niggainmybutthole.zip
- SHA256 49dce1e441129f44034eb94143df788c874da685cb8f3c6bbfbbf471531dd840
Static task
static1
1 signatures
General
- Target niggainmybutthole.zip
- Size 24.2MB
- Sample260702-avmfcaav4z
- SHA256 49dce1e441129f44034eb94143df788c874da685cb8f3c6bbfbbf471531dd840
- MD5 a7368e8ddfd9af4250d5a59c623f3220
- SHA1 82ef6925bcc1d1ae670c17d3dfed590339655a26
- SHA512 b1d5a4d166b58bad1e2236662143c943cdbe8c394f901391e94d33d08ce34ba3e65264b6c91293bd77ae1ab9c8588b1af9fae3ca99f4f5f2840e64915afff247
- SSDEEP 393216:cy1+OBPzGvOIvCTwHcZcHEYS2/sTQbVZWX7uM72Eh9o4TXPjJNl+Rktw1:cAzIcURHE2/s0mXNbo4zl+sE
- TLSH T1994733211E9C403D9C6A625A95532D253A4987D79FF3D7FEE3EA2FE36F0402864190C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Aurora/Aurora/AuroraClient.dll unpack001/Aurora/Aurora/AuroraClient.exe unpack001/Aurora/Aurora/CuoreUI.dll unpack001/Aurora/Aurora/QRCoder.dll unpack001/Aurora/Aurora/SiticoneNetCoreUI.dll
File Explorer
-
niggainmybutthole.zip.zip 24.2MB
-
Aurora/Aurora/AuroraClient.deps.json11KB
-
Aurora/Aurora/AuroraClient.dll.exe 21KB
-
Aurora/Aurora/AuroraClient.exe.exe 374KB
-
Aurora/Aurora/AuroraClient.pdb15KB
-
Aurora/Aurora/AuroraClient.runtimeconfig.json443B
-
Aurora/Aurora/CuoreUI.dll.dll 288KB
-
Aurora/Aurora/Microsoft.AspNetCore.Cryptography.Internal.dll.dll 44KB
-
Aurora/Aurora/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll.dll 25KB
-
Aurora/Aurora/Newtonsoft.Json.dll.dll 695KB
-
Aurora/Aurora/QRCoder.dll.dll 152KB
-
Aurora/Aurora/READ IF NOT WORK.txt105B
-
Aurora/Aurora/SiticoneNetCoreUI.dll.dll 31.9MB
-
Aurora/Aurora/System.CodeDom.dll.dll 179KB
-
Aurora/Aurora/System.Composition.AttributedModel.dll.dll 18KB
-
Aurora/Aurora/System.Composition.Convention.dll.dll 51KB
-
Aurora/Aurora/System.Composition.Hosting.dll.dll 53KB
-
Aurora/Aurora/System.Composition.Runtime.dll.dll 24KB
-
Aurora/Aurora/System.Composition.TypedParts.dll.dll 59KB
-
Aurora/Aurora/System.Management.dll.dll 71KB
-
Aurora/Aurora/runtimes/win/lib/net8.0/System.Management.dll.dll 305KB
Aurora/Aurora/AuroraClient.deps.json
- SHA256 1efac287ae688b80a2f1e51dd457bfd33b8505c600f193f5cfa05cc4109f645f
- MD5 85598f8bb1cfe444c3de5999c33908b2
- SHA1 39d30960324061ccca4d8069630bea4517964c97
- SHA512 ed5c6b982a408fc042b1ef0f90f13468c0b4d4bf26bb82e72ef28dd8a9b52659dae2336625e567a67eedce41cad16caf01d0ba02f048ce204ab191c931346d6a
- SSDEEP 192:CF2YfyaKmFSLpfs+5IMq/RDHSmL/MwdN8GBqlMtJLDChleWiy78R5yS:CF2YfyaKmFSLpfs+5IMq/RDHSmL/Mwdf
- TLSH T111329826D9805EB70536AFA264354242F635533F4401698F78FC64ACCFBBE8B6262F34
- MD5 SHA1 SHA512 SSDEEP TLSH
Aurora/Aurora/AuroraClient.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4cdf9603b52036b9689b7c368fc0ed98f41e3fc7f1baf66e904938db3692a614
- MD5 d9cb765b5ea2fc1d879598ee1c32a631
- SHA1 01708ae10332c6171b1327cd75f6c58645f72557
- SHA512 d2d6938b6d8c2b6658a7c1d0c380ad29abca4aeee939b2a2ccde8df5cabb7e8d859187db4c3dbf36fe81664a9bdecb320a5847eb0cf88f3bb9cd000ea4686958
- SSDEEP 384:Lnvy9xeZaDQco+wvJqr/pdbe9iDoElLAICXwwAA9:Lvy9xeio+wvJgS9ovk
- TLSH T1C8A2929163DCEB23D97F87F889E2428107B365025416DF592DEA14CDAD3A7049B62BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\oleg1\Рабочий стол\test\AuroraClient\AuroraClient\obj\Debug\net8.0-windows\AuroraClient.pdb
mscoree
_CorExeMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/AuroraClient.exe
- IMPHASH ad84e9bbec1f11ee76f786dbd8fb80f0
- SHA256 e694f26b249050dc0001e48911c1381ebe9308a85e86afce1699d730eaac7b77
- MD5 4cd375e418630fe4d3ff7caf08a15788
- SHA1 f523100bde0ce2dc8ed8b56fbb9a9e8679460b30
- SHA512 1ae13b88a7037422b6da21f910cd6162da0082718a31cd47b7c803797b2c35cb7893bbbe300decf1e02e2c0719b73b9c959d4707b7874442d04c75cc8e3bbf81
- SSDEEP 6144:ZbKtVwDpnCHHi+46FXg6qF1B/zIUkYieBoVhl4slHWinoVHNLXs:FK88HHv463qlzbieqDisxfok
- TLSH T1D9847D06E6A504FDE16BD138C9525902FB727C4E47A1DBCF23948AA61F236E09E3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
101252
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\danar\OneDrive\Рабочий стол\Sources\Add\macosos\x64\Release\macosos.pdb
kernel32
WaitForSingleObject
GetFileAttributesW
GetLastError
FileTimeToSystemTime
DeleteFileW
CloseHandle
GetSystemInfo
GetTempPathW
SystemTimeToFileTime
GlobalMemoryStatusEx
CreateProcessW
GetSystemTimeAsFileTime
GetSystemTime
GetExitCodeProcess
SetEndOfFile
GetModuleFileNameW
WriteConsoleA
GetStdHandle
GetCommandLineW
SetConsoleTextAttribute
GetVolumeInformationW
ExitProcess
CreateDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LocalFree
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
Sleep
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
WakeAllConditionVariable
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
WriteFile
GetFileSizeEx
SetFilePointerEx
GetFileType
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
RtlUnwind
advapi32
RegDeleteKeyW
AllocateAndInitializeSid
RegCreateKeyExW
RegSetValueExW
FreeSid
CheckTokenMembership
RegCloseKey
shell32
ShellExecuteW
SHGetKnownFolderPath
ShellExecuteExW
ole32
CoTaskMemFree
urlmon
URLDownloadToFileW
wininet
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
InternetReadFile
Name
.text
Size
254KB
Virtual Size
253KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=30795,
count=181, id=261, version=30795,
count=23, id=260, version=30795,
count=10, id=259, version=34321,
count=16, id=260, version=34321,
count=93, id=261, version=34321,
count=1, id=262, version=30795,
count=13, id=257, version=30795,
count=180, id=1, productName=Unmarked objects,
count=1, id=265, version=34808,
count=1, id=255, version=34808,
count=1, id=258, version=34808,
Aurora/Aurora/AuroraClient.pdb
- SHA256 17e667c23d7d4add501e2081daa18a1ebd67a62fefd7c420305f03fe02356b2f
- MD5 588e731f27a94aee9c4ad673808c5079
- SHA1 f09b403f6904ea37a8c20ba75c884089c1226fa2
- SHA512 9e55fd22333986e509c5fe30283892c6a5890603a72f6a50c59d2213b4b87653c4a1ba7e908074de1ade0ce2869655dffef377403b3fe32ee9c690f63221912a
- SSDEEP 384:VGlKAsYEkzKZi34CeatoSEdJwzzylq+QJKyulSE4vRz7WrkQPgJ2wbJAcHgfgERH:sgAcke0orSEcJ0gJ2bzdv
- TLSH T11972B47397DCC562C141B9330522C59D3AF683E22341ED78F1C46508DEEF3AA43B1664
- MD5 SHA1 SHA512 SSDEEP TLSH
Aurora/Aurora/AuroraClient.runtimeconfig.json
- SHA256 7e79af92820e50910b90f1cade2728f45987393f24b50e384dc225d9773b7194
- MD5 9db099f143ead47e224653d0dde19fe9
- SHA1 d050db767fc64aa1705353132da3e35048475d3c
- SHA512 579c3c870903b3d47dbc2567153fa7c73e0aa47387c6969b8982037884033a4b25de702e0efb8c7ae717b6b463192b917b18a79b1ef5f8c969f257422af2b65f
- TLSH T1EEF0222ACA100DA308B977BEC626D182FE30436B00141966B5FC041C2FB3AA21100F89
- MD5 SHA1 SHA512 TLSH
Aurora/Aurora/CuoreUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a9d8aa819fff823dce4158c3619c034a938296bea26904d08ce864bbcd9edca
- MD5 cd62940b49ad0b1b46a73143305d91fb
- SHA1 f20dddc601ba24b3115110a5c508913c1da81c37
- SHA512 016984f3ccebbfeac95d17836e0aaf319c6da6bb68b0be8123735f1340e0aa45f0c6b53df98524f28b586da5edc5994fcc8702e6723efed33a42ce2c13c5df68
- SSDEEP 6144:+OVsj3RuTd8j9zkasd0MFFBskshdc7NRHRnM1E+e2g8jlyJw:e3RuTd8j9zkasd0yBskshdc7LRn4ze2/
- TLSH T127543A3063189A2ED97F4779909BC2C1C7F19257B25FEBDD5EC080FC29B2711A6261A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
301230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
286KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
672B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/Microsoft.AspNetCore.Cryptography.Internal.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 00cf84ee76c029cded8104ff0fa4bad1c5b482b88dab4abedebf54df63aa2800
- MD5 6c891b6dd1784a4f1c4da5dd3de2d266
- SHA1 819e13ea4e03745fcb8067836f8ee54f01d7688e
- SHA512 9e3505c983c5558e78f4fb6fa8bbdd9cd01579a280e68ee61311098f440245ba322a4ddf1d2b06b09ef40dce3225ce262646b38f375a8693c27609d8f98fe892
- SSDEEP 768:zI9BRqWpTMBUNAg/qkCyd6dBuqPVrJ7qfOvtv6nyXPj1FCleY9z:zIT8WTiUNAg/1Cu6XP9htyy7jieQz
- TLSH T1B6237E01BBBC0517EDE529B098F1F5962538F3937A53FF6D1182D29828677CA8B20379
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
89:a8:e2:f9:1b:b8:57:0e:75:c3:40:a8:f3:60:e5:44:d3:13:7b:b4:d7:38:87:a1:ca:af:33:5c:8b:a7:12:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
40594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.AspNetCore.Cryptography.Internal/Release/netstandard2.0/Microsoft.AspNetCore.Cryptography.Internal.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/Microsoft.AspNetCore.Cryptography.KeyDerivation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d52ab4b3d6de3ab36eac092dd2666bce2587668db52aad6419c699ee6c496db3
- MD5 7b6ff4e4dc55b70d23071cefe06ce08c
- SHA1 9a6b34e1abd4e8aea123b2178cd4df1cf4ccd7f9
- SHA512 cf24df68ec92564d35b727b7e958d19e287cdb2669ab108a75f6e12c5375ba47e5d0b049fd675e90851dc9a996ee9fac4127d36d103143464ab9f2476f589328
- SSDEEP 384:RbOH/N1i45q/Qan7CPhqfsTbr5CVHUyJWsX7WRYA6VFHRN7ZDtdQ5R9zF/34:hOHF1/oYan7LfsTbr4pCFClXds9zFo
- TLSH T1C9C26D5597EC9256EE7EAF3055F1D34B7D38EB4B5862AB6E0588E20D0C83388D32472D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
48:47:da:85:8e:e9:f8:d8:8e:2e:c7:62:50:58:ed:7b:9b:0f:92:ef:48:01:0b:be:39:ec:9c:c8:0f:40:6e:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
20730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.AspNetCore.Cryptography.KeyDerivation/Release/netstandard2.0/Microsoft.AspNetCore.Cryptography.KeyDerivation.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
705086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/QRCoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dab588acc9f280f289f6348fcc6388fd0c2eed932069cac9ae2d7fdb15076c43
- MD5 50f3c4e1f42753ed72d07138ac9b7a73
- SHA1 1133ca1f737e33774893159f3b57503fc61e5789
- SHA512 85c09f3a585fc5732b12ab947e1c2511ef1cdf48346f1e45a85c216c2e8648d6fc451872c3c57246e86133ad113d3c2e3dde1ebafea17013f33d695ab7e09985
- SSDEEP 3072:h+YDQ8otKJ8dAOHGcROabumhgdZ1QEIk05WquQ2oM:h+vVH0FIkuP
- TLSH T136E36C6867ECDF17E2BF3B7AE87040908771B4266A76D74E1D8895DE14A2B908C107F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
149938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net6.0-windows\QRCoder.pdb
mscoree
_CorDllMain
Name
.text
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/READ IF NOT WORK.txt
- SHA256 913a000455342a62c90bead4ab5b0466477f74a1d48ee0eb3f13e811c4610af6
- MD5 d220ab39d3211536253cef04686ed0f9
- SHA1 9a4960049258eb64add2df8a7ecfb45b5af6ee07
- SHA512 5459edde84b080a3aa093af94bd448936edfbc34b6a474a49e687a733b97643302d0472386b47b6a6013c4bc82536b3b501d34f1a1492dd30e2257a55d461496
- TLSH T10BB0126913164670A51E3533D37CCC510B99106192E36607D0D8804DFC31615C67B4FC
- MD5 SHA1 SHA512 TLSH
Aurora/Aurora/SiticoneNetCoreUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dff567d9c9f6a906fd0c7eab7deaa4b0f3ba1bd168cbcbca640a46d70ba19eeb
- MD5 d8b21adc021dd1526700753301dd29a5
- SHA1 ec1e95fbf72285310e9554a189e4f2b543e60ab8
- SHA512 1794edc23916cfafe29a2b03514745e275719b06023214f3453d64e0fd20b220f0feb4f4d59a27d077d8f2feed15251d82a4fb9b32a9c99d6221fbe424aab74f
- SSDEEP 393216:HfaB8bo0oxm5+fIlyjYgGCPeXEt/Nwlze8dQMTL4C5RhH/vv6zg/A:HiB8boCwnjKCPe0sl5H4CNv6O
- TLSH T17977AD5D9BF94F0AC6481272A12A46177258C1903ECFB3AE4726503F76463A08F9BDDF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33477934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SiticoneNetCoreUI.pdb
mscoree
_CorDllMain
Name
.text
Size
31.9MB
Virtual Size
31.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79e53505a9e9ceafcae4149c303cd1e45e65ca831e07b1e76447ee2df579f242
- MD5 d7742993fcd9ead7c036f1656ed3af2e
- SHA1 d1f84da3c6dfac053c35acfdfa7f9029fec9ca63
- SHA512 0cb2bcbe575a91accc1d2e5166a85b52dc0b57f61a90ea70204e68b566fc7f0ea10f69d5a769768dc625e019a4e347253aff467373f60de185b732dd24a258fd
- SSDEEP 3072:6MKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+ltZh1cjdGfl:mLBk0szhebCSKfOA9
- TLSH T12C042B6437FC8376E7AE6674F028092146FCE44E7283DB5A8D8951F55E23740EE20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e3:af:b7:40:76:03:7d:2d:bd:7b:77:05:b1:66:4d:a1:ae:0d:19:55:ab:b8:af:ed:36:52:06:19:14:b9:74:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
178622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net8.0/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Composition.AttributedModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e506dff4ea24163c90b6cac81c8f959efc316308da635e62adf17f610f93333c
- MD5 bcde2487694b90bac9ee9539bca4e85b
- SHA1 f1a4bb87f1eb316db349d486d70484b467fa3b42
- SHA512 f3ad2a81cb91e2f45d2a24c08350e7f9209ea846baeb59bcc72a36bbc9d449127089da695d645571e1955a49e2defe062992861f81aed45009bf001589c4dede
- SSDEEP 384:/xVcUyAXti0RL3OSlSxhuRuQFcqWIAvVxyW//uPHRN7EhlsQS:JVcKkeuQFccANx7MQS
- TLSH T14B825C2267688323DDBA5F705635DA432E3CE3856C22D62E158DF10A0DE77C66B30736
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:07:a3:81:9e:6b:34:ee:e3:65:69:96:5f:ce:fb:ec:73:49:a7:a5:0a:44:3e:be:8a:bb:f0:60:14:a6:94:ee
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:AE2C-E32B-1AFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:48:a2:88:45:56:bc:2f:80:bf:00:00:00:00:01:48
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
14302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Composition.AttributedModel/net6.0-Release/System.Composition.AttributedModel.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Composition.Convention.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4a66481a3f9e0ab4c5c50123e7e141ab7028013e2f041941e746e546468544e1
- MD5 ed8a34dd0d1b12cb71cf1c6c52cd9553
- SHA1 c7f3cddc55ffc37aab4f9c33f67a00e7bb1ac342
- SHA512 416d68eaf2ffb7e856ddd18b386ebef3d9dba14550ce535b74dc045187864034d4ab5ea52351f2ae464859d3f00b45586eb7c48fcf5c4a76cdbce63bf127cedf
- SSDEEP 768:5nsg+KeayFDPBQwc+7AgbC4FAWZSwrzeVHlXK4/GL2SuHVjTsxXVMfu4:5SKByF7ap5gbCgYNKvLBXMG4
- TLSH T12B333B0763EC8316FAEF0A74B675E6084B72FAD55513EA9C295CB4BD0572B8003A2737
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
40:ba:47:e7:df:9c:28:c6:79:45:02:6c:5e:70:20:6d:bd:e6:0f:02:ac:ae:9b:37:31:6c:e7:ca:b7:21:60:af
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:E5A6-E27C-592E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:47:9d:8f:f1:e6:de:31:83:59:00:00:00:00:01:47
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
48418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Composition.Convention/net6.0-Release/System.Composition.Convention.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Composition.Hosting.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 998f268a7c0a16ad2a86158ffb86bfdc76a1bf6b3a9065d2bc67cbd603cfb0d5
- MD5 4e60cefef9b7b8d9b272a62e90dc9f00
- SHA1 2244a2f06f0f3928bdf090dcd07df1b0eb0e5d62
- SHA512 354f041acb758ee8411a0d64974a4b770ae3d31ec1f784d99c7598431e4c56a7051cf4e10e218b815b995c820ac3074a229e5d1c85457e6e7690a4bc60a9d041
- SSDEEP 768:PLd0gjJYgHvg5CxRB99kHrdv6Y9JMIpYLj1Jy2XiMu3VtpPYxVMix:z1vS2RpkN6YRY/VXiMuy7Mix
- TLSH T182333A0277F80256F6FF5E7536B4C4450E76BA456913EB8D0DC8A0E90DA7BC48A20B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f9:ea:52:cd:76:af:f6:65:67:e1:32:c8:85:19:c2:ce:7e:55:64:bc:30:50:e8:ed:c3:93:3c:ad:89:17:bd:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:E5A6-E27C-592E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:47:9d:8f:f1:e6:de:31:83:59:00:00:00:00:01:47
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
50598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Composition.Hosting/net6.0-Release/System.Composition.Hosting.pdb
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Composition.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec300fa94e84746c8ca94ab049887ed7e7999ce26c721a82ebc0c97337fc35c5
- MD5 1532bf896b394e28af2201ed9b73059f
- SHA1 520417d87289618cb735fde54d25c51d1f73147c
- SHA512 4580b1a25d033019a0d9e2d1ec1aeda4e2fa514b66479bac31433423e779153a886d9832e06d4a9935e99b4d95aa3063f01437b83f799b7321998f22461887a2
- SSDEEP 384:GaGPv79/Z88KFyprUA/0Ecl+yueE8F4VSIGny262Dsplk4p4WQb0xhW6/uPHRN7o:GayNHn0P+h8Kenv94pWb0x/MjuT
- TLSH T196B26C16ABFC8253EFBB5E7062A4C0025B39A7C65821F749154DB16C1AF37C09722B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f0:cc:54:aa:cc:b0:24:19:48:29:e7:01:e5:c9:a6:fc:10:6f:2b:8c:13:f2:58:7f:1b:55:a8:c3:75:24:45:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:AE2C-E32B-1AFC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:48:a2:88:45:56:bc:2f:80:bf:00:00:00:00:01:48
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
20494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Composition.Runtime/net6.0-Release/System.Composition.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Composition.TypedParts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8ffa3f5472025de05f7ecacb46fb94b4514ac8fd4b608f33f01c5a5cc21ac556
- MD5 e8aaf9cc02759428482439dee68369f2
- SHA1 82bb55a652bd487a60da47b5542e0a21386752de
- SHA512 c66ac4e67f276432b2b8ddd91b4c6a8a98c5bf43be820ef94c053679c9de54140ac24105a580e3d5244a9cc2c2b4540f658fc475890a8a03ce5dc374b1bb643e
- SSDEEP 1536:ywQQf7kxBeXFgUPvTq1ktF3i5aqINlMA:Qu7kxkzW6FafINlh
- TLSH T12F534A4273AC9723DBEF1EBC66A8D0550B75D2517802FB892CCC75AA0B6678047217FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
78:72:89:c6:bc:68:8e:ad:9c:74:33:fb:03:c6:19:ec:69:75:eb:5e:9f:de:96:d1:93:16:c5:15:38:bb:fb:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:12BC-E3AE-74EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:53:d2:82:72:45:6c:57:e3:8b:00:00:00:00:01:53
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
56498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Composition.TypedParts/net6.0-Release/System.Composition.TypedParts.pdb
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13b0c6edf3c845e3372ef927da7127b7982c8c0f97566c86b114514b576fd4c7
- MD5 b940f37798b685424678cc3e12717c07
- SHA1 2b0a6c9e10a41bfc8d9460003a0bcfc689c7124b
- SHA512 5af0d2e26b99bebaf9438921ba4ebf80c2e21a3788d228727d0b826a2d835ec6421ec9a4eb1fc5f832e63be31c7c6e7d2f3b8c8994661f092740c5c80cc6c1dc
- SSDEEP 768:uV/2DXm3gh3nb3Wm/IOTVE1thoQDXkiSLJKdbzFW049z/F:c/UXmEnb3Oqs2QDXxS9y/FW0wzt
- TLSH T12F73A411EBE88779CBE70670B47083746E74BAC72D22DA1F291B210D197AFC04F65E66
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f5:2e:0d:ce:d5:0c:33:27:8e:6d:36:e3:02:07:cd:81:4b:4d:ab:e3:d3:bc:65:8a:4d:d3:da:ca:e4:6d:9f:d8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
67714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Aurora/Aurora/runtimes/win/lib/net8.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1fd6733ec97240f987485d288941069d20d41142fbf0df40f9ae9dc9fe0cf12a
- MD5 9949c691a3dd78725b81d8b136b6d8f5
- SHA1 311ee678ede69289726e3f6a3a1f2f197bfd3ee7
- SHA512 1c0f66828f02d76001c508c6f95478d051141e156a08531ac930488753d72ae173d51e281fcf27a23fc9d716706551e426b1582a41cae309e688bd89cd784343
- SSDEEP 6144:syj+butGieusJEYE1SF7c39iwjwmppwbHV/ZqPJkobp04SxptV4:s4+butGieusJE31Shd/k9sxp0
- TLSH T15B64062023F88A44E8BF5FB5A0702060CFB5775B2A6EDB9C4D917CED19B2740856732B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:f2:d9:54:7d:21:56:16:f7:b8:f8:b1:22:f8:a7:a5:17:c8:75:35:3e:4b:86:ea:51:da:9b:16:ca:1b:2e:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
306882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
292KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ