Adobe_Acrobat_en_installer_o_backup_v8[.]6[.]0[.]338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A[.]exe

resource
unpack001/SQLite.Interop.dll
unpack001/System.Data.SQLite.dll

resource
unpack001/$PLUGINSDIR/INetC.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack001/$PLUGINSDIR/processwork.dll
unpack001/CBFS6Net.dll
unpack001/Cloud.AzureClient.dll
unpack001/Cloud.Backup.DiskImage.BootImage.dll
unpack001/Cloud.Backup.DiskImage.dll
unpack001/Cloud.Backup.ESXiEngine.dll
unpack001/Cloud.Backup.ESXiEngine55.dll
unpack001/Cloud.Backup.ESXiEngine67.dll
unpack001/Cloud.Backup.ESXiEngine80.dll
unpack001/Cloud.Backup.Engine.Data.SQLite.dll
unpack001/Cloud.Backup.Engine.MBS.XmlSerializers.dll
unpack001/Cloud.Backup.Engine.MBS.dll
unpack001/Cloud.Backup.Engine.XmlSerializers.dll
unpack001/Cloud.Backup.Engine.dll
unpack001/Cloud.Backup.Exchange.dll
unpack001/Cloud.Backup.MSSQL.dll
unpack001/Cloud.Backup.VM.dll
unpack001/Cloud.Backup.dll
unpack001/Cloud.Base.XmlSerializers.dll
unpack001/Cloud.Base.dll
unpack001/Cloud.CbfsInterface.dll
unpack001/Cloud.Client.XmlSerializers.dll
unpack001/Cloud.Client.dll
unpack001/Cloud.GoogleClient.dll
unpack001/Cloud.OpenStackClient.dll
unpack001/Cloud.S3Client.dll
unpack001/Cloud.Wizard.dll
unpack001/Dapper.StrongName.dll
unpack001/DiskAccessLibrary.FileSystems.Abstractions.dll
unpack001/DiskAccessLibrary.dll
unpack001/Esent.Interop.dll
unpack001/Hpack.dll
unpack001/Http2.dll
unpack001/ICSharpCode.SharpZipLib.dll
unpack001/ISCSI.dll
unpack001/LZ4.dll
unpack001/Lucene.Net.dll
unpack001/ManagedNativeWifi.dll
unpack001/MurmurHash.dll
unpack001/SecureBlackbox.FTPS.dll
unpack001/SecureBlackbox.SFTP.dll
unpack001/SecureBlackbox.SFTPCommon.dll
unpack001/SecureBlackbox.SSHClient.dll
unpack001/SecureBlackbox.SSHCommon.dll
unpack001/SecureBlackbox.SSLClient.dll
unpack001/SecureBlackbox.SSLCommon.dll
unpack001/SecureBlackbox.dll
unpack001/System.Data.HashFunction.xxHash.dll
unpack001/ZstdNet.dll
unpack001/libzstd.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe

IMPHASH 12082e77cfc7e34f96f21f95764c8ac3
SHA256 f11345c8996c1750815b1d25269ca69c7b3a931ebfb244cd85c23b299d92fdcb
MD5 300c93aeb6144b9d796e8da02d2cbe0f
SHA1 938668a34b37d82f527184e46a94b606468240c8
SHA512 298f61a86ab631dfcd1c742bcfa9c9d1e24949ebb1c881325677507e4f6112b55e1f2d31b2fbd2e91fe56de94df26cb1801ff66084b8e11f7017e45de7add426
SSDEEP 786432:4VjuqDKDNANzbZfTpZBmmLkGkPpFM6znBgz9:4VreDN2JTpy5ZpFvznBe9
TLSH
T1AF473377D94610FAE07D17F665DC9FB2088D8C2F18C219C616EC22D0C293ABA27D7679
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

cc:d7:ae:86:e9:ca:69:83:63:86:a3:c5:d7:7f:61:1b:f9:fe:95:4c:b4:12:39:a0:ad:2c:3c:e2:bd:e0:8b:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetShortPathNameA GetFullPathNameA MoveFileA GetLastError SetCurrentDirectoryA GetFileAttributesA SearchPathA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime CompareFileTime lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetCommandLineA GetTempPathA GetProcAddress DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer ReadFile WriteFile GetPrivateProfileStringA WritePrivateProfileStringA MultiByteToWideChar FreeLibrary MulDiv LoadLibraryExA GetModuleHandleA

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SystemParametersInfoA RegisterClassA EndDialog TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA SetTimer OpenClipboard SetWindowTextA GetDC LoadImageA ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA SetClipboardData EmptyClipboard DestroyWindow ExitWindowsEx SetForegroundWindow PostQuitMessage CreateDialogParamA

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/INetC.dll

IMPHASH 8ef3613e48db9e7b48e33704238cd659
SHA256 5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934
MD5 92ec4dd8c0ddd8c4305ae1684ab65fb0
SHA1 d850013d582a62e502942f0dd282cc0c29c4310e
SHA512 581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651
SSDEEP 384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
TLSH
T123A23B5253605FFEE3D71938B8B7773745EAE76464178A8F06732E8918B2352B930382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16209

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA LocalFree lstrcpynA DeleteFileA CreateThread WideCharToMultiByte lstrcpyA TerminateThread LocalAlloc MulDiv WaitForSingleObject GetModuleHandleA ReadFile lstrlenA lstrcatA GetTickCount CreateFileA GetFileSize GetLastError lstrcmpiA CloseHandle GetProcAddress lstrcmpA WriteFile GlobalFree GlobalAlloc SleepEx SetFilePointer

user32

RedrawWindow GetMessageA wsprintfA DestroyWindow EnableWindow GetDlgItem UpdateWindow LoadIconA SetWindowTextA IsWindowVisible SystemParametersInfoA GetWindowLongA GetParent MessageBoxA SetWindowLongA DispatchMessageA KillTimer PostMessageA GetWindowTextA IsWindow SendDlgItemMessageA CreateDialogParamA TranslateMessage ShowWindow IsDialogMessageA GetWindowRect SetTimer SetDlgItemTextA SetWindowPos SendMessageA GetClientRect FindWindowExA

comctl32

ord17

wininet

InternetReadFile InternetErrorDlg HttpQueryInfoA InternetQueryOptionA InternetSetOptionA FtpCreateDirectoryA InternetConnectA InternetWriteFile InternetSetFilePointer FtpOpenFileA HttpEndRequestA HttpAddRequestHeadersA HttpSendRequestA InternetOpenA InternetGetLastResponseInfoA InternetCrackUrlA HttpOpenRequestA HttpSendRequestExA InternetCloseHandle

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 2274cc1534607459cdd304a928601ef9
SHA256 e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
MD5 88ad3fd90fc52ac3ee0441a38400a384
SHA1 08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
SHA512 359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
SSDEEP 384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
TLSH
T16F724B25ABA083FFC5500571A6E1672217FA98301979586F8E73EEC62FB59436C3E703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA lstrcpynA GetVersionExA lstrcmpiA GetCurrentThreadId LoadLibraryA FreeLibrary GetLastError GetExitCodeProcess WaitForSingleObject DuplicateHandle Sleep GetCurrentProcessId CreateThread GetCommandLineA OpenProcess MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle SetLastError GetModuleFileNameA GetPrivateProfileIntA GetPrivateProfileStringA GetProcAddress GetModuleHandleA

user32

SendMessageW DialogBoxParamA CharNextA UnhookWindowsHookEx CallNextHookEx GetClassNameA SetWindowsHookExA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow GetWindowThreadProcessId MessageBoxA SetWindowLongA LoadImageA DestroyWindow GetWindowLongA EnableWindow ShowWindow SetWindowTextA wsprintfA GetDlgItem SendMessageA LoadStringA EndDialog

advapi32

RegCloseKey QueryServiceStatus OpenServiceA CloseServiceHandle OpenSCManagerA OpenProcessToken RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 fbec5dfc6532218c49374ee1607058acd72c0c9d4418fe5e60f0b7935d0d6eab
MD5 98aca846c2f9d4569cf3746159cf881e
SHA1 d088cf3e48c53d61aa792e90387c9bc50a85ee11
SHA512 780e277ca2eb71aaf9b9928df7662510f60714291507335664cdfcb642ab096d479f7a5175256d91a3635011bceea11962a6a047aacfebade1281b1e578a9035
SSDEEP 3072:2uwfYJ0ZclxW7Tk6lIwllZsllllLtq95ucp/jkfWfW:2uwQJkccifWfW
TLSH
T122E3E51942511DC4D852A5EBBB2E2E8F3C88BF9C5139F6F98C26B72BD1390FB8579101
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

IMPHASH ddfc5272f0f38c6d49db71b2dfaa312e
SHA256 81745087f193b6fa131189f4b3ee9caa93e9692e408d3955fbcb9a4ec8516e2f
MD5 0917ee492308b691326e6581e8c793c9
SHA1 ff689c8051ffca7657461ac828bc46e303ab8e59
SHA512 2a4ae4b93b0eac113a0e65f459798466120f1af4605a82a11f9022d790fe0b4f7d368b312f8a073b1dcfe8760e529ea56a5b5d4289321dc9f2fc8a22691b42b5
SSDEEP 192:L+QMtjhIz23Tv7QpAXXcxwtXexpnGOO81h2xXP:SQ6nDv70AXXcWtXexpnGIhW
TLSH
T1C642090A1F6082F5F8F201BA557A2B355A1D7E19971E1EEB07A314142E209C73F39BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

9920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8abe046ef411de4d3e6e831b6b1ee264
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 67cfa491a15c2e6ae037612d4a7ef727
SHA256 15b527ac5d224b2b684ef07fecd6d71d61f05955e3a2bd3dd1de6378e927b3f8
MD5 b7878c46c342f851d35fb2dbc898a593
SHA1 dd0ebd231edcfdc0a561cbda733c58e22ce3156f
SHA512 d7f179d33695b62da5fc0643fac461129975e78a8694c02e8c8d74471d0ee4061b92f1010401209605146861b259d34079583b2080c8ba69382c2122d9b969c2
SSDEEP 384:QYUEEoUMA9RoB+cq4OJTv/ldPWUn2kaVC+DEbXG989qX6rMIZy9RrT:PeRoBXHoTXld3n2XubXf9+EMNvrT
TLSH
T152A25B566170A8F1F92618FAB9D26E237F7DF90834745897CB23056D2A91863BF3C312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/processwork.dll

SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
MD5 0a4fa7a9ba969a805eb0603c7cfe3378
SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
TLSH
T1F2343B36E1C0CC76D5672B7CDC49E3D8556EBA302E2898866BE91E8C9B3D391351C287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

208948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

147B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

47B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$TEMP/$R0

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
MD5 4a545dc7605e6bdf8e107173e5eba69c
SHA1 cf45cf7594e9970b4ffeda48ac728556e3d232cc
SHA512 3be7af94fd0b20ddfeedf3001991280e2da7a4c48763e6dc55ac8f3461ed4a200773cdb6f3b6cee47abd49680acd9377ddb6d539e2fa604da0b9df390de11fa5
SSDEEP 768:/T8ZI9YIHMfndz2dgKCsUoEBLhpX8Mmg2EIEMmk2Es:/TEeYIHMFydgKCsSLhpX8Mmg3Mmk+
TLSH
T1DA238D0277E84546DEEE4FB974F449390A71FB836D61C5CE16ACC0894E62BC16B603BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e2:3e:8c:ce:4b:67:a2:ea:6e:cd:15:67:bd:8f:fc:bb:f5:7f:fe:76:dd:a7:1f:bb:14:94:57:0a:bf:8c:3a:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

8f:bd:8b:71:72:a7:b0:72:19:31:ed:a0:9c:b4:7e:54:ce:65:a3:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Serial Number

50:1a:3d:4c:78:00:f1:71:1b:3f:14:e5:36:ea:ec:ab

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2021 - Dec 2, 2024

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

31030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Project\backup\Tools\CheckPlans\obj\Release\CheckPlans.pdb

$TEMP/$_65_

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b3076560d5321b9d8d99221194376241e5277957c8eb4b0eba689b616e803ac7
MD5 4a545dc7605e6bdf8e107173e5eba69c
SHA1 cf45cf7594e9970b4ffeda48ac728556e3d232cc
SHA512 3be7af94fd0b20ddfeedf3001991280e2da7a4c48763e6dc55ac8f3461ed4a200773cdb6f3b6cee47abd49680acd9377ddb6d539e2fa604da0b9df390de11fa5
SSDEEP 768:/T8ZI9YIHMfndz2dgKCsUoEBLhpX8Mmg2EIEMmk2Es:/TEeYIHMFydgKCsSLhpX8Mmg3Mmk+
TLSH
T1DA238D0277E84546DEEE4FB974F449390A71FB836D61C5CE16ACC0894E62BC16B603BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e2:3e:8c:ce:4b:67:a2:ea:6e:cd:15:67:bd:8f:fc:bb:f5:7f:fe:76:dd:a7:1f:bb:14:94:57:0a:bf:8c:3a:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

8f:bd:8b:71:72:a7:b0:72:19:31:ed:a0:9c:b4:7e:54:ce:65:a3:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Chains

Oct 22, 2024

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MSPBytes\, Corp.,O=MSPBytes\, Corp.,ST=Pennsylvania,C=US

Serial Number

50:1a:3d:4c:78:00:f1:71:1b:3f:14:e5:36:ea:ec:ab

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2021 - Dec 2, 2024

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

31030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Project\backup\Tools\CheckPlans\obj\Release\CheckPlans.pdb

$_34_

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 42400a7e092c84a29ad7f5c29c8f4cbff8e825f0940ba4951fab5f536c703d43
MD5 315d11c9311e5a6c9aefc8b0194dd128
SHA1 0dbd00457f715d93bb41000ea3f78acfacb2a9a0
SHA512 4d426d6ece31ea0366f6bc8a3c775f7a08b3f2cc5f441c6571a1bf29ea22c30b3498e254a418b2e91c83f23530351fac9009461aaac55874e15788455976d1ad
SSDEEP 49152:h9q5jM0n3urQLgwxjwwH+wiQYp+hPqlpZwkSqSOM8:zWjM0+2gWKt9CPyZKROM8
TLSH
T1FEC5BE973F41D139F4F7E5712A88619027933C6A9767641826E2FC8E85F1BC20ECF626
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d1:09:e5:4d:07:12:81:86:5e:cb:f2:8e:72:6a:aa:18:88:5a:f7:5b:b5:6a:56:e4:b4:57:2b:8e:31:cf:5f:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

2309758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$_34_.config

SHA256 3eb01a6853b832276324c83c19791309b41b27cf5c7c93ce860d9bac649e855c
MD5 d4b1d6410230c253b1c3c7dbd9bfdb0f
SHA1 736545af4e8d4ed1dbbd1dd25c6f0ab9d4dd21b5
SHA512 2f243bb34f37e2581b993a8019a4323c1c6e9697e469f2a99b4c60f5d7d32ee59a76f4e3cd51b2b16c3429da98925c402d05c5d2beefa01afca095fca8d79d5b
TLSH
T14B716011A1C8AFA50FB209A27F6FA458CB7D03B7294D054DB1DE6B878F3695A0707077
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

CBBackupPlan.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 352b9b4574d89ff6316297a78058ccdb34a362400b9b9199e8ea776ac52789bd
MD5 a1a36407dc0f42ba757bf7fa9aa8c65f
SHA1 a18df675de388047715ee7fd47d08c042cdfffc0
SHA512 6a45192fb5b1028761bb2625fef2baa127a94b3cdfd57ed7e36b8411c0810b5456cda835b88d52316037699ebc733f0833e0947ca0f58a96da1e119acc30b697
SSDEEP 24576:/J7IP/dBs5e0SBy2HNHekvo4ecAIqQjgrMrv:/J7W/dBs7yfqKmML
TLSH
T157355B6B7F24C929D0BF88743112511017F23C5F93AA725A66D2FEE926F23D21D8E193
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

4c:e5:ed:04:d9:97:7a:35:23:2e:25:98:f4:f8:47:c0:2b:48:78:5c:db:04:49:6e:6c:30:df:1f:d8:fb:6c:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

734782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

CBBackupPlan.exe.config

SHA256 df727789159fc6334f6d352408ba158417231d2ca3c9e1bd7a3ce73ce3f8f845
MD5 4c3e0e77fb6e0c37b97f9a5996e52cbf
SHA1 022420bed3c0493e8c3a35f9984f66538c6fc573
SHA512 4c4dcd13a32db3ee4d4b2f16e4f09e5f3cc24426c530ed656e7ce751248fb174b7c41a5025ebb6d6986812969470535a57ed9b53a608eb07c57d83cf4cd91164
TLSH
T1CC712B1161C8BFA50B7209A23E6FA85CCB7D03B72D4C068EB1DE6B878F3555A0647177
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

CBFS6Net.dll

IMPHASH bfe10e780260a385f9bf45fc42f211aa
SHA256 2ad750b27fdb15dd5ccd5a08d2e13d7ed844089f00482850cc6edfaf4c2726bb
MD5 1fc9aee5d9e43546fb263d0aea020822
SHA1 8cd4383cd578fbeda464166c14e36bc597d58081
SHA512 402953480a999b73c4763f4b9f1ee745ab57c03ad1cf41ccf893da4dc67399f067d51ee6c2088702b59bd8846811bc8a1a3b0868e9b646814e3fd40c2d31f107
SSDEEP 6144:OnO5KGJCY2iOEwuCeHPOLQDACVw7l8dWZNTDBVA0G8kpCe:OOQU2i8uCsWLRewxRZNTTA0GFC
TLSH
T1B4745B59AB200199EAAFC27C9473D603A673B1D9635B53CF4138CAA41F277C9B1793C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

174294

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Projects\CBFS\dotNet\x64\Release\CBFS6Net.pdb

msvcr100

??3@YAXPEAX@Z ??2@YAPEAX_K@Z __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __CxxQueryExceptionSize _cexit __FrameUnwindFilter memcpy memset memcmp _onexit _lock __dllonexit _unlock __clean_type_info_names_internal __crt_debugger_hook __CppXcptFilter __C_specific_handler _amsg_exit _encoded_null _initterm_e _initterm _malloc_crt _ultow wcsncmp memchr _wcsdup _ltow _wtol _wcsnicmp memmove _wcsicmp wcschr _itow wcsstr wcsrchr malloc free

advapi32

RegCloseKey SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor LsaNtStatusToWinError InitiateSystemShutdownW QueryServiceConfigW AdjustTokenPrivileges ControlService FreeSid QueryServiceStatus StartServiceW LookupPrivilegeValueW GetTokenInformation OpenServiceW OpenSCManagerW OpenThreadToken DeleteService OpenProcessToken CloseServiceHandle LookupPrivilegeNameW CreateServiceW RegEnumKeyExW RegEnumValueW RegDeleteValueW RegOpenKeyW GetSecurityDescriptorGroup GetLengthSid RegisterEventSourceW RegCreateKeyExW RegQueryValueExW DeregisterEventSource RegOpenKeyExW ReportEventW RegSetValueExW CopySid GetSecurityDescriptorControl EqualSid GetSecurityDescriptorOwner IsValidSid

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

shell32

SHFileOperationW

setupapi

SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW SetupDiGetActualSectionToInstallW SetupDiGetClassDevsW SetupIterateCabinetW SetupDiSetDeviceRegistryPropertyW SetupDiGetINFClassW SetupFindNextLine SetupGetSourceFileLocationW SetupGetIntField SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupCloseInfFile SetupGetSourceInfoW SetupGetStringFieldW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiCallClassInstaller SetupOpenInfFileW SetupFindFirstLineW SetupDiGetDeviceInstanceIdW

kernel32

FindFirstFileW GetModuleHandleW GetSystemDirectoryW MultiByteToWideChar CreateMailslotW FindClose FindNextFileW GetWindowsDirectoryW GetFileSize MapViewOfFile UnmapViewOfFile MoveFileExW GetCurrentProcess CopyFileW GetVersionExW GetFileAttributesW lstrlenW CreateFileMappingW lstrcatW GetFileInformationByHandle lstrcpyW SetFileAttributesW InitializeCriticalSection TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetComputerNameW GetLastError GetFullPathNameW ReleaseMutex TlsSetValue CreateMutexW ResumeThread DeleteFileW TlsAlloc GetCurrentThreadId OpenEventW GetThreadPriority CreatePipe DeviceIoControl GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess DecodePointer EncodePointer LocalFree WaitForMultipleObjects FreeLibrary LoadLibraryW SetThreadPriorityBoost SetLastError GetProcAddress WaitForSingleObject SetEvent VirtualFree Sleep VirtualUnlock VirtualAlloc CreateEventW GetSystemInfo CloseHandle CreateThread GetTempFileNameW TlsGetValue CreateProcessW CreateDirectoryW SetHandleInformation GetCurrentThread WriteFile GetExitCodeProcess ReadFile CreateFileW GetThreadPriorityBoost SetThreadPriority GetTempPathW GetLogicalDrives

netapi32

NetShareDel NetShareAdd

mscoree

_CorDllMain

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.AzureClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ece6b28a1501bc7ff7844a0acf65bf6019abdda840972b6e3d1456486f9755a
MD5 2935d2b7581b646b1fd4f9bd90085a8f
SHA1 fb811b3de88193b546e232a83b43be1a5eaaa853
SHA512 b4798f3937686dd6c595c29724ccae95db1e07fb9d70aefd5d11494d5da630c22dba3408b9893cb064a3ba0b60aef0ed52e27ffc748794351da745455e30d4b6
SSDEEP 6144:iAXGmkqB85rtSLwM7mYLSVrv0Dx6KSHvKdlPNgEQjtPlrFZj:cmPWrKr+Bv0DxVtgxP9
TLSH
T155746C0957B1861EDA6F4ABCD227050C62F09D0B7779F78B6AC2DCA59C497CDAC012E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

367086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.DiskImage.BootImage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 11c9668a4356563b89888059bcdc90cecd18230039f30f490449078c2a6100ed
MD5 a8c9b2a481f5b78336e2cb580bc25bc2
SHA1 4206ea7e95e820c1991523b2bf3275643edce99c
SHA512 b4144d27f2964ffdddf07a916933a53010e6012b8a32eac0e3733af571755a94827c234ea6dcddcf9126b5976742338da82348067f9edf32f5ef00551dd914a7
SSDEEP 3072:2mzyy3bnmkeVhaUweWzjxqgIpSF5MKbnw506cxVTGxmB1KddJDAebh1bV3zw11Iy:2py3bnr57YymihfKsuAPpR
TLSH
T1215454AD472CCAB6C6B67471EB197CA4E21B878BA0C2EE08F1F86416D1B3DDD4314725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

294702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.DiskImage.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9717af8637e6be30134b499ecd79d4e9682706d8d1c9d124288b3d6d4233eac5
MD5 af955b7e3bc4aaf065ca29fc8ae396e9
SHA1 c69bf4a3b02bdccb27c1f79c1aef06ae45e42e3f
SHA512 d0eb2856b171c3bef549d62cfd8c629396649b3d6668791eca0b54bd2c0e46e8db03e16b92843292e60391592679525bb28da98938c14017a313f02b838145bc
SSDEEP 24576:QpW//ndr0tJxEf7bkVqCrE7gojs5g4ztmfKHlXLwOnztS2Up:QM5fbOM8ojs5gRCHlXLw2
TLSH
T1A9855C0267F8862BC16E5AB8A072011727F1E867A773F78B368D65B55F83741CC22793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1768702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.ESXiEngine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ba69a156e6dec33879d669c91552cd81fddc6d4e8b9c1bff0bddabcdb719bfda
MD5 cd9f52154ae6287ef57fcd4b829c13b5
SHA1 426fb17d591d756eac097a35e6f8bf2ac57bd35a
SHA512 2ddd2a4a1658d2f16b56154c21a3025f305b894a4435c638028823a982a22754769a521cee3c2d75da7f18ee7671f587f2deb0e935373ed0034decf59e32fffe
SSDEEP 384:1dyAPNc8eRno031DO+jLFkIEhwLYJuhwEJm9mn+1WMK8v28JBx:N6oQDN+I2EOPv9
TLSH
T16B72D6198BE8871AF2FA0B745EF006D50A35FE045C32D7AE59C4102F5867B088D63B7E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.ESXiEngine55.dll

IMPHASH 62fab5d8ef3bbc56e4e729355272e71a
SHA256 70f076572ee96e98a0a81574ade4744135e98127a9718ee5bbc3bcfbcaf7bee0
MD5 5c9062aaee54f367c5de2334cce53df4
SHA1 57c6be1f0b680be9152cb9e63bd841d08c7b2d13
SHA512 4b3aeb65f6ebe6a4351ff9948c104d3d3ca0fe28eb54a89f901fac53bda19466857bd52136f8a09afa2c17084ffe3d968132948a6c31f5537b0a144e795a38a6
SSDEEP 3072:qJypfuQSn2Mj/aPzk777NFmeBRF5hCIEeSmNb6:TOj/aPzk777pBH5hCIEeSmNb
TLSH
T139E308141772C967E67F83B42C77EA079133E6813B62934BD261E2640F7638CB513ADA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

25845

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine55.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset _CxxThrowException __std_exception_copy __CxxQueryExceptionSize __CxxExceptionFilter __CxxRegisterExceptionObject __CxxDetectRethrow __C_specific_handler __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __std_exception_destroy __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _crt_atexit abort _crt_at_quick_exit _invalid_parameter_noinfo_noreturn _execute_onexit_table _register_onexit_function _initialize_onexit_table _configure_narrow_argv _seh_filter_dll _initterm_e _initterm terminate _cexit

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

vixdisklib

VixDiskLib_GetInfo VixDiskLib_Open VixDiskLib_Connect VixDiskLib_Disconnect VixDiskLib_Close VixDiskLib_FreeInfo VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_GetErrorText VixDiskLib_PrepareForAccess VixDiskLib_FreeErrorText VixDiskLib_Write

msvcp140

?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.ESXiEngine67.dll

IMPHASH 9cd981fa32ba858fc21ed25e255dac09
SHA256 e15caf5e6b6ae8e61817e8d1679f056b55af2590684ecbd96be77366232d1bfa
MD5 0fd157d5c5ccf0a04a022e1bfa39008f
SHA1 ee30bf36b6b00f79d29e357040435be707ebb9e9
SHA512 8c3db3ce86f448e92c6d85ba5b62556af0391e79d720dec2ca82225edfd86cae83b56407ba89aacc84548dc0bd0b8e1374619204f173847293d4f7bda5f8e7d6
SSDEEP 3072:C01Ev6GP5UbQ6My74xE2tquR6yh1IHe1mxjmy:SSC6My74mg7syh1IHe1m5m
TLSH
T10BE33B116BA38493E65B13385C73EA038632984237B2575F9257F2B44EDB3CDB812AD7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

26609

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine67.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset __CxxDetectRethrow __std_exception_copy __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __CxxExceptionFilter __CxxQueryExceptionSize _CxxThrowException __C_specific_handler __std_type_info_destroy_list __std_exception_destroy __CxxRegisterExceptionObject

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit abort terminate _invalid_parameter_noinfo_noreturn _seh_filter_dll _initterm_e _initterm _configure_narrow_argv _cexit

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

vixdisklib

VixDiskLib_Close VixDiskLib_FreeErrorText VixDiskLib_GetErrorText VixDiskLib_FreeConnectParams VixDiskLib_FreeInfo VixDiskLib_GetInfo VixDiskLib_GetTransportMode VixDiskLib_Open VixDiskLib_Connect VixDiskLib_Disconnect VixDiskLib_AllocateConnectParams VixDiskLib_FreeBlockList VixDiskLib_QueryAllocatedBlocks VixDiskLib_Write VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_PrepareForAccess

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.ESXiEngine80.dll

IMPHASH dca595da2a7defae3953557b941b1ef4
SHA256 48bcc371cbba2b39fbe7e32c7c62066c766a9b837d8d9851711c097892d7d6b0
MD5 efb8754133b0fb2d4e9a242c6c8faa6f
SHA1 3689d61490fc91d8a676e223d6f70e99e0f9e1ea
SHA512 e4cc19858f6ba1c09cd8b000278fc77ffc62c69ffa3871c06f3bed9b30bff099030ff1df85d6694c6ce0060255b002f50c590955a46fb521a8fae87b9e543661
SSDEEP 3072:MnmIpqmxdENW8N5b8tCMImRd9hwIWehmwRJ7:M6NWk8CMhz9hwIWehmwR
TLSH
T159E33A4013A255E3F75B53316973D6038133A802A726979F8265FEA58F5A3CDF81BBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

26809

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\71b07ec173ec9602\Console\bin\Release\Cloud.Backup.ESXiEngine80.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW Sleep

vcruntime140

__current_exception __current_exception_context memset __CxxDetectRethrow __std_exception_copy __CxxUnregisterExceptionObject memmove __FrameUnwindFilter __CxxExceptionFilter __CxxQueryExceptionSize _CxxThrowException __C_specific_handler __std_type_info_destroy_list __std_exception_destroy __CxxRegisterExceptionObject

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_p

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit abort terminate _invalid_parameter_noinfo_noreturn _seh_filter_dll _initterm_e _initterm _configure_narrow_argv _cexit

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

vixdisklib

VixDiskLib_Disconnect VixDiskLib_FreeErrorText VixDiskLib_GetErrorText VixDiskLib_FreeConnectParams VixDiskLib_FreeInfo VixDiskLib_GetInfo VixDiskLib_GetTransportMode VixDiskLib_Open VixDiskLib_ConnectEx VixDiskLib_Connect VixDiskLib_AllocateConnectParams VixDiskLib_Close VixDiskLib_FreeBlockList VixDiskLib_QueryAllocatedBlocks VixDiskLib_Write VixDiskLib_Read VixDiskLib_InitEx VixDiskLib_Exit VixDiskLib_EndAccess VixDiskLib_PrepareForAccess

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-string-l1-1-0

_strdup

mscoree

_CorDllMain

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.Backup.Engine.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7fece14d1abf69d9db950fc8a6d0b4cca3ce4b711f10855967185ee9962683da
MD5 b0937b6f95f634cb8db9543f57825043
SHA1 3ebac6d863d6242e373569b37894ae76fefc0257
SHA512 7c0bc68accc903f4a08e17626ac7cb8a769325e5806841b0602f98845741ae61a4af458a5ebe167e85bf76026e4969fa1935ea9759b8ab0ed4bf2776cf559170
SSDEEP 384:H5UwjwLpqOHUffkpSOFetJWtYxJ+7RmzSpl5Q+nQvuJzPWHkL0fuY95RKbI:36UffNmenrWRmzSz5Q3GLApJ
TLSH
T117B21A4A9BA4823BD77E8BB970B2430103B5C7451023EBCA5DD875AACD533877D127AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

29198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.MBS.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a62290ac0399d391bd2358cce32a3180b257e6e0f704dc3db28c7768138b3406
MD5 a2efa1931f90ecfd89ed845515b8bb97
SHA1 6897d1f0466d5e0144bbdd217c111db210279de4
SHA512 87bd00d393cc997fa31d1ccaa07e9f94d2b66af12d548479053e31bae0740e6df630187609f80cb4bc8a3633ad0dc811c07d1837ec12779fee17dc2d373f7d08
SSDEEP 6144:ao2rnhwffwNGcX3pBAcDwLyJg03veGFDQsQ:ao+pBAckLAg03veGFDQ
TLSH
T14864FD14F3FD4E06EEFF1A7EEAB510D04E7BB993D801D26D09A4005D16A4B448AA3F97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

341598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.MBS.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4eac2e85cf626939f9573df16c4f64816dc9ad4515d99b180ec79afc5b9f5e35
MD5 9bc80e97367c11a35ff637277359461e
SHA1 b3788661ebca863a6fd0509b594caf4b452bcd57
SHA512 22d68e674327a6e2baba6b625ab696ae2defb7dde3cef06dc2d628f790bb40771c256f5b3d58d7af19b39cdc7b2115e9734e54b6b54b9864c3b2b899049bd932
SSDEEP 768:wXL4pL8gl8n+S6EBc/HGrktaHC1v+TsUDca68iofQfM9m3pbCF12zzj1Qzn6ZmkN:wXMnxO2vJUDd6aNI3p+F1ebLZ
TLSH
T19853D6698384C17EC7C20AFAF6725324137AD24031A1F7DB5FA67988B8C376353671A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

71758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6461c52b7b85a5cc399ef44daa9f047b399faf3f14dd4aa6892cfe9bdec6ffb8
MD5 e6aacce1e3460cc7588c71a6c06deb36
SHA1 9cfd17afdb083f4f9194209abd0201b48b99f96f
SHA512 494a1d424d5afc0fb6af5702f7f2a675e7edee3976e7fe046c0f721835f00d62e2bbd37b04f8fc25d9a99a80e8b3b437847d8f4559226e0964d8c79650d1a0ce
SSDEEP 49152:y8MYTtgNVvUcxUbn5A+nBUNMx8/sb7QwJDlNu7tu6wv:duNtUcxKn5A+ntx8/u7rJ
TLSH
T15B362FC5AF94970BEEFF577A54B106244B3EBCA391C0FA9DA195402F14A0700E97DBE2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4958430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Engine.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 33feb1de0be3c1dfd0eb90f70093b42b63b3068b75b3af07e623137fbb45d197
MD5 e4e5d0dd63bda862ddea563f3a323c1d
SHA1 761557b7145770b70b700670dfe3078b944eca0d
SHA512 d5f176c2f64815535bfae77c76dbaa81725f65f71b064729506378b596c132bd861b1b96dde5e46b7d1b53105f3d65899a46a049780cbc84dbbfd9b4eb5a3cac
SSDEEP 49152:m/s0cMxwonSIi9fwjEE5DfakWWuz5VoNZ62NCtan7G2XhyIm04YClerOiOHO:m/s03PSIi9fwjEQDfa5zahN6anXR3
TLSH
T1DC465C15E3F49AAED27E09F4D174411806F6E90A1A62F34B31BAD82D2F533055E92BF3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5585694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Exchange.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7164416e263fd1fc01a860c9fbc095fb00d0381a0943b53763e60cf9c1965255
MD5 c8c35c078a8b10a81352b762ebe495f1
SHA1 b8efb32845c583e982296900b1626a468821c090
SHA512 db8777adaf7d71cd0938a897a0b097372588b7d895a402aa86f6ee9b660c3ef5d6d382204a160bf795f73eec95877e512544eaf94c25b04552b0bae9c12ea1b7
SSDEEP 6144:8c/J1TtE4K9r+VNPVTwGn96tuw6RaxEuFwE1M3v24IxOAfGKglmZjD5xgsnd3Jo+:8cvm45wqAsw6RiFwE1CUGMZjNXd3h
TLSH
T111942B2A22F9D52BC6BD543881B31A25AAF50C4C62E5F3CF3AC29E689C4235DDDC51D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

427470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.MSSQL.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ee13c8345aef272d1a77a52a854723e6e1189a4a662cdd86825f359cf9a22f04
MD5 d05ec9776db45ef323e45bef7d36d403
SHA1 d7b24a0ceefd66b37cad3a854f5f82420a561b4b
SHA512 40cefc37d902f2c037bcfaad28223d5b07d2edba0217547922c8c4a7f4094b863585cf56dedf804337e8ff360ef4dae882a2d4f0c740805d492517ff7d25b5ca
SSDEEP 1536:qC6+GSvJydN3f8723SpJkpSCWfFKBGJJn:ltL+iBkACoFKBIJn
TLSH
T128334B3D672D8D37CB9F9C7CB167929202F8890E3471FB6B6E92245A12233C91D481F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

60206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.RM.Service.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 557100ec1fe2ea2c3a346296241c13e06990f3f3b4bf76d8803813db5ba1bd9d
MD5 77daeb1d8714126b01e664b286c8c3a3
SHA1 ebe620e5944191dd583a5c348a0cab380f771506
SHA512 c40ee319719e342965e2d2d80397995b706b074befc3b419b3bd8d78db696858257bde0aa7af33310d19534d00db3520fc231f3620797451a5c8eed7ac300927
SSDEEP 1536:Qq+Tb5MT9v7KUjd7KhxvJFlny3SYsELv2+k9pJtVxHB15LqVUTZM3qK+:Qq+TAvu5bFly35eXpjjfFXTCy
TLSH
T13DB3F23B63BEB441EB2DDB394113728294E42D6B3670EABF7A560A4007415CE7ADD1CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

be:b0:94:a9:92:bc:b8:48:6c:5c:f7:5e:88:f9:80:f0:17:eb:da:c1:04:5d:16:7a:ef:67:9f:e3:7f:a2:54:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

105934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.RM.Service.exe.config

SHA256 0fa30361c646c4914f1663928a15532d5dc7981dd53b7974a13b4e6c0731ffea
MD5 cbf3c795a4ff847454e469b825bb1455
SHA1 799d1a789c6858ea0c216e291bdcfd9cd446d2cf
SHA512 4cb51e91d075c9187632e292ca67915dba601bad7295b36b6db4277e634d6595746ce701f6d669fde254fd501bd4142ce34efc19e83b81e8bb877872f3785b2f
TLSH
T14C719F2190C8AFE10BB209A23EBFA418CB7903B7294C058DB1DE6A478F7695A1707177
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Cloud.Backup.Scheduler.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fdf4acc5ea068208009dbdb0c5d95bbc79ea8c5a712fd60f3093a013c6a04118
MD5 f26ae0ed78e32d9251f91558eded02f5
SHA1 32c81c2cf85215a0b2286725250e30ac428e5e9f
SHA512 2520aeffce303387375040e4dc8da66e98063d1475ec6a1991ca56a4a63f8bb38ab709807d7492bed0e7e7aa3431ecdaf6019fc95f07cc92afc79386a1f3a008
SSDEEP 3072:GRLXdjGky14QQF+6+7ar+EbTxrL1rhUJ5WXms80KfFJOGK4W6ZzPO:ULBGiQQFccHxrL1lUJ5WX2zG
TLSH
T102E34B5153A9C13DE7BF4ABCF67601010BB15D07D171F36A2AD964F8085338ABA8A3F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

f2:6b:7a:4e:0a:bb:cd:0e:2f:77:f2:ee:a2:5b:35:80:99:75:b1:20:0a:79:ec:28:8d:d8:46:5f:da:53:f2:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

145534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.Scheduler.exe.config

SHA256 79afa985f39394b142b044f4eba76a2fa6153ce8aa1b0bb9b76326c9fc043a46
MD5 2af07236bd1116f69a277110fade6ea4
SHA1 b12370198937054644567cfe42a32affc023bb35
SHA512 fc536096373f607d2531c97d9c012b5f5c11ac6d2112413968fc14f1b02b326b6b2e3b5aa8b1be51cb2061aa6bb2a419649ab2794ac0f8865f7a2818eb391695
TLSH
T158512C1165C8BFA50B7209A23E6F6818CB7D03B72D4C064EB1DE6B878F3695A0607177
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Cloud.Backup.UI.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 878a3156ec8e384b7f4f2e85db1ad5a46b76aabcd99132cf47f11a762e5d1de4
MD5 0302dbc94e6a75e41fbdf994f45fccc8
SHA1 7d0a33e0f7b1407b812dcd8daaad0b654413ef94
SHA512 15040b551b6055e9b09a59cee5f1c3b0fe3d84ce3d9d2b933e9add548164d10409ebf920e9c8cdc8470d763acafa6e58112f928e804501d1b367b30c93197c45
SSDEEP 98304:LXesbYmuO+3FE51WzPOgl5WjMS2GfOsBhcEv3hTq5fouY:LXesbjdWzPJlGfO4hcsReWuY
TLSH
T187F66B2037A9921DD47B0B715C3191C017BA7E2B7B54CA2E2995361CADB37238F227B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

04:d4:a1:c4:b5:c4:64:fe:5d:a3:4a:3b:e3:8f:3f:f1:ab:85:cb:01:35:2a:cb:af:14:bd:20:38:1f:44:8e:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

15594174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.VM.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8574fb3c79d24234a691f94a91ea096042d03c6d6b090f607843944aa1dd099b
MD5 053bef530849d67d2e6281cc2c9faeca
SHA1 cac721ce9829864cc2893e0eeb34a8fcbefe4f41
SHA512 d2628d51851079f31eef9f845ed53410c0ca54499db6330db9f8d5af4b07896c8d22394eba25d8f5a47e8a4c09d22c1b1fdf083305d483feadc1cf98b9d8ee5a
SSDEEP 6144:azPny0aviIdd+PnyAM83teunwJSaSIKkpDZsLslnkE7Dalcbae:a/avuPnPdhwJSaJZbnkFlcbT
TLSH
T128842A0233319A16C6FF9B385013C1056FF5492A93F9B78F5A969EA8394235FFA850D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

385902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Backup.Wpf.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 42400a7e092c84a29ad7f5c29c8f4cbff8e825f0940ba4951fab5f536c703d43
MD5 315d11c9311e5a6c9aefc8b0194dd128
SHA1 0dbd00457f715d93bb41000ea3f78acfacb2a9a0
SHA512 4d426d6ece31ea0366f6bc8a3c775f7a08b3f2cc5f441c6571a1bf29ea22c30b3498e254a418b2e91c83f23530351fac9009461aaac55874e15788455976d1ad
SSDEEP 49152:h9q5jM0n3urQLgwxjwwH+wiQYp+hPqlpZwkSqSOM8:zWjM0+2gWKt9CPyZKROM8
TLSH
T1FEC5BE973F41D139F4F7E5712A88619027933C6A9767641826E2FC8E85F1BC20ECF626
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d1:09:e5:4d:07:12:81:86:5e:cb:f2:8e:72:6a:aa:18:88:5a:f7:5b:b5:6a:56:e4:b4:57:2b:8e:31:cf:5f:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

2309758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.Backup.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 923169932e79848bac79be60e8a1866d95441904991d9b5b68328663f430644a
MD5 da61147e0146a6c18a6377ab8190a243
SHA1 fc3c3b48960cdcd23d333fcc86f96f5606280467
SHA512 baaa33daa5470889263908f06b9483a3f5901c6703e62f64082b2cc4a55dba16f9937cbe13d87e8b5fca70a9955c5d0ca79b7dc138b5b952752031f66a81ccca
SSDEEP 6144:b+dNx5wFIEVSSd/+nOkm9HcVizW5t+XUe7h1pB+KPxjAKEjt:b+fxiFjbJ+nRszW5wUe7h1pB+X
TLSH
T1E0640241B7E0911CF52F0FB66D3215B08B3B7B525B21EAAF31C5328D29B6295CB24727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

324494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Git\cbgit\Backup\Brands\Resources\SimpleRebranding\obj\Release\Cloud.Backup.pdb

Cloud.Base.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 959fb06f5445b43d213db2946376a743df3cfe0c2db0a7484973fd64f34b5069
MD5 f3fd9f98e9eea75067a12af7b4390ff9
SHA1 5c95701185f9c0c5840b65b96c6c329ff82e139b
SHA512 4d9046f48ee197a4a6d9c406d7bbb0b929b769b1dd2c0b9e8c561f1f8c2585b82da97011bcb53bda9cee475d746ab1acc3e89c93bdb3529fad4b200efd330be5
SSDEEP 24576:k0dEW0DAnyqHgXHcSw9mpAU86ko4d0b+cS0kWps4TariOjNK/jNaLnPm0eVpk9Nd:sAU86ko4d0b+cS0kWps4TariOjNK/jNs
TLSH
T14C25315037E85E79F2BF1A791EF24091C63ABA2BD721CEAD8D50113C09B5710FA21B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1056494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Base.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 020e3fe23371e2350ccc05572499d12b7fae9bec5d76750cafb8e0a74549d668
MD5 289e6febe916bb86bd12d5b5166591b6
SHA1 2a8fd194f8019ac1a128b98253a9aee18479f5cd
SHA512 b9bde93421a85112f78424a06e3084ccce8e869d9eb50a402426b2e0b62b3520dd24672d84b1507970ce4731c7a0d8f2cb6de357dddb6c01f54d538373b8247a
SSDEEP 24576:sGZS4+VQ1bTgsXZubosyPP7XTpchi9gXq670/B+XrioO:ymwbo7Dn9gXs
TLSH
T1C7653B09EBE19297C67E9AF8B533052023F4D9495336F34F2755AD3428C372A6C8D6E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1434622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.CbfsInterface.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 50f52b74dd614f19310b9b5767ad7518266d2299f5bc2eb52daa9e0a053a4f1f
MD5 a31d7ee50611ed234d0ee31713f9c479
SHA1 50cda1843da2f8584880d92e7b8221cdc286fc40
SHA512 9ef28b5bc6e5410311017dc8ab9289430d494c3226010af04a5e55c66a5a4456457ed48483fdcf908dd739dc2b0c10a4d6a55bd2d48de47336261c05636231eb
SSDEEP 1536:/+TNlAqmg9/5jiP4cCT7+BCac+BRV/Xx:2TNlwg9HnOBCacURVp
TLSH
T15C534B7817EC8B92C2FE2775B977071243B1F2991613E72E6C95A65FAE0270089137F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

70526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent_2\work\25c08f47025d0f1a\source\CbfsInterface\obj\ForBackupRelease\Cloud.CbfsInterface.pdb

Cloud.Client.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e008ab3ce5ad9ed21d40259aec4ad2822179560d5c3a5723c35a2f15ea1502c9
MD5 c60c5f633978d74f8d87e24e86e8c02b
SHA1 b923481ac3a89bbccc408e5e4fb96f6b1a2c60d9
SHA512 ba053a0b54d1c1a6b4bee09b7209bfa19cb3d850899461e9f6ad0c0a8fdc2217aa87905f71fb719fed426405df29fdc4aa71ea46b5ef6d6871201e075eee9835
SSDEEP 384:dvhfTfpvktDQ56WRszppiV55s3gXTM5VSDBaeQrKasnIrTkWOUB9i6hbMhbGhe04:xJpFRszppf3gXVH5f
TLSH
T12EB23F207BF89E13FA7E0FF92BB110914A727952FD12D7BE5ED4048905A4B44E630F6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

29710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 501ead96dd039be25f790f760b1ba1e97884d666ef62cff1b5086085713b9b4f
MD5 3f76c1d7624e77f597cc1f65fd9062e4
SHA1 b9dcdc60e51853f6cff311c26d4dd7d45823d466
SHA512 eb4c1da515e7ecb9bc57d04c6ac73835df4f17cf10312ef36366d6cf2f1362026aa600d05d87fc91083f60cb448223bf38ff3ba91e16f474793a7da7b3ab2e87
SSDEEP 12288:q5Mn2a8EqWw5Kc9r/DLt/vxr/J83OLRpJ4Xqm1Kuy1QDzCt4bCyncwJe2+B82ZDC:0ZWqWw8cBd3pL4amWwpJe2+B82ZbTrK
TLSH
T1F1355B43ABD5D72BC95E897DB131022903F5C01972E7F3676B506A28BC8330E6DDA267
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.DiskImage.Flash.Launcher.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7221ec6e2e4770d474f80f30872b5e23be174908dbb33b96ffb74d1703270f2e
MD5 37b4f1b89af0ebf38f29b320c748c773
SHA1 6d4d62640c0034bed75b07af3f12ece0acb7b1a2
SHA512 c61fc372e96ad77556923f72ba26bead2dd31df12a981e759d5882720313e97e6fdb2939e9334b7cb5d1af29bd6c4eb7560613470c9bf067a2cb25406fed8348
SSDEEP 6144:uHrF1++DIQKEVSp+BdZFQo5R3Mazb+0V5Avo:uHrF1++DIQVPKo/z/5AA
TLSH
T15B74083133AAA20ACD7A0B70183592C517B67E667F14CB9D2859334D9D72B138B227F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

d7:9d:b3:15:59:e1:dc:4a:92:45:38:72:67:57:b4:6d:bb:61:c7:df:d0:f9:a4:61:e0:84:ef:e9:37:75:ca:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

333486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Cloud.DiskImage.RestoreVerificationService.exe

IMPHASH 0923102362e3d6b015ad139d6aca98c1
SHA256 cfb6d083b59b6dc32ecda05cb160bc1e33dcdd95fc7010ef639ea6944d623994
MD5 91dae107f3eb78cd0eb1ad13e8efb06c
SHA1 ffffb80896cd64765fc100a2d9d44e65b4f0e767
SHA512 20fbacb729d5d5ec049565d8d9e9aea49e5a476779246885a2619b1ba245eb1bb645334fd98ea1c36771c53b7acae7deeb56657ff385407e87b1d1169115fc6a
SSDEEP 6144:YshOscBFo67QXGQxZzrVBgYLBHGe9r70LIo9AOzEdQOZTON:Y267xQxR8Ypnr7c9ZlOZTw
TLSH
T16D349E1175D28472D9B3153509FCEBB64A3DB8600F2599EF63E40BBE8E343C19A31B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

35:89:aa:0e:95:a7:58:6a:7f:9c:b4:84:9c:94:3a:9e:11:50:f5:63:d7:7b:12:92:30:e3:46:f7:c2:0e:f8:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

27210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\a8597ef7bb7c4374\Source\Console\bin\Release\Cloud.DiskImage.RestoreVerificationService.pdb

user32

CharLowerBuffW

advapi32

DeregisterEventSource DeleteService RegCreateKeyExW RegSetValueExW RegCloseKey StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus RegisterEventSourceW ReportEventW ControlService OpenSCManagerW CreateServiceW StartServiceW CloseServiceHandle OpenServiceW QueryServiceStatus

kernel32

QueryPerformanceCounter WriteConsoleW CreateEventW GetLastError CloseHandle Sleep SetEvent WaitForSingleObject OpenProcess K32GetProcessImageFileNameW K32EnumProcesses QueueUserWorkItem GetModuleFileNameW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEndOfFile GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW HeapSize RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapAlloc ReadFile ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW

Name

.text

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud.GoogleClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6aa6b3f740755dba3b785ad23d24efb7bce32b7fb4728f32667924ce7f516e3
MD5 eda206dc5a5a4caf96f074741739a878
SHA1 350a4bc52287f910c2d462a1699a0044c92757cb
SHA512 dcc44d647c47666d26214dd1f33ff26034606fbc50c0b0d527afadc34cb306ffcd2be9c3125b4e264474d148e2ce7b1c70a533136b1c2f5b05e07fa4e1fc3f2a
SSDEEP 6144:c6oc52cAWvVs+LLVwqA/ezyNJSh4VJg/xFCbbrx:toc52ZWdsEjzyWGJgZFCP
TLSH
T1CD643B6363F5860AD6EE46B8A021840417F14C4B9766EBCFAEC2D5BD5C063C9ADC63D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

314750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.OpenStackClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 514444aed72790ca8d620b8a6f24bd14f9409dcc3538b2dc581f7961d52ce854
MD5 5df9f417ce06d51292478e168d176ddf
SHA1 a61a51a49ad6e7192f7752e449b9acf8bda4d99c
SHA512 4a199eface5690926f64ada93d677bf7e0b15fb44a1654de7abe14d542623b0a7febf08dd60fb0642b9969c5db84b47c2c747ac2c02d31b46ced878032f827db
SSDEEP 1536:JlUtfgBRl0nvXsZjQJjUfX5KfDOMamu1ZM1ut0b1we6F3wyxQJ+zAricYrUq8JL9:JaqX0vXfgXAhawESQ2i7Joxn7MJbjA
TLSH
T1A2C34B42235D5A2ADBAD48BDE112C101C7F08A1A9932F7677DE3B9F1145338AED8A1D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

132622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.S3Client.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c227baf457f462cfc67ddfb1dbc29e1b80316bf58978497ae1a4330d44266001
MD5 13cfb15f7cb29bd40d950ec990554997
SHA1 2e76a5a068399274fa0754bd535bcf5636474a90
SHA512 217e9660bbbf1544d58120b1229b92b052c0dc5be1141bc7797a74a1ea78863fbcfc90edc8b309bebd7b74232cdfb665f129def4eaf7f769fd67d254e9e8ac95
SSDEEP 12288:KpMZLKW70RROLa5qKZ0dVufLi9EmxghTVrMMjRHHVMAEp4+OX:dZLjD32o9gzrZgLpC
TLSH
T12E355B467BE0C66AD1BD597CF022101807F0D80CE2F6F347AB6375786D4BF8A9E86196
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1127662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Cloud.Wizard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6e1c13ee8d81838b7a57e9b4e54956338d79e92bc662479021fcb449a41ba736
MD5 533ae07b1db4c76f5251dee8aa7f4f65
SHA1 c1356bfe7836a5e82b19e18a6d08b8a4134695fd
SHA512 ba4797f961ed6b3d7db0918b9f6b0120bff1d7fd4f59121ea56e827cb45e3afbe5370c7262083b8f43d2aad0ba5302844935eec7b285c8a77a6dcfa2e0a902c3
SSDEEP 768:PsUK/kA+hNZ4z1bQmr+6ubyUBKGDECKo99F1uNEBc5jReC9STk53vKL:CUn4z1bQmrKbwQu9jMC9STkBvKL
TLSH
T19253093033BD821AC9694B787C7591C517BAAB257B00EBAD6C89155CEC633134B22BF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Dapper.StrongName.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d72a8d7c13d5cd37fc4daf52c78f09d8199d72e3f3b4298c72c121b65ee6583
MD5 e1a11d2eb998eeef9d91055ffbea0132
SHA1 a8fa26d510b75436079e7ffbdfe705367c01c1c0
SHA512 a8bc95228c51f5835185ece4037b4807595641caa84bfb70d26007c2993f2c59f3d811f0c71b490309550e2a4e735cb12b6e1a2c2bdb3c7d58faf2a3952e364d
SSDEEP 3072:v6ZWd9g9mMzpGapZeEvizRYe2vDzZMCsdvqL+YS0YmIyb+g:yZWdHap1izRYe4sL4Pb+
TLSH
T1F9046C15639D8BA2CBEF0BBA7475800043B2A6A7F5D7F78E69DC91E568537801B003E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

180266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Dapper.StrongName.pdb

DiskAccessLibrary.FileSystems.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9b85093a7c8050a33f7382a85481e84a99cc6ca940ea8b640e1359a4530b09ba
MD5 45da5dfb10320aed21a9a9eb78043d12
SHA1 dd7d3ffbc207ab97ba34fde0c7663b3948b6921e
SHA512 8b832acb034f40ed3a68d6fb657d49da2894bc3bf17dbdb62e5b094a7ad92ac3fc10fdbe1978e3c992d1206b20c1e0a4ff354e1d3e7d2fe10c388301e8ccf8d3
SSDEEP 96:WchCFOTU/kz/xhV1ruVUytkt5/pPTKpOPR+Nwesmm:z8KU/O7uGytkt5/pTnn
TLSH
T131F1B411A7D8D323DDB70B3CBDAA97421235EB998D17CB4F1C49160EAC366582BB2760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DiskAccessLibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 13a3ba8d52fb800f1a0f4f371ad994b9070966596355272fe1f5164cc55a0063
MD5 6636dbc983bd69d7ad1c23f4a6fdd6f5
SHA1 23551ced0c07e4d75c770719c3c31969d029df4c
SHA512 647e1bf899f67ffbf78ed78352d7b6b199cd5f22e36c9002a37d24887815806d768ba04707e8f6d5cac5bb8a330c593d69b61d51b586ab3df56f8f9bf891f747
SSDEEP 6144:NWicmkog6d8D+odR6HcFxMVaFTXB8IiH7LE85MmnF:NxFkoOfB8h
TLSH
T19E543A2857E98921F8EF57BEE4B6044587B4F016DA2BE75E1BD424FB2D63364C8007A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

285902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Esent.Interop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a69c7365fb55db9740e886d6d8137c4a64f90e983e2a730037b5afba4c9f195
MD5 23cd57e1099c8356572c2b149661bcb7
SHA1 a43f26f9c54c5b040e3e368152118c47aec21bf5
SHA512 bda8abc988390731ca3bbdb4ee9d87396b4d139031391568d57dfa1d5f50e791e84b0dedacf64584ba0088fcfafcd23436b942b78d92a13f5e171c916a459279
SSDEEP 6144:qw9nwscyJjd1V04WCwtnRwtv1r3BFc9FSWGCX:xrhJjdnJ9tvZ3Pcn
TLSH
T1A4740A2063E44619F1FE7F74A6B4AD5D44B2FC4B6A3AD38D92009ADE5C62F50CD22393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

373518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Hpack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d30ded0b0be4418574768de0f050b42de58d2bceeb2db78f641af9e62e91533
MD5 ad34aeee4ab0a615770f5531254d4915
SHA1 459d3290200ec57c71919a8ef0855a8e0e38f339
SHA512 9f6ed2a8f830e539b18717bce3e7088ac6ae681b88d10075a0fb2f2b1a009bc2ac7ef2591d5ccca4fa64c4ab491c1706981b01bacac5ba70b4d1eec1a124d4d5
SSDEEP 768:dvAeZFRVEc40L0Ls5xFtwlCVDWU60Ir0TYC:x9EcJoq/tRVmr0TYC
TLSH
T1AEF201715BAC805AE5ED663DF1EB274507EC25B62172C1D1338CE86F9C837462D02BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

40702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Http2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfe9219f448ff6d527b805fc968806740e7844760db17e4a1c03239ceb93e115
MD5 605f1d8c512a3d4419a309e4187b2010
SHA1 a7bbb624ca9ef79eb55273ab77b1040a85f1e215
SHA512 0fcdbc3b426e51010e9d63d10940424f91b2d8ebf69c982fd01bad8b7a4565f01710d4cafb48870cc6a67c565da2ad2b8dcc0932d3b4f3a19fd731eb00faec6a
SSDEEP 1536:UvSd6ZJ+DJZWeIppfigCOatcnI/dSLrzumhWtTfsKmy6iZTpb:UvSd6atZpQpagmPSqhBsny64d
TLSH
T1E293185417EC4623F6EF2BBE543246634675BA11B97AF38E098C94EE18D3B40DC113AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

103406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ICSharpCode.SharpZipLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c287e9b07a8251828f35914364c89a37db606b0c1d64457f9eb8fa2258f0dee3
MD5 d59ef46a5f01ddfe7eb691e6c725a247
SHA1 edf2ab9ee284fa21dbb55e93d082848e800f068b
SHA512 8b5b622618ddc32695cef8f0744c548e5068a908794caeef3286f5a2f521ee2bdc91fb63e37ce211147dc1feb8777da1e029f0ae8c6dd04b061753832fea55db
SSDEEP 6144:E1uYsjrFIzmuxpOI/1MvCdRbpSISC8j7s:LIzm6pOIgvr7
TLSH
T1E0142924B7FC4A67F6BE97B8E475908087F5B9A6313EE75E5C0094EE1C56B6089003B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

206806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdb

ISCSI.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d10e28fa20ca82a19d0aca2c6c2af8e49f972650ff0c615fc1c3689361b2fb9d
MD5 43c677e816a52dd021b5bab12fae0fd5
SHA1 8b165e2773371137b8f155369dd03bc65cbeb22f
SHA512 4c02d4c808f0033d7cf49d16a955dc5dfedeab9332fb926aae699ec768e0269a102a14ad78f669cfde40243ac160ba45224eebe0ef6fd53e7edbf87dfd241d01
SSDEEP 3072:Ae5XHlADsxM3Mf0cQcBp7+1RQN+K+pU7vwxn7b:AbDsxM3zcQcBpqU2+7v
TLSH
T1A9B3299C5BEC0B65F86FA7FE90B48501C7B8B95A611FE30E1E8490FA2873391C5117A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

121646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LZ4.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de81e4ccb659ba85a4a6d1bad8742ba0af75aa6ff50a2f6330e78721681d3b14
MD5 031d50f8089f30c265a281b7f8d90e73
SHA1 6548799d247855279dd45bab863c08da4ba5018c
SHA512 3e1b8f9f854e4d4e805c495425a0ce6278bd2bc4a8db6da8b7cb2e797fbc78187727cabf185c44d5fbf144543e27814347f565337d4992868479bc16d366c833
SSDEEP 3072:zqndOlIdZmqtVioTf5vjJRzGc28SGHWEhpU/urue6mnFDy/:zBSdRioBjGc23GHWYhue/x
TLSH
T13DE3D02577D95597FBB69A38ADF551014338BEB2B9BAE38F710008393D26BC88D20753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

151822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lucene.Net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d3e374e75c33391e7d5a127e21a603f29241f6c3ac35b4f5766ea14ab49a8bda
MD5 38a3875f7a2169645fee066fd4e25572
SHA1 5e72581c0c0ece95bda361cc08d50c6a7a18602e
SHA512 4a54064bf78e8a506b5f8ae80f93be584420d82515044c0d5de8c294bc89653bdab54142e3c1e53ec934cbf6a016a9daeda2008dd9dd90e306d31e8285d85b0d
SSDEEP 12288:WZuUoUqrbs7TpCjxH4pxxo5CS06Nf637tBnN8JwqxhCbKjDp:WAUk0pCBgxxo8rWtjDp
TLSH
T152F43A4527F81A17F4AE5BB5E471092A83F5E416E7A7F74F6A50B8B42C67B90CC003A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

748542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Lucene.Net\FullRepo\trunk\src\core\obj\Release\Lucene.Net.pdb

ManagedNativeWifi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37d2facc99be6cb1694b98a0208704f25f376efb8f25906151bed0e85e44dd12
MD5 9585cc9cc83f5cf7217b7ecc77c461ab
SHA1 38eb935e5eabd47bf123f5e3f397239911a9e70b
SHA512 8d5a84c39bf7cb1df4693b3eeb897bf9bba1858af40e7c2874e17e62fa139529141c7019e75476ec14ed16d324cdfce496f980f87f8ffaaeb14843e98f79071b
SSDEEP 1536:0fiDWOrOUkcNSHhJbTl7K4tIYLKKjYBEC8mj+T2EvMLr:BWOrOpJH/bT7IgjYr8myT2EvOr
TLSH
T154A34C5953E81367CBEF6B3CE0B101518375A00B2047FB8B89DC15E65197F817AA2AEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

106830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Exchange.WebServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6dc1e364a5b9507d806e12b0d1c390ff8fd779749a57b51c8d37126889ee79b
MD5 b0ef1cca695fb3fd38b219f3b67974f5
SHA1 7b5bf10c7fd710a1cd5c3f43af352f31c9880cb1
SHA512 92c5a2c910bde00d379f0b33380c7328c672cf58bf90bae382afc2a6af429491dfb353b9dbe8388e47d0eae43386faa442d43192dd215f10e276571893907755
SSDEEP 12288:c8pomlMhnk/IfGUcbtYiwVz9Ou+O9GPxuZa/7lhyylVybnFBRRGQmEQF:Voma6I+UcKP2xuZafyyrszRRGQdQF
TLSH
T18C35271937E8131EE1FF1F39A5750424A6F5F92A3B16E32E0A15E69E1C62B40DC22377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

33:9b:35:d7:b7:ca:c0:19:e9:96:ce:c7:22:8f:b7:cc:52:e3:b7:d4:df:23:56:ee:98:7a:bd:22:e6:d9:6d:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

4e:33:ea:07:01:04:42:1f:10:d4:2f:cc:8b:c8:34:f3:c7:f1:bc:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 11, 2013 - Feb 11, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:29:97:4e:7c:82:cb:20:16:41:00:00:00:00:00:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

1106206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\15.00.0847\target\dev\ewsmanagedapi\ewsmanagedapi\retail\i386\Microsoft.Exchange.WebServices.pdb

Microsoft.Extensions.Logging.Abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 050405babe5276f1b2e405809c46847da2b4a7cb005a976c58949ed68d9ff37a
MD5 9db8219ccd84e539574aed9cd1b52d0e
SHA1 8edb6463d09b74145ba775f10133398ba024d3d1
SHA512 beb9dad5a6253519d165cddd9920c360af3e4c090ff8919cf19442ad93c9015d542d803fb24870f507387ebab1ec19526333a73dbfea947e1ae957475882eade
SSDEEP 1536:knvIi/g58AJ5LAOgeo5QFPZUsPuqMMrZg:WvIi/g5LviqMSW
TLSH
T175534A0957D88333CB6F49B9ADA0E2119B79C2A37407E7572CCCA178285BFDC8B11676
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

32:42:0e:22:9a:b5:a4:33:a6:ca:b6:c6:fd:6a:a9:86:59:e1:e3:af:b5:bd:59:86:ea:b0:a2:2c:cf:71:f5:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:5c:86:d2:e3:ec:39:f6:8b:38:00:00:00:00:01:5c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 14, 2021 - Apr 11, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

4

Entry point

59390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/net461-Release/Microsoft.Extensions.Logging.Abstractions.pdb

MurmurHash.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e0a8687021f8ffbc5a09fa875deda2419b5246d15f4b1e6856b8d6a24a6f86c1
MD5 884ab9c5107e6e40cf6178c9d6877d0c
SHA1 8c7dcaa850cb4bf27de9c7725dad8be8495761cb
SHA512 66270e0bbef588ebedac7387e79aca178a3f69bd4cdfa45c58a2de39a6a9c1f55111eb8f5dc7b3f0307aa5735735f5f2337d0b3bb376bcc473b07604660f0785
SSDEEP 384:P9RkLcnj9h6C9ctoGwnkrJup//hWkk33j7me1rN9ptjv8XE:2cnph6C9ctNu233ueXY
TLSH
T16062B515D76881A7CBAE873A49E1321A4D39D247BFD69B3FD124B02E7E83BD102407A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\git\murmurhash-net\MurmurHash-net4\obj\Release\MurmurHash.pdb

SQLite.Interop.dll

IMPHASH 56568d263b8f0fbaf90fda41effb57f1
SHA256 10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d
MD5 a73fdfb6815b151848257eca042a42ef
SHA1 73f18e6b4d1f638e7ce2a7ad36635018482f2c55
SHA512 111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d
SSDEEP 24576:EpmVXSlb6q7SKjK2RMP1lfuqluu3cAG8WqMkXbbz38MJBbMNCoUpgLPNwEcIMK:6mVXy7SKjyfTFMwEkr3VJBbKCoUYt
TLSH
T17D858D4BB3B8009DD5A7C17CC627670BE7B174451710A7EB17A086AA2F23FE516BE324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

56:eb:de:df:9c:b8:0f:03:aa:7a:8e:2b:be:fb:9e:b5:82:f1:3b:e3:a8:2b:0d:7d:d8:d8:13:76:1d:fe:30:a2:29:e3:9b:e3:af:f0:d6:9e:98:d6:3a:da:ba:08:60:b9:bb:03:3a:3a:2c:dd:1d:96:30:f7:2e:d7:58:07:6f:fc

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

1f:32:3a:b8:eb:0f:7f:5b:71:c0:1c:37:0e:42:8f:20:8e:b1:e9:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2021 - Dec 12, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet-private\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

mscoree

CorBindToRuntimeEx

wintrust

WinVerifyTrust

kernel32

GetFullPathNameW lstrlenW WriteFile GetDiskFreeSpaceW OutputDebugStringA GetModuleFileNameW SetEnvironmentVariableW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA GetEnvironmentVariableW SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA DisableThreadLibraryCalls EnterCriticalSection lstrcatW WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile lstrcmpiW WriteConsoleW GetTickCount FlushFileBuffers SetStdHandle RaiseException HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryA QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA CompareStringW LCMapStringW GetACP GetTimeZoneInformation GetStringTypeW GetStdHandle GetFileType FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA

user32

wsprintfW

advapi32

CryptAcquireContextW CryptEncrypt CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptDestroyHash CryptReleaseContext CryptDestroyKey

SI01290ccda2c08117 SI013a90511e949b99 SI019bb1b0f8b88a4b SI01f2e1e38fd8dfcd SI0205288c09c4da1c SI05acf7f13d83ef68 SI05e4faf8d2d5065f SI06ad3f4f233fab5b SI074a26a6bce53634 SI08295ce2aca70863 SI0942bf2cdfbcbce1 SI0eec257817cfc527 SI0f45dfa7051356c4 SI1066e7ad782ea882 SI10e4ec2593e4bdd4 SI124a949911a522a1 SI12f9286f5bd6f098 SI12fe1f150b42ac38 SI14849b3d0e89b1e0 SI15e46d353ddec488 SI1647e559283d26e2 SI1686085452cb6c90 SI16e108f53793a43a SI16e172772b0b1706 SI1709fb0c78fe6bc7 SI17c3a78ecf9eff4c SI1818f2c8eadbcd54 SI18b9c7fd6d90deff SI1ad41a0e33dff249 SI1b8a3298ea828a3b SI1bf8975e567ea97a SI1bfa1d92146eadb1 SI1bfe410acac3c9be SI1e7babb0bb0adcc2 SI209d1bfbbab7da73 SI209eb0dd58fa77ae SI2102da665922f66a SI216a233b40cb7147 SI25ca8d2baaee0750 SI25d73a5ab4d6cacb SI28687b581b626bbf SI28a6405343e7bbd9 SI2a71c3377e6c357f SI2cc330551d123067 SI30455e90830ca460 SI33209d52126464ab SI34e0a4f84fed7ec1 SI353770fd94e573c1 SI3542aeff9c3855db SI367e45cee72bfd47 SI37012ee3c6dde764 SI38de1207a575b65a SI3bb401944414ce69 SI3e5389eb172bc856 SI3f65beeaaa0d85de SI4251c713c05a3b5e SI42669818b7978ed1 SI4490ba755e98e797 SI4507744386fcba0a SI457a7dc78746ca90 SI47cc739b3bdc3dc6 SI493bdcf3d13ad302 SI4b170c874686e4d8 SI525814a3c7849b6c SI527544a37185bd6a SI527c455c79b66da5 SI53af60c92476ad6f SI53d16af9fd9dc018 SI5492f6d28289950b SI558bdfe0e27562ea SI56ddcf38809cce55 SI58b3396e563758e2 SI58d9c9e758678014 SI596241adb70ce0e2 SI5b4aedd0c04bd151 SI5b914c29cf5a7984 SI6039a77d8b3fe4a1 SI63770fcd460a846c SI6423b87d77537d0e SI6448e5eb2ca66d9e SI644ad6803933fc53 SI64d795d8d6a5652c SI670a722dbc4b11ed SI681faac9c0128a40 SI68689a9b2961f1c3 SI688b887ce4a2e5bc SI6afceccab898a321 SI6c799e24bc9109fd SI6cff36399d6b8510 SI6da43f525fcc10f2 SI708dc027c2a0b01f SI71d54e41ee149c1b SI71da61fbbaaa7074 SI7501ae36b96de01e SI7559ce66b2a83683 SI7607824c610843ac SI769271af19a2299d SI77dfbddb9b6d65d2 SI783c2997f4bbe903 SI7b811ab87b7b7a6c SI7d8b2b5b65802a7c SI7e899b5a8ad87eab SI81c3656e0c2c152b SI821a25758b212c1b SI8259474343588db4 SI841b860ec95cb540 SI842d9c1989f08a60 SI8476de5ad2e1f63e SI86be81683e8ee826 SI87f584c5f9c8cd81 SI88473e35770c74fa SI8955d5517e10b3b8 SI8b0d9e6837e61abc SI8bd1a2ecd61e628f SI8bdbd256a7a800ee SI8c5d6a3d79dd16ae SI8cb1ce55b92259b1 SI8d503b48c50b0f0b SI8d98262fc9dcd199 SI8db78c75599d54bb SI8ea977f217df4eb6 SI905dcc543d48caab SI911c8a4b74b6de07 SI91da00d7298230f3 SI9383891d346ef4b7 SI93dfc8fa53d5b31f SI94ecb64e9dbb8338 SI952d22c6db518ea2 SI9555aa94e5464fb7 SI95d251bc4895e058 SI96516336c99ce75a SI96d7cc1e6c528820 SI9728956559a83c71 SI98fcda7827970a5d SI99449f6fa6d0dabc SI9a326fe0ddbebf12 SI9dbf9d88aa001ea6 SI9e5caf3f82afbec6 SIa07e0e87d9c86d40 SIa0b89be8ea9562cc SIa364946505687432 SIa7c1cd9b020850a4 SIa8a7ecc7b42638c6 SIa9bcec858971f4c7 SIaa0f8e0c251cfd1d SIab9b1bd6a4822cb2 SIabb2be07ffdb1945 SIae265b9a3e7ff7d8 SIaf003abaa59f4e17 SIb03c6e79afae3a3e SIb12933c5b4a9b1f8 SIb20222b622b9f6ae SIb378d0a537411fb9 SIb50fc3839c421869 SIb58d68e34259bb85 SIb61de3ea47c362fc SIb64c92262f98df4c SIb75bb703537e34a8 SIb80a1b71f58ea310 SIbdf2cc3159ddf9a9 SIbf02a0e02928adea SIbf5934dfe2a8d472 SIc14fb8a21feb2e94 SIc60c813695b0a929 SIc6ecc041c46c67c2 SIc73e44ad36c6c308 SIc9b8df374df75071 SIcaac088b33f92dac SIcaedf2c29ebe4e44 SIccd01f4d70f48acf SIcd51961be732e0d3 SIcfe1e5cf0035a8c9 SId17980a984b0df0a SId2ea6a764978b870 SId3575b24dfdbea5d SId61cfc777bf4f00a SId68f4562cd5aecf9 SId6f924c8ba3d05b2 SId95bb14c42234d8e SIda0491b2623dcc8d SIdac3904ec873f97d SIdace78b5300c999f SIdb45e174afb28e2c SIdbdaa654d0b26d40 SIdcfb39991ebbc7da SIdd048b2fedb74020 SIdd8123a9d5986c26 SIdd99c1c074d20b83 SIe1639e708407f10b SIe2f92b70742a9bc1 SIe609bd7d2871cbd6 SIe969e8d8137a8a33 SIeaf6f475f4e274e5 SIec8bf9affd85b987 SIee4a1cd279a7db69 SIeef348ae766c388c SIf0a08171cb5be57f SIf6e594a0ca15fef7 SIf7b501d343c24f69 SIfabc748b81ce8fcf SIfbde1ee423d263fe SIfc4b758a3d39aef3 SIfce41a414fc927fb SIffb8076c269e2a85 SIffcf65ff995c2367 sqlite3_cryptoapi_init sqlite3_fts5_init sqlite3_fts_init sqlite3_percentile_init sqlite3_regexp_init sqlite3_sha_init sqlite3_shathree_init sqlite3_totype_init sqlite3_vtshim_init

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SecureBlackbox.FTPS.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a4caae91bd5eb3c83cb8c20eeaa15971deb1a787aaea5f663f07c910497942e8
MD5 5ff81eb85c2f2351c8299cde2801f1ca
SHA1 ba0ea62509c625a204ef3e40a7f70305f4250e9c
SHA512 844ecb3f1b57c0da7804f9c3fde258687492bf3477afbaefd5088b4111435ed7d2c07de2f7da2bbc58906b6cc97a362a6c5bab63cd670e6614e6ba3b5df866b5
SSDEEP 1536:fYhRTUCY2mMWUsXHWlaVX7QpG8k2GltAorMAuqQsDjEDZs1ozboHQE+:f0TxmU4Wwmg2GpQsDQDZs1
TLSH
T149B35B482BF82627D6FE17B8F6B551A247F5EE284297F3AD1C5424F9086A711CB013B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.FTPS.pdb

SecureBlackbox.SFTP.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 068169d96fc7d9ea30f624dafc75d3eb89039a5e7a3c7df43ffea549c82c0a47
MD5 c51faed9946e3f39714371124de62452
SHA1 ed4667f714efaab38100a17184013713c5d14c86
SHA512 2a2399600ce1e0f44a40805ce9d14358bd8c100c5982c026671d564dc33d62108ca033b3125a8fe8ac35b6a08811796fd85e6dcd4c7ae07880d93a9216be6625
SSDEEP 1536:xmrEkuHs7YLK2nZ+hHXmdFUSRVA2xNrtSfLVTUGftQkm7FFFnF7BkBcbIacM3P2W:x0QHs7YLRy9wVAkNYTUGy3PpOCXD/RF
TLSH
T1D6D33B946FDC4507D9ED67FCE82C02508BF1E866E297F76A1DA0B1BD1C5732287422A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

146978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SFTP.pdb

SecureBlackbox.SFTPCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 150e513b0f5d54c9e68fdff92f6be632bee89837f58a7e8f4ddff446ac2aec62
MD5 54af6a13f63377e82c7f5cc597bd469c
SHA1 5b7a112411e6a62cfe89b95cf1911e04448db857
SHA512 e739b6385d155b0e8041a19ca222ca3c5804d63f41be93716679d7834b037d8f7e8f8f7ff9a8d4f090b77401f8cf99d4f670d912b2a1dcd8bdfb7f0a0b0cdb65
SSDEEP 1536:5Q8K0jT57h1obWnKnlroI05/acUVykgcdDOa8pAMB4A8crSAZqJ5:S8K6T5734WnKnZs5/HUwJpAM6A8crSA
TLSH
T1D69318258F46075BEBAD13BCF8490A9047B48247E24FF78E5529A8FD2D1E3508572AB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

99778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SFTPCommon.pdb

SecureBlackbox.SSHClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 958b90b9f8b2c3341fe936adfeca09bbf08601222a126f900786dd61723c723c
MD5 ea588d397c357548e93c0013bc260446
SHA1 864982ee6011319c09fbe65a30bc4a6f3b9669db
SHA512 5db19bffcf03e63ee3758eb63c8c08e81a870fe9b5a971332a821c3b0484104ec79d7ce6557198670696c71cafff43ebf250f3c807c5e037142ebf790cab593d
SSDEEP 6144:5zCyS5PE3fGxFfuHdW3rj32wNYWId3Qsfb:XYPQMWAr9NXIK
TLSH
T16E545BE02B679A07E2AE27FE9C3C615153F4E425D15FF7980EA464FA0C9633087291B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

295910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSHClient.pdb

SecureBlackbox.SSHCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b3db7148f6b531b3a7d11b66eccb4c4cbee37a185b2645861cb6394d1e467de2
MD5 1c55d29bf17d04e6b25cc9d62089690b
SHA1 8a135e4c4b0d9f78ca4da0cd050a4f72c9a6e684
SHA512 14f70868a6a96ee14712f7e0a75a39383d0793f6883a93756b206ca46efa38f020ef807243af3c218fc7b9df12d5cfa69cdcd475b3d985f241aebcd2c89b545c
SSDEEP 6144:oX3EYv5ZUw4ar1Q3uK+Q6cZpcAvNQVMOPSUoN5DL5NTpQB8+zS04pFHB2STgyy45:oX6Xf
TLSH
T14494083D1DBD123BE1A8D6F5CFC28823F454E0BB3112AA3958D693698747E4269C317E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

437126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSHCommon.pdb

SecureBlackbox.SSLClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 589ef3558a2d436fb003e87df1c7462c60963a4c32e9082dd3531c3778d1687e
MD5 b446e9cb9175e5244b1ef0385301455b
SHA1 52c36c5fcbc183b15159193cd6259ec8cd174aab
SHA512 20b8ed5070f4a7e720041c40850ff848ec8ac4f27839c819e44f145f1f874d483456d49bf7b84b8c38b4a3f24a5daf7819c5b9c87223a0f4b77d89bf7f345d40
SSDEEP 3072:KuWHJnDhH8QUdTDdXskGNiUhV6ie7PgOqFaoRSTZTpGA:PWHJn9H2XskehV+S0v9NGA
TLSH
T12A04188D73197B63D49D87FEE4BA608253F99536D347F3951EEAA4FE8C8231042502A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

195634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSLClient.pdb

SecureBlackbox.SSLCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d4c5cf996d9ea5547b56fba51c5505a137d60951273795b6a2148d5c3140aaa4
MD5 ba66f1c412a2dda2006e0e73239fcd51
SHA1 ed9359aa407f24bbdd3aaf8342d5e1f0bb571f34
SHA512 1bebf2f1e9118731d8a9a4e8caaf1fa7a6e2d73d47d0a95394e59b4bc48c2ebdd962134d19feec33701e7d89d0b1b95f16fd7a303ca42ac23bca4dc146e3cfa7
SSDEEP 1536:H28zVF+nGaCNCAlVXfKYckST6uEN+E6oBoQD/6tjYOYNIggoa7IAoTHfuJ1xXjaQ:/5wGaCNBrygua+E68z6d
TLSH
T115B3171A2AD85017F6FB63FEBE91208093F562E4F3A3D34909D605F91803F695D932A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

114710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.SSLCommon.pdb

SecureBlackbox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b90580f4974f9048a5ae2ccb0449e5048b74dfed795c0712b59273ed53e8619
MD5 f56bd4bca5849a15ccad45fb405c6dbd
SHA1 1e8ecc1a267e61b145e044ac8823a1c7e18236dd
SHA512 2fae8a29bf0064302a9776a7434ffbc15214ba1cf4b555b7bc7d577f497ca81673ae0205f485e63c56ece62e66d0abb4dd08762c6d88d4e85b714dfbc061eaab
SSDEEP 98304:8wudnMQPFE5MLqJ+EIbkRxUtOzui0Ap5OdVwAmYKae1YUpvVS20jfPTGi:VjQPFE5MLqJ+EIbkRxUtOzui0Ap5OdV7
TLSH
T19BF54B1A9ED06D13E07DB63094F3401293F1DD7E734BAB6B1598B2B88D2A70B5DC126B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3614946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects\SecureBlackbox\Redist\NET\Packages\SecureBlackbox.pdb

System.Buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3af1e07305bed0abe0cf32d9854e0a7f5f470216adee1b87d02350be09d31b35
MD5 b20c1ed526c9fd90569a340914864d32
SHA1 8c23283128d23f6cbc208e3a485a1cf1a9c0cb50
SHA512 c7de839aa129b73094678efea3da88073c3521c99e3533a0858ec8e0804db2004c4e84af12ecf4358ce134b12c66040fd04add9ab96c78414a247a7cbd0d75d5
SSDEEP 384:HRJyzxhqFAB5n55560IxEFuAUTcxR+sDWY82W6fX6HRN7gCJDtdQ5R9z1QUMtr:xJyYkx60IxeuSM2Wrds9z8
TLSH
T110B27E21C7DC421BCE7F5D7056B9DA862D3A43D5A503E62F108CE9081DE3789DB32AAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e3:fd:68:c9:ea:31:03:97:61:76:d7:4c:e4:86:cf:3c:be:86:85:7c:73:ee:69:b8:8e:fd:53:24:60:7d:38:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

System.ComponentModel.Annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 04113c8549185519f3202790ceb23df609644872b9c249a56d2bcf59566102c4
MD5 7d3d14b0417a68ccdd9c51972ff74863
SHA1 ceacbd53b6a02e1f7337a6b0058924e1e11949bb
SHA512 b2d133214f21d700e1af0c248dcc11ef66ea6da62043ff6d5e900fe2a1665d75583e4cd218526a146f2c62e22adf4ca2fa3b8879ae0f5a2e515e2c3a5184ce9c
SSDEEP 384:GnXppnvYs47bNql0kevR9SDQxSWIfYYL8oRT3KI3lUlBmeEZeTfyDxdQocwc1fVZ:gXDQsPurQcR3y6JOnSHDYFD9VioLQJ
TLSH
T10313D842A7F81139FDF34BB06B38ED96597BBED66D22C12D149890CD08B17D08B6173A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ac:8a:21:bc:7a:d2:9b:72:f4:00:00:00:00:00:ac

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

30786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb

System.Data.HashFunction.xxHash.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ebd5b9585529102ea1843ac2ec52b9072567ad9234b71180a2b3b3e0fcba982e
MD5 21d59b5aaf6b72d807079ee5e649a5e0
SHA1 a5a7ad860796330b94012a52f7257dbcac1f9bca
SHA512 bb61c7fc0f5b369c04ee664c6614211c283bf33aab209a5ef3f24b6d595ad8c552a306889afdab905454499b8061d5d3cb08922b89761379bc951e6e5656d034
SSDEEP 384:yemqD6czm+3F9DMfhN6vHz+STCpjYyvBo4SQlJ/ZPF3x1TS:56ci+3FlS6vT+STCpj9HPPFq
TLSH
T150A21B086B8DC637C7FE767458B25651E3B0FE16A437D71B2CDC9078290B7A83980B69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

27270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

H:\git\xxhash\obj\Release\System.Data.HashFunction.xxHash.pdb

System.Data.SQLite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 24043ef4472d9d035cd1a8294f68d2bbfdf76f5455af80c09c89e64f6ed15917
MD5 b0911d27918a1e20088b4e6b6ec29ad3
SHA1 93a285c96a4d391ea4fe6655caaa0bbf2ee52683
SHA512 518da2e73b849be38570d7db218adeb47f85fde89c15dac577eb1446a9a55bb4cfaf31d371428b9c4f0c69c0be3e2cb10fafcadbec24e8ab793b639392e3f029
SSDEEP 12288:ZGGoS+lVQ7ECFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cH:ZGGmlq7E
TLSH
T1C7945B9427EC250EE2FF5B74E4B0A841CB70F452AA66D34E38C4A0B96D21B44BE53777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

b8:e7:ef:64:1c:45:71:42:6a:b2:4f:b5:41:86:aa:d9:37:da:77:74:01:a3:88:02:03:43:7b:b8:74:cb:6b:5e:02:f6:2d:d6:a9:f5:ab:56:15:4c:ce:9c:22:a1:a8:c2:27:be:3b:d5:14:8d:88:01:fc:cc:3a:9a:7b:5c:6f:a0

Digest Algorithm

sha512

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

29:1c:69:e2:88:90:cb:d8:49:3c:e0:a1:e7:d9:8a:eb:e5:8d:9d:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Nov 26, 2022

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2021 - Dec 12, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

395186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb

System.Memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
MD5 35e6237ff5533342516bf01a46e4b7cd
SHA1 f8a118f07eea37ce732b487ab730646dedc46235
SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
TLSH
T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

a4:39:e2:43:4e:c5:d8:14:7e:fb:ba:42:fc:56:b9:dd:2a:b9:0e:a1:5a:1a:ee:d1:46:3c:33:a1:91:9a:d7:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

System.Numerics.Vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22c84be385fe8ba6d0e0138952748f28d781fce36078b5a7aed91a6104bcd99b
MD5 7ab5dbdd2ace2a313392cff4f372e4b9
SHA1 8890ad1911448490526d2a45ac8cc518b6e886a2
SHA512 5bce867274f23694402e9f9f73f8c3ebf5d77114836f56d3cbf5cbdeef164a299091e1cd69fd7635e6b7bbacc7376193eb8daff32d5aeed0df72835a00baa4e2
SSDEEP 1536:cuIaashZlF/cLecJE3+DWG/E2NstmOz+aAKWGd7isnzP:czaashZzWeca3+DWG/E2it5GK7dnL
TLSH
T119B3EFE22F6C655AC7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9c:c9:af:38:85:33:7c:90:83:bf:34:2b:db:74:94:cd:b2:a9:55:e3:39:54:ef:b3:12:50:db:ca:eb:18:45:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ed:e1:5f:cb:d5:f7:a5:5d:73:00:01:00:00:01:ed

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

System.Runtime.CompilerServices.Unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d6f419d641682d8efc4a40e850d2e85de519d6823b93daf2aeee63206d4e32d
MD5 aa7a54f5a3ba48e60d51e6eeb378404d
SHA1 e5d644311a6087c6a500f0e79bae4af305430b3d
SHA512 b033330695b4edc1bef5d36d98e1a68f5862469598cd6a71cafb8f72732d29403d4e8b9e4df3809c2f49dcd59d5ca751ada97ea9b7e268298effd6e19eb52399
SSDEEP 384:hkGbUzdrbbxHKWgr2WXTX6HRN7K3/7R9zXL/Lq:WGAdlQTWoF9z7zq
TLSH
T1B7826D20C7D44543FE673B3055ACE583BE38E7D51806A3763585E97A2C963C8AF3562C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

84:fd:35:d4:54:3b:33:7a:ff:21:82:ef:df:40:6b:06:5c:9b:b3:15:61:2f:37:5c:a4:57:2f:31:81:4a:8f:b5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e6:d9:42:9e:ea:00:f8:7d:e1:00:01:00:00:01:e6

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

System.Threading.Tasks.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:8A82-E34F-9DDA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:19:8c:bb:54:08:0a:5d:fe:65:00:00:00:00:01:19

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Feb 11, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

ZstdNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a7a062c0c02179cf942ecfc3533bb6604a946dd3597abe80869549048e1307b6
MD5 db96103c6375a4a49fdee609f7ca7584
SHA1 e3f0005bef532690163f455d002a43cc3cb280b7
SHA512 8e726b29ec0b5b1495525c232e2189334a096f6b2ba0c2645ff4c005b632b5bb7498c5ab68de5e4f85ef6476b680f5aab44200fa78e63acc376de560932970e3
SSDEEP 768:ALAtyHfVGVGBgHeWnwwEgc8+9PRVYxpgP4VF:oAtYgV8da+NRuxpgPIF
TLSH
T107C20A55B3D8C137E4AF5AB8A472052543B5F5833933E78F65EC84A81D27B908E223D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

34238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

cbb.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 32f01d317287c9eedb2eb53ae627bcc7971881a5648066647fb3f869f552ce70
MD5 abff3831e8f6c0abc1ee3b3d0868c94a
SHA1 eac5523cf77bae13b0982dc1c4d8f9a1708e7869
SHA512 527b69279334defd0736b2a144c0803e6a0382fecd811efd391bd8d5bbdbf0b86ca4590e50f73179a79ad00daeb88998ab2ff6fbb7c474e5353659a7bf1289ae
SSDEEP 6144:+q1m9+2ugSsrIednNUw0WL/okd6uQwBYsBD4FjgbcnXTJ0YVYlWMPS641if7QDDa:+JO/NbWUnXTSHlP66Bf4dWkMJUnvjo/
TLSH
T1DCE4E9F62FF5A919D6AF4A38103A8C2456EC5C9B1374A38FEF5229D6C441FCE29491C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6b:4b:65:c5:38:13:06:d5:28:43:0f:9b:63:34:1d:fe:9d:ca:e3:aa:da:82:aa:65:1f:02:fb:2d:30:87:cf:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Chains

May 8, 2026

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

81:4e:42:17:a1:29:7f:ed:5a:cc:d4:17:f8:91:ad:75

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2024 - Jul 28, 2038

Subject

CN=MSPBytes Corp,O=MSPBytes Corp,L=Pittsburgh,ST=Pennsylvania,C=US

Serial Number

53:67:53:f8:5a:ae:4e:90:1b:f8:ea:e4

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2024 - Oct 1, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

666958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cbb.exe.config

SHA256 8135e6e81640baf6d5b3444ced0a440221e13a8e36e6cc89c313736e3f69183f
MD5 9c112544b3aefcdaa081ec9cac059573
SHA1 af65004d9cf4ce6a5f522926780bfbd26fec9356
SHA512 51040e2e5cc8607e8af539b3622e2538c40b1caa704dbbf2a13cac8eea4d118c66e371d435a11153fb68c3a35482ba3270a82f8bfa4b331eda0812d95fe1c0a8
TLSH
T152512D1165C8BFA50B7209A23F6F6818CB7D03B72D4C064EB1DE6B878F36A5A4607077
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

libzstd.dll

IMPHASH c47ad36ac72daf87a4f693877d7e903c
SHA256 0c245a3c93ad074469f675fb6f1401461f8d46d0ead253e459757d102b8ae562
MD5 b96a7091ed2b45c38ec8a97795152011
SHA1 178bf487e248e7bb3712ec4cd79b5f349111f7cb
SHA512 1b8fb4aa93b62ef068dbbd2e39ba3c2b87ef9a35aa9bf5ee7f12e795e48c4c6a29f5f4016606bb909e0ba3710428dba4476d0dad6fbc5b6b2ac3d6d6dcc2c866
SSDEEP 12288:2PHZyTfnngrA0n5bfAvLpLY2byCfwkp0wDvj+Xx4K:GigU05bfAvL5Y2bdfwkprDvyXx4K
TLSH
T1C5055C47E1E350DCC16BD9B4836BA273F9327C199124AA6B8BD0DB353D52F20E518F68
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ZBUFF_compressContinue ZBUFF_compressEnd ZBUFF_compressFlush ZBUFF_compressInit ZBUFF_compressInitDictionary ZBUFF_compressInit_advanced ZBUFF_createCCtx ZBUFF_createCCtx_advanced ZBUFF_createDCtx ZBUFF_createDCtx_advanced ZBUFF_decompressContinue ZBUFF_decompressInit ZBUFF_decompressInitDictionary ZBUFF_freeCCtx ZBUFF_freeDCtx ZBUFF_getErrorName ZBUFF_isError ZBUFF_recommendedCInSize ZBUFF_recommendedCOutSize ZBUFF_recommendedDInSize ZBUFF_recommendedDOutSize ZDICT_addEntropyTablesFromBuffer ZDICT_finalizeDictionary ZDICT_getDictHeaderSize ZDICT_getDictID ZDICT_getErrorName ZDICT_isError ZDICT_optimizeTrainFromBuffer_cover ZDICT_optimizeTrainFromBuffer_fastCover ZDICT_trainFromBuffer ZDICT_trainFromBuffer_cover ZDICT_trainFromBuffer_fastCover ZDICT_trainFromBuffer_legacy ZSTD_CCtxParams_getParameter ZSTD_CCtxParams_init ZSTD_CCtxParams_init_advanced ZSTD_CCtxParams_reset ZSTD_CCtxParams_setParameter ZSTD_CCtx_getParameter ZSTD_CCtx_loadDictionary ZSTD_CCtx_loadDictionary_advanced ZSTD_CCtx_loadDictionary_byReference ZSTD_CCtx_refCDict ZSTD_CCtx_refPrefix ZSTD_CCtx_refPrefix_advanced ZSTD_CCtx_reset ZSTD_CCtx_setParameter ZSTD_CCtx_setParametersUsingCCtxParams ZSTD_CCtx_setPledgedSrcSize ZSTD_CStreamInSize ZSTD_CStreamOutSize ZSTD_DCtx_loadDictionary ZSTD_DCtx_loadDictionary_advanced ZSTD_DCtx_loadDictionary_byReference ZSTD_DCtx_refDDict ZSTD_DCtx_refPrefix ZSTD_DCtx_refPrefix_advanced ZSTD_DCtx_reset ZSTD_DCtx_setFormat ZSTD_DCtx_setMaxWindowSize ZSTD_DCtx_setParameter ZSTD_DStreamInSize ZSTD_DStreamOutSize ZSTD_adjustCParams ZSTD_cParam_getBounds ZSTD_checkCParams ZSTD_compress ZSTD_compress2 ZSTD_compressBegin ZSTD_compressBegin_advanced ZSTD_compressBegin_usingCDict ZSTD_compressBegin_usingCDict_advanced ZSTD_compressBegin_usingDict ZSTD_compressBlock ZSTD_compressBound ZSTD_compressCCtx ZSTD_compressContinue ZSTD_compressEnd ZSTD_compressStream ZSTD_compressStream2 ZSTD_compressStream2_simpleArgs ZSTD_compress_advanced ZSTD_compress_usingCDict ZSTD_compress_usingCDict_advanced ZSTD_compress_usingDict ZSTD_copyCCtx ZSTD_copyDCtx ZSTD_createCCtx ZSTD_createCCtxParams ZSTD_createCCtx_advanced ZSTD_createCDict ZSTD_createCDict_advanced ZSTD_createCDict_byReference ZSTD_createCStream ZSTD_createCStream_advanced ZSTD_createDCtx ZSTD_createDCtx_advanced ZSTD_createDDict ZSTD_createDDict_advanced ZSTD_createDDict_byReference ZSTD_createDStream ZSTD_createDStream_advanced ZSTD_dParam_getBounds ZSTD_decodingBufferSize_min ZSTD_decompress ZSTD_decompressBegin ZSTD_decompressBegin_usingDDict ZSTD_decompressBegin_usingDict ZSTD_decompressBlock ZSTD_decompressBound ZSTD_decompressContinue ZSTD_decompressDCtx ZSTD_decompressStream ZSTD_decompressStream_simpleArgs ZSTD_decompress_usingDDict ZSTD_decompress_usingDict ZSTD_endStream ZSTD_estimateCCtxSize ZSTD_estimateCCtxSize_usingCCtxParams ZSTD_estimateCCtxSize_usingCParams ZSTD_estimateCDictSize ZSTD_estimateCDictSize_advanced ZSTD_estimateCStreamSize ZSTD_estimateCStreamSize_usingCCtxParams ZSTD_estimateCStreamSize_usingCParams ZSTD_estimateDCtxSize ZSTD_estimateDDictSize ZSTD_estimateDStreamSize ZSTD_estimateDStreamSize_fromFrame ZSTD_findDecompressedSize ZSTD_findFrameCompressedSize ZSTD_flushStream ZSTD_frameHeaderSize ZSTD_freeCCtx ZSTD_freeCCtxParams ZSTD_freeCDict ZSTD_freeCStream ZSTD_freeDCtx ZSTD_freeDDict ZSTD_freeDStream ZSTD_getBlockSize ZSTD_getCParams ZSTD_getDecompressedSize ZSTD_getDictID_fromDDict ZSTD_getDictID_fromDict ZSTD_getDictID_fromFrame ZSTD_getErrorCode ZSTD_getErrorName ZSTD_getErrorString ZSTD_getFrameContentSize ZSTD_getFrameHeader ZSTD_getFrameHeader_advanced ZSTD_getFrameProgression ZSTD_getParams ZSTD_getSequences ZSTD_initCStream ZSTD_initCStream_advanced ZSTD_initCStream_srcSize ZSTD_initCStream_usingCDict ZSTD_initCStream_usingCDict_advanced ZSTD_initCStream_usingDict ZSTD_initDStream ZSTD_initDStream_usingDDict ZSTD_initDStream_usingDict ZSTD_initStaticCCtx ZSTD_initStaticCDict ZSTD_initStaticCStream ZSTD_initStaticDCtx ZSTD_initStaticDDict ZSTD_initStaticDStream ZSTD_insertBlock ZSTD_isError ZSTD_isFrame ZSTD_maxCLevel ZSTD_minCLevel ZSTD_nextInputType ZSTD_nextSrcSizeToDecompress ZSTD_resetCStream ZSTD_resetDStream ZSTD_sizeof_CCtx ZSTD_sizeof_CDict ZSTD_sizeof_CStream ZSTD_sizeof_DCtx ZSTD_sizeof_DDict ZSTD_sizeof_DStream ZSTD_toFlushNow ZSTD_versionNumber ZSTD_versionString

Name

.text

Size

725KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

956B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Adobe_Acrobat_en_installer_o_backup_v8.6.0.338_oid595f2f7b-2721-4965-9a47-5884cf68f0d0_bidSEEzazG0BU6CB6wd37dv8A.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/INetC.dll

kernel32

user32

comctl32

wininet

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsArray.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsJSON.dll

wininet

kernel32

user32

generic

$PLUGINSDIR/processwork.dll

generic

$TEMP/$R0

mscoree

dotnet

$TEMP/$_65_

mscoree

dotnet

$_34_

mscoree

dotnet

$_34_.config

CBBackupPlan.exe

mscoree

dotnet

CBBackupPlan.exe.config

CBFS6Net.dll

msvcr100

advapi32

version

shell32

setupapi

kernel32

netapi32