Updаtе.7z
- SHA256 5226907f0173fa726e52f7ba74a4888a2df21f7865122422a4750fb501f53b3f
Password
password
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
lnstaIler_x86.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Updаtе.7z
- Size 103.8MB
- Sample260710-m5m6vaa161
- SHA256 5226907f0173fa726e52f7ba74a4888a2df21f7865122422a4750fb501f53b3f
- MD5 c40b6fd3b0135410d064d0f121ca9345
- SHA1 2d24af0c10c23c6fa6ef99da77cc5e045d8d4fe3
- SHA512 593e801ccf49e01134852a544f3304713a3e4609c8008b43fd8e32829a782a3d9cbc21bb397dd12fdb2dd1ce29bf129ac34aba1a32a95f2bb24da6d13471cb14
- SSDEEP 1572864:vOuZBdSxEt66Nui59zyqUllsJNuvw1D4bhK8rHjOn1UOhcuctv933HN49w5VlsvK:BLtTNVzUllvv/H4UMczLHN4yl2B4
- TLSH T1D138337BB3A3469AC175970FFDD1292DB08264CDA5AF8B75E0B3D28608D2100F659CF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/lnstaIler_x86.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/libcurl_org.dll - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/gup_util.dll unpack001/libcurl.dll
File Explorer
-
Updаtе.7z.7z 103.8MB
-
Config/library32/libswscale-5.dll1.0MB
-
Config/librаry64/addgamepage.txt17B
-
Config/librаry64/i2j9S2Mrl3BV50.0MB
-
Config/librаry64/libavif-16.dll691KB
-
Config/librаry64/libswscale-5.dll1.0MB
-
Config/librаry64/namesoftware.txt13B
-
Config/tartparyt/AcXtrnal.dll553KB
-
Config/tartparyt/i2j9S2Mrl3BV50.0MB
-
Config/tartparyt/libswscale-5.dll1.0MB
-
dаtаlib/acproxy.dll2.5MB
-
gup.xml.xml 4KB
-
gup_util.dll.dll 2.4MB
-
libcurl.dll.dll 4.2MB
-
libcurl_org.dll.dll 526KB
-
lnstaIler_x86.exe.exe 709KB
Config/library32/libswscale-5.dll
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/librаry64/addgamepage.txt
- SHA256 0e164581679e59b6ae9daf224051ed5215664a9708bd0855b731c5ef53369836
- MD5 42e4e254dd06d9ebf1d82e258b904531
- SHA1 ba7160695febb3232f7b93635c3aed73a1c44a64
- SHA512 e5615e22c777839f38aa8109b8d9aff2935f62da1d542ab560753f77d1ca77f0df2e73ec27a8f9604d57c00286240a150a9a2695a3aceffc7698f8b0a67d1c29
- MD5 SHA1 SHA512
Config/librаry64/i2j9S2Mrl3BV
- SHA256 2ca07f0b2cb05017e5c30caafb4f02cfe980bd74f97a08650a82848993e7acd8
- MD5 5537abdac8496e4b656d8b71ce02ca48
- SHA1 09a4e7e8bcca937358b2beb0fc522f694940f6a8
- SHA512 fdab8eae2e4bc425a01a37d9688afa64bf61f1a7b0d9d251dea7cfca53a23948674af73a826aa378185bc0c43cefecd35717d594414639289d993a55dc033420
- SSDEEP 1572864:x/7mIoRDo+n+Fu1oi54wb3KZNA+Q8xiEcr:MM++FGzb3KfQuw
- TLSH T18EB7337FB3A346AAC175570FBDD1292DB08264CDA59F8BB5E1B3C28608D3100F659CB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/librаry64/libavif-16.dll
- SHA256 4bf9ca1c1a3e7a9a3d2bef9c4216dbebdc05adad80c31a2176b8758552b3dcf8
- MD5 3afd94f4fd9ff6530f35d1df01882909
- SHA1 1f86b0c2b192a4518d61e9c5ef4345154ab43187
- SHA512 a461aa4b238c329821eddf300fa4d0b329bd58e60363706c84ef2fc27a47779858120e9d6ad74762013a910941fbffc05d647124684a352d459a82969ea0231c
- SSDEEP 12288:x6YLnwUjJTuW2RGt150N2HlaE2CY5FDcdmbkGOwr7mRjUmsyYBjeWUxw2VOlPeuy:MYT52R81W8Y5FDcdmbkGOwr7mRjUmsyb
- TLSH T1BCE47C12788041252CF231EE47FEBD35C98F50A4436AE5C73DEE26D9D38A4E266B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/librаry64/libswscale-5.dll
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/librаry64/namesoftware.txt
- SHA256 4ff4f5af1700502527d401936736feed2539c03b0a8a78f3bccdfef2689b0ca8
- MD5 2ff50bd8eb7496b9cb76e936efdfe621
- SHA1 06b7c2387463c905b0b110792dbe35a52640b01d
- SHA512 eec5d6c78ef8b80bc55a19da20c3e9a98c0b8ebec78f583243858d8ce28a9cdf4d325475c31a45378eec7693b4dbcc2b6d2d30c112f5d7bbd8e36fed6a7a725e
- MD5 SHA1 SHA512
Config/tartparyt/AcXtrnal.dll
- SHA256 2275f4f330d2d5299d4b83dbd972e7cd0f6183fc75b82c86b5ef601e81eb471f
- MD5 f3be9981cd41276a2c15a180857b3964
- SHA1 a5a10b5324656a5967568aa607fefeee6dc224f5
- SHA512 f3e29818b307fa0e1f71877d230ca1896e0b031a0cb3868dd2283e51e6c24469fe4a81e8058ff0c6ebad87a5f8d384e9b301d3f6c20c693936cea619ee1c775a
- SSDEEP 6144:H6XSVRJShY8/71HuqELdzMpqUN1XnV7W4nIlgtkWzsiiw4Q/Ht9BgPQsrh179yIb:0LPuqEKXXnV7WKIIkUUrhXyIn3c+pF
- TLSH T14DC44CEB1554C19562B6510CABEB9C0FE5B60CC9076289C7B8DD32C40B7BEDA94FF206
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/tartparyt/i2j9S2Mrl3BV
- SHA256 2ca07f0b2cb05017e5c30caafb4f02cfe980bd74f97a08650a82848993e7acd8
- MD5 5537abdac8496e4b656d8b71ce02ca48
- SHA1 09a4e7e8bcca937358b2beb0fc522f694940f6a8
- SHA512 fdab8eae2e4bc425a01a37d9688afa64bf61f1a7b0d9d251dea7cfca53a23948674af73a826aa378185bc0c43cefecd35717d594414639289d993a55dc033420
- SSDEEP 1572864:x/7mIoRDo+n+Fu1oi54wb3KZNA+Q8xiEcr:MM++FGzb3KfQuw
- TLSH T18EB7337FB3A346AAC175570FBDD1292DB08264CDA59F8BB5E1B3C28608D3100F659CB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Config/tartparyt/libswscale-5.dll
- SHA256 8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69
- MD5 32b637c6e70b25d042544402b55a68dc
- SHA1 e52347fbd55f8aeb11bcac9ebbb5a8b45deee4dc
- SHA512 7cc849935ac86729308b640b5b993f181ae403b98117429618e23103c160eecb09fa95f6b70663239c1e023f2b5dc531f32b3f5e1e0be24f3e5a3f66482513a8
- SSDEEP 12288:7povbC/T9Q+BDMKo4v7ukSc0fJS1ajImEvEBTqiCQtUN1tSg2zj1jcuKUJEFyB/+:Tluke6ajIm/MQS1LuKsLPvImcUy
- TLSH T15E25BED14440422A2DF125CAC3FE9E11AA5D5A9A071FF8D7B48D2ED0D3094E2B9B3F97
- MD5 SHA1 SHA512 SSDEEP TLSH
dаtаlib/acproxy.dll
- SHA256 0bd4bbe8a124ac3822bb3527547c80feae542190145d3e3b9e0517cb65885f44
- MD5 a9f82ba8aeb66762a4bc341a6e6a1ac1
- SHA1 6d6061a24d1035a35f2247c25b9877865c8a2a43
- SHA512 041b06bb052cb281be2f6304359a8851eb4ba3e9715277326db25e2b59449be04556c71a863eb6ef85efbdcb41f65116fd95f77c64150bd4ddd0f0e9938bfedc
- SSDEEP 49152:uVhFj5n9K8ulruHjhQEvMRWNvM1Tl//WXCV3tVeZaDyG:3p/iG
- TLSH T189C53B8B1954C04173B6811CA9BBCD0EF9F65289571389CBB4EE36C8177FEEB50BA211
- MD5 SHA1 SHA512 SSDEEP TLSH
gup.xml
- SHA256 92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5
- MD5 abde55a0b1cb4a904e622c02f559dcd1
- SHA1 1662f8445a000bbf7c61c40e39266658f169bf13
- SHA512 8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0
- SSDEEP 96:rrxgFDl+72Y+WbPRkrm1+U4YeJS2kG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka1+UNQo2sBCPwJrkFI
- TLSH T19491944B57DCC3770C3112A178AE9191D33409F932B5500138A8809BA36ADA6BBBF7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
gup_util.dll
- IMPHASH 4d791c7ff8a04656c4df23bdb9ebb892
- SHA256 485f814d90220f75d41dd46a4bed94cfd09e1e9e409a41eddb8f9c3070cf67d2
- MD5 b9b666c0105ecc5aa1e25e2c9076b92b
- SHA1 4150b42a13b81ab14d84874599e87e745ee1817c
- SHA512 f19e59e1b10a912fbde50e4d706c07b31a6a679563a377a4d3425388e2a0891d33eb4b50b3d92e09e150512527c7d0b45eed140272e87a50548b3b75c6714544
- SSDEEP 24576:Znyx/9Czu3GoMFQ0xH1sK/KAfYG0sprCxhFkfEXBelesaKDQepN4sTG3Te3:ZnytkzbokQ0V3YG0qCxv593Te3
- TLSH T104C53A07BED158B6D05A92318972D3A57B30FC482F2153CB3AD0BB2A3EB66D25D35784
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
password
PE Signature issue
Digest
a0:3d:6d:ff:3d:be:8d:72:29:a3:00:15:83:6e:82:dc:9c:0d:33:3c:2e:a2:2b:9b:07:87:ef:95:ad:79:0a:07:70:43:68:ac:31:e6:73:cb:e6:7e:c8:5d:fa:70:45:a2:ae:b2:cb:6e:88:21:43:b2:0c:57:8a:4d:49:1a:a4:2a
Digest Algorithm
sha512
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
Chains
Jul 5, 2026
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
PE Signature issue
Digest
72:b9:72:c7:af:b0:15:87:84:c0:96:93:8a:da:ea:b8:67:56:21:9b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
Chains
Jul 5, 2026
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
Serial Number
69:0e:8c:4a:f2:ad:61:a7:4a:58:e8:d8:73:e6:0d:f8
Issuer
CN=Hotkey Title Search,OU=Development,O=IvyTon Point Labs Ltd.,L=Toronto,ST=ON,C=CA
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 5, 2026 - Jul 5, 2027
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE
Serial Number
84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4
Issuer
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 15, 2025 - Jan 10, 2037
Subject
CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE
Serial Number
83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f
Issuer
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 16, 2025 - Jul 16, 2041
Subject
CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 9, 2020 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
1
Major OS version
6
Entry point
4754
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
GetTokenInformation
GetUserNameA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
comctl32
InitCommonControlsEx
crypt32
CertCloseStore
CertOpenSystemStoreA
dwmapi
DwmIsCompositionEnabled
gdi32
CreateCompatibleDC
DeleteDC
GetDeviceCaps
GetStockObject
imm32
ImmGetDefaultIMEWnd
iphlpapi
GetAdaptersInfo
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetComputerNameA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetErrorMode
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimes
GetTempPathA
GetThreadContext
GetTickCount
GlobalMemoryStatus
InitializeCriticalSection
IsWow64Process
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SearchPathA
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WriteConsoleW
WriteFile
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
_stricmp
strcmp
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
ole32
CoInitializeEx
CoUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
powrprof
GetActivePwrScheme
shell32
SHGetFolderPathA
shlwapi
PathFindFileNameA
PathIsDirectoryA
user32
GetAsyncKeyState
GetCursorPos
GetDC
GetDesktopWindow
GetKeyboardType
GetSystemMetrics
GetWindowRect
MonitorFromPoint
ReleaseDC
uxtheme
GetThemeAppProperties
IsAppThemed
version
GetFileVersionInfoSizeA
wininet
InternetCloseHandle
InternetOpenA
winmm
timeGetTime
waveOutGetNumDevs
winspool.drv
EnumPrintersA
ws2_32
WSACleanup
WSAStartup
_cgo_dummy_export
curl_easy_cleanup
curl_easy_duphandle
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_ext_load
Name
.text
Size
864KB
Virtual Size
864KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1023KB
Virtual Size
1022KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
1004B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
287KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
libcurl.dll
- IMPHASH d9cdd14f1e51bf231e8fd705275c2c8a
- SHA256 237a0d9bf6d203c3bdd317cd260ffd746d6c6d7dfb5865af9ea7b03ff186d261
- MD5 4de3475102142da7d087e10c465b5637
- SHA1 04496572e2b07b3dfcbb24787b4699c1ccee206b
- SHA512 8c9703813fcfc75245ba930dc83391240eb3efed189c1bcab0128cdd42373090a2f02053ca4f23ea971e40519298d0e520be83e60625947cf16741eef8c74934
- SSDEEP 24576:3fPFyBf0pn+naAUy+Ox2RAkCYrzAmMsPnWsuTL:HiE+YQY8f
- TLSH T18E267DC1BD49E93ADA27CBFCC01982F2CBC62966D7C1012751AEA6E5B4E7644440FE4F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
password
PE Signature issue
Digest
77:ff:b7:df:95:8b:b0:e2:5b:e9:cc:f5:17:b5:9c:95:96:8f:36:dc:4f:20:d1:b6:b4:cb:9e:82:79:f5:f4:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
Chains
Jul 5, 2026
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
PE Signature issue
Digest
5e:7e:52:aa:65:dc:4d:30:ba:30:b8:b2:9d:e8:9f:0a:b6:c2:27:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
Chains
Jul 5, 2026
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
Subject
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
Serial Number
19:f4:b6:8c:48:1a:36:9c:48:40:49:2b:5c:5f:b0:0c
Issuer
CN=Temp File Path Resolver,OU=Software Publishing,O=WindField Valley Apps Ltd.,L=Munich,C=DE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 5, 2026 - Jul 5, 2028
Subject
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Serial Number
36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Jan 18, 2038
Subject
CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB
Serial Number
90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06
Issuer
CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 25, 2026 - Mar 24, 2041
Subject
CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB
Serial Number
e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15
Issuer
CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 25, 2026 - Jun 24, 2037
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
4754
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
_stricmp
strcmp
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
curl_easy_cleanup
curl_easy_duphandle
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
240B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
219B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/14
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
175B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/80
Size
512B
Virtual Size
121B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/91
Size
512B
Virtual Size
369B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
277KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
libcurl_org.dll
- IMPHASH 5358152c0d79f70fd94d03415e08ddbe
- SHA256 3d7bfbcb98ed7a3c806b41251140a6302f89305b8bddcf85afb00f78c6d518b9
- MD5 7e84ed0200251cc54ce85168e0e3d98a
- SHA1 95b25f6f25f21a3da5f2499fba0fbf07c4658cfe
- SHA512 8b6c9d7f445c94a9d5cbf5d2c874faca81fac8efe5313383a0ed61b7f68c167521d671da29032b033f92167abd3b9e096254ecbf55a11f57066c5a628a2ac271
- SSDEEP 6144:V6NI7/hgoJrPOkFVuW6ZoiPPnk/9AAQIPGBxTShA9ZvT6QKob6LHywHFE1P+wTtb:L/ZhPxVOdk/4IPETvzhHuzE1P+wTt
- TLSH T1ADB47CA9B7B407B9D5A7C138C9538607E2B2B4651350E7CF43A48B7A2F23BE1563B710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
password
Minor OS version
0
Major OS version
6
Entry point
288240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohl
htonl
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
socket
setsockopt
getsockopt
getpeername
connect
closesocket
WSACleanup
WSAStartup
ntohs
listen
htons
getsockname
bind
accept
WSAGetLastError
send
recv
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
advapi32
CryptDestroyHash
CryptGenRandom
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
normaliz
IdnToAscii
crypt32
CertFreeCertificateContext
kernel32
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
HeapReAlloc
FlushFileBuffers
LCMapStringW
CompareStringW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetACP
HeapAlloc
HeapFree
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
GetFileAttributesExW
GetStringTypeW
GetTimeZoneInformation
HeapSize
WriteConsoleW
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
GetLastError
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
GetProcAddress
SleepEx
SetLastError
FormatMessageA
Sleep
CloseHandle
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
RaiseException
VerifyVersionInfoA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
387KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25203,
count=6, id=259, version=25203,
count=169, id=261, version=25203,
count=6, id=199, version=41118,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=19, id=260, version=24123,
count=13, id=257, version=25203,
count=173, id=1, productName=Unmarked objects,
count=126, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
lnstaIler_x86.exe
- IMPHASH 69e374040c4b9d552fcf7cc67435e5c4
- SHA256 268a65829e86d5c3d324eea79b51e59f0a7d07c69d3ba0f700c9cb3aa772566f
- MD5 622d263f3fe7b7cdc79c20650bfa0370
- SHA1 dc81940101454948dc4b12f5b4a6a8f00c17dd98
- SHA512 86103190b30f621a61980b55b303b8a37c13586de6eee4fd7c23d8cbc600ea443b65ea49815303831457d10340fe15d043425d9eb71535e8b9bb511f1e0f5246
- SSDEEP 12288:R72vnF1GOH0+8fjf+Dmf9ElWglnENyjokryT08wGErbgYip:RMpSf7+Dmf9GWglnZyT08wqp
- TLSH T1DBF48D9ABBA445F5D5B7C13AC991894AF7B278110B319BDF03A4836F1F236D44E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Password
password
Digest
6f:68:c1:3b:2d:d9:e2:59:3c:89:e2:7c:ec:1f:95:05:f0:bc:78:0d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Jan 27, 2019
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
05:5f:93:7a:9d:f7:3d:fd:90:ba:98:89:e4:c5:0a:11
Issuer
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 25, 2016 - Jan 29, 2019
Subject
CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
2
Major OS version
5
Entry point
212976
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_easy_perform
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsA
PathFindExtensionA
PathIsDirectoryA
PathRemoveFileSpecA
PathFindFileNameA
kernel32
UnregisterWaitEx
QueryDepthSList
LoadLibraryW
CompareStringW
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
MoveFileA
OutputDebugStringA
lstrlenA
Sleep
DeleteFileA
lstrcpyA
CreateThread
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WaitForSingleObject
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
SetEndOfFile
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WideCharToMultiByte
TryEnterCriticalSection
DuplicateHandle
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
GetACP
HeapAlloc
HeapFree
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
FlushFileBuffers
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
CreateFileW
WriteConsoleW
user32
FindWindowExA
SetWindowTextA
MessageBoxA
GetDlgItemTextA
SetDlgItemTextA
SendMessageA
GetDlgItemInt
SystemParametersInfoA
SetDlgItemInt
DialogBoxParamA
EndDialog
SetWindowPos
GetWindowRect
CreateWindowExA
shell32
SHFileOperationA
ShellExecuteA
Name
.text
Size
472KB
Virtual Size
471KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
175KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=241, version=40116,
count=167, id=243, version=40116,
count=27, id=242, version=40116,
count=1, id=199, version=41118,
count=8, id=259, version=24123,
count=117, id=261, version=24123,
count=39, id=260, version=24123,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=170, id=1, productName=Unmarked objects,
count=35, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,