digital-magicians.zip
- SHA256 6c4601ef63fa80419a4abc0ff20338200201b08beb44ab04f91f57ab73497eb5
Overview
overview
7Static
static
5libiconv-2.dll
windows10-2004-x64
1libiconv-2.dll
windows11-ltsc_2024-x64
1libidn2-0.dll
windows10-2004-x64
1libidn2-0.dll
windows11-ltsc_2024-x64
1libintl-8.dll
windows10-2004-x64
1libintl-8.dll
windows11-ltsc_2024-x64
6libpsl-5.dll
windows10-2004-x64
7libpsl-5.dll
windows11-ltsc_2024-x64
7libunistring-5.dll
windows10-2004-x64
1libunistring-5.dll
windows11-ltsc_2024-x64
1psl.exe
windows10-2004-x64
6psl.exe
windows11-ltsc_2024-x64
6Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
libiconv-2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
libiconv-2.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
libidn2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
libidn2-0.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
libintl-8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
libintl-8.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
libpsl-5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
libpsl-5.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
libunistring-5.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
libunistring-5.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
psl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
psl.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target digital-magicians.zip
- Size 3.0MB
- Sample260629-ph2rtsez3l
- SHA256 6c4601ef63fa80419a4abc0ff20338200201b08beb44ab04f91f57ab73497eb5
- MD5 2733c132ec6101da77a76fe6b0215514
- SHA1 a609bcd0f03b32e4b6e55715fb72d56cc07e54ba
- SHA512 bdc0823eef5ce63e5836f954690955d68aa310fe6b849e1e0f5e08c9dc4157a8acb0fe20348f527c5707a91cb9fb92821959a964c6e7dcc9078e2c68c785d221
- SSDEEP 98304:szkXrg18sb7bEU8oDgVoTDPTSwN5/jvVLO8:szk72lb7bEttVQTSwNdvRO8
- TLSH T165E5334685EED49FBEB7022563D47A51932B017BD5C3112B4AF28AE3F0D46C458AB8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/libpsl-5.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/libpsl-5.dll
File Explorer
-
digital-magicians.zip.zip 3.0MB
-
libiconv-2.dll.dll 1.1MB
-
libidn2-0.dll.dll 251KB
-
libintl-8.dll.dll 301KB
-
libpsl-5.dll.dll 2.4MB
-
libunistring-5.dll.dll 2.1MB
-
psl.exe.exe 64KB
libiconv-2.dll
- IMPHASH 8a5d172d589fee964dc5dae251463ad2
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
- MD5 ba98508c9c8fb1681193aeffdbfa535e
- SHA1 789489f95afe79a531373099336310707f0199ff
- SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
- SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
- TLSH T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ad:e4:2c:14:15:76:1a:34:4e:18:27:db:d3:33:a8:4c:3b:7c:c7:65:4d:f5:ef:e3:ba:d5:8f:cb:3f:ff:84:bd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:6d:55:c0:d4:3b:28:9c:0b:de:00:00:00:00:04:6d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - Jul 7, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1f:3a:70:69:e4:a2:30:2e:95:00:01:00:00:02:1f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetACP
GetCurrentProcess
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
_write
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
qsort
realloc
setlocale
strcmp
strerror
strlen
strncmp
strrchr
vfprintf
wcslen
_libiconv_version
iconv_canonicalize
libiconv
libiconv_close
libiconv_open
libiconv_open_into
libiconv_set_relocation_prefix
libiconvctl
libiconvlist
locale_charset
Name
.text
Size
142KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
946KB
Virtual Size
945KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
libidn2-0.dll
- IMPHASH 6ae87002874a50cefa5b38dd3882cb04
- SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
- MD5 a356b7276a9d7e05a7a6e277b371c44b
- SHA1 d77d7b5584a73b9e5bbecba60a886edcf5d3d8d5
- SHA512 58fa422b4d9049ea3b08a2e4e7b5065086f2cc833fce581cc7135b22369a8cc4c399d4c9821e1f33dcc468ce06376dfa852efe25921d7671d5e2c9c598cc9cd1
- SSDEEP 6144:41G+RUwUos/HQQqBsDwSs4m/ukDyB9pKw:2GIUwUd/wynWyB9pKw
- TLSH T132447C22FFC358BAE8BBC231A4874731A7A2BC012615DF5B5318FE287C326F54D65219
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7c:45:9e:db:30:2a:40:26:cf:83:89:cf:1e:3d:bb:ab:3e:4b:07:c0:af:c8:9f:15:8f:79:b2:d2:c8:9b:14:35
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:6d:55:c0:d4:3b:28:9c:0b:de:00:00:00:00:04:6d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - Jul 7, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
libiconv-2
libiconv
libiconv_close
libiconv_open
libintl-8
__printf__
libintl_dgettext
libintl_fprintf
libintl_vfprintf
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
GetACP
GetCurrentProcess
GetFileInformationByHandle
GetFileType
GetHandleInformation
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PeekNamedPipe
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__argv
__iob_func
_amsg_exit
_close
_dup2
_errno
_fileno
_get_osfhandle
_getmaxstdio
_initterm
_lock
_open
_open_osfhandle
_setmaxstdio
_setmode
_strdup
_stricmp
_unlock
_write
abort
bsearch
calloc
exit
fflush
fprintf
fputc
free
fwrite
getc
isleadbyte
localeconv
malloc
memcmp
memcpy
memmove
memset
putc
realloc
setlocale
strchr
strcmp
strerror
strlen
strncmp
strrchr
vfprintf
wcslen
libunistring-5
UC_CATEGORY_M
u32_cmp
u32_cpy
u32_cpy_alloc
u32_normalize
u32_strlen
u32_to_u8
u8_mbtouc_aux
u8_mbtouc_unsafe_aux
u8_mbtoucr
u8_prev
u8_strconv_from_encoding
u8_strconv_to_encoding
u8_strlen
u8_to_u32
u8_uctomb_aux
uc_bidi_category
uc_combining_class
uc_is_general_category
uc_joining_type
uc_script
uninorm_nfc
_idn2_punycode_decode
_idn2_punycode_encode
idn2_check_version
idn2_free
idn2_lookup_u8
idn2_lookup_ul
idn2_punycode_decode
idn2_punycode_encode
idn2_register_u8
idn2_register_ul
idn2_strerror
idn2_strerror_name
idn2_to_ascii_4i
idn2_to_ascii_4i2
idn2_to_ascii_4z
idn2_to_ascii_8z
idn2_to_ascii_lz
idn2_to_unicode_44i
idn2_to_unicode_4z4z
idn2_to_unicode_8z4z
idn2_to_unicode_8z8z
idn2_to_unicode_8zlz
idn2_to_unicode_lzlz
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
157KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
707B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
libintl-8.dll
- IMPHASH 9c0b2998edc1396470783ceaab4d42a4
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
- MD5 83f4bfec7f089f4a9efd5b36690b6cd7
- SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
- SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
- SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
- TLSH T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:7d:47:3e:61:ea:9e:c9:ec:50:ed:d2:f0:ad:ca:ce:16:e1:86:2a:06:59:77:e7:23:1f:aa:a0:0c:e5:e3:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:6d:55:c0:d4:3b:28:9c:0b:de:00:00:00:00:04:6d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - Jul 7, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
libiconv-2
libiconv
libiconv_open
kernel32
CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
GetACP
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
GetThreadLocale
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
SetEvent
Sleep
TerminateProcess
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_close
_errno
_fileno
_fstat
_getcwd
_initterm
_lock
_open
_read
_setmode
_strdup
_unlock
_wcsdup
_wgetcwd
_wopen
_write
abort
calloc
fclose
fflush
fopen
fprintf
fputc
fputs
fputwc
free
fwprintf
fwrite
getenv
isalnum
isalpha
isleadbyte
isspace
iswctype
localeconv
malloc
mbstowcs
memcmp
memcpy
memset
putc
realloc
setlocale
strchr
strcmp
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtoul
tolower
towlower
towupper
vfprintf
wcscmp
wcslen
__imp_libintl_version
__printf__
_libintl_asnprintf
_libintl_asnwprintf
_libintl_explode_name
_libintl_find_domain
_libintl_find_msg
_libintl_free
_libintl_gettext_extract_plural
_libintl_gettext_free_exp
_libintl_gettext_germanic_plural
_libintl_gettextparse
_libintl_glwthread_mutex_destroy
_libintl_glwthread_mutex_init
_libintl_glwthread_mutex_lock
_libintl_glwthread_mutex_trylock
_libintl_glwthread_mutex_unlock
_libintl_glwthread_once
_libintl_glwthread_recmutex_destroy
_libintl_glwthread_recmutex_init
_libintl_glwthread_recmutex_lock
_libintl_glwthread_recmutex_trylock
_libintl_glwthread_recmutex_unlock
_libintl_glwthread_rwlock_destroy
_libintl_glwthread_rwlock_init
_libintl_glwthread_rwlock_rdlock
_libintl_glwthread_rwlock_tryrdlock
_libintl_glwthread_rwlock_trywrlock
_libintl_glwthread_rwlock_unlock
_libintl_glwthread_rwlock_wrlock
_libintl_hard_locale
_libintl_hash_string
_libintl_language_preferences_default
_libintl_load_domain
_libintl_locale_name
_libintl_locale_name_canonicalize
_libintl_locale_name_default
_libintl_locale_name_environ
_libintl_locale_name_from_win32_LANGID
_libintl_locale_name_from_win32_LCID
_libintl_locale_name_posix
_libintl_locale_name_posix_unsafe
_libintl_locale_name_thread
_libintl_locale_name_thread_unsafe
_libintl_locale_name_unsafe
_libintl_log_untranslated
_libintl_make_l10nflist
_libintl_mbsinit
_libintl_mbszero
_libintl_normalize_codeset
_libintl_printf_fetchargs
_libintl_printf_frexp
_libintl_printf_frexpl
_libintl_printf_parse
_libintl_setlocale_null
_libintl_setlocale_null_r
_libintl_setlocale_null_r_unlocked
_libintl_setlocale_null_unlocked
_libintl_state_lock
_libintl_vasnprintf
_libintl_vasnwprintf
_libintl_wprintf_parse
_libintl_xmax
_libintl_xsum
_libintl_xsum3
_libintl_xsum4
_nl_expand_alias
_nl_msg_cat_cntr
bind_textdomain_codeset
bindtextdomain
c32isalnum
c32isalpha
c32isblank
c32iscntrl
c32isdigit
c32isgraph
c32islower
c32isprint
c32ispunct
c32isspace
c32isupper
c32isxdigit
c32tolower
c32width
dcgettext
dcngettext
dgettext
dngettext
fseterr
getlocalename_l_unsafe
gettext
gl_consolesafe_fprintf
gl_consolesafe_fwrite
gl_consolesafe_printf
gl_consolesafe_vfprintf
gl_consolesafe_vprintf
libintl_asprintf
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_fprintf
libintl_fwprintf
libintl_gettext
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_set_relocation_prefix
libintl_setlocale
libintl_snprintf
libintl_sprintf
libintl_swprintf
libintl_textdomain
libintl_vasprintf
libintl_version
libintl_vfprintf
libintl_vfwprintf
libintl_vprintf
libintl_vsnprintf
libintl_vsprintf
libintl_vswprintf
libintl_vwprintf
libintl_wbindtextdomain
libintl_wprintf
locale_charset
mb_copy
mb_width_aux
mbiterf_next
mbrtoc32
mbsnlen
memeq
ngettext
rpl_getcwd
rpl_iswalnum
rpl_iswalpha
rpl_iswblank
rpl_iswcntrl
rpl_iswdigit
rpl_iswgraph
rpl_iswlower
rpl_iswprint
rpl_iswpunct
rpl_iswspace
rpl_iswupper
rpl_iswxdigit
rpl_localeconv
rpl_pthread_once
rpl_towlower
rpl_towupper
setlocale_messages
setlocale_messages_null
streq
textdomain
uc_is_alnum
uc_is_alpha
uc_is_blank
uc_is_cntrl
uc_is_digit
uc_is_graph
uc_is_lower
uc_is_print
uc_is_punct
uc_is_space
uc_is_upper
uc_is_xdigit
uc_tolower
uc_width
wcwidth
wgetcwd
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
libpsl-5.dll
- IMPHASH 109f73cc95228e3eacd82c151b1a5e6f
- SHA256 c9ff9a1c70d0326468eebfb6c6edfe5dc7350a9e79c3c3e14d7f93b0893c3565
- MD5 75a46879fdb6d4f9c32b504e2f97f5ab
- SHA1 e0892f01bd81e1a78fc99d914f96f9ab7b56d662
- SHA512 0161051a1bf4eec30f1ed0d3bc2511f7b417e3a96e5ead4c0721b6bb70b3dffdef4b827bd5d1e7f7281b27df883a7f1f7812437fee208b622a12e700334fde07
- SSDEEP 49152:8310VYDRmvl+BnBjQ8GBCnDXepZjtXIH/C3uDuG5fw8QJXAYnq9a26mCa5caDGQ7:IsZ+BvOZjtXIH/C3uDuG5fw8QJXAYnqN
- TLSH T1A5B5AF56B3C45AAAD116C93987179232C272BC524776D2CBAE96E70E1F77F804F39B00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
801684
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
InitializeCriticalSectionEx
EncodePointer
CloseHandle
CreateEventExW
CreateThread
DuplicateHandle
FormatMessageW
FreeConsole
GetCPInfo
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStdHandle
GetThreadPriority
GetTickCount64
LoadLibraryA
LocalAlloc
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
ResumeThread
SetEvent
SetLastError
SetThreadPriority
Sleep
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
RaiseException
AddVectoredExceptionHandler
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetCurrentProcessId
SwitchToThread
GetCurrentThreadId
SuspendThread
FlushProcessWriteBuffers
GetThreadContext
SetThreadContext
GetSystemTimeAsFileTime
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
LoadLibraryExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsFree
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
ole32
CoWaitForMultipleHandles
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoCreateGuid
api-ms-win-crt-math-l1-1-0
log
ceil
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
_callnewh
api-ms-win-crt-string-l1-1-0
_stricmp
strlen
strcmp
strcpy_s
strcpy
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
abort
_seh_filter_dll
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
0LdDmTMMmm2eVUudVsf9aSDC
1WEFuuuZ93YjRkC9uhVNBqFWd2gKNP
2L2c8456ytLk
3hcBq7Xpd
3rwEmIQMj1P4yjOdzct
4eMrATbgYKyN6VU5h3ouf8
4kKzE3aMpETgDovII59
5reR3qC2MT21SjrahRBOMw
5wyPDIO9EkgREe
6Gli1qg229FtbwQu0XKdD2M5W
6YSMAKa6hweV2g9MFJuNUj
77nuJDeA6vpZIshcVzUAQ7pMIx6LWf
7KFUUla1zbUyaP2ZgfU6ZN89
8IXtNReTKkg8LcL37Y86
BvPL65rY3
CBB96x0TMin0i0oqKG4qryjBJI
CmvnojY0lY4dyGWwEyfiUSc9ezOyXAR
DSZCcJvcObX9GLDys
DXTFgV8jw9pygHvg
Du25WU0wFD4
ET9gT1Nj7LaW9SsRp
FMnlebJ772hHDxP2xBBjFfCahNegzw
GHLfVQjTJwgoPEVCdMbUN4myQFyzrz
GetUtfMode
Gs2rHfdRvd3KbBxbarW57rPQkPqoA
IVwLPMcy
IXPOburEqgdo4C4ZHgzJSKIyuuGxsIdo
LcFajpQSijrmWO4Pz
LookupStringInFixedSet
LyMpjyo32vdWTXVqzJkT1pB18bx
MEdbwdyJSmdDS2owivRZ
MOrTTWhI7sOOWc8IA5U4Iodo5sZN8y7
MhhgiIHaxVfyg5YIOP4SalOw3npRn
N301kHuEhiA5Im8s8wh
OfOZLEVjGvgoYFrQWbfmr2c
Ok8KYp4XL8zz0fSQDO1066hgP08E
P5u8tReZNRi7P
Pe4EGbbNvH2F6VZ5Ks
QT3Kvg7tKWkpK
RBf4B1RRpj
REaGCAx5
T3n4EZu125y8ZeqSQ
TwfCZzQVG8Oi1SWwa2eiyLgawOGw3
V2rW5jSs85F4D9Rhdy1hEkIlY0J
WchU9kA8ZsIBjOiCIIWzZjEmLY4C
WmShcYQWeAN
WvDznNQGAQTJggAUMXTLTI1CyaxCY
Xf7EGKReXX
XseXPnA5
Y7QVE2OLIeXhGgrAfpUoFQM
YIPkNzHxdcKjbq68n15ABAo76qMiA
ZdWxRcEN
ZrPdg4QG8UyJdNWc4C31SBYyjj
a1H3wm2Lb3qpAwvJ4grHw
aHwivTclJWpfPsdPn3NV
aQ04U3zowNbjnQqztKVCaltSfUwtC
bs6hYzVsltg0wUW
cktMfZUJ0Oco854bOwr
daN9R8A636rzXW0xKU
drZGbG10GiUpzHTo
eS05mnuo67HSDOxqQhX7f
eg0MDQT7qWI9HMi4jdSsL0QFxD5HiP8b
f7HDmJuVrCD
froOm4I7HUtxdADwkCCWkDn
gDVpAMEgoUPooh
h7quJXQySuQzltLTOG8
iEHwMpjgKy
iTCWfPvarA4qbi2KcaPq
j1x8LqWueTwai2b0NYrU
k9BbMuXEbsgQjZalw
kSZ1oScKmCP39
ktbYiC0BJ
lwe4yYsqhqjGlt8S
m8qlFycSgppuYSNePsT0KBxOoJwENy
mEnc7sUmrC9tHQb
nSrmREQpjfPOIf8vPkLuO0GEKVTdLlU
psl_builtin
psl_builtin_file_time
psl_builtin_filename
psl_builtin_outdated
psl_builtin_sha1sum
psl_check_version_number
psl_dist_filename
psl_free
psl_free_string
psl_get_version
psl_is_cookie_domain_acceptable
psl_is_public_suffix
psl_is_public_suffix2
psl_latest
psl_load_file
psl_load_fp
psl_registrable_domain
psl_str_to_utf8lower
psl_suffix_count
psl_suffix_exception_count
psl_suffix_wildcard_count
psl_unregistrable_domain
qDFpE1tutLiRleyHtauV
qGZNmBBZovUBcYA
rbMZCQT3CUSJcrQfxMFgnM9jo
schLmh6x5N1cO3vE
syFKbK705hoCUew
vRL3QIBdqDXYKUm58iSzhdI
wfXHzjE6oNKmiAuUdlDylUzCha9ndr0
xC3vYKBVLz1jkU
xPL8w0BeNKl5XAlKQ6vLNY0N9q4
Name
.text
Size
800KB
Virtual Size
799KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
libunistring-5.dll
- IMPHASH 5df5957a2375fd9826150acae6823c04
- SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
- MD5 c7c2ad785d5cd588ffbc7287a7a32f57
- SHA1 dcc9c1e21dbfc14e26574d024bde379aec839160
- SHA512 d07bd5d3b5600d97624a0f8fba46754000a5c9ae9a346b1171a7cdf7efcb38a7569798b0f2b8a4378530a8824c8f9a1e24f95e47c76c633ced04a1a8861faef9
- SSDEEP 49152:aFIJ3c3285Qfix+WoXHd6PFbE6QTVpIyd5F3dB:a+J365Qf93l6QD5F3dB
- TLSH T166A56A16B11FD3D8F5C9C4304E8EFBB291517C29ADA0A67FB650F32D1D3A8E74A09126
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ec:7d:2a:f1:6c:a7:81:74:07:a9:0f:f1:55:24:e5:ad:1b:31:92:94:63:c5:86:3e:ac:88:72:6f:d8:38:f0:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:6d:55:c0:d4:3b:28:9c:0b:de:00:00:00:00:04:6d
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - Jul 7, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
libiconv-2
libiconv
libiconv_close
libiconv_open
kernel32
CloseHandle
CreateEventA
DeleteCriticalSection
EnterCriticalSection
EnumSystemLocalesA
GetACP
GetCurrentProcess
GetCurrentThreadId
GetLastError
GetLocaleInfoA
GetModuleHandleW
GetProcAddress
GetThreadLocale
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
SetEvent
Sleep
TerminateProcess
TlsGetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_assert
_errno
_initterm
_lock
_strdup
_unlock
_write
abort
calloc
fputc
free
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
setlocale
strcat
strchr
strcmp
strcoll
strcpy
strerror
strlen
strncat
strncmp
strncpy
strrchr
strtoul
strxfrm
towlower
towupper
vfprintf
wcslen
UC_CATEGORY_C
UC_CATEGORY_Cc
UC_CATEGORY_Cf
UC_CATEGORY_Cn
UC_CATEGORY_Co
UC_CATEGORY_Cs
UC_CATEGORY_L
UC_CATEGORY_LC
UC_CATEGORY_Ll
UC_CATEGORY_Lm
UC_CATEGORY_Lo
UC_CATEGORY_Lt
UC_CATEGORY_Lu
UC_CATEGORY_M
UC_CATEGORY_Mc
UC_CATEGORY_Me
UC_CATEGORY_Mn
UC_CATEGORY_N
UC_CATEGORY_Nd
UC_CATEGORY_Nl
UC_CATEGORY_No
UC_CATEGORY_P
UC_CATEGORY_Pc
UC_CATEGORY_Pd
UC_CATEGORY_Pe
UC_CATEGORY_Pf
UC_CATEGORY_Pi
UC_CATEGORY_Po
UC_CATEGORY_Ps
UC_CATEGORY_S
UC_CATEGORY_Sc
UC_CATEGORY_Sk
UC_CATEGORY_Sm
UC_CATEGORY_So
UC_CATEGORY_Z
UC_CATEGORY_Zl
UC_CATEGORY_Zp
UC_CATEGORY_Zs
UC_PROPERTY_ALPHABETIC
UC_PROPERTY_ASCII_HEX_DIGIT
UC_PROPERTY_BIDI_ARABIC_DIGIT
UC_PROPERTY_BIDI_ARABIC_RIGHT_TO_LEFT
UC_PROPERTY_BIDI_BLOCK_SEPARATOR
UC_PROPERTY_BIDI_BOUNDARY_NEUTRAL
UC_PROPERTY_BIDI_COMMON_SEPARATOR
UC_PROPERTY_BIDI_CONTROL
UC_PROPERTY_BIDI_EMBEDDING_OR_OVERRIDE
UC_PROPERTY_BIDI_EUROPEAN_DIGIT
UC_PROPERTY_BIDI_EUR_NUM_SEPARATOR
UC_PROPERTY_BIDI_EUR_NUM_TERMINATOR
UC_PROPERTY_BIDI_HEBREW_RIGHT_TO_LEFT
UC_PROPERTY_BIDI_LEFT_TO_RIGHT
UC_PROPERTY_BIDI_NON_SPACING_MARK
UC_PROPERTY_BIDI_OTHER_NEUTRAL
UC_PROPERTY_BIDI_PDF
UC_PROPERTY_BIDI_SEGMENT_SEPARATOR
UC_PROPERTY_BIDI_WHITESPACE
UC_PROPERTY_CASED
UC_PROPERTY_CASE_IGNORABLE
UC_PROPERTY_CHANGES_WHEN_CASEFOLDED
UC_PROPERTY_CHANGES_WHEN_CASEMAPPED
UC_PROPERTY_CHANGES_WHEN_LOWERCASED
UC_PROPERTY_CHANGES_WHEN_TITLECASED
UC_PROPERTY_CHANGES_WHEN_UPPERCASED
UC_PROPERTY_COMBINING
UC_PROPERTY_COMPOSITE
UC_PROPERTY_CURRENCY_SYMBOL
UC_PROPERTY_DASH
UC_PROPERTY_DECIMAL_DIGIT
UC_PROPERTY_DEFAULT_IGNORABLE_CODE_POINT
UC_PROPERTY_DEPRECATED
UC_PROPERTY_DIACRITIC
UC_PROPERTY_EMOJI
UC_PROPERTY_EMOJI_COMPONENT
UC_PROPERTY_EMOJI_MODIFIER
UC_PROPERTY_EMOJI_MODIFIER_BASE
UC_PROPERTY_EMOJI_PRESENTATION
UC_PROPERTY_EXTENDED_PICTOGRAPHIC
UC_PROPERTY_EXTENDER
UC_PROPERTY_FORMAT_CONTROL
UC_PROPERTY_GRAPHEME_BASE
UC_PROPERTY_GRAPHEME_EXTEND
UC_PROPERTY_GRAPHEME_LINK
UC_PROPERTY_HEX_DIGIT
UC_PROPERTY_HYPHEN
UC_PROPERTY_IDEOGRAPHIC
UC_PROPERTY_IDS_BINARY_OPERATOR
UC_PROPERTY_IDS_TRINARY_OPERATOR
UC_PROPERTY_IDS_UNARY_OPERATOR
UC_PROPERTY_ID_COMPAT_MATH_CONTINUE
UC_PROPERTY_ID_COMPAT_MATH_START
UC_PROPERTY_ID_CONTINUE
UC_PROPERTY_ID_START
UC_PROPERTY_IGNORABLE_CONTROL
UC_PROPERTY_ISO_CONTROL
UC_PROPERTY_JOIN_CONTROL
UC_PROPERTY_LEFT_OF_PAIR
UC_PROPERTY_LINE_SEPARATOR
UC_PROPERTY_LOGICAL_ORDER_EXCEPTION
UC_PROPERTY_LOWERCASE
UC_PROPERTY_MATH
UC_PROPERTY_MODIFIER_COMBINING_MARK
UC_PROPERTY_NON_BREAK
UC_PROPERTY_NOT_A_CHARACTER
UC_PROPERTY_NUMERIC
UC_PROPERTY_OTHER_ALPHABETIC
UC_PROPERTY_OTHER_DEFAULT_IGNORABLE_CODE_POINT
UC_PROPERTY_OTHER_GRAPHEME_EXTEND
UC_PROPERTY_OTHER_ID_CONTINUE
UC_PROPERTY_OTHER_ID_START
UC_PROPERTY_OTHER_LOWERCASE
UC_PROPERTY_OTHER_MATH
UC_PROPERTY_OTHER_UPPERCASE
UC_PROPERTY_PAIRED_PUNCTUATION
UC_PROPERTY_PARAGRAPH_SEPARATOR
UC_PROPERTY_PATTERN_SYNTAX
UC_PROPERTY_PATTERN_WHITE_SPACE
UC_PROPERTY_PREPENDED_CONCATENATION_MARK
UC_PROPERTY_PRIVATE_USE
UC_PROPERTY_PUNCTUATION
UC_PROPERTY_QUOTATION_MARK
UC_PROPERTY_RADICAL
UC_PROPERTY_REGIONAL_INDICATOR
UC_PROPERTY_SENTENCE_TERMINAL
UC_PROPERTY_SOFT_DOTTED
UC_PROPERTY_SPACE
UC_PROPERTY_TERMINAL_PUNCTUATION
UC_PROPERTY_TITLECASE
UC_PROPERTY_UNASSIGNED_CODE_VALUE
UC_PROPERTY_UNIFIED_IDEOGRAPH
UC_PROPERTY_UPPERCASE
UC_PROPERTY_VARIATION_SELECTOR
UC_PROPERTY_WHITE_SPACE
UC_PROPERTY_XID_CONTINUE
UC_PROPERTY_XID_START
UC_PROPERTY_ZERO_WIDTH
_UC_CATEGORY_NONE
_libunistring_unicode_version
_libunistring_version
libunistring_amemxfrm
libunistring_c32isalnum
libunistring_c32isalpha
libunistring_c32isblank
libunistring_c32iscntrl
libunistring_c32isdigit
libunistring_c32isgraph
libunistring_c32islower
libunistring_c32isprint
libunistring_c32ispunct
libunistring_c32isspace
libunistring_c32isupper
libunistring_c32isxdigit
libunistring_c32tolower
libunistring_c32width
libunistring_c_isalnum
libunistring_c_isalpha
libunistring_c_isascii
libunistring_c_isblank
libunistring_c_iscntrl
libunistring_c_isdigit
libunistring_c_isgraph
libunistring_c_islower
libunistring_c_isprint
libunistring_c_ispunct
libunistring_c_isspace
libunistring_c_isupper
libunistring_c_isxdigit
libunistring_c_strcasecmp
libunistring_c_strncasecmp
libunistring_c_tolower
libunistring_c_toupper
libunistring_freea
libunistring_fseterr
libunistring_gl_locale_name
libunistring_gl_locale_name_default
libunistring_gl_locale_name_environ
libunistring_gl_locale_name_posix
libunistring_gl_locale_name_posix_unsafe
libunistring_gl_locale_name_thread
libunistring_gl_locale_name_thread_unsafe
libunistring_gl_locale_name_unsafe
libunistring_gl_unicase_special_lookup
libunistring_gl_uninorm_decomp_chars_table
libunistring_gl_uninorm_decomp_index_table
libunistring_gl_uninorm_decompose_merge_sort_inplace
libunistring_glwthread_mutex_destroy
libunistring_glwthread_mutex_init
libunistring_glwthread_mutex_lock
libunistring_glwthread_mutex_trylock
libunistring_glwthread_mutex_unlock
libunistring_glwthread_once
libunistring_glwthread_recmutex_destroy
libunistring_glwthread_recmutex_init
libunistring_glwthread_recmutex_lock
libunistring_glwthread_recmutex_trylock
libunistring_glwthread_recmutex_unlock
libunistring_glwthread_rwlock_destroy
libunistring_glwthread_rwlock_init
libunistring_glwthread_rwlock_rdlock
libunistring_glwthread_rwlock_tryrdlock
libunistring_glwthread_rwlock_trywrlock
libunistring_glwthread_rwlock_unlock
libunistring_glwthread_rwlock_wrlock
libunistring_hard_locale
libunistring_iconveh_close
libunistring_iconveh_open
libunistring_mb_copy
libunistring_mb_width_aux
libunistring_mbiterf_next
libunistring_mbrtoc32
libunistring_mbsnlen
libunistring_mbszero
libunistring_mem_cd_iconveh
libunistring_mem_iconveh
libunistring_mem_iconveha
libunistring_memcmp2
libunistring_mmalloca
libunistring_printf_frexp
libunistring_printf_frexpl
libunistring_rpl_free
libunistring_rpl_iswalnum
libunistring_rpl_iswalpha
libunistring_rpl_iswblank
libunistring_rpl_iswcntrl
libunistring_rpl_iswdigit
libunistring_rpl_iswgraph
libunistring_rpl_iswlower
libunistring_rpl_iswprint
libunistring_rpl_iswpunct
libunistring_rpl_iswspace
libunistring_rpl_iswupper
libunistring_rpl_iswxdigit
libunistring_rpl_malloc
libunistring_rpl_mbrtowc
libunistring_rpl_mbsinit
libunistring_rpl_pthread_once
libunistring_rpl_strstr
libunistring_rpl_towlower
libunistring_rpl_towupper
libunistring_setlocale_null
libunistring_setlocale_null_r
libunistring_setlocale_null_r_unlocked
libunistring_setlocale_null_unlocked
libunistring_str_cd_iconveh
libunistring_str_iconveh
libunistring_str_iconveha
libunistring_u16_casemap
libunistring_u16_is_invariant
libunistring_u16_possible_linebreaks_loop
libunistring_u16_printf_parse
libunistring_u32_casemap
libunistring_u32_is_invariant
libunistring_u32_possible_linebreaks_loop
libunistring_u32_printf_parse
libunistring_u8_casemap
libunistring_u8_is_invariant
libunistring_u8_possible_linebreaks_loop
libunistring_u8_printf_parse
libunistring_u8_width_linebreaks_internal
libunistring_u_printf_fetchargs
libunistring_uc_compat_decomposition
libunistring_uc_is_case_ignorable
libunistring_uc_is_cased
libunistring_uc_tocasefold
libunistring_ulc_printf_parse
libunistring_uniconv_register_autodetect
libunistring_unilbrk_is_all_ascii
libunistring_unilbrk_is_utf8_encoding
libunistring_unilbrk_table
libunistring_unilbrkprop
libunistring_uniwbrk_prop_index
libunistring_uniwbrk_table
libunistring_wcwidth
libunistring_xmax
libunistring_xsum
libunistring_xsum3
libunistring_xsum4
locale_charset
u16_asnprintf
u16_asprintf
u16_casecmp
u16_casecoll
u16_casefold
u16_casexfrm
u16_casing_prefix_context
u16_casing_prefixes_context
u16_casing_suffix_context
u16_casing_suffixes_context
u16_check
u16_chr
u16_cmp
u16_cmp2
u16_conv_from_encoding
u16_conv_to_encoding
u16_cpy
u16_cpy_alloc
u16_ct_casefold
u16_ct_tolower
u16_ct_totitle
u16_ct_toupper
u16_endswith
u16_grapheme_breaks
u16_grapheme_next
u16_grapheme_prev
u16_is_cased
u16_is_casefolded
u16_is_lowercase
u16_is_titlecase
u16_is_uppercase
u16_mblen
u16_mbsnlen
u16_mbtouc
u16_mbtouc_aux
u16_mbtouc_unsafe
u16_mbtouc_unsafe_aux
u16_mbtoucr
u16_move
u16_next
u16_normalize
u16_normcmp
u16_normcoll
u16_normxfrm
u16_pcpy
u16_possible_linebreaks
u16_possible_linebreaks_v2
u16_prev
u16_set
u16_snprintf
u16_sprintf
u16_startswith
u16_stpcpy
u16_stpncpy
u16_strcat
u16_strchr
u16_strcmp
u16_strcoll
u16_strconv_from_encoding
u16_strconv_from_locale
u16_strconv_to_encoding
u16_strconv_to_locale
u16_strcpy
u16_strcspn
u16_strdup
u16_strlen
u16_strmblen
u16_strmbtouc
u16_strncat
u16_strncmp
u16_strncpy
u16_strnlen
u16_strpbrk
u16_strrchr
u16_strspn
u16_strstr
u16_strtok
u16_strwidth
u16_to_u32
u16_to_u8
u16_tolower
u16_totitle
u16_toupper
u16_u16_asnprintf
u16_u16_asprintf
u16_u16_snprintf
u16_u16_sprintf
u16_u16_vasnprintf
u16_u16_vasprintf
u16_u16_vsnprintf
u16_u16_vsprintf
u16_uctomb
u16_uctomb_aux
u16_vasnprintf
u16_vasprintf
u16_vsnprintf
u16_vsprintf
u16_width
u16_width_linebreaks
u16_width_linebreaks_v2
u16_wordbreaks
u32_asnprintf
u32_asprintf
u32_casecmp
u32_casecoll
u32_casefold
u32_casexfrm
u32_casing_prefix_context
u32_casing_prefixes_context
u32_casing_suffix_context
u32_casing_suffixes_context
u32_check
u32_chr
u32_cmp
u32_cmp2
u32_conv_from_encoding
u32_conv_to_encoding
u32_cpy
u32_cpy_alloc
u32_ct_casefold
u32_ct_tolower
u32_ct_totitle
u32_ct_toupper
u32_endswith
u32_grapheme_breaks
u32_grapheme_next
u32_grapheme_prev
u32_is_cased
u32_is_casefolded
u32_is_lowercase
u32_is_titlecase
u32_is_uppercase
u32_mblen
u32_mbsnlen
u32_mbtouc
u32_mbtouc_unsafe
u32_mbtoucr
u32_move
u32_next
u32_normalize
u32_normcmp
u32_normcoll
u32_normxfrm
u32_pcpy
u32_possible_linebreaks
u32_possible_linebreaks_v2
u32_prev
u32_set
u32_snprintf
u32_sprintf
u32_startswith
u32_stpcpy
u32_stpncpy
u32_strcat
u32_strchr
u32_strcmp
u32_strcoll
u32_strconv_from_encoding
u32_strconv_from_locale
u32_strconv_to_encoding
u32_strconv_to_locale
u32_strcpy
u32_strcspn
u32_strdup
u32_strlen
u32_strmblen
u32_strmbtouc
u32_strncat
u32_strncmp
u32_strncpy
u32_strnlen
u32_strpbrk
u32_strrchr
u32_strspn
u32_strstr
u32_strtok
u32_strwidth
u32_to_u16
u32_to_u8
u32_tolower
u32_totitle
u32_toupper
u32_u32_asnprintf
u32_u32_asprintf
u32_u32_snprintf
u32_u32_sprintf
u32_u32_vasnprintf
u32_u32_vasprintf
u32_u32_vsnprintf
u32_u32_vsprintf
u32_uctomb
u32_vasnprintf
u32_vasprintf
u32_vsnprintf
u32_vsprintf
u32_width
u32_width_linebreaks
u32_width_linebreaks_v2
u32_wordbreaks
u8_asnprintf
u8_asprintf
u8_casecmp
u8_casecoll
u8_casefold
u8_casexfrm
u8_casing_prefix_context
u8_casing_prefixes_context
u8_casing_suffix_context
u8_casing_suffixes_context
u8_check
u8_chr
u8_cmp
u8_cmp2
u8_conv_from_encoding
u8_conv_to_encoding
u8_cpy
u8_cpy_alloc
u8_ct_casefold
u8_ct_tolower
u8_ct_totitle
u8_ct_toupper
u8_endswith
u8_grapheme_breaks
u8_grapheme_next
u8_grapheme_prev
u8_is_cased
u8_is_casefolded
u8_is_lowercase
u8_is_titlecase
u8_is_uppercase
u8_mblen
u8_mbsnlen
u8_mbtouc
u8_mbtouc_aux
u8_mbtouc_unsafe
u8_mbtouc_unsafe_aux
u8_mbtoucr
u8_move
u8_next
u8_normalize
u8_normcmp
u8_normcoll
u8_normxfrm
u8_pcpy
u8_possible_linebreaks
u8_possible_linebreaks_v2
u8_prev
u8_set
u8_snprintf
u8_sprintf
u8_startswith
u8_stpcpy
u8_stpncpy
u8_strcat
u8_strchr
u8_strcmp
u8_strcoll
u8_strconv_from_encoding
u8_strconv_from_locale
u8_strconv_to_encoding
u8_strconv_to_locale
u8_strcpy
u8_strcspn
u8_strdup
u8_strlen
u8_strmblen
u8_strmbtouc
u8_strncat
u8_strncmp
u8_strncpy
u8_strnlen
u8_strpbrk
u8_strrchr
u8_strspn
u8_strstr
u8_strtok
u8_strwidth
u8_to_u16
u8_to_u32
u8_tolower
u8_totitle
u8_toupper
u8_u8_asnprintf
u8_u8_asprintf
u8_u8_snprintf
u8_u8_sprintf
u8_u8_vasnprintf
u8_u8_vasprintf
u8_u8_vsnprintf
u8_u8_vsprintf
u8_uctomb
u8_uctomb_aux
u8_vasnprintf
u8_vasprintf
u8_vsnprintf
u8_vsprintf
u8_width
u8_width_linebreaks
u8_width_linebreaks_v2
u8_wordbreaks
uc_all_blocks
uc_all_scripts
uc_bidi_category
uc_bidi_category_byname
uc_bidi_category_name
uc_bidi_class
uc_bidi_class_byname
uc_bidi_class_long_name
uc_bidi_class_name
uc_block
uc_c_ident_category
uc_canonical_decomposition
uc_combining_class
uc_combining_class_byname
uc_combining_class_long_name
uc_combining_class_name
uc_composition
uc_decimal_value
uc_decomposition
uc_digit_value
uc_general_category
uc_general_category_and
uc_general_category_and_not
uc_general_category_byname
uc_general_category_long_name
uc_general_category_name
uc_general_category_or
uc_grapheme_breaks
uc_graphemeclusterbreak_property
uc_indic_conjunct_break
uc_indic_conjunct_break_byname
uc_indic_conjunct_break_name
uc_is_alnum
uc_is_alpha
uc_is_bidi_category
uc_is_bidi_class
uc_is_blank
uc_is_block
uc_is_c_whitespace
uc_is_cntrl
uc_is_digit
uc_is_general_category
uc_is_general_category_withtable
uc_is_graph
uc_is_grapheme_break
uc_is_java_whitespace
uc_is_lower
uc_is_print
uc_is_property
uc_is_property_alphabetic
uc_is_property_ascii_hex_digit
uc_is_property_bidi_arabic_digit
uc_is_property_bidi_arabic_right_to_left
uc_is_property_bidi_block_separator
uc_is_property_bidi_boundary_neutral
uc_is_property_bidi_common_separator
uc_is_property_bidi_control
uc_is_property_bidi_embedding_or_override
uc_is_property_bidi_eur_num_separator
uc_is_property_bidi_eur_num_terminator
uc_is_property_bidi_european_digit
uc_is_property_bidi_hebrew_right_to_left
uc_is_property_bidi_left_to_right
uc_is_property_bidi_non_spacing_mark
uc_is_property_bidi_other_neutral
uc_is_property_bidi_pdf
uc_is_property_bidi_segment_separator
uc_is_property_bidi_whitespace
uc_is_property_case_ignorable
uc_is_property_cased
uc_is_property_changes_when_casefolded
uc_is_property_changes_when_casemapped
uc_is_property_changes_when_lowercased
uc_is_property_changes_when_titlecased
uc_is_property_changes_when_uppercased
uc_is_property_combining
uc_is_property_composite
uc_is_property_currency_symbol
uc_is_property_dash
uc_is_property_decimal_digit
uc_is_property_default_ignorable_code_point
uc_is_property_deprecated
uc_is_property_diacritic
uc_is_property_emoji
uc_is_property_emoji_component
uc_is_property_emoji_modifier
uc_is_property_emoji_modifier_base
uc_is_property_emoji_presentation
uc_is_property_extended_pictographic
uc_is_property_extender
uc_is_property_format_control
uc_is_property_grapheme_base
uc_is_property_grapheme_extend
uc_is_property_grapheme_link
uc_is_property_hex_digit
uc_is_property_hyphen
uc_is_property_id_compat_math_continue
uc_is_property_id_compat_math_start
uc_is_property_id_continue
uc_is_property_id_start
uc_is_property_ideographic
uc_is_property_ids_binary_operator
uc_is_property_ids_trinary_operator
uc_is_property_ids_unary_operator
uc_is_property_ignorable_control
uc_is_property_iso_control
uc_is_property_join_control
uc_is_property_left_of_pair
uc_is_property_line_separator
uc_is_property_logical_order_exception
uc_is_property_lowercase
uc_is_property_math
uc_is_property_modifier_combining_mark
uc_is_property_non_break
uc_is_property_not_a_character
uc_is_property_numeric
uc_is_property_other_alphabetic
uc_is_property_other_default_ignorable_code_point
uc_is_property_other_grapheme_extend
uc_is_property_other_id_continue
uc_is_property_other_id_start
uc_is_property_other_lowercase
uc_is_property_other_math
uc_is_property_other_uppercase
uc_is_property_paired_punctuation
uc_is_property_paragraph_separator
uc_is_property_pattern_syntax
uc_is_property_pattern_white_space
uc_is_property_prepended_concatenation_mark
uc_is_property_private_use
uc_is_property_punctuation
uc_is_property_quotation_mark
uc_is_property_radical
uc_is_property_regional_indicator
uc_is_property_sentence_terminal
uc_is_property_soft_dotted
uc_is_property_space
uc_is_property_terminal_punctuation
uc_is_property_titlecase
uc_is_property_unassigned_code_value
uc_is_property_unified_ideograph
uc_is_property_uppercase
uc_is_property_variation_selector
uc_is_property_white_space
uc_is_property_xid_continue
uc_is_property_xid_start
uc_is_property_zero_width
uc_is_punct
uc_is_script
uc_is_space
uc_is_upper
uc_is_xdigit
uc_java_ident_category
uc_joining_group
uc_joining_group_byname
uc_joining_group_name
uc_joining_type
uc_joining_type_byname
uc_joining_type_long_name
uc_joining_type_name
uc_locale_language
uc_mirror_char
uc_numeric_value
uc_property_byname
uc_script
uc_script_byname
uc_tolower
uc_totitle
uc_toupper
uc_width
uc_wordbreak_property
ulc_asnprintf
ulc_asprintf
ulc_casecmp
ulc_casecoll
ulc_casexfrm
ulc_fprintf
ulc_grapheme_breaks
ulc_possible_linebreaks
ulc_possible_linebreaks_v2
ulc_snprintf
ulc_sprintf
ulc_vasnprintf
ulc_vasprintf
ulc_vfprintf
ulc_vsnprintf
ulc_vsprintf
ulc_width_linebreaks
ulc_width_linebreaks_v2
ulc_wordbreaks
unicase_empty_prefix_context
unicase_empty_suffix_context
unicode_character_name
unicode_name_character
uninorm_decomposing_form
uninorm_filter_create
uninorm_filter_flush
uninorm_filter_free
uninorm_filter_write
uninorm_nfc
uninorm_nfd
uninorm_nfkc
uninorm_nfkd
Name
.text
Size
424KB
Virtual Size
424KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
psl.exe
- IMPHASH 10c6c97eb4b6a404b9554b496a898693
- SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
- MD5 7a682a9da479baec38d5d43a02b604e9
- SHA1 f47cfd3053fe916d078433a53c87010001de16ad
- SHA512 acab4e8eb030b14f78119dbaf2dff58cffc11ff620c608fd0978653d6db7ac4bc0df93915c676af3bac0573587b15ba2b3707f83bdbc90d3e2fd16ef7b13df1d
- SSDEEP 1536:dChgkRItz9QPtRg8NcMVPr8roUJqHWWbFE3rvzN:dcFt1S8NcMVPr8t0bFE75
- TLSH T1E3535C6AF34264EDD697C53491E69B71FA32B9110230AB3F725CE1301F31FA19E2A45E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
45:98:bc:13:ee:95:d5:c1:e1:9d:b3:34:7b:85:d3:27:f9:2a:53:c8:69:da:89:f1:43:e2:0b:bb:32:a3:0d:4c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 1, 2026
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:6c:b0:06:24:d2:92:9c:6f:e0:00:00:00:00:04:6c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - Jul 7, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetLastError
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_localtime64
_lock
_unlock
abort
atexit
calloc
_write
exit
fgets
fprintf
fputc
free
fwrite
isspace
localeconv
malloc
memcpy
memset
putchar
puts
setlocale
signal
strcmp
strerror
strftime
strlen
strncmp
vfprintf
wcslen
ws2_32
WSACleanup
WSAStartup
libpsl-5
psl_builtin
psl_builtin_file_time
psl_builtin_filename
psl_builtin_outdated
psl_builtin_sha1sum
psl_check_version_number
psl_dist_filename
psl_free
psl_free_string
psl_get_version
psl_is_cookie_domain_acceptable
psl_is_public_suffix
psl_is_public_suffix2
psl_latest
psl_load_file
psl_registrable_domain
psl_str_to_utf8lower
psl_suffix_count
psl_suffix_exception_count
psl_suffix_wildcard_count
psl_unregistrable_domain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ