c80e6dc9568e889ac758d782179f60d2f33c2f963a7ec170cb0165ce82aeca84
- SHA256 c80e6dc9568e889ac758d782179f60d2f33c2f963a7ec170cb0165ce82aeca84
Overview
overview
7Static
static
3PrintMQCli...re.dll
windows10-2004-x64
1PrintMQCli...re.dll
windows11-ltsc_2024-x64
1PrintMQCli...ry.dll
windows10-2004-x64
3PrintMQCli...ry.dll
windows11-ltsc_2024-x64
3PrintMQCli...pp.exe
windows10-2004-x64
7PrintMQCli...pp.exe
windows11-ltsc_2024-x64
3PrintMQCli...er.exe
windows10-2004-x64
3PrintMQCli...er.exe
windows11-ltsc_2024-x64
3PrintMQCli...ss.exe
windows10-2004-x64
3PrintMQCli...ss.exe
windows11-ltsc_2024-x64
3PrintMQCli...ce.exe
windows10-2004-x64
3PrintMQCli...ce.exe
windows11-ltsc_2024-x64
3PrintMQCli...on.dll
windows10-2004-x64
1PrintMQCli...on.dll
windows11-ltsc_2024-x64
1PrintMQCli...re.dll
windows10-2004-x64
1PrintMQCli...re.dll
windows11-ltsc_2024-x64
1PrintMQCli...ry.dll
windows10-2004-x64
3PrintMQCli...ry.dll
windows11-ltsc_2024-x64
3PrintMQCli...pp.exe
windows10-2004-x64
7PrintMQCli...pp.exe
windows11-ltsc_2024-x64
3PrintMQCli...er.exe
windows10-2004-x64
3PrintMQCli...er.exe
windows11-ltsc_2024-x64
3PrintMQCli...ss.exe
windows10-2004-x64
3PrintMQCli...ss.exe
windows11-ltsc_2024-x64
3PrintMQCli...ce.exe
windows10-2004-x64
3PrintMQCli...ce.exe
windows11-ltsc_2024-x64
3PrintMQCli...on.dll
windows10-2004-x64
1PrintMQCli...on.dll
windows11-ltsc_2024-x64
1PrintMQCli...nt.dll
windows10-2004-x64
1PrintMQCli...nt.dll
windows11-ltsc_2024-x64
1PrintMQCli...se.dll
windows10-2004-x64
1PrintMQCli...se.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PrintMQClient(202106)/Beflam.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PrintMQClient(202106)/Beflam.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
PrintMQClient(202106)/MQPrintClientApp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
PrintMQClient(202106)/MQPrintClientApp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
PrintMQClient(202106)/MQPrintClientManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
PrintMQClient(202106)/MQPrintClientManager.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
PrintMQClient(202106)/MQPrintClientProcess.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
PrintMQClient(202106)/MQPrintClientProcess.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
PrintMQClient(202106)/MQPrintClientService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
PrintMQClient(202106)/MQPrintClientService.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
PrintMQClient(202106)/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
PrintMQClient(202106)/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
PrintMQClient(202106)/Beflam.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
PrintMQClient(202106)/Beflam.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
PrintMQClient(202106)/MQPrintClientApp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral20
Sample
PrintMQClient(202106)/MQPrintClientApp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
PrintMQClient(202106)/MQPrintClientManager.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
PrintMQClient(202106)/MQPrintClientManager.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
PrintMQClient(202106)/MQPrintClientProcess.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
PrintMQClient(202106)/MQPrintClientProcess.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
PrintMQClient(202106)/MQPrintClientService.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
PrintMQClient(202106)/MQPrintClientService.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
PrintMQClient(202106)/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
PrintMQClient(202106)/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
PrintMQClient(202106)/RabbitMQ.Client.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
PrintMQClient(202106)/RabbitMQ.Client.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
PrintMQClient(202106)/Stimulsoft.Base.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
PrintMQClient(202106)/Stimulsoft.Base.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target c80e6dc9568e889ac758d782179f60d2f33c2f963a7ec170cb0165ce82aeca84
- Size 8.1MB
- Sample260729-mcap2sdr7w
- SHA256 c80e6dc9568e889ac758d782179f60d2f33c2f963a7ec170cb0165ce82aeca84
- MD5 b8f390bec13890ed46899f87fab1af80
- SHA1 8b4913f207af6571a1e8fe31b6bf8f28e3bb319d
- SHA512 5ac70053523a317a0ca11a710ddf4ac59eca37fd2cfd3fb26b1f9cb47de71c17f728d41916e0faab8d5e759de4a925127d96cc48a9b3bed90ed5a54afb634b1c
- SSDEEP 196608:WX2mLiIUdfnxV+j1T6P08JAYOBrjvChxN0t1oE:vmERnxV+ZsAtrIxDE
- TLSH T1048633CE0AC2842DD215433514C16DD7347E286A954AE5A9FE335C3B874EAA6E13E0FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/PrintMQClient(202106)/Beflam.Core.dll unpack001/PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll unpack001/PrintMQClient(202106)/MQPrintClientApp.exe unpack001/PrintMQClient(202106)/MQPrintClientManager.exe unpack001/PrintMQClient(202106)/MQPrintClientProcess.exe unpack001/PrintMQClient(202106)/MQPrintClientService.exe unpack002/PrintMQClient(202106)/Beflam.Core.dll unpack002/PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll unpack002/PrintMQClient(202106)/MQPrintClientApp.exe unpack002/PrintMQClient(202106)/MQPrintClientManager.exe unpack002/PrintMQClient(202106)/MQPrintClientProcess.exe unpack002/PrintMQClient(202106)/MQPrintClientService.exe unpack002/PrintMQClient(202106)/RabbitMQ.Client.dll unpack001/PrintMQClient(202106)/RabbitMQ.Client.dll - Untrusted Codesign Signers 4 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/PrintMQClient(202106)/Stimulsoft.Base.dll unpack002/PrintMQClient(202106)/Stimulsoft.Report.dll unpack001/PrintMQClient(202106)/Stimulsoft.Base.dll unpack001/PrintMQClient(202106)/Stimulsoft.Report.dll
File Explorer
-
c80e6dc9568e889ac758d782179f60d2f33c2f963a7ec170cb0165ce82aeca84.rar 8.1MB
-
PrintMQClient(202106)/Application.config.xml 1KB
-
PrintMQClient(202106)/Beflam.Core.dll.dll 2.9MB
-
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll.dll 36KB
-
PrintMQClient(202106)/Log/20210625/MQPrintClientProcess.log484B
-
PrintMQClient(202106)/Log/20210625/Microsoft XPS Document Writer.log1KB
-
PrintMQClient(202106)/Log/20210625/Printer_QueueId.log23B
-
PrintMQClient(202106)/Log/20210712/MQPrintClientProcess.log131KB
-
PrintMQClient(202106)/Log/20210712/Microsoft Print to PDF1.log2KB
-
PrintMQClient(202106)/Log/20210712/Printer_QueueId.log123B
-
PrintMQClient(202106)/Log/MQClientService.log68B
-
PrintMQClient(202106)/MQPrintClientApp.exe.exe 1.4MB
-
PrintMQClient(202106)/MQPrintClientManager.exe.exe 524KB
-
PrintMQClient(202106)/MQPrintClientProcess.exe.exe 43KB
-
PrintMQClient(202106)/MQPrintClientService.exe.exe 11KB
-
PrintMQClient(202106)/Newtonsoft.Json.dll.dll 683KB
-
PrintMQClient(202106)/PrintMQClient(202106).zip.zip 4.3MB
-
PrintMQClient(202106)/Application.config.xml 1KB
-
PrintMQClient(202106)/Beflam.Core.dll.dll 2.9MB
-
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll.dll 36KB
-
PrintMQClient(202106)/Log/20210625/MQPrintClientProcess.log484B
-
PrintMQClient(202106)/Log/20210625/Microsoft XPS Document Writer.log1KB
-
PrintMQClient(202106)/Log/20210625/Printer_QueueId.log23B
-
PrintMQClient(202106)/Log/MQClientService.log68B
-
PrintMQClient(202106)/MQPrintClientApp.exe.exe 1.4MB
-
PrintMQClient(202106)/MQPrintClientManager.exe.exe 524KB
-
PrintMQClient(202106)/MQPrintClientProcess.exe.exe 43KB
-
PrintMQClient(202106)/MQPrintClientService.exe.exe 11KB
-
PrintMQClient(202106)/Newtonsoft.Json.dll.dll 683KB
-
PrintMQClient(202106)/RabbitMQ.Client.dll.dll 275KB
-
PrintMQClient(202106)/Reports/MaterialBox.mrt#0.0.0.2020KB
-
PrintMQClient(202106)/Reports/rptAsn.mrt#0.0.0.433KB
-
PrintMQClient(202106)/Stimulsoft.Base.dll.dll 525KB
-
PrintMQClient(202106)/Stimulsoft.Report.dll.dll 4.9MB
-
PrintMQClient(202106)/RabbitMQ.Client.dll.dll 275KB
-
PrintMQClient(202106)/Stimulsoft.Base.dll.dll 525KB
-
PrintMQClient(202106)/Stimulsoft.Report.dll.dll 4.9MB
PrintMQClient(202106)/Application.config
- SHA256 5e9b097280d72c54ba5e1c15a59fbe6fe21d36dc63407e0b7779076bd16742d6
- MD5 81aab1af14ef6dfaafd575c94b373bdf
- SHA1 79d84a083284a5fac1eab50050b373cb3fbeb02b
- SHA512 adbc555978323933db750253bb0994da8ab634b48feb68617f02a7714e1a3067602153913ac1914f019a903b06b311ff4308e14a616883b04b4c62134983ccc1
- TLSH T17A31AADBA1D4ED62A0B7D657A3D18D41FDF1939288980889F4AF63232E39C6E43C340C
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Beflam.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e3255a861d2d76f28e63af12a91073c9ebc9af3de1cf9271c9d19004a22150f1
- MD5 4bdb098cb1901ee9b38f9cc596501fc9
- SHA1 80d937c6c4e1f53afd77d7b6804eec105b73fd32
- SHA512 0533222e05b071f7fd3703f401b87adb604623c9e238a6d91482c5eba3d61d73aaa123138f12a5ac6b455ea4f728ef532ccd847a06065a37108b8eda2bb75b00
- SSDEEP 49152:U6iIXKotrFHZsF7yLnA39a0w7g1QCx6wGNZiPj+k0a243aQ4VkOX2q:f3fhF+w7g1xNg4LKl4KNkO
- TLSH T1CCE56C41A291CF2AC7C42E352163462F4A21DC1BF6F3B34B5BED216BB95A3750E143DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3088510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b801de06f65557c0c82e9f6bdd444e1e09cfd9b46184e224dbc482228e5d027c
- MD5 98038435b01e5e118d8a8e5a8e7f1845
- SHA1 b8bc6a6aed5efa083d0e584f6cbffc034d5bda7b
- SHA512 bdda7e604d524c92e14938a656dd90a5108fa81893912becc0a3373efe0879c12ae78911b6302e837d5d1050d4586cfaedee16c002042d16369eb11eb3664ff4
- SSDEEP 768:gDZfmTXoKYfUkPnBkZlBQQ/SMfzdztuo2z9IkCB1ptcNa:gYHYfvStbfBko2z9ID1oa
- TLSH T109F2A673B774A265DC6227B544B32FA02371D60287A3EFDB847C936A5F072848D91736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Log/20210625/MQPrintClientProcess.log
- SHA256 a799a5f5ede60670e689fa75ec3a49e8c447a0ea8641ea03058067f540e8778a
- MD5 c952660a4b22e91f36a69e4b987c84e7
- SHA1 301a178a7663287146d6fb492c622f518640a02d
- SHA512 d2b3a383f83bd659980d1ad446cafd64fc7d09c172290bf0f113f04614a20c32ca2ddd337632cdc8236d1301a62d0008121ae34feaa5f0cc378ccd7181d280a4
- TLSH T12AF054EF5CF5D44989CDC3733460DC1EDFE74256B8686CC83CAA9A15071A68DE1DC852
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/20210625/Microsoft XPS Document Writer.log
- SHA256 c65ee2f5b21f4e3ed0dd04cd15033ac6d28027c2664e3723760b9b435fd7d955
- MD5 e1154ace9b6ce9755bf565896c8b940e
- SHA1 66ba6b4db1856b5cd3658e8b9fe80b2485a2f5ed
- SHA512 02d810e654d584fd319de4f91ad3ba02be9000db4538c725205f6c7c3df0951708324272e29cad23600550a3525a38a87cd69b1569b14c4a2ba2a218db8b51b5
- TLSH T1FB21C4699CD2CC01CE8D6293B860E86AEFCA05E3B5BCFD857CAC0252564F5DCC54CC22
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/20210625/Printer_QueueId.log
- SHA256 b360c7919dc82dcd903f66673be9c16bb738c7240fe00433ac2a30653d743b14
- MD5 c65a87fc8213c122537e5e1ba9387108
- SHA1 6a01a8c1d7338006e719b94709280eca9f87dc3d
- SHA512 8b425a19914924167dab139d1dd174b8f2df6710019f505d09546c36e050d4a1baa8a3f6b8a0a44b0b1269563bd530d3bd1d42606bd2bcd2ded574177ab023bf
- MD5 SHA1 SHA512
PrintMQClient(202106)/Log/20210712/MQPrintClientProcess.log
- SHA256 3315f23a1b1a73caab0625135a0d223b7863db3c8182d456bca6fa41d4ae913a
- MD5 f8e72b3285774fe1e97a6170ec42cee3
- SHA1 30c7d7a607b48f44a7ac4a7cdc720d2e742bf6cd
- SHA512 43a3becf9add88d0967c6e770f4f169eb7a5eddb33b3b3230659e0367127f722c22975bc28e10bfc342d942e9a0867f8c7e2b06ebd42da0da67c529039fa1d1a
- SSDEEP 3072:lH0yycceessxi00++00K78LO4G0uusRiJ88KK88OOssqqUUGGEE6688UUiiMMGGc:G
- TLSH T1D9D30F6DBA0932F236D39710B107C48CF23B563971757855B9EA5C2C8E742822BFDAD2
- MD5 SHA1 SHA512 SSDEEP TLSH
PrintMQClient(202106)/Log/20210712/Microsoft Print to PDF1.log
- SHA256 979735ef860a5513754a56352dd37b748bd8359e81ce30b6d40be1b003d0bb76
- MD5 fb53e0202ba6bfce5eedd1e190c18e26
- SHA1 d13e75b112a26f010a2aa613ae510a6ee3619d3e
- SHA512 ca32ff6b03ddc502d4a680f3316058ee434b81af065cfd30781a33edb130acedbda90490359e79333793a20b774732868f3e349edeab35c36ebd248a1f968a7d
- TLSH T1BB5154815D419C02AFC099AFB46194ED368B629F69B9F51CF0DD940DCF8F26CCA7E808
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/20210712/Printer_QueueId.log
- SHA256 aa722d79eddff79a593cea7060d0e32e20a948a7aca60e22d04013c600e86da6
- MD5 c87a96f762be978110e51409b7a64a92
- SHA1 7e37d6691c5abda9fe439a7537507eed626421f7
- SHA512 94f248e0c7c9093dc519678c791ab9ebb834b13ca8c920245a89992054805bd17d8673eceb8e95cda83cad34dc7fa960b9863720ee6135e3c8dd31529aa68ccf
- TLSH T1CFB00285C07652854518D52DD56470792C1910A68D538DDFF45554FB1718D24D24FC54
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/MQClientService.log
- SHA256 6839212d8bccb5a3e0dd6d2703d3e953ad473e2c76085de058526f4f3871c31f
- MD5 b9c9da7cb2d899f5e1c281c0c9b5aedd
- SHA1 c86d4617bec9ef12d5a706e8bf0a8d89f101a733
- SHA512 c37222aecf7e7a8c04b2f31a35244c1c0892395ac06cbcd80add50500401b41614b8ba2edf983c58032a272ccebaccfa406931efb088560dbee1fe4661e8cae5
- TLSH T131A002CAB29598F804C71245DA47428DBE5314FE1579B2336AF5208E6BE482A17DE148
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/MQPrintClientApp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3
- MD5 53f3758e3a20ab278820f36a00036059
- SHA1 ce68851a0d98470b72f77682d131829cbc35fedf
- SHA512 5fb7e5a1c626c1c1c133ca912bd0d8022172646408af82a42cecee44d81bf71cebe23cfa5828d07ba9c00fcf2a2cb03a5b259b1148e02c11d47833c60ddcaeb0
- SSDEEP 6144:1+5yZL5yZLKsVs7oCaxJax0ttrSlONKNANKNZN:+aO27oCaxJax0ttrpM6Mn
- TLSH T165657494B9409486D89A7E33C01785FC1B1B3C56D25160CB7B463BEA3FB8F43693668E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1331322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientApp\obj\Release\MQPrintClientApp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d0f9b377a0b693598c231d9174cda32226cce0afb4995811a7259302d52eabef
- MD5 b8e8354e94e350addab88f92444dd512
- SHA1 eb202f9c383b7eff66f864e67845bb7a7dce9adc
- SHA512 1837ed7d73e50b0866f4ccdb2e83ba7c087410173ddf469d89d98c2b7baa290c37ab1e43492bbdd18c3d37db5e5f2e8285f70f8c2afe8815155aea73715d3f95
- SSDEEP 12288:w2fhGSGlpFEpppppppdEpppppppDGQJEppppppp:w2fhH2p6pppppppipppppppD3epppppL
- TLSH T101B4F910360A8ED9E828EB799DD6743F06E4BCC96462986F7E913F6E13351D4463F08E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
379490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientManager\obj\Release\MQPrintClientManager.pdb
mscoree
_CorExeMain
Name
.text
Size
363KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientProcess.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dfbdfb97da2fd50a30cb71359bdf6c459eaa2f8206c2cf4f07b8072027e80ce6
- MD5 dec4a6d033c8e5ea5e4de0ab13147010
- SHA1 c7dd85a05bb1ccb0b2781f4e5179cfb8786c5505
- SHA512 9a09abb5653b104792d635234e7ac8b530f6a885f4832ef4c43755f06eefb06d1d6c7915ad89917ac5ce7943c31168d447fbaaa60ae6ddad97acf7316e47cf41
- SSDEEP 768:MGgMTkXasHpwo5qzxLP8aK/KRmDXW66gYDhAJcnNiVZo4VgfZwV9K:hgMTkXaskLP8aK/YmDXW66gmIc2tgfZd
- TLSH T104133943B3D88A5AE2EE2BF1197052A043B2F7469A32F71D4DC4A0ED1AB77C04901B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientProcess\obj\Release\MQPrintClientProcess.pdb
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientService.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bd368f4363b9aebe53eceec550cd6433469df92a1e38b37b6afbf25f869bfefe
- MD5 6c577d1cab26dd412ce8909c3054306d
- SHA1 ad0a318045dba091d6f42f83b9967b36db7c1a28
- SHA512 1fc11dfb30662a511b4bfdad14cc69ec1627078b462e8429dc2ba9eefcbe827eaf067b95bd549938a5fe4f59b2d47850f95f1e6962fe32c66c5b43496cc7ccff
- SSDEEP 192:Tbr6EmqnP2ODuWE+4iIIW1H6kOXPR8nHBLf8ii9WfVVPYrVx:uDqvo+4i3kOPIfVO
- TLSH T19C32FA5253C84376E9E60B73EC3352800BB2EA05456ABF3E75C9A34A4A777450BD2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientService\obj\Release\MQPrintClientService.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/PrintMQClient(202106).zip
- SHA256 29bcbc27e6fd22f17b355d8b0cc1fa5a36837052265e534fb6d4144f74b517ff
- MD5 c8dda29f3dcca4f07f566e022367aacb
- SHA1 f6d597c29298d90b89c64a520ba8ce515d870c16
- SHA512 16ca6650daccd944e5ff42faf1c4d55365a649b9ef53cde2bf369ce7a3117345a23f29c80a2778f613737f1c82be922d23f327eef5a0f3135ef3cbbbff87a696
- SSDEEP 98304:p6RQzwvGQQc92+ta/g1lfssvK10+XQGahCEyPzAAWfWn+DQFQ0XORE74:oQzYrrZPfXC11XnahHMcANMKxX14
- TLSH T1852633BA9C40865DE7C6219DB4B353F42B35C5DB87F873CB0A172CE487CEA029642697
- MD5 SHA1 SHA512 SSDEEP TLSH
PrintMQClient(202106)/Application.config
- SHA256 cc7880bdef674c9a6e28a0125fca336a1178ccf4eb2763e7b09298aea72ff566
- MD5 75b8b1bdf88ed0c1d853e588ac381f67
- SHA1 27d81fcf63141dd930493182b45e4bbb99c2a227
- SHA512 7beb4a4ed25878741d6f292b706f612ff546cf81bc16a02fa31992bbf3ac046fbea94302ff291258367c91a722355088f05a1f30ecc3f9c0ebebb87535b2ce90
- TLSH T11031ABDBA1D4E962A0B7D657A3D14D81FDF1D39288A80889F46F63232E39D2E43C340D
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Beflam.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e3255a861d2d76f28e63af12a91073c9ebc9af3de1cf9271c9d19004a22150f1
- MD5 4bdb098cb1901ee9b38f9cc596501fc9
- SHA1 80d937c6c4e1f53afd77d7b6804eec105b73fd32
- SHA512 0533222e05b071f7fd3703f401b87adb604623c9e238a6d91482c5eba3d61d73aaa123138f12a5ac6b455ea4f728ef532ccd847a06065a37108b8eda2bb75b00
- SSDEEP 49152:U6iIXKotrFHZsF7yLnA39a0w7g1QCx6wGNZiPj+k0a243aQ4VkOX2q:f3fhF+w7g1xNg4LKl4KNkO
- TLSH T1CCE56C41A291CF2AC7C42E352163462F4A21DC1BF6F3B34B5BED216BB95A3750E143DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3088510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Interop.IWshRuntimeLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b801de06f65557c0c82e9f6bdd444e1e09cfd9b46184e224dbc482228e5d027c
- MD5 98038435b01e5e118d8a8e5a8e7f1845
- SHA1 b8bc6a6aed5efa083d0e584f6cbffc034d5bda7b
- SHA512 bdda7e604d524c92e14938a656dd90a5108fa81893912becc0a3373efe0879c12ae78911b6302e837d5d1050d4586cfaedee16c002042d16369eb11eb3664ff4
- SSDEEP 768:gDZfmTXoKYfUkPnBkZlBQQ/SMfzdztuo2z9IkCB1ptcNa:gYHYfvStbfBko2z9ID1oa
- TLSH T109F2A673B774A265DC6227B544B32FA02371D60287A3EFDB847C936A5F072848D91736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Log/20210625/MQPrintClientProcess.log
- SHA256 a799a5f5ede60670e689fa75ec3a49e8c447a0ea8641ea03058067f540e8778a
- MD5 c952660a4b22e91f36a69e4b987c84e7
- SHA1 301a178a7663287146d6fb492c622f518640a02d
- SHA512 d2b3a383f83bd659980d1ad446cafd64fc7d09c172290bf0f113f04614a20c32ca2ddd337632cdc8236d1301a62d0008121ae34feaa5f0cc378ccd7181d280a4
- TLSH T12AF054EF5CF5D44989CDC3733460DC1EDFE74256B8686CC83CAA9A15071A68DE1DC852
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/20210625/Microsoft XPS Document Writer.log
- SHA256 c65ee2f5b21f4e3ed0dd04cd15033ac6d28027c2664e3723760b9b435fd7d955
- MD5 e1154ace9b6ce9755bf565896c8b940e
- SHA1 66ba6b4db1856b5cd3658e8b9fe80b2485a2f5ed
- SHA512 02d810e654d584fd319de4f91ad3ba02be9000db4538c725205f6c7c3df0951708324272e29cad23600550a3525a38a87cd69b1569b14c4a2ba2a218db8b51b5
- TLSH T1FB21C4699CD2CC01CE8D6293B860E86AEFCA05E3B5BCFD857CAC0252564F5DCC54CC22
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/Log/20210625/Printer_QueueId.log
- SHA256 b360c7919dc82dcd903f66673be9c16bb738c7240fe00433ac2a30653d743b14
- MD5 c65a87fc8213c122537e5e1ba9387108
- SHA1 6a01a8c1d7338006e719b94709280eca9f87dc3d
- SHA512 8b425a19914924167dab139d1dd174b8f2df6710019f505d09546c36e050d4a1baa8a3f6b8a0a44b0b1269563bd530d3bd1d42606bd2bcd2ded574177ab023bf
- MD5 SHA1 SHA512
PrintMQClient(202106)/Log/MQClientService.log
- SHA256 c84a58795eb0981fb801fd3c752293f009d08cd8455e19ea8927f923787f39d3
- MD5 5807efb5c851f184bb1a133046cb47c2
- SHA1 cd31a6793b1e9115a637087baeab1fc75e2ba0a2
- SHA512 15e0d165199346527f801403d3cf5926ccad766cadbaff1f87e28a5cf422c4b65de772c0c0b7f639aaae43f9fcc2d089f8d62683b2f09123f3404bd2aa620324
- TLSH T1DDA022C3F2C028F828820302CA83028CBF0300FE002EB2330AF0300C2BE0CAC02888E8
- MD5 SHA1 SHA512 TLSH
PrintMQClient(202106)/MQPrintClientApp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67e3619843384f1b69f0c9af9f8a212fe19d71be3d3bc2e116d429f866b273c3
- MD5 53f3758e3a20ab278820f36a00036059
- SHA1 ce68851a0d98470b72f77682d131829cbc35fedf
- SHA512 5fb7e5a1c626c1c1c133ca912bd0d8022172646408af82a42cecee44d81bf71cebe23cfa5828d07ba9c00fcf2a2cb03a5b259b1148e02c11d47833c60ddcaeb0
- SSDEEP 6144:1+5yZL5yZLKsVs7oCaxJax0ttrSlONKNANKNZN:+aO27oCaxJax0ttrpM6Mn
- TLSH T165657494B9409486D89A7E33C01785FC1B1B3C56D25160CB7B463BEA3FB8F43693668E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1331322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientApp\obj\Release\MQPrintClientApp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
161KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d0f9b377a0b693598c231d9174cda32226cce0afb4995811a7259302d52eabef
- MD5 b8e8354e94e350addab88f92444dd512
- SHA1 eb202f9c383b7eff66f864e67845bb7a7dce9adc
- SHA512 1837ed7d73e50b0866f4ccdb2e83ba7c087410173ddf469d89d98c2b7baa290c37ab1e43492bbdd18c3d37db5e5f2e8285f70f8c2afe8815155aea73715d3f95
- SSDEEP 12288:w2fhGSGlpFEpppppppdEpppppppDGQJEppppppp:w2fhH2p6pppppppipppppppD3epppppL
- TLSH T101B4F910360A8ED9E828EB799DD6743F06E4BCC96462986F7E913F6E13351D4463F08E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
379490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientManager\obj\Release\MQPrintClientManager.pdb
mscoree
_CorExeMain
Name
.text
Size
363KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientProcess.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dfbdfb97da2fd50a30cb71359bdf6c459eaa2f8206c2cf4f07b8072027e80ce6
- MD5 dec4a6d033c8e5ea5e4de0ab13147010
- SHA1 c7dd85a05bb1ccb0b2781f4e5179cfb8786c5505
- SHA512 9a09abb5653b104792d635234e7ac8b530f6a885f4832ef4c43755f06eefb06d1d6c7915ad89917ac5ce7943c31168d447fbaaa60ae6ddad97acf7316e47cf41
- SSDEEP 768:MGgMTkXasHpwo5qzxLP8aK/KRmDXW66gYDhAJcnNiVZo4VgfZwV9K:hgMTkXaskLP8aK/YmDXW66gmIc2tgfZd
- TLSH T104133943B3D88A5AE2EE2BF1197052A043B2F7469A32F71D4DC4A0ED1AB77C04901B77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientProcess\obj\Release\MQPrintClientProcess.pdb
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/MQPrintClientService.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bd368f4363b9aebe53eceec550cd6433469df92a1e38b37b6afbf25f869bfefe
- MD5 6c577d1cab26dd412ce8909c3054306d
- SHA1 ad0a318045dba091d6f42f83b9967b36db7c1a28
- SHA512 1fc11dfb30662a511b4bfdad14cc69ec1627078b462e8429dc2ba9eefcbe827eaf067b95bd549938a5fe4f59b2d47850f95f1e6962fe32c66c5b43496cc7ccff
- SSDEEP 192:Tbr6EmqnP2ODuWE+4iIIW1H6kOXPR8nHBLf8ii9WfVVPYrVx:uDqvo+4i3kOPIfVO
- TLSH T19C32FA5253C84376E9E60B73EC3352800BB2EA05456ABF3E75C9A34A4A777450BD2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\5系统框架\2SourceCode\1SearchingPlatform\3-2MQPrintClient\src\MQPrintClientService\obj\Release\MQPrintClientService.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/RabbitMQ.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e7d786ae3a2a8ed01e0ae822e7284121ed792b4600856411146830f059dc169
- MD5 1c26f086db1696ba20eb0ed65a5e8ece
- SHA1 4588fb18963a7da13cb19ce645315d3fd8546057
- SHA512 32ae9f4161459f359b630fd54a988872ea7af13e326a13b8e1da0a4f2b24ee949e70e4b5d58c0d8804e5539ac9efadd8df3313bb461b934928dc6599c7fac17f
- SSDEEP 3072:Olg+x4fv1M25dpjeznj3+bhbpWLu2Ubc7i1j0oKfkmrpT4IC03FCzVMM7Cj/+CC2:OlgH1v2j3+9NpNw+j0zfpkUiXz
- TLSH T105541A4C57E85612F9EE17BEB0A845649778B516940BB71F2F607CE42C33732CC12A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
287554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\SearchingProject\BaseProject\SearchingPlatform\MQService\RabbitMQ.Client.V3.6.9\RabbitMQ.Client\obj\Debug\RabbitMQ.Client.pdb
mscoree
_CorDllMain
Name
.text
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Reports/MaterialBox.mrt#0.0.0.20
- SHA256 de775f9487d80a4a6f65b49f3d298cec35ed437f032dfa820c7de2171d5717bc
- MD5 fd525b9aa6a4d6d26809d278f6696809
- SHA1 4c0950099acfb430e3745158dda5d7daf4e6261c
- SHA512 e1d451d561fa95d0a72a898201c0e8711f984234f3318e15142f1fa6231a7f42faf8135aedf31474d30d9648f081d20ced5d7a9276c9605569c10e00950cc634
- SSDEEP 192:Y9mQDIzC2Nr9DDJMvjrH8U0KVWdNaqPBBapUiuvZTgOGnKBU4sbC76YoG:Y9mI2NxvJM/HDqpcqiuyOJB8C6Y7
- TLSH T1E692AD3BB1C6B53587F50665B4B24589EF1282C702924097F38C66E76FB6CC70EAB631
- MD5 SHA1 SHA512 SSDEEP TLSH
PrintMQClient(202106)/Reports/rptAsn.mrt#0.0.0.4
- SHA256 240bf2e38c0bc7613aa11ab4fb706316bcbd2a94aedbce07688e0eaf331a10e1
- MD5 b9cfd84822568b789d2b03fe2a1155b9
- SHA1 422c58ac62bff9174b4d6b681d8622e3057c4bd5
- SHA512 3dd1073c5920915c622d958c6ff62a241dad3bf5b56d23a4a1a052ad225073562e24dcc7db125c2be142d3713c73ee548e42a237f182ca82062f36b715e72a27
- SSDEEP 768:Y9xVeVRxR08VgDGXW0MPHYbfUY/VTJ5RYY7:bcY7
- TLSH T1C5E2DC3BB0C5B02587F64A56A4B24949EF5642C702C25493F3DC57A72FB2CC31FAB622
- MD5 SHA1 SHA512 SSDEEP TLSH
PrintMQClient(202106)/Stimulsoft.Base.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34d329238ee2149ee4c31ada124314fd56d91dea078bb81281d16aa42757c461
- MD5 ff05d161ba6dc586ca4d2b9e3e5df2b3
- SHA1 11ffb3e3eb9e1c7a940e8e5900c4cec80076459f
- SHA512 e92cc017adff5a685c7bede319a9606a337918b11ad7ce05dbfad6d9c1ec3c71a185a1b67c30a28df29cfff97259798e42cf188c76de8d03bb68be6f57f450c2
- SSDEEP 12288:HSmOse0L5c5TzMsydiICd65M6gPy9ygaS:HSrsfsTgsydiICd65MjKopS
- TLSH T12DB48C1523C82729C3BF5276F821468AEEB0913793D2976A388581FF1FB274486577E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8f:69:be:25:81:80:2d:cb:72:ed:b9:5a:68:0e:61:81:ed:5b:27:71
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Chains
Jul 27, 2026
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Subject
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Serial Number
13:23:a5:05:5d:62:e5:ff:a0:26:6e:88:91:e2:c2:7c
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
May 16, 2012 - May 16, 2013
Minor OS version
0
Major OS version
4
Entry point
529710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Stimulsoft\Stimulsoft.Reports\Stimulsoft.Base\obj\Release\Stimulsoft.Base.pdb
mscoree
_CorDllMain
Name
.text
Size
512KB
Virtual Size
509KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Stimulsoft.Report.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8ba96b26fbb2cc9427729c011ca91f7aec65b4538d5df6141a15b9df274987bb
- MD5 5ae0ba237e6d619b26c52c98171bf3fd
- SHA1 edd84ab9c8b28a087a8826f3b7a94a46bbc42c5f
- SHA512 0a897644d49b42cdb7e6922a7114b412057995473cf0d25e8ec6f2a9fc2e1775162203fb7bfdf33ba9955deb47ff7ddd993ea5554dbff0616f2b58c7d2762138
- SSDEEP 98304:GPlZ+NeAZIV4h9BE9E0PyWrmukmAxsXtUFEZRLU2YVO1OgabDvhYmk2i+XMH1ZjO:GPjUFE
- TLSH T194366B14BBD8CB29E1AF8330A47611A852F0EC6DAB92D70F7A4179395D737804D626F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
44:80:e4:97:f9:78:22:5c:9d:6c:07:6b:75:ab:5f:8f:32:0f:53:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Chains
Jul 27, 2026
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Subject
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Serial Number
13:23:a5:05:5d:62:e5:ff:a0:26:6e:88:91:e2:c2:7c
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
May 16, 2012 - May 16, 2013
Minor OS version
0
Major OS version
4
Entry point
5112398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Stimulsoft\Stimulsoft.Reports\Stimulsoft.Report\obj\Release\Stimulsoft.Report.pdb
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/RabbitMQ.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e7d786ae3a2a8ed01e0ae822e7284121ed792b4600856411146830f059dc169
- MD5 1c26f086db1696ba20eb0ed65a5e8ece
- SHA1 4588fb18963a7da13cb19ce645315d3fd8546057
- SHA512 32ae9f4161459f359b630fd54a988872ea7af13e326a13b8e1da0a4f2b24ee949e70e4b5d58c0d8804e5539ac9efadd8df3313bb461b934928dc6599c7fac17f
- SSDEEP 3072:Olg+x4fv1M25dpjeznj3+bhbpWLu2Ubc7i1j0oKfkmrpT4IC03FCzVMM7Cj/+CC2:OlgH1v2j3+9NpNw+j0zfpkUiXz
- TLSH T105541A4C57E85612F9EE17BEB0A845649778B516940BB71F2F607CE42C33732CC12A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
287554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\SearchingProject\BaseProject\SearchingPlatform\MQService\RabbitMQ.Client.V3.6.9\RabbitMQ.Client\obj\Debug\RabbitMQ.Client.pdb
mscoree
_CorDllMain
Name
.text
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Stimulsoft.Base.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 34d329238ee2149ee4c31ada124314fd56d91dea078bb81281d16aa42757c461
- MD5 ff05d161ba6dc586ca4d2b9e3e5df2b3
- SHA1 11ffb3e3eb9e1c7a940e8e5900c4cec80076459f
- SHA512 e92cc017adff5a685c7bede319a9606a337918b11ad7ce05dbfad6d9c1ec3c71a185a1b67c30a28df29cfff97259798e42cf188c76de8d03bb68be6f57f450c2
- SSDEEP 12288:HSmOse0L5c5TzMsydiICd65M6gPy9ygaS:HSrsfsTgsydiICd65MjKopS
- TLSH T12DB48C1523C82729C3BF5276F821468AEEB0913793D2976A388581FF1FB274486577E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
8f:69:be:25:81:80:2d:cb:72:ed:b9:5a:68:0e:61:81:ed:5b:27:71
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Chains
Jul 27, 2026
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Subject
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Serial Number
13:23:a5:05:5d:62:e5:ff:a0:26:6e:88:91:e2:c2:7c
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
May 16, 2012 - May 16, 2013
Minor OS version
0
Major OS version
4
Entry point
529710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Stimulsoft\Stimulsoft.Reports\Stimulsoft.Base\obj\Release\Stimulsoft.Base.pdb
mscoree
_CorDllMain
Name
.text
Size
512KB
Virtual Size
509KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PrintMQClient(202106)/Stimulsoft.Report.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8ba96b26fbb2cc9427729c011ca91f7aec65b4538d5df6141a15b9df274987bb
- MD5 5ae0ba237e6d619b26c52c98171bf3fd
- SHA1 edd84ab9c8b28a087a8826f3b7a94a46bbc42c5f
- SHA512 0a897644d49b42cdb7e6922a7114b412057995473cf0d25e8ec6f2a9fc2e1775162203fb7bfdf33ba9955deb47ff7ddd993ea5554dbff0616f2b58c7d2762138
- SSDEEP 98304:GPlZ+NeAZIV4h9BE9E0PyWrmukmAxsXtUFEZRLU2YVO1OgabDvhYmk2i+XMH1ZjO:GPjUFE
- TLSH T194366B14BBD8CB29E1AF8330A47611A852F0EC6DAB92D70F7A4179395D737804D626F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
44:80:e4:97:f9:78:22:5c:9d:6c:07:6b:75:ab:5f:8f:32:0f:53:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Chains
Jul 27, 2026
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Subject
CN=Stimulsoft,O=Stimulsoft,L=Vitebsk,ST=Vitebsk,C=BY
Serial Number
13:23:a5:05:5d:62:e5:ff:a0:26:6e:88:91:e2:c2:7c
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
May 16, 2012 - May 16, 2013
Minor OS version
0
Major OS version
4
Entry point
5112398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Stimulsoft\Stimulsoft.Reports\Stimulsoft.Report\obj\Release\Stimulsoft.Report.pdb
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ