a6c49e5372c7e7d27817f5d2fb7ffed949b40cc98a2e5037b73ef
- MD5 386f1ca0587d1a5772ef7a509f447b84
- SHA1 53d678edc0352e7b62dbd1ee62b3839823c613ba
- SHA512 a2bd7a1a27acb74a31643edfc3ef75bfb6af6e344941ee7303907b1966e6ede23ab1aba829686931781e1c546e5d9273d6bfd2749bdcf84fa98afcfc8c2d52c5
- SSDEEP 24576:QMW7IQ990aiwDjKiZ8dliMRoF+JQN5TNObyv7fWAV:UJsdj4y/
- TLSH T18E455C1177E99F37D09E87BAD97509680BF1EA0AE793E71B5710FA692C837449C003A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1187390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net6.0/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/resources/upx packer/COPYING
- SHA256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643
- MD5 b234ee4d69f5fce4486a80fdaf4a4263
- SHA1 4cc77b90af91e615a64ae04893fdffa7939db84c
- SHA512 aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957
- SSDEEP 384:ghUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:gmFWixMFzMdm7jUI
- TLSH T13A82A42E770443F205C202A16A4F68DFA32AD5B9723E1155386DC15E236FE35C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/LICENSE
- SHA256 905d4a66d5324e154d976bbf88829d4d9263815a2b97cc40954f06d4a23c28eb
- MD5 353753597aa110e0ded3508408c6374a
- SHA1 f33a1dbeeff88775cd66940d4d3383544b618680
- SHA512 10565fb864e912bf52e23e71ca8805f85de96f76ed06dc37c28f0cdb18eaa8ed3921245a1286b6856ae39787858d0f3ce15f6ca7053e76fc3e81541769a8f5ad
- SSDEEP 96:LrmxPO+n4/uwNmu+3h9R7x4YZgll+8jcH5k4:HmxPr4/uwoJ3hTvc+8jcZV
- TLSH T165B1B5AAEA0C93F005C316125985DDD8E20AA16772994CE4BC5DC38E0F6DB3892F92E1
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/NEWS
- SHA256 1e529b356e1517ce6b553d7f26ac72950539475d2c9f16a862cb18361e769879
- MD5 db9355d9148911b5d424f6228efa5308
- SHA1 eefeaf70f37088c6c9a25c8a99ebc79d819ef71d
- SHA512 74636063649a9ad67ae654e3c769a1372b6465b7976db9d1450e920e28a9c4c32af81d83a0a881ee5c26fd1fa1ff43440c3381d180d5b14fc58a316ad0290998
- SSDEEP 384:+wYuSxNjjR0sDi2u7lCTirSyzeZVzuqxGzgl77SGj9WFybwruza9CoVd1zhyNhz8:+xNjjR7ju7lCTLa4+qy/W+VrzkhPdwXR
- TLSH T191C2B722290531B203C3A6C27BD67186EB1BA1BDB710E125B7BB850C1F513DE56AF5E8
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/README
- SHA256 04085613a1d16c859a8557b069fc72babd2a94fdc237446f606397f9a6c68f2b
- MD5 2fab208b2bbe37b585cf26d64e203bb2
- SHA1 6c73f5e8e2bb9085fbe873bc515c47ad61c09d04
- SHA512 1ca729b63899fd86e91cf2b93927e4b8f907df06fa7dbe46e64c02c20b5625ba7bdbe4ed9170cc4e8dd393a789b369d43ae10d17b9c4dcf84f7fee71ab4f31a1
- TLSH T1D371B8A6570C67B30DC21732534E4CC6AE8E5A2A726A5CF5B80C424F2718F1885FF6F4
- MD5 SHA1 SHA512 TLSH
net10.0-windows10.0.17763.0/resources/upx packer/THANKS.txt
- SHA256 7daa50ab3a8a438f0c6a7e4834ccb1ce7c8984f94d3e927fd605d681d4ca6460
- MD5 fe9063d206f754e48e32571955da7404
- SHA1 1b5bb403cf50bf6eea545d77b7ba0164dc23e5fc
- SHA512 7722cfd307695ad78f18a2d41c5f93ba8863a09296927fac9e48a05555306d261d49e26f13c7d0fcba0e844a09e44b52b199cf5433c67d86a7ae19be33d96f92
- TLSH T19E4153674D0DB73311829A315A084D81EB9D45372662CCFBBB7F430D5B4086A4AEE1C0
- MD5 SHA1 SHA512 TLSH
net10.0-windows10.0.17763.0/resources/upx packer/upx-doc.html
- SHA256 8a94e57e68e85928fd5a6ca9fe7a29cf768db11184f36ceff52b07f6b6277030
- MD5 556b21c36534ce225de3c248e165787f
- SHA1 d9aac412be377352504c98ac760460fc892f5fbb
- SHA512 86ad1392f31de483bc734f2d0dc8ab1b0a833e3b8380f12edae84bd903eef78eb7d72486417eebbd0a7afe240c30f52ac5d6df15219fed4cd5c9ec9b4290dbac
- SSDEEP 768:OWHwJhpQ/Yh7xxDmoyW4WB8FmS7lkUcyhE2UcyhEEoam4qKTwRwQTnIkonb7h:9HwJhpQ/+7XR4WsJkdOE2dOEEq4pTwRK
- TLSH T1CA03E976C75D13B304C5AA797F19A6DD9B2AA32C323222D0B84D820DA30593855FFBF5
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/upx-doc.txt
- SHA256 4dc547edc7201f205ce904f373518b6fcaef608d5aafd8a4a7564d42993b8c42
- MD5 8f2aef0cac45e8dd292594ca7f7ad756
- SHA1 eaca890612d3a21b50595ae7bbb636aa8e64ef77
- SHA512 d677399f399303a83c8499a3414e9f46d6bcfcb37776f1579942fbcb71ac056cd08914a53f63e3eb7998100b849dfc955b0e095eb7025f222f8be274ee619fdb
- SSDEEP 768:UmW5wh5hr32FGhyidWclu84ZyrtkwKK6kwKKOM6dftXEY3y3X78SwxwL9:Ul5wh5hr+3igclu84Y5Z65ZOtVXEY3Uj
- TLSH T1D3F2C66A9B4C13F615824A716F9DDBCA5736D22B32326550B8DD820C1F06D385AFBBF0
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/upx.1
- SHA256 6f18ec47957ba41dc4a85917f959a56abf5b25e15deddc3b9cc8c2f518aa364a
- MD5 c8d0c6047b5f5d5a780705e29e5bebcd
- SHA1 0ebc721bbb3996838061b45fff940c2df71580f5
- SHA512 463b016c5a839bab08907fd71f97ace28d34d13a3313cc1387fd47a372ec7254f1b500a28fe775910fc53bdd2740d1ac6a39466d4bc5376f5ca71210c2a87300
- SSDEEP 768:4bkWbuszVANCMGjfiqmjsl70EWmHkSJ+TdbFiG1mfUkghDUkgq7WczzofcfodPgs:AbuszVANC1tmmw3mHkSs5bFiu0xghDxq
- TLSH T15003E877468D13B51E8159D05F19AAC95725E22A3332D164F9AC810DE301A3F8AFBBF3
- MD5 SHA1 SHA512 SSDEEP TLSH
net10.0-windows10.0.17763.0/resources/upx packer/upx.exe
- SHA256 16a29adbdf3b6fde74c290205e24cceb7bef1a216941922aa73d2d808a699bbb
- MD5 3c5e325d6b638567fdbe4a446065b0d6
- SHA1 04e7a89b85f270baa19e734f42a9ed19b6731f27
- SHA512 dc95c059514c9d48361b665a4dd2d4c26a62202e00e5864c2a0a02dc2e4d0f653790c2c645d85c26d4cb919f7b2be84c66975a84544f5eaed6ed197d64c6e499
- SSDEEP 12288:1yIuN1Ya+E/1OB49YEM2MqC5NkmIKvsA2qa7OR2vn/FW47Oxgmvfm:1AXYa+YfYc5CcE8qS3F6Z
- TLSH T129D423F378C7C9F1F7C7A6736A16B7C0D040EB359BD7A90662AC2268276F84507A6016
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2516592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
606KB
Virtual Size
608KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 34ab5c910e1ed7c405e945d0594abbe9783c2ba0ac3363001b1616ba04ef8079
- MD5 ab1b53e2816cd37a8b35b1896550838b
- SHA1 83a0e82f68681ab98f31d6c90891381f24e91add
- SHA512 ddabfbfdcaa8359478e11a45576584f411a01adb2eea90c9e2bd29ea937b11f8f7e81ada43bd9f40883a9b9a12b3c37681bf1d37ecf14adb138faebf782930fc
- SSDEEP 24576:jbYzFmkREM8vjzbawPxjJyOsqlWTuwpbxjqS4I7FEUH:jUFmkRC7XaihstuI74
- TLSH T145B54B41E2D15CDED5BAC23A011B3A36B17AB80211F55ECB32ACC7B49B7DE489347678
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
912KB
Virtual Size
912KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
net10.0-windows10.0.17763.0/runtimes/win/lib/net10.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b54deff63d4c23cc4bbea00cea659727872f7ceb8ade74475577d45aa92e6216
- MD5 084ba49e366b40e449c8927437844d5c
- SHA1 e921b77cfe5fc5a01684adbc027430b9ddc8e0a7
- SHA512 710f896fac2974187a159a8517063f5811679ad9434c28409a50e09744d4da5625017285d12884592243113d3c2c3a94b91471723b8466ca6adc09313a4979e2
- SSDEEP 6144:ZSZQ2/bmbrBsj0G2OkLYOgHyqXemxZtY9:ZSq2/bmbrB8RkLYOgRvxZY
- TLSH T10664061133F84645E5BF1FBAA4B060A5CFB2B7672D2ED75C0C9168ED18B2780A61335B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
58:3a:8b:9f:f7:be:00:d1:e6:aa:2c:b8:f5:ac:d5:70:98:3f:31:f9:00:d8:76:08:9a:2f:15:97:00:3d:71:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ac:76:2f:fe:6e:d2:8c:84:68:00:00:00:00:04:ac
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:02:79:50:74:21:14:7d:b8:a1:00:01:00:00:02:02
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
309150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Management/Release/net10.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
294KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/runtimes/win/lib/net10.0/System.Speech.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d90047d9d1800e938bbc8f3059bc467f07700693a8987ecce989973d8fd57398
- MD5 a2f531d497701da26b90db1851d94281
- SHA1 095a4a4339555a55a996efe2280d2de92e3d7f37
- SHA512 0ef16f5234c025d04659ca3f06cd44fe612df9cfb69108e52de4186905840f62b30f624e28e3bb5c3f7228e55d4d73db0e77f5d6f4b9b8e974b46aff6c9d75d3
- SSDEEP 6144:dD26R2/xU38hZSi6ZCKirtrfn1GwaawaIsIBjiUdvMiFN2vQztm0K6/huQxcvP6E:dDwJSikpwGHabUd0jS/HsCE
- TLSH T1B8E43A1933E44267DCBA473CA0EA583567B5EC063A23EB4F0385F57A3893B54ED506A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
42:82:ef:f1:8b:37:4d:94:63:7a:50:b3:7b:16:a1:57:11:41:10:d3:ae:39:7d:42:7b:d4:2e:89:61:96:52:43
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 3, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:ab:af:3a:c8:82:4e:48:55:5d:00:00:00:00:04:ab
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 18, 2025 - Jul 6, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
671766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/runtime/artifacts/obj/System.Speech/Release/net10.0-windows/System.Speech.pdb
mscoree
_CorDllMain
Name
.text
Size
658KB
Virtual Size
658KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net10.0-windows10.0.17763.0/server.pfx
- SHA256 1580df3880568df5a8db5e86110a0d134222b79ee11ae9be68576414627a4e6f
- MD5 00c26e992fd75098c4ec12005deb5861
- SHA1 26e7732c4f6d75d243a1b488a26fb228a9a52dbd
- SHA512 4ca6b1d2905ce16be0ff0e79eff8366f658acad3988a0b5c4b47064214511890c7cda3bf33486b4bbb0ca7993262f5af6d213fba599a35b0b7c5d356b3fdd08a
- TLSH T18A5109BB0B7D84986A21DD8A18B9E357C0C093001FB0504BAD37579E2C6BD3075AA247
- MD5 SHA1 SHA512 TLSH