IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026[.]exe

resource
unpack001/snmp.dll

resource	yara_rule
static1/unpack001/WindowsAgent.dll	rat_dattormm

resource
unpack001/scvncctrl.dll

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/SimpleFC.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsSCM.dll
unpack001/$PLUGINSDIR/nsisXML.dll
unpack001/AxInterop.MSTSCLib.dll
unpack001/AxInterop.ViewerX.dll
unpack001/FsLexYacc.Runtime.dll
unpack001/ICSharpCode.SharpZipLib.dll
unpack001/Interop.MSTSCLib.dll
unpack001/Interop.ViewerX.dll
unpack001/Microsoft.Web.Services3.dll
unpack001/NLog.dll
unpack001/Newtonsoft.Json.dll
unpack001/SnmpSharpNet.dll
unpack001/Transitions.dll
unpack001/Vim25Service.XmlSerializers.dll
unpack001/Vim25Service.dll
unpack001/WeifenLuo.WinFormsUI.Docking.dll
unpack001/de/Gui.resources.dll
unpack001/es/Gui.resources.dll
unpack001/fr/Gui.resources.dll
unpack001/hu/Gui.resources.dll
unpack001/it/Gui.resources.dll
unpack001/kproxy/win-x64/fips.dll
unpack001/kproxy/win-x64/kproxy.exe
unpack001/kproxy/win-x86/kproxy.exe
unpack001/nl/Gui.resources.dll
unpack001/pt/Gui.resources.dll
unpack001/putty.exe
unpack001/sv/Gui.resources.dll
unpack002/$PLUGINSDIR/SimpleFC.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/nsProcess.dll
unpack002/$PLUGINSDIR/nsSCM.dll

resource
IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026.exe
unpack001/CagService.exe
unpack001/Common.dll
unpack001/Core.XmlSerializers.dll
unpack001/Core.dll
unpack001/CsExec.Service.exe
unpack001/Gui.exe
unpack001/Snmp.dll
unpack001/WindowsAgent.dll
unpack001/snmp.dll
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026.exe

IMPHASH 187b3ae62ff818788b8c779ef7bc3d1c
SHA256 2a8905359666b55d12e5de9b68d8a3fba2a80b4809cb9738be51902b3d9fbebf
MD5 11c574eef359fa94fcc3f90a15e154ba
SHA1 685008c15a17a370b74978a3afabcb751a2e75ea
SHA512 f91d592b2717f93c01d24b4bf61e84d4df1d24352e62a6f5e76831889862d6162be8f3842bc212ba6d5993ca22d6467edc8abb7745701d414a35b658ff5286cd
SSDEEP 393216:RnrIzsnTEGISE7Ah1p29qIT0ejrX+QdLJB7FjS6w5UZuZlqc9wyd6kMkaKx:R8YnFCMj29l0ejrX+gt9rZOdLSklx
TLSH
T100173346ED7BACF0F783453C8AC21B41B6495D95CC4BD095914A223A36F68AB8E3D7CC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

46:ab:aa:06:26:96:b2:72:a5:a9:22:a1:37:15:1d:be:08:e7:3b:8e:14:fc:1c:84:55:49:18:07:86:86:d8:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 20, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Serial Number

03:25:30:02:e6:35:ef:f5:c9:c7:7d:68:6d:d7:ad:75

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 2, 2026 - Jun 29, 2027

Minor OS version

0

Major OS version

4

Entry point

16743

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetFileSecurityA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
TLSH
T140E25A2128D144F7C68F4134A4E44F178A7E69752AE614D3DF65A9CA2E229F2F23B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SimpleFC.dll

SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
MD5 6d38bb6f6f19c2c22a7ef774bc5d9855
SHA1 99778940e059238ca23a513e717d4db2cf34e606
SHA512 12a3999c73e43f3a07460c16fb6c6867b551a159314df15f05d6b4ffece450764bf1e27bb03ba5e81d8483b793d78d87a50391883bdcf4a441a4cd0e4035bada
SSDEEP 3072:p2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVIgqKDhq426Au:Ys4zIg+rKTTmnhfAoSxqgNtqX
TLSH
T108046C3AF2C08537D1772B7C8D9A9294642AFE512E2D280F79F80D4C9B3D65169393CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

155852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/SimpleSC.dll

SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
MD5 d63975ce28f801f236c4aca5af726961
SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
TLSH
T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

950B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsSCM.dll

IMPHASH cae3b41a07819ca715746a4d081b8a6c
SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
MD5 62efa7b730eb0523a026ea4325403b77
SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
TLSH
T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6089

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH d9ee494a2a7b0d46616d9537ef3d8431
SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
MD5 13deb9a0f4e4286df01abc85e1895e09
SHA1 3174853b32407fd85220de844b390a18a8a76c97
SHA512 604aa82a9c4818d2f63fb11bbde561afc137a77e9f3108dfd7f4596524e46ce71b6dc31606bce534b600b250c3b4092a311fd1eced83da01156d5bcfaad7aade
SSDEEP 192:GRTSl/ex70OJp3U5WtRqRLnOyhb6hz801Sux3ulXhDQR:GRTSl/kfzWIRqRLnOy3mxaX1E
TLSH
T11E32B50737B699B7C9460679AF976B4BD6F4A30265800C07A7470F0BAB3098DFD3D61A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AxInterop.MSTSCLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
MD5 0f581e56ed5ba500ce5d98d105b04a37
SHA1 b6e2cade601bc6fd15e7f07ed41a4dfa4ee0a589
SHA512 9034b8c289ce3ac9386d43473a019a9b45d9de82090e7da90c3cfbb00c8e9aa1509eba4787958495ebb928481f7b42edd184ec9e0c0009d4f2f2ec98bbd92fdd
SSDEEP 1536:/ri+u+4qhkPZVb45mF2UQJlPg85ycFtIhH0rOP7gVzySImpYQ6BDdrMkwbTTj+6v:TuBqhkPZ61wOrOzgVbpx4aX+6C1Z5gd
TLSH
T15134CC06DFD54AB9D2CDA7FADC64114DC1B6D2C9604EFF0A6880A8E11E477B34C9B623
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

238446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AxInterop.ViewerX.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
MD5 edc5e696c4ad70f0be6301f703ab3672
SHA1 9c699039715db6bf6746e438991988f9cfaf8ea2
SHA512 58d9441d9648ece7f0284da75fb79777679e4f00610a71399ad2a22df8b418995f6a3fa06d69c17e62faeb3e7f061e3b3ec13ccf2ac00a809832594943c33760
SSDEEP 384:2rezJLlifR3sVk72M6InhrJqOr9xun+mB1UDn0mVLAp8RQJ:wo3ifYBIpJqe7mUD02ApXJ
TLSH
T1B30394009AA48EB9E2E6C7B1F5F582514270F9C67742F75F194588D9C903B485EB32F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

34558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CSIcon.ico

SHA256 b59a0e0570d2a22cd51fb51fc106913f9048f2889fc3bd94a5a51be1a5d102f9
MD5 2f6fd9aa57aa40728a65fa006c7e0f17
SHA1 ba8a966342a1485e5ee17097dabe252e2883fc42
SHA512 fd72df629894fa51bc394c7e05b0ea96490c753f2d4b143c0fdf05844503803cf5610810da78ceeb018963c3750185cd0b122b1863e4fb38bd5173ae8a76b138
SSDEEP 384:pr+Sw7yOFwk3DJlsUYhawY2yz/YLxL4roVBfnHCpb+G65s0Z:N+pl/3DJlsdRYzroVBPC976L
TLSH
T1B5C2E9C1FDD185D4EAB9BA3CD323D9F179A65154004AC9C0EAADBFB128B840A3F0DD95
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

CagService.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 91774f1195ba7042293bba1152afc334052d6c235a90e715f8c5c5fc8f27b089
MD5 a4c13e15530f174b3c8e39c5af657b0e
SHA1 4fcefba8647993ddd09716815abc4a3a324d31b3
SHA512 b4e47aca364b933bc8fdb6e76d9ab9e2610f581d3ab836bc6e4139b6ff8492a6a22123c7219ec4be33ed66bc710237dea943f641a7a10a3cc553f3d9a6618670
SSDEEP 384:hYMQor4U+94X9nmhJUZkJXfxEQTJosEyZJsm20:KorYi8TZEEmsfZJsm3
TLSH
T1C092C601A3E84B66F6F76F715A7206050F72FE9AAC71D35C26A4005E19B3B80CD7177A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

04:63:c1:a2:8e:01:9c:28:ac:9f:6d:37:ae:b0:4e:ad:08:82:1c:1f:4c:47:0e:1b:43:8a:13:c3:67:ae:ce:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

21154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\Service\obj\Release\CagService.pdb

CagService.exe.config

SHA256 3ce19ed67d44589e3ca749de2de6f6c23f01a3ac4e95bd646a4efbcbe1d7917a
MD5 dcc286cd23db7b14f475a67542a41fce
SHA1 18f1e66a6c72db7348e79040cb068b4e77e7b10f
SHA512 a1f8551ea7e981f23c4b64135a2318d3a809affdaee5e638b894a888e465c98ab6065cac94816e8483319739b1384c6de5cdcbf61f6207f7cbb7b42cbd42b426
SSDEEP 48:cCeNFhN8orNZTNx/UvUCnamAaUAuVPnsDpga+P4xZ6/dd+nAg3hCS7Xndn78UJhl:7e1zrHTnUv5am8VeAg3hCOJT
TLSH
T12F81DE10B1F5EFAA06831932FA7056849FF14377266850E8B8FD3591AF14D874B933B8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3dc2c4a07014baeaa3938d61d5b7348e3c14ece8c7477ac5d9451ea053f3e013
MD5 82e2deaf08ac79513064bec132ddb6ba
SHA1 862241cdfb7e2c78093677190f026eb187634e02
SHA512 29c32aa5154c9d9794847334229cda77b4be7768908fa26bbc08f8dab2f99534a074e2de28f35f8054150a227509fc97f7c94daa563124ce405fabe7cdbd4d9c
SSDEEP 384:g8RZI9AhN25kqsaORsdshFJXD32sA2m2J:dZI9AhIxEhFJz32sA2m
TLSH
T130721C288B78C33BC65A1B31F561CE6503F5574AB281CA9A8A14E85F3F033DA44059FF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

60:d3:e9:32:cb:b6:3f:e4:8b:a0:52:9e:06:4b:22:3f:05:d2:52:9a:18:2e:45:82:47:4f:28:91:f6:b1:9b:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

19774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\Common\obj\Release\Common.pdb

Core.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d0b4d1a4da66d5ffdad9b4d9c6da1730f2def8e4b6679948a453b7509cdbe049
MD5 0563aa17d7ef52f0989949c682be068c
SHA1 00da77490d16c6c439d3006714f798d2c73ce569
SHA512 38491577e2478e1afc60326f2a2643d388e67d3afda3883d465bcc7cdd1dd90bb8a627e8f47dc7d5712523c0f12d843af7906ebf8cc61335433cc05938183f10
SSDEEP 98304:W8YUxrNbfMS7HbysnHD/56X55xFU7oGkwMgTr1IqfxG6X72c3/ymXZe00hc:W8DxrFfX77yQjR63Pjwz2qf97G
TLSH
T1E9B632D076E91E0FF87F57AD3A7156EAAA32FC1B0686D2DD06D5039920B730058D36A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

1f:2f:e7:8f:5e:bd:7f:26:91:42:eb:ec:1e:e4:fa:4f:86:a8:ed:d7:c6:cc:69:fe:fa:9f:62:9c:0a:ca:7a:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

11113518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1cf1c5e771ab0efe9ac8c0dd4cee0a7969ceb5c5a6003d4d36a3180515217122
MD5 5e418fa976cc0727eb8617c10cf22145
SHA1 2988fce92488405557eb4f3285533afb609f3938
SHA512 391596c8a1165d61dc030bcb212a2c05c6bdfbf472d60c1b1451b6882a5f78aa01d37ac3551f1ad0a9d2e211367cabca7b206bd491f3de52131707fb8e0c7be7
SSDEEP 24576:3ZiWJkLFzq5wjSNC5e8X9UKZcxcYjJw6D5/jTtcVbANvCW4o9M5qtyxGX+JaZX4f:QXxZchhLTtcV+aK9
TLSH
T18FC5D91026B0D6E4C4290B34783B124AB3FFD64F9B79D36E56E0166D4FA6B078B13663
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

06:0a:c2:70:2d:3c:5a:07:45:fe:d9:58:3d:20:92:aa:e3:96:54:fd:1c:81:33:f7:75:67:2a:1c:78:6b:97:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

2507826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\Core\obj\Release\Core.pdb

CsExec.Service.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4ab0954307a1f387bec0e921bff807db3526073323e77e3a2b78052225ae8624
MD5 191faa00bd4f6086c8870a0445bf05de
SHA1 c7d5c2a4677a6e8ac5d7e70b26ca829f21b761e8
SHA512 4704498bfb7b5eed9fd2c5b21d157a33a515e51a087a16419cab2c3ec5ab442a9855a9c6360ff2645388a308bbcf4b2b04a874944654b61f3c0ee6e78926c3c0
SSDEEP 384:QsZOOW1SXLqF9Am3p0vA3Cdh0VcSWLreLQ/lAKmd+p8pzm2N3K:qSXLqGmavA3C8nep8pzm
TLSH
T1B1824A06ABD0C6FEDDAA177D3CB303511B78F7492252D39E2C8D5C1E1E937440AE26A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

92:c6:7c:5a:30:5a:13:3b:fc:e7:12:6d:d6:c7:63:03:75:dd:27:e3:e3:43:f3:49:56:51:3c:b1:9b:5e:cf:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

20950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FSharp.Core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9292eb06bf4cd100c94abd2949a96351a0f3710008674993c7491da578e1ede1
MD5 99a817a04b25690b98edf3370ed2eb83
SHA1 1a878f0e4fb4f7ea1d75674eb724fc6feaccdff0
SHA512 a0eef9ee2f661a2cbacac61d975ca5e56e7213b38b1b5bf172ec590d9157d0d316435c7ff42c52d94cc4cdfbc26297babd73fdf2f209b6385070fb896337437b
SSDEEP 12288:AmksTXX3ieERl2EQOYqOsiunqhU16+wLpmuu6NXd+ib27fDiscy:bXHzEzPQOHiunqhU16+wG6xcib27fDZ
TLSH
T168555C0BFF84C392D0AF57BB84621349B760D2C193D3A74E329475E25CBB7A05DC92A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b2:b9:72:eb:16:e5:2e:1e:64:0e:27:50:79:76:ab:32:e4:d2:c3:26:7f:d7:9c:1f:3b:3f:6e:46:4b:e8:6a:f5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

ea:ea:b4:12:cb:bb:53:35:75:dc:a9:20:eb:b1:bb:1f:17:ac:59:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 15, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 11, 2013 - Feb 11, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 22, 2014 - Jul 22, 2015

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:4e:f3:66:b1:29:13:9a:11:13:00:00:00:00:00:4e

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

0

Major OS version

4

Entry point

1389982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\fsharp\fsharp.core.fsproj_1376428507\objr\x86\FSharp.Core.pdb

FsLexYacc.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b635ba89e9cc8455f252b7e24e5d2838f50aaf75121ca7d070bb7d6cf41a6235
MD5 06b971620bda7960f7d8e43ce69e3bbe
SHA1 08e1f37cd9c1d320fac3a32105f16abbbb73092c
SHA512 5536e678fdf83a939347265c0efded4a892e2cbbc9ec8d18c83de4f4d0467fad68eacb6abc4966eff5f275375dbfb3746d394fb4f2fbb34d7aada89aca6c8c20
SSDEEP 1536:MlI+vm/yJsMIMG7KfdJdztPT0/2Cc6CdLrTx45BCeXU5:89zw7iL
TLSH
T100631909BB8D4633D25E2BF90492275A2B39C2069147FFEB2D48B695BCDB3D10C3255B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

76750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\FsLexYacc\src\FsLexYacc.Runtime\obj\Release\FsLexYacc.Runtime.pdb

Gui.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 367db5d7dcc2f802f65aca1fe7a5216675249c2c9242d00d179211421f6125f0
MD5 087048e8e731b1ca367f9385b0ccde70
SHA1 4bb70d56ec17f199d220184f2da6aae842481114
SHA512 c258eaf24df1a7814e5fb98dd600c23ac30526e4e8b8d67b4b305d45f57bb397d23470ad49c739b8587d7e149063beab8008393ecfae538e8f57643f925372d7
SSDEEP 24576:Kd/HaJIyjEjElyPIuxIzbsfR21COq2H7Re2EvP/z1w2LdB1PxQb3N/e:KpgEjIMfRPOw35ZR5E
TLSH
T1D4A53A4173F44D1DE17F8B35A83354B487F6BE8696D5CB8E6998B2AE2CE97008D01393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7b:fd:84:18:93:79:04:ae:35:51:93:1c:38:ad:87:17:5d:de:68:be:94:94:e7:2e:d2:5e:52:6a:e3:d2:ea:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

2144066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\Tray\obj\Release\Gui.pdb

Gui.exe.config

SHA256 71b4f6772fe48a80281e0d112dcb0a2fcaf99da736a07fca4caa3e8107bf4ab0
MD5 29d78bfd9a4c0d4f850250c25ca8112d
SHA1 ef2507e71626d4c8141d905dc00ff3fd5c163be0
SHA512 fd14b3eb42f04a5e66b570f005435589ecd5562a93293c1435494956220673d7b99867f3db3ff5842b3f5126f413126c66f9bc06b795b854301c0cf8bd2c1f67
SSDEEP 96:Tr7t7Kqe7t7nrrzGKULuvoFX4vdk6DAvJAvtv0cAvf4cv4vd3svjovuxAvmvPBAr:Tr7t7fe7t7nrXGKSuoSj
TLSH
T16EC1E80CB1C1AF9906736731EA3152D5EEB00663117A61E478ED31679F70CDA4BA33B6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

ICSharpCode.SharpZipLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
MD5 c8164876b6f66616d68387443621510c
SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
TLSH
T16E14061967FC4A5BF6EA4BB8E47524A5C3F0B966362ED74E8D8050FF1C127A0C825363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

196446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Interop.MSTSCLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfa9351dcbbbde572684f569b900ade24380fc0ad63d592c4100d754b2bfdf7e
MD5 e28c8111ea4cab3890fb559e977f5847
SHA1 cc19e6ceee81d2dcea7358cd0d9c53f442088dad
SHA512 af884009b08b864fa6bb215c37a9fe09ad7ceb3561aa6a53a47236c2b4102de097a039f8dc2843c3646bfa2b1eaa964296579f28c563008fdaf431b1db46812a
SSDEEP 12288:nvsVS7oxOnkN6TgJ2fclCLYh+XUdqjQ5vSUSR6ya/aIK1CWSzy8S5qaqHqQ6S7m7:nvsVS7oxOnkN6TgJ2fclCLYh+XUdqjQt
TLSH
T154A4192BBB4C2430CC9A037F91E707986FB155841667CF11560C5AF6AF9F28A8EC6376
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

471678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Interop.ViewerX.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e92d3683673d7899d33c71d2b5e022d83198aab9413dcafc43f6ce597cdf252
MD5 fcbce484db6b9051b50381be4c70d4ad
SHA1 f752be7a7a0d9e7986855db6806b01c70350c058
SHA512 14ea0bf33c6635fa553646a654029c381f66c3a1a37507a10358a40370f43bdc253ffeb62795647a69436bb34a588d84d7bdaa169a58b0161867eb9d73c66488
SSDEEP 1536:wa1SD4xe/U9qbw5WXobIXpyTtMoEUJfIU9u3OoFKF2:x1SD4xe/U9qbw5WXobWpyTiiHu3OoFKQ
TLSH
T1AF738437B5A8D436D6AD823A47A7233423F0C5025DC1EF271A5CA5144F8AECA6F532B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

72446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Licenses.txt

SHA256 f80d5184b1705e2065e5b30e06448d357117e5d7b88e642b79f091e876b641ac
MD5 64948b1a2e408e7482da0ea438b559ee
SHA1 833433d40482e6822020426e306d9c25afde690c
SHA512 24d99d0e40f95a8747bacb5e9fd31bfafea5e00cb82ec3d71fd06e90eef5a57f98ce849eb643ab23b8051422564c20a1efe4b9534607243bdeb6548be1440399
TLSH
T19B217BCD8CA484375F72F7CF585E32C2F136634198C6E5EAFC958D904222B0EA54D266
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Microsoft.Threading.Tasks.Extensions.Desktop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
MD5 e548a93d16964e52868c47cef1c98f2e
SHA1 4b96b0aa48f6ac050a764c7d65f4129a9bb8cf21
SHA512 fd1377b5d2d792eccf2ab9a01529838f178126fd6748da8e27cbc908ea83813fb4de021aa88989186459fef1c11be76aaf8b29b2291203d5f34f98361acf77ab
SSDEEP 768:bsoKLggFUyETHj0Y5m64r+B6yP5wwWGZ8iJvHWrI:DKUgSyyD0Y5tVwwlZ8AWrI
TLSH
T1D4236D95C728957BCB463674EAE4D1825A34C7C28902DBAA3C99F0F5146B7F84B103BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

13:67:c4:ba:e2:93:bd:65:86:c6:f5:d7:c3:a6:f0:d0:68:02:49:2e:d2:ee:3e:84:02:0d:ef:5a:04:f6:d3:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

65:a4:f9:42:4e:b2:d6:f8:6d:38:be:bf:7a:f7:33:75:39:73:cd:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2c:d7:29:77:3b:67:cc:1b:c6:00:00:00:00:00:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

36398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.Extensions.Desktop.csproj_1a077422\Release\Microsoft.Threading.Tasks.Extensions.Desktop.pdb

Microsoft.Threading.Tasks.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
MD5 6aa2393ff1fde1a61d0cf51730428f74
SHA1 3c847a95a6547aa49919789d7a0cb6ed76122849
SHA512 1af984ec56885cdea9a0e379d659b65196713571377e2db267259dbc1f8748f1a610b0183a8fea3730f0049c3468f632240475730563c6413cbc88cc76032d91
SSDEEP 384:5qL9uaxv+fg8SA4nrzrRzoGbSOW12nWH1q//0GftpBjHoH3HRN78xLsltr/wn:+MfmrRzZ+QD8idoH5r
TLSH
T14DE25BA1CFAC8143CD4B7D71D7A4D6C36D39C7E29C05DB66188CF0B41C973D99A20AAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

51:12:8d:19:6c:68:96:8d:65:c0:81:e5:96:de:0f:06:56:f8:d9:2f:31:1b:73:0e:8f:91:bd:0d:11:bb:8d:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

c3:47:c4:de:4b:ec:44:bd:02:60:10:62:63:59:8e:43:90:d5:cd:f3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2c:d7:29:77:3b:67:cc:1b:c6:00:00:00:00:00:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

20894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.Extensions.csproj_15f6194d\Release\Microsoft.Threading.Tasks.Extensions.pdb

Microsoft.Threading.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
MD5 d01819bfe03222dfa9e35a36555b6b6c
SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
TLSH
T1B5F27D89C3BC4117CEAB1E7196A4D5432E38EBC34812DB196588F2E51C937D19F3266E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

b1:13:00:5b:36:13:ce:2f:23:c6:0d:0b:cf:75:20:94:18:94:2e:63:26:8a:ed:9d:e5:a9:f6:b2:54:92:bf:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

8a:50:28:53:0d:ab:5d:2d:e6:72:c7:e9:b0:73:fe:e5:94:2c:a4:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2c:d7:29:77:3b:67:cc:1b:c6:00:00:00:00:00:2c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

0

Major OS version

4

Entry point

26462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2597\src\intermediate\Microsoft.Threading.Tasks.csproj_97b2926c\Release\Microsoft.Threading.Tasks.pdb

Microsoft.Web.Services3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a7ca101fd8efe0006f2f69d786989adc968d82cea35d83e976fb12d9baace32
MD5 e42998e3bb92e6696a82ef796efac507
SHA1 8202e573a8abedaaa138b3cef6135ce09c0e87e6
SHA512 8dacb1fdd97e2ffb2c12c553c28739eb8a85807341d7decd665fd05724713c8b8937100739585517361f788840ffd0e9baeafc6fc810016b7f5b1c1ad2d9494b
SSDEEP 12288:2I/k6m+BkysR2NF7hlx6U4xhN9K+Da0QNgXOQMtsokoUoAQWG+GimYyY8ocZ:9kysRgFtlx6nY+iUG+CYyYc
TLSH
T1F1156C5537F8671BE16F8776E872402987F1F90F6662EB0E5CA182AC0C97FA08D41673
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

878062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.Web.Services3.pdb

NLog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5413095e2e536356a2f8facfcf0818f711bc512aad8a0034f646cbd4e9f979df
MD5 9bd9998fada60eb7e157148a5d681633
SHA1 0715f534b854ac2e3660dd073610e2c6426ef274
SHA512 d6507ded543d5f2ad1889698067b58d05dfcbec3613bfae92d655f5e032a03d7af4e79d2a2994366d14319f2611c719c61a5c50da489907608fd906e6c265864
SSDEEP 12288:0nq3M3ufU3inL3HzT1hUfYyHrZlrnYW3Y9AxspqZ+NUsQ:0nq3M3ufU3inL36ZDY0sxNUsQ
TLSH
T198E4281233EC4A2BD19F1735B4310926B6F9ED093A96E38F5545B1AD2C723866E103EF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

698758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\nlog\src\NLog\obj\Release\net40-client\NLog.pdb

Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
MD5 8f6875148b45c300b95514cb40703c2e
SHA1 0015b8e21d84e0f6f174cf71b63651bad94582df
SHA512 e0670c00e0c5cb0e0e1c691f053a53de121e1771cffb17b2d08b8cc3f0498bdde3c6efe1419fd74103952a327c26bb6f29e5f817965873f8391ee8b8be80a6fb
SSDEEP 6144:H06bz+bF0GIPy8ydgpdK9Ea7YUKnK49wNgVaLgBFatK4/dc:HsbF+yvgGJYJnMWBAd
TLSH
T16DB4380023F8962BE6EF2735E138091547F5F92BE7B6D78F5E4094AA1CA37819D107A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

546054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net40\Newtonsoft.Json.pdb

Snmp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 25e202b3fdecac35e1c4e57266217741f54791a3dfa7191a631ccd7ceb9ea37f
MD5 b9d4d0f4a391a2eb62f3aa5741ea4b64
SHA1 924d651af58a8bbbb456d1e30fd1150a40409123
SHA512 6c0fc5225e100a8ab8b18ac635b3c2ea8470d65fddfadabdd7b25538ffff5e431152c287662db8cbc23951c4a1cafa7a5a6bfd6b07709c85fbad9d39424410cf
SSDEEP 3072:CuDrtiTwwpiWXvVHsqEqiIYy6eLkTRfkV:3hikYXvVMFQYy6eLkTRfkV
TLSH
T19004070EBB408663D2E92F7190A993165775DE07B543E3970B1476EABDB23F10C222D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

da:8a:e2:bb:3e:30:01:04:64:b9:cd:36:de:1c:3c:82:69:b9:65:bd:13:00:9b:6d:01:c8:82:79:ed:de:1e:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

184894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\Snmp\obj\Release\Snmp.pdb

SnmpSharpNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b46f763461aea32fcea7ad964533a0706e6ea377c211f8dbd1841241a4edc7e3
MD5 c9217b4fc057c99ef0b1c603de094a30
SHA1 8b6326767783e351c6bed00ea2aa46ce441048c0
SHA512 9f4a5efdd69fe6e72f80f7e1b4721308b8fb9b55e48997c31330e5b52fc75a27794b22cce3e16be01edc07616bbcb05a10fbcaa90459c9f99de6db8cd41c6b3f
SSDEEP 3072:baE/1gWxsZP9ecLJDyV3bkZ/qvrQsCfCRAKv2SXbvW5j+9eW1eP:bV/CrTJoks
TLSH
T199B33925B7FD4219E7FA5B78E4B4191507F1F8823537EB8E5D2160EE2923B818E21363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

115722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\SnmpSharpNet\obj\Release\SnmpSharpNet.pdb

System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 24bd076d31dc9d363eb2adb8b27a7d45d9f975aeec565132d27901537e31f239
MD5 d552de7d39179b914db7cc2dbdd005c2
SHA1 044329c6c335224ba05a4e398a5fcb204f13ac36
SHA512 b82cbd6c4b3d378fba1793858c556ea1fdaa405905686ce219f192d16041e79aa063145c6d469aa7c15aa945d3ef344618fa0996d6611282a8718dd0de77d64d
SSDEEP 384:FJm/WFMrOhEZ0GftpBjMT6fMk+ILKHRN7uX6lFgJj:yaYbKi2zkmuXMw
TLSH
T1DA924CD68B7C8153EC935D7062A8DA833C3C97C35D11996E05AAF6E92CC33C4DB24A1D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

40:36:ae:d3:7a:ba:73:88:52:39:0f:84:47:c9:e1:b0:16:ab:c0:17:d5:81:94:9e:74:9b:35:d5:c7:3f:39:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

53:23:f4:1b:9c:d4:d7:9b:5b:00:20:68:be:35:2e:d4:4c:8e:c2:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:62:41:2f:c7:4d:8a:ae:13:26:00:00:00:00:00:62

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 10, 2015 - May 10, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 22, 2014 - Jul 22, 2015

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:50:67:33:bb:d7:fb:e1:17:1a:00:00:00:00:00:50

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

0

Major OS version

4

Entry point

10798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2125\src\intermediate\System.IO.v2.5.csproj_a2be5c47\Release\System.IO.pdb

System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfeab83e6a9555a6c18070c611d868e117fa2fef6f815da26e622feb2e610254
MD5 8e4e0ea396b5452bed54e6888cb07ca1
SHA1 1a7afcdd7f118b3ef8f1d9761fa71faeee16fd2c
SHA512 e160570f598d5fdd637725a70595a7ddc247c20aed66c031ff9816142231c8ea58c69fef7f5eb8e10120e5e5ad68ececb1b584054832464046209c9e04cc1aae
SSDEEP 384:r+4185WiR/B0GftpBj4T+ILKHRN7YSlVQP/:sLgiWmYws
TLSH
T19EA24B95CB7C8293ED835E70A6B8DAC33D3CE7C75C11912B1099F6952C833D59B24A29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

25:eb:7a:bb:cf:08:77:55:34:ad:4f:6f:d2:ab:19:b8:f0:6e:dd:c1:c4:21:09:1d:06:07:84:96:ec:b5:de:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

35:73:98:64:54:e6:e9:28:75:b5:eb:73:a2:db:86:a9:77:2d:2f:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:5a:ed:2f:f4:e4:20:99:3f:3a:00:00:00:00:00:5a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 22, 2014 - Jul 22, 2015

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:4f:ad:e8:54:95:50:28:94:67:00:00:00:00:00:4f

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

0

Major OS version

4

Entry point

11934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2125\src\intermediate\System.Runtime.v2.5.csproj_a5e4c3f1\Release\System.Runtime.pdb

System.Threading.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d20552fd5c8c8c9759608a84db1e216da738f5e9f46de9e8a3f39a0d6265cb8b
MD5 85f6f590b5c4b8c7253e9c403c9be607
SHA1 d5a9db942a50c8821bacd7f6030202c57ec4708b
SHA512 9c78cb444e28618d44e9deb23571fc7bbce268882c2803e0ccc0e84b3e6eab89c6af2aac0d81ef0d2c9fd1e9611cb35334ef3304fb16c5ba0481f6a7273c3660
SSDEEP 384:WL0xHprBefGMOrRQY+hoZhOZkcvr3Eql38WqATrOhEZ0GftpBj1x+ILKHRN7c6lE:NRBefGBkoWjvr0VabKirxmcM+
TLSH
T111F26C9987BC8117DD6B2DB0D6A4D5472D78E7C25C22DB1A24CDF2B82CC73C48721A2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e6:c4:dd:fa:30:b1:96:f9:c6:f7:8e:db:a1:50:98:aa:57:13:07:4b:74:be:25:2f:22:f9:ee:43:bc:3e:9d:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

b3:54:a2:8c:e9:80:dd:8b:a8:e2:3a:ff:37:ae:a7:0d:fd:1f:83:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:62:41:2f:c7:4d:8a:ae:13:26:00:00:00:00:00:62

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 10, 2015 - May 10, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 22, 2014 - Jul 22, 2015

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:00:50:67:33:bb:d7:fb:e1:17:1a:00:00:00:00:00:50

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 23, 2014 - Aug 23, 2015

Minor OS version

0

Major OS version

4

Entry point

24494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\b\4741\2125\src\intermediate\System.Threading.Tasks.v2.5.csproj_75e1c727\Release\System.Threading.Tasks.pdb

Transitions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9d6f57b2cda902df276730d76c481d4537402643d1aed03dab81a5d17286c913
MD5 ad23b4cdfda55b7abe505087b246b1a3
SHA1 442fb06d6c8173429f8f4133478086ccaf4dc271
SHA512 2883f45d34da0afb792760ae7c6e0393b45749dcd4f532e4679a47b48feae3c6dac25279feda7934633305462cb22234bf7fc9a95b79372ec0ee79cf75cb89d9
SSDEEP 384:Ktt4bbA/FBBhZIqBCOfb9HKLQlk8Doy+l4:K/gK1qWnk8Doy+l4
TLSH
T17A721A0DA39C032BCD9F0B79E8F216010730AA946B33DF5D2D9A819A6D13B9545637BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Code\Transitions\Transitions\obj\Release\Transitions.pdb

Vim25Service.XmlSerializers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e333548749078be5b6207453755e40220361ace77bae0b81b60e2666b5fa8986
MD5 aa78ec5b23873e94e11f619b7566cc95
SHA1 3e4b0d084212dc096ae1b2b4194a11c4e9fa255c
SHA512 0c1e5adbd75341faad2664167b7ed13f38d62c210f8276eba6800a6d8c68ed290cc7c55ce296d857ca05ab22ce16e54bc5487403bec0455bb22786cf0756f2c0
SSDEEP 196608:mtuRrhgMpgu7PG6aA8SJ3/HrIyD5Ab1Ev9OnI:OE/HrIyNAxEv9+
TLSH
T1AE961C037ACC6E48E7BF27A610356FA59F3BB83345C6D6ED155A044924F4B70E980FA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8893934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Vim25Service.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e0c73e94cdd28b0373bb6e1fbebe29f258f8fbf0d4771ac9dd08dbcda3ef6d9
MD5 ae2f45308384f5f2aaec76f079dca1af
SHA1 30e20b3f79f9164644b7ba2bc171cd60bcfb0690
SHA512 70612855e5dc8d2aa6c7d162f9ca8136f9d4747435547f63c16adf8a83fd5d9b4c88dc49c92d0d80b124073274c9f0870f4a7018a3a082872e39a46a908fc67e
SSDEEP 24576:CfvmVbrolKiE8p1l1OtoFwRnO6Ve3LxH0URSmzJqm1AoLwl8dQAD4dRcGEFDk4aR:Y1jp1lAfNIhNJtAoLwl8dzD4dSGEF
TLSH
T17FD5A749EFA8995BC49D477DEEF341220764E0887A06E35E3B51B4A41D3E3F1CE4B1A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

2802366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WeifenLuo.WinFormsUI.Docking.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b0f62bb2f3af65e458ca56535a580c31fc9ce555ec8dae825031c843b440f1e
MD5 93847672e8ab6a31d56a93b28daa130c
SHA1 3654b18fa3b2cbb90bf65ffd78b4449c04e7fd69
SHA512 9a5b77fc6dbb8ee7aa90f7b731e635437bc021f77dd373aa8e7e2c7bae37bb35b213d02881611c6fa7dac2566f3806663985c600f3008534dad1761bd9a81eb9
SSDEEP 3072:xjrP4sCRD9Fj2hmwUASqct0LmDpF6ffNvmFlHJkNHE6U/a0Oll:VrP4VRD9Fi9LmZZfS0O
TLSH
T18694B33185AE64A9D1BF0731EB1C267E55B1BC902351DA3BB821369F24B3760782C5BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

416942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Save\SaveFromVM\WinFormsUI.Docking - V2\WinFormsUI\obj\Release\WeifenLuo.WinFormsUI.Docking.pdb

WindowsAgent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7e51d3545df8c7f4ec0211efbdc0f1636631992d48c8fe027479e765230f430c
MD5 bf87b95eeef18b16494871a1332eef0f
SHA1 ce63265227e0f208895c762d1a27d291fb586b3a
SHA512 cce8f7818545a63fdcb21b6b6b80cc24a9c7dda139ad3a6c14b9c25a1135034faadee3db35230fb050460df6624f0691a255764f28696873eb33706871d8bcce
SSDEEP 12288:/6Ph+oZUIY66Rm44cj9pWnIIptokmNfRF:Cp8XWnBtokmNfRF
TLSH
T149A4070063F94A18F0FF6B7879B142154B77F942A879D65E0A8C589E1FA3742CD60B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

DattoRMM remote administration tool

DattoRMM is a remote administration tool that can be used as a backdoor

backdoor rat
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

99:9f:56:68:db:f7:98:93:18:a9:ff:0d:87:fe:70:16:94:4a:dd:76:52:c6:ac:0b:22:60:5e:96:70:2a:d9:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

460686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\actions-runner\_work\centrastage\centrastage\cag\src\WindowsAgent\obj\Release\WindowsAgent.pdb

de/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 106071823893807018437bcc3fb6d6fc9bed1bd8e1c05a40dc1f8593ddf63b41
MD5 5f96e1b55583fea756bbc892be1b1bf6
SHA1 79665a70894d8547654c7a6aed994cbaa74efba6
SHA512 fb269308b4d39c8248893c8310b0683234651ea4185297de801837cc6f976c63c8a308b3dd5575e1d2540376936123b9b062fa8f97212a1faaa8ac42b5981565
SSDEEP 6144:dIErUGZldlLwiAbBNY3ddsY3dqCIZfz1nPxKuS9Y3dUHtls:dzd/1wZbBOdd7dYZfZnPxKujdUH
TLSH
T19CA4C4823AF6845CF5B6CB349E73C4F0A8B67DC71C52C54E30D47E1E2939946AB64B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

460302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

es/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3529490ea065db7425fa95d414e6587986da7d689c2200194dbd146175c0f7f0
MD5 a492386dbf35c9519ee2e12e33e6868c
SHA1 9efad56f8da77341284930cd8af1b5bd536ad302
SHA512 846288c6c5e489953909fefc362e3cbd50ccac017726914599dc0515e0c2a1262eb2c4012b0f29ff4e5148f12bdd130e8d574f2aa1b887933d6982ea0461a515
SSDEEP 6144:07Bj3hY3di5lhmY3djodgz1nPdUf/CtY3dpels:07lKdindnZnPdUfqudp
TLSH
T15864C4813BF68458F5B60B34EA36C5D0A8F6BDC72C05C58F70A9776E0974A45BE60F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

330078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fr/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 806671694b17dbd40ea768f703c43e8a503ebfc4396754f4514cb4b31437ac98
MD5 d512debf2c8f29095f94f69a1f8b169d
SHA1 9c68257c5199e79ec08f717c86ff40b5f8b2d5b1
SHA512 91e8ef6893dc3c39fc9df71158cfa5c89eb29d122331230f93954ea8f5f98ba139eeee50602e371de2ed7e511614326dea2b0aea50675e0ef27dd41b993e10e9
SSDEEP 6144:zyHCIY3di5lhmY3dhn6Lz1nPdveD/9Y3dWls:zy0dindhUZnPdveDWd
TLSH
T1FB64D4813BF68458F5B60B34EA32C4D0A8F6BDC72C05C58F70A9776E0935A45BE64F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

332990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

hu/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3c33a5a9eb4499ff5d889fd806fed853435bc1796ac7835c55da49b0ebbf8d71
MD5 ee689fbe03c205b341da3cfe487a26f9
SHA1 009586e94ef5a9f0500321bfd155ee8e5e95dec5
SHA512 e27978350ddc3683a5ad095a50062f8d540162a6917ed5ec608323ec21a91be81cbb155906fc977e4cef3685cf6ba2e930e844c41027746bf0be52b2931cd309
SSDEEP 6144:v89WY3di5lhmY3dx6z1nPdXg/RY3d/2ls:vadindUZnPdXgCd
TLSH
T18E54E5913BF2C458F5B60A35EA32C5D068F6BDC72D06C58F70A97B6E0D34905BE24E62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

310078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

it/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0d798809ccfc1f85d3bbc3d5633fec38066cf687c996a18a9b49d8fb1f9924c3
MD5 92e66c2206bff419a937b78cf03ef824
SHA1 25f2fc528ce6261038c175408f94483b204a077b
SHA512 9db51cc2b27a27c5998f08c816f4e5f2ad1ffe77e640acb079f977313abdd837bcd0324130027e33a9164c3e42aeac3f2d831aad834ae8074660f9e0de9912f2
SSDEEP 6144:uvGX8ITO9WsktY3di5lhmY3dDKT8x8Zz1nPdjh/DY3dFUuyls:ub0s5dindmnZnPdjhEdau
TLSH
T1F764D4813AF68458F5B60B34EA32D4D0A9F6BCC72C05C58F71A97B6D0935A05BE64F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

329118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kproxy/win-x64/fips.dll

SHA256 47b906e74c42b6d031ca520784683a722aa7cc70e3c720549c65691bdfb00f21
MD5 c210a97985897d6a27d0ac52f005db10
SHA1 b75b91096609f7dc3bf62653587ec3aba826bcea
SHA512 fa347009c69317b84a6d4d83024935060a65ddd0eae418ea64b0e4f86f21efec83b3a306b1f72a126bc3a3cb1595331a2f6e9a1ea3fd9178a19505f81f1d49c7
SSDEEP 6144:NsayJl6Pwqn7m7fGtlqwVwASON21kiAUka4gZwYPvb6+j+b+m6Y3rbSzj:Y6PGGtlqwVwASONRh+jI+tY3rezj
TLSH
T19155E8FC943E0913389A2DE783C972786715035957F824DBFE158AE51F48AD42AF3B82
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

424KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

671B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kproxy/win-x64/kproxy.exe

SHA256 112340f1631c4072d44e5c274f70ab7a359f38e44da1e5be983ed3bcd63ea072
MD5 e57038c98ef6b3a8a5d5d2b387f43706
SHA1 93db0406f252afd2502c6fe33ea6754fb4eee50c
SHA512 7b525425058638ef70aa999448932e9bae7f4b6601733fa62edcf052f2b500c063ad2c33b2ce7f6d5c86e2c5db636b05f9fd68dbe546bd55244112f03f06ae3b
SSDEEP 49152:tuFrZQbPSH9l4SVuoeAzy1QATZhey+ZlfWwdhOQCJmWMGIA9NGtlq0gVwASOHogK:knCAdzMIGTHX3nHLF7qHnwpbZa7
TLSH
T1DD565B69AABD00ACD56BC0B8C3469237DA71709B13747AEF195486F12F57EF02A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

5777932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

kproxy/win-x64/openssl.cnf

SHA256 a0f42393d4dfa83bd395dd404cb5845818acff621117128f1c7a9e9bcae50411
MD5 1751fc499ad6697924ceb668ccd10b24
SHA1 f6413b3e668eb40b1afbf6b43fec3f777b785486
SHA512 873e3fd9ae62fd52feba8af364d8f2313a9e849513cdb9b61914565451f320aa5e3f84fa4789802a9141ea8027801c3de300efa2973fec93e30bab7284342e7f
TLSH
T1BF1103356C3335C40CAA25E33EC318A6E7BC2900141005509BAB80E96362C65DBCB52B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

kproxy/win-x86/kproxy.exe

SHA256 c68065c7d7cf70398c0a3e86a5303fe3229e0d565175b076a22dee94c3454767
MD5 baca87b7e2fdfd212b1a1098afe85c12
SHA1 30995fcc2cf263d9b5b0fdfe9ebd3082844dd22a
SHA512 b65abfc08eb9da524bd9f095ac0c58072fa44a6d51d704fd3b99e87f008afabda6fba33c7cab2c422041d6cdf968a7d2971056ab7b5cadae282aa29424c9ca65
SSDEEP 49152:ShWt4Hw8zAqMj0njwbiqnmRLq9/Gt7NLh:Sh0uFMj0nUbiqnmxwY7n
TLSH
T11BA55D42F78274FBC65781B1E01CD37EDA23565A93248DE78698DD78A8E53F11832A3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4358951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kproxy/win-x86/openssl.cnf

SHA256 20e191c85151169df055a31f4efa3ce23ca83f047ce10f5573ca223322c60dc0
MD5 62d29f05bad18a9c2fbc7ce3bdd19acb
SHA1 99bee66a99095c760ff9acdc19c52636f39dfea2
SHA512 8243a7996395280348dc216b4fde41ff5d61ae4a9d4dab945b96069a7dd0e017a2fb726338358a2ee14f13ff21910ce43b31bdfb411817b81232de9a9131dffd
TLSH
T1ED11D372683231C40CAD65E73ED718B6F67C5D0014104571EBAB80E96663C34DBDB52B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

nl/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b7cf5ac0587e8202743b0dca21c41b780b2b886277eaa712636d6321007ac7c1
MD5 6378c2f4fcdcd5c9b135d0f3a8d4d5ca
SHA1 ebcf520d9e83786cf56704c3c5b5ee5524087f1c
SHA512 b931c905aa11ab37d04e74adfe4f8c99ade824344474e10f1b3049ba74e228ce42b9add5377b171a616a38eab66ed91930f99f1a96bfce08a5ebda237751831e
SSDEEP 96:vQiiZtT9cUJpVxfFp1pziQ6kX3qpgJX0lcisRas:vQfZNpJrrBNnqax0Psss
TLSH
T1C6C1FB0197EC0FF9F0B60BB66DBA16421D36F9D1AAB0F62C0444511F5821FA9CF60B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nlog.config

SHA256 926a539315d76d6f0a9a434dfd94a3753d235e6f429ed8e93eb059da201770f3
MD5 b9fcb1cee2d0e148ebfcb6e320df79e0
SHA1 271b4546996fb991d7d49b39d85a8f02e0c5cbdb
SHA512 76182b541c9718dcb9b2785507722f7c39fd1a530bcd5477214eff70b9aa566fc2902542a06664e3b7e08c3033d9c356dc93351c23fba1488bf295196e333546
TLSH
T11C41E1529A88CDF345B26654EE34742ACA81E3E7920814D6F0FEB2132F79D5349DB18F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

pt/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8ea618fbb8b7d3522401e08f67e0ef85df5ae2dd6c92ff9fee2099f41a39fb54
MD5 3a179ffaefbdca6a5f960a0bfb85ecbe
SHA1 21dc5ce88013afd79d3a5cf32ec2da88a5ea2708
SHA512 74ec92e2ba9210f113808976af6874436af621665023a952881657383723498934428842211c1ebbab98cee97f854cb38592621ab8627b917bc1d4499f37270b
SSDEEP 6144:Z7ZH8Y3di5lhmY3dKz9z1nPdfh/osY3dVls:Z7ZdindIZnPdfhqd
TLSH
T1DB64E3813BF68458F5B60B34EA36D5D068F6BDC72C05C58F70A97B6E0974A05BE60F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

329678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

putty.exe

SHA256 af9d896e80854e5156d0243acc8e7a9a166e13eccdc16b3b1118251b8db16bec
MD5 e35e033cc73ccf460f5e79269115f821
SHA1 a659eec0bba0e28590e2603197d999baf821e821
SHA512 ab477d180db99171306e53add2236245df4d0bc14c9f1b546f8e4436337ccfdaab7fe01180ba007a6269002c88bb8dbcb7b86015d166e3f77d9f3dd3a1d4966e
SSDEEP 24576:PlwQ9tICfYJ+E3UjTSiz23THT3WkZ+c6SZpqC4DgmZ/Gx/dcB0:Plp9tHfYoEaTSiz23THT3WSMpDgF/qB0
TLSH
T13C255B27B25211FDC06EC179875B9126E970BC850B357ADF17A067212E26FE02F3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

765700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

928KB

Virtual Size

928KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

17B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

scvncctrl.dll

IMPHASH b1b16994bb3cc9ad8542500ed434ebab
SHA256 e9932fb947df5125648828248f51beb1f0b213b41f0a15bf77d56bc4b9217375
MD5 9defb2682db3afbc640ac3fdf4045154
SHA1 3996fe866d6bd39878ea6b498e439589020c1ed8
SHA512 96cd9d69d2cafa31bb3ae64bab26473c70eb60fe868c36d6b5f03cc512b500420c8a4ac2b63f30997aee397ec7326bd56d5dc020d574c52db57120aa52c735d2
SSDEEP 49152:fimimklizfY90IsmeRlUcjWyw1AVOsForTRFoaxCf:Kx6Y9K/RlFbw1AVOsFWm
TLSH
T1DB85BF02F7818472E1DE0130517AABBA593DEE38172985D7A3D439BD9D702D26B3E387
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

9b:af:e9:93:a2:8b:a9:e7:d6:a5:9b:73:42:95:2c:21:b3:68:7f:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SmartCode Solutions,O=SmartCode Solutions,L=Singapore,C=SG

Chains

Oct 27, 2018

CN=SmartCode Solutions,O=SmartCode Solutions,L=Singapore,C=SG

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=SmartCode Solutions,O=SmartCode Solutions,L=Singapore,C=SG

Serial Number

16:86:e4:0b:b5:2b:87:5a:4e:f2:29:5f:69:cc:2a:7a

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 25, 2017 - Feb 23, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

1

Major OS version

5

Entry point

1087890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\yury\source\repos\SmartCode\Projects\ViewerX\ActiveX\MAIN\sources\Release\Win32\scvncctrl.pdb

ws2_32

setsockopt shutdown inet_ntoa gethostbyname gethostname WSAStartup WSACleanup accept bind send htons select socket WSAGetLastError WSAAsyncSelect listen inet_addr getaddrinfo freeaddrinfo connect getpeername closesocket ioctlsocket __WSAFDIsSet recv

winmm

PlaySoundA timeSetEvent timeKillEvent

comctl32

ord6 ImageList_ReplaceIcon ImageList_Create

gdiplus

GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipSetImageAttributesColorMatrix GdipAlloc GdipDrawImageRectI GdipDrawImageRectRectI GdipSetClipHrgn GdiplusStartup GdipCreateFromHDC GdiplusShutdown GdipGetImageWidth GdipGetImageHeight GdipDrawImageI GdipDeleteGraphics GdipFree GdipSetSmoothingMode GdipSetInterpolationMode

kernel32

lstrlenA LoadLibraryExA GetModuleFileNameA GetModuleHandleA FindResourceA FindResourceW FindResourceExW IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte SetEvent WaitForSingleObject Sleep CloseHandle Beep CreateEventA OutputDebugStringA GlobalSize GlobalFree ReadFile CreateFileA GetVersionExA SetFilePointer SetErrorMode WriteFile FindClose SetFileTime GetLogicalDriveStringsA DeleteFileA FindFirstFileA FindNextFileA FlushFileBuffers SetEndOfFile GetFileTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime CompareFileTime GetTickCount lstrcpyA lstrcatA GetDriveTypeA GetTempPathA CreateDirectoryA GetFileAttributesA MoveFileA MoveFileExA GetStdHandle AllocConsole WriteConsoleA WaitForMultipleObjects GetTempFileNameA GetSystemTime lstrcmpA MulDiv LoadResource LoadLibraryA GetFileSize InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetLocalTime GetComputerNameA CreateThread SetThreadPriority ResumeThread EncodePointer GetModuleHandleW SetThreadLocale GetCurrentProcess GetCurrentThread DuplicateHandle CreateSemaphoreA GetFileType QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus FlushConsoleInputBuffer TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent CreateMutexA ReleaseMutex InterlockedExchange GetLocaleInfoA GetVolumeInformationA SetVolumeLabelA SetFileAttributesA GetFullPathNameA DosDateTimeToFileTime LocalFileTimeToFileTime GetVersion QueryPerformanceFrequency lstrcmpiA GetThreadLocale LoadLibraryExW GetSystemInfo VirtualProtect VirtualQuery GetTimeZoneInformation ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection SetLastError GetCurrentThreadId GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement lstrcpynA FormatMessageA InterlockedFlushSList DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy LocalFree DecodePointer ReadConsoleW GetCPInfo CreateFileW GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetStdHandle GetFullPathNameW SizeofResource SetEnvironmentVariableA SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetCurrentDirectoryW GetStringTypeW GetACP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation WriteConsoleW DeleteFileW GetFileAttributesExW SetFileAttributesW CreateDirectoryW MoveFileExW FindFirstFileExA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RemoveDirectoryW GetStartupInfoW GetSystemTimeAsFileTime RtlUnwind GetStringTypeExA SetFilePointerEx

user32

ToUnicode GetComboBoxInfo LoadStringA GetWindowTextLengthA DrawTextA GetMenuItemCount EnableMenuItem GetSystemMenu DrawMenuBar MoveWindow wsprintfA LoadImageA GetWindowTextA SetForegroundWindow EnableWindow CreateDialogParamA PeekMessageA DispatchMessageA TranslateMessage ToAscii GetKeyboardState IsClipboardFormatAvailable RegisterClipboardFormatA GetCursorPos SetCursorPos GetSystemMetrics InflateRect EmptyClipboard GetClipboardData SetClipboardData GetClipboardOwner CloseClipboard OpenClipboard SendNotifyMessageA SetScrollInfo VkKeyScanW SetRect SetCursor AdjustWindowRectEx SetWindowTextA ShowScrollBar ScrollWindowEx GetForegroundWindow SetActiveWindow UpdateWindow KillTimer SetTimer ChangeClipboardChain SetClipboardViewer IsIconic RegisterClassA PostMessageA SendMessageA RegisterWindowMessageA GetKeyboardLayoutNameA GetMonitorInfoA keybd_event GetSysColorBrush FillRect GetActiveWindow GetDesktopWindow DrawTextW RedrawWindow MonitorFromWindow DestroyIcon LoadIconA LoadCursorA GetWindow GetParent SetWindowLongA GetWindowLongA PtInRect EqualRect OffsetRect UnionRect IntersectRect MapWindowPoints MessageBoxA GetWindowRect ScreenToClient GetSysColor CopyRect SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx GetScrollInfo GetUserObjectInformationW GetProcessWindowStation LoadKeyboardLayoutA CharNextW SystemParametersInfoA GetWindowThreadProcessId IsRectEmpty GetClientRect InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC GetKeyState GetFocus SetFocus CharNextA SendDlgItemMessageA GetDlgItemTextA SetDlgItemTextA GetDlgItem EndDialog DialogBoxParamA SetWindowPos ShowWindow DestroyWindow IsChild IsWindow CreateWindowExA GetClassInfoExA RegisterClassExA CallWindowProcA DefWindowProcA UnregisterClassA OemToCharA CharToOemA wvsprintfA InvalidateRgn

gdi32

ExtTextOutA SetDIBColorTable UpdateColors SetStretchBltMode CreateSolidBrush SetBkColor SelectPalette SelectObject SelectClipRgn RealizePalette DeleteObject CreateRectRgn FillRgn SetBrushOrgEx CreateFontIndirectA StretchBlt CreatePalette CreateCompatibleDC CombineRgn BitBlt SetWindowOrgEx SetWindowExtEx SetViewportOrgEx LPtoDP SetMapMode SaveDC RestoreDC GetDeviceCaps DeleteMetaFile DeleteDC CreateRectRgnIndirect CreateMetaFileA CreateDCA CreateDIBSection CloseMetaFile

advapi32

GetSecurityDescriptorLength LookupPrivilegeValueA SetKernelObjectSecurity GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorControl IsValidSecurityDescriptor IsValidAcl IsValidSid AdjustTokenPrivileges GetKernelObjectSecurity ReportEventA RegisterEventSourceA DeregisterEventSource RegQueryInfoKeyA OpenProcessToken CryptGenRandom CryptImportKey CryptGetUserKey CryptGetProvParam CryptGenKey RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptGetKeyParam CryptSetKeyParam CryptDestroyKey CryptDeriveKey CryptReleaseContext CryptAcquireContextA

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA SHFileOperationA

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CreateDataAdviseHolder ReadClassStm WriteClassStm OleSaveToStream CreateOleAdviseHolder OleRegGetUserType OleRegGetMiscStatus OleRegEnumVerbs StringFromGUID2 CoCreateGuid ProgIDFromCLSID

oleaut32

SysFreeString SysAllocString UnRegisterTypeLi RegisterTypeLi SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayDestroy CreateErrorInfo SetErrorInfo SysAllocStringLen OleCreatePropertyFrame LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantChangeType VariantClear VariantInit SysAllocStringByteLen SysStringByteLen SysStringLen

secur32

GetUserNameExA

imm32

ImmAssociateContext

generic

count=14, id=241, version=40116,

count=209, id=243, version=40116,

count=26, id=242, version=40116,

count=14, id=199, version=41118,

count=27, id=259, version=26706,

count=19, id=260, version=26706,

count=46, id=261, version=26706,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=347, id=260, version=25019,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=530, id=1, productName=Unmarked objects,

count=30, id=264, version=26730,

count=33, productName=Unmarked objects (old),

count=76, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,

count=44, id=260, productName=VS2017 v15.8.9? build 26730, version=26730,

count=1, id=256, productName=VS2017 v15.8.9? build 26730, version=26730,

count=1, id=255, productName=VS2017 v15.8.9? build 26730, version=26730,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.8.9? build 26730, version=26730,

snmp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f43ec0e1544baf147e28a7135f3e9cda40cf2657f31fa8c6acb2501fd95b4e3e
MD5 a5a4cd5e052208055b3154e9afe2f463
SHA1 3be61fcc6003faab2f96577dc721618489dc367c
SHA512 b0ebff9dfa9308715d314d3d3f62bf329aad4222c95c450bc54dba793c5114cbcfa6b621e165462084664a0ecd85c16c0f98c28fd8d33866c30357ac3ac7d42b
SSDEEP 3072:0uDrtiTw0g6rzeqDfkphdsgfJgYy6eLkTR:Nhik0T/eOMbWDYy6eLkTR
TLSH
T19904F61DAF504163D2E91F3190B1931A57B6DE0BB643E3974B0435EABDB23F13C2269A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

f0:e1:58:81:a4:a3:e7:8e:12:20:33:3d:bd:ed:55:72:85:3d:03:69:73:23:5b:b3:78:55:72:d9:0d:4b:f5:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

185102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\bamboo-agent-home\xml-data\build-dir\AGENT-AGENTRELEASE-WIN\cag\src\Snmp\obj\Release\Snmp.pdb

sv/Gui.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5e79afd3cf5ba5304c73119081978b30e5b2d0ad98a010be5cbc45dbd4d2c00f
MD5 b11922a18ed4365a67b51f05f25a2f26
SHA1 1837750949a76812baf359734b561e5f123d8a17
SHA512 469cc782b5d05f6bdab870de193b5d5ef5640066c1babab69feadd25c7b074ec1f1923b33e0d57ff223d8e5acac7cbc95beafcc17d80f17105887ebdff1236ac
SSDEEP 6144:RemiqY3di5lhmY3dul5z1nPdvS/1Y3dUls:Re1dind45ZnPdvSOd
TLSH
T12264C2813BF68458F5B60B34DA36C4D069F6BDC72C05C58F70A97B6E0935906BE64F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

327390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

uninst.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 17eb1b44318b1fbc332a7522f11c6d9f2a34f51f28b80092cf92ff447368b965
MD5 1b105d847b66e56fd20d47f615588872
SHA1 98c153b4c081310235c178c7191ec013a8de7849
SHA512 1b0e632e58ebfe17fb91cd477f594a00ddf063929056ed56b63695f8c50cc35476c1705b4bf5be92dd9eb99cc49cbf0bfa18050dc1fd48faa9d6a147ed904dce
SSDEEP 6144:18LxBC9Qrwb3ws4zIg+rKTTmnhfAoSxZ5O10a:z3bgjIVmvmntwxZRa
TLSH
T145447D36B2C08437D1671B3C8DA692A8753AFE512F29150F7BE81E4C5F396426D392CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

f3:a7:7b:a7:86:06:9e:32:aa:de:42:70:f9:a3:63:66:7c:0f:44:aa:2b:7d:51:d1:c8:28:98:8c:05:b3:9d:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Chains

Jun 30, 2026

CN=Datto\, LLC,OU=datto rmm,O=Datto\, LLC,L=Norwalk,ST=Connecticut,C=US

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/SimpleFC.dll

SHA256 7274fe736fe36cdc8343b04fea6ff598ce384ead99ea94e4b47d4d329037331d
MD5 941a7b4dc105c3487d2b2961dc6ccb01
SHA1 ac71c5b759cabd78213748329909eaee60810d12
SHA512 40b2067121366254a6ff048e05767c337ea3f811122f97a5ce283502b6b6bba3eb82b2637115e65772c8b32c6c1a8cf9f991b06731bf7e71ffe5a6cf026ed5e6
SSDEEP 3072:l2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVn5OtcieI0Yr61u:Us4zIg+rKTTmnhfAoSxZ5O10a
TLSH
T187046D36F2C08437D1772B7C8D9A9294642ABF512E39240F7AF80D4C5B3E69169793CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

156092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8abe046ef411de4d3e6e831b6b1ee264
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsSCM.dll

IMPHASH cae3b41a07819ca715746a4d081b8a6c
SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
MD5 62efa7b730eb0523a026ea4325403b77
SHA1 806ed3bd677ccf5d9817c9b464015e347f2c8f3c
SHA512 748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b
SSDEEP 96:tqlcg4xFj0Gm+dqJ8tMQluPF/KSEmkpY0Qe1pe:tqlcg43jZRA4Jlpp5Q6e
TLSH
T19EC1B873C3E06FF6E6440AB3495B28E1A7B29A252B6CD00BD67746941861D0FFE7C603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6089

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

IndividualreportIndividualCorporateFinancialRecords_FullExecutiveSummary_2026.exe

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/FindProcDLL.dll

kernel32

user32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/SimpleFC.dll

generic

$PLUGINSDIR/SimpleSC.dll

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$PLUGINSDIR/nsSCM.dll

advapi32

kernel32

user32

generic

$PLUGINSDIR/nsisXML.dll

kernel32

user32

ole32

oleaut32

msvcrt

generic

AxInterop.MSTSCLib.dll

mscoree

dotnet

AxInterop.ViewerX.dll

mscoree

dotnet

CSIcon.ico

CagService.exe

PE Signature issue

mscoree

dotnet

CagService.exe.config

Common.dll

PE Signature issue

mscoree

dotnet

Core.XmlSerializers.dll

PE Signature issue

mscoree

dotnet

Core.dll

PE Signature issue

mscoree

dotnet

CsExec.Service.exe

PE Signature issue

mscoree

dotnet

FSharp.Core.dll

PE Signature issue

mscoree