Software Cloud.zip
- SHA256 f78dc99d0dbed664d0ee118dc6e37e1f6a0ab9e3e3e37d6a10d9a496128368b3
Password
1231
Overview
overview
5Static
static
5About/80/C...di.dll
windows10-2004-x64
3About/80/C...di.dll
windows11-ltsc_2024-x64
3About/80/T...di.dll
windows10-2004-x64
3About/80/T...di.dll
windows11-ltsc_2024-x64
3About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1About/90/S...es.rtf
windows10-2004-x64
1About/90/S...es.rtf
windows11-ltsc_2024-x64
1Files/Reso...70.dll
windows10-2004-x64
1Files/Reso...70.dll
windows11-ltsc_2024-x64
1Files/Reso...70.dll
windows10-2004-x64
1Files/Reso...70.dll
windows11-ltsc_2024-x64
1Files/instapi110.dll
windows10-2004-x64
3Files/instapi110.dll
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
About/80/COM/sqlvdi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
About/80/COM/sqlvdi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
About/80/Tools/Binn/sqlvdi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
About/80/Tools/Binn/sqlvdi.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
About/90/Shared/Resources/1028/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
About/90/Shared/Resources/1028/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
About/90/Shared/Resources/1031/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
About/90/Shared/Resources/1031/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
About/90/Shared/Resources/1033/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
About/90/Shared/Resources/1033/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
About/90/Shared/Resources/1036/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
About/90/Shared/Resources/1036/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
About/90/Shared/Resources/1040/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
About/90/Shared/Resources/1040/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral15
Sample
About/90/Shared/Resources/1041/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
About/90/Shared/Resources/1041/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
About/90/Shared/Resources/1042/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
About/90/Shared/Resources/1042/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
About/90/Shared/Resources/1046/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
About/90/Shared/Resources/1046/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
About/90/Shared/Resources/1049/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
About/90/Shared/Resources/1049/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
About/90/Shared/Resources/2052/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
About/90/Shared/Resources/2052/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
About/90/Shared/Resources/3082/License_SysClrTypes.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
About/90/Shared/Resources/3082/License_SysClrTypes.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
Files/Resources/1033/sqlevn70.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
Files/Resources/1033/sqlevn70.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
Files/Resources/1049/sqlevn70.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Files/Resources/1049/sqlevn70.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Files/instapi110.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
Files/instapi110.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Software Cloud.zip
- Size 237.8MB
- Sample260813-tpbw7sca73
- SHA256 f78dc99d0dbed664d0ee118dc6e37e1f6a0ab9e3e3e37d6a10d9a496128368b3
- MD5 8a3e422fdf754a2a791f7db6f08317fe
- SHA1 2d88b97e0eabc31f1c601a6233ec6ff2991303b6
- SHA512 8f6f5f5f31b6d0f3c93d13cd8e07f915868ba29125986c3b5bba27f67754564b0e7534f29df2a408b502bbda4b9e3eb61515092afe26f61951394929df263f1b
- SSDEEP 6291456:uEzBJ9l/itaLyWeA0MnI/HE7kmQcvZCyAewes:v3ziiyO0Mn8KQcvYybi
- TLSH T1C5C833903BDE6F6321BF2D518408798F968E11D8FB25371BB43A99CF48EB5C2C76501A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/mpclient.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/mpclient.dll
File Explorer
-
Software Cloud.zip.zip 237.8MB
-
How to install.txt116B
-
Release-арp-x64.rar.rar 237.8MB
-
About/80/COM/sqlvdi.dll.dll 200KB
-
About/80/Tools/Binn/sqlvdi.dll.dll 200KB
-
About/90/Shared/Resources/1028/License_SysClrTypes.rtf.rtf 124KB
-
About/90/Shared/Resources/1031/License_SysClrTypes.rtf.rtf 94KB
-
About/90/Shared/Resources/1033/License_SysClrTypes.rtf.rtf 93KB
-
About/90/Shared/Resources/1036/License_SysClrTypes.rtf.rtf 97KB
-
About/90/Shared/Resources/1040/License_SysClrTypes.rtf.rtf 93KB
-
About/90/Shared/Resources/1041/License_SysClrTypes.rtf.rtf 146KB
-
About/90/Shared/Resources/1042/License_SysClrTypes.rtf.rtf 364KB
-
About/90/Shared/Resources/1046/License_SysClrTypes.rtf.rtf 94KB
-
About/90/Shared/Resources/1049/License_SysClrTypes.rtf.rtf 137KB
-
About/90/Shared/Resources/2052/License_SysClrTypes.rtf.rtf 117KB
-
About/90/Shared/Resources/3082/License_SysClrTypes.rtf.rtf 96KB
-
About/ODBC/170/License Terms/License_msodbcsql_ENU.txt11KB
-
About/ODBC/170/SDK/Include/msodbcsql.h108KB
-
About/ODBC/170/SDK/Lib/x64/msodbcsql17.lib6KB
-
About/ODBC/170/SDK/Lib/x86/msodbcsql17.lib6KB
-
Files/Resources/1033/sqlevn70.rll.dll 2.5MB
-
Files/Resources/1049/sqlevn70.rll.dll 2.8MB
-
Files/instapi110.dll.dll 47KB
-
Files/lssyscat.dat186.0MB
-
Files/sqldk.dll.dll 1.6MB
-
Files/sqllang.dll.dll 24.8MB
-
Files/sqllangsvc.dll.dll 51KB
-
Files/sqlos.dll.dll 23KB
-
Files/sqltses.dll.dll 7.8MB
-
Files/xe.dll.dll 399KB
-
LICENSE.txt13KB
-
Set-up.exe.exe 683KB
-
mpclient.dll.dll 9.3MB
How to install.txt
- SHA256 35e39dd9a69967447572f35221d97878e2c1a0ff82fd67e40434267a1f7bd370
- MD5 423db8812692441853d827027b4af63b
- SHA1 3e1e16dfde638a71f7ff38665c81b9ba9bfec447
- SHA512 9610ff0583f300b4d4c6222f01e08d33c4bd6a50cd5e0faa907b885290cca569e2b05d21f7fb39581dcf3f317229501622aae155f686bead8094d7f6d59ce49a
- TLSH T117B01201E30301B105BD11BF4E000C38E01ADD192135209615D488F9E993E6DCFD8C83
- MD5 SHA1 SHA512 TLSH
Release-арp-x64.rar
- SHA256 b4cd7b9f5c1b7390e803bdc6c2117ca55901788909ffd6304f39b8f341b0ec1c
- MD5 776b532b331efb572a4024c467986a18
- SHA1 a86d6d02b9831f11329cbb2674c32287e50f5c0c
- SHA512 c542cd66e28eaf1a3d72ace6f7a2a8913b80d4c3536e1926b8fdd41df60748eb90299e652721b53a2bcf0b0b3d9bac7d1e67d210d0ec63c45a3db327d03e6a68
- SSDEEP 6291456:cEzBJ9l/itaLyWeA0MnI/HE7kmQcvZCyAewet:x3ziiyO0Mn8KQcvYybX
- TLSH T103C833903BDE6F6321BF2D518408798F968E11D8FB25371BB43A99CF48EB5C2C76501A
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
About/80/COM/sqlvdi.dll
- IMPHASH 6499b940213d268aa405068355eafe37
- SHA256 19e4a2a8676a9f4a488d67f1f7e44bf8a013f0ab5c51d7a0d4911e4b2300e2d6
- MD5 5fca59a96ad276ee95bc6ab297c3b374
- SHA1 08cf8d5ddf77fb7b51e210a316b5f89b81acb514
- SHA512 83dffee067f9b6e5349e3b3f4db469ff9e44028e1ccfbcea8b89d2ee3946b75c31aff4a2f04058e22cbf7afe663f650a105c14e1dd9ee096d4d026da0023ff56
- SSDEEP 3072:bXA0f7V8M5uGcdTbdfQC2mCpCJ4bvu76gAOD05hoTl1wrcGBxG2fOXEOGS8:bXA0fBrcdTb03WhJYkGxGaJlS8
- TLSH T124147B717AC180B6E8F315B816FCA676153DB9A10B6088DF13A81BEDA9307D09734B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
61:23:bf:49:03:40:17:f0:1d:e7:36:77:b6:0b:e6:13:40:93:6c:4a:2a:1f:ed:2b:81:18:52:17:77:e1:c2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
42965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\18\obj\x86retail\sql\ntdbms\storeng\dmu\dmpld\vdi\sql\sqlvdi.vcxproj\sqlvdi.pdb
kernel32
OpenSemaphoreW
CreateFileW
WaitForMultipleObjectsEx
WriteFile
ReleaseSemaphore
ReadFile
GetTickCount
ResetEvent
WaitForSingleObjectEx
SetEvent
ProcessIdToSessionId
CreateEventW
GetComputerNameW
GetCurrentThread
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetModuleFileNameW
GetModuleFileNameA
GetCurrentProcessId
LocalFree
FormatMessageW
GetCurrentThreadId
MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
CloseHandle
GetLastError
OpenProcess
UnmapViewOfFile
OpenFileMappingW
GetEnvironmentVariableW
SetLastError
HeapFree
GetFileAttributesW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
WideCharToMultiByte
VirtualQuery
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
WriteConsoleW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetSystemInfo
GetVersionExW
CompareStringW
InitializeCriticalSection
advapi32
SetSecurityDescriptorDacl
CloseServiceHandle
OpenSCManagerW
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSidToSidW
RegEnumKeyExW
IsValidSid
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityInfo
QueryServiceConfigW
OpenServiceW
BuildTrusteeWithSidW
OpenThreadToken
MakeSelfRelativeSD
LookupAccountNameW
GetSecurityInfo
GetTokenInformation
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
GetLengthSid
CopySid
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
RegEnumKeyExA
ole32
StringFromGUID2
CoCreateGuid
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25203,
count=138, id=261, version=25203,
count=18, id=260, version=25203,
count=34, id=261, version=26706,
count=15, id=260, version=26706,
count=19, id=259, version=26706,
count=1, id=262, version=25203,
count=7, id=257, version=25203,
count=165, id=1, productName=Unmarked objects,
count=10, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=3, id=151,
count=1, id=258, version=27034,
About/80/Tools/Binn/sqlvdi.dll
- IMPHASH 6499b940213d268aa405068355eafe37
- SHA256 19e4a2a8676a9f4a488d67f1f7e44bf8a013f0ab5c51d7a0d4911e4b2300e2d6
- MD5 5fca59a96ad276ee95bc6ab297c3b374
- SHA1 08cf8d5ddf77fb7b51e210a316b5f89b81acb514
- SHA512 83dffee067f9b6e5349e3b3f4db469ff9e44028e1ccfbcea8b89d2ee3946b75c31aff4a2f04058e22cbf7afe663f650a105c14e1dd9ee096d4d026da0023ff56
- SSDEEP 3072:bXA0f7V8M5uGcdTbdfQC2mCpCJ4bvu76gAOD05hoTl1wrcGBxG2fOXEOGS8:bXA0fBrcdTb03WhJYkGxGaJlS8
- TLSH T124147B717AC180B6E8F315B816FCA676153DB9A10B6088DF13A81BEDA9307D09734B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
61:23:bf:49:03:40:17:f0:1d:e7:36:77:b6:0b:e6:13:40:93:6c:4a:2a:1f:ed:2b:81:18:52:17:77:e1:c2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 15, 2020 - Dec 2, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:49BC-E37A-233C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:49:80:08:4a:bb:09:a0:33:0b:00:00:00:00:01:49
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 12, 2020 - Feb 11, 2022
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
42965
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\dbs\sh\s19c\0719_152503\cmd\18\obj\x86retail\sql\ntdbms\storeng\dmu\dmpld\vdi\sql\sqlvdi.vcxproj\sqlvdi.pdb
kernel32
OpenSemaphoreW
CreateFileW
WaitForMultipleObjectsEx
WriteFile
ReleaseSemaphore
ReadFile
GetTickCount
ResetEvent
WaitForSingleObjectEx
SetEvent
ProcessIdToSessionId
CreateEventW
GetComputerNameW
GetCurrentThread
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
GetModuleFileNameW
GetModuleFileNameA
GetCurrentProcessId
LocalFree
FormatMessageW
GetCurrentThreadId
MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
CloseHandle
GetLastError
OpenProcess
UnmapViewOfFile
OpenFileMappingW
GetEnvironmentVariableW
SetLastError
HeapFree
GetFileAttributesW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
WideCharToMultiByte
VirtualQuery
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
DecodePointer
WriteConsoleW
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
GetSystemInfo
GetVersionExW
CompareStringW
InitializeCriticalSection
advapi32
SetSecurityDescriptorDacl
CloseServiceHandle
OpenSCManagerW
SetEntriesInAclW
CreateWellKnownSid
ConvertStringSidToSidW
RegEnumKeyExW
IsValidSid
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityInfo
QueryServiceConfigW
OpenServiceW
BuildTrusteeWithSidW
OpenThreadToken
MakeSelfRelativeSD
LookupAccountNameW
GetSecurityInfo
GetTokenInformation
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
RegOpenKeyExA
GetLengthSid
CopySid
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegCloseKey
DeregisterEventSource
RegEnumKeyExA
ole32
StringFromGUID2
CoCreateGuid
StringFromCLSID
CoTaskMemFree
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=25203,
count=138, id=261, version=25203,
count=18, id=260, version=25203,
count=34, id=261, version=26706,
count=15, id=260, version=26706,
count=19, id=259, version=26706,
count=1, id=262, version=25203,
count=7, id=257, version=25203,
count=165, id=1, productName=Unmarked objects,
count=10, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=3, id=151,
count=1, id=258, version=27034,
About/90/Shared/Resources/1028/License_SysClrTypes.rtf
- SHA256 0cb71395534f598d40d12d80d0b1818b2715434a93cc2e4e63bb070aa20c0377
- MD5 af75df6971c1d09d31549698c1917eb2
- SHA1 737b7c496498eb83cd13433861425b3c58c14f4c
- SHA512 ebcd8004fed3277769e559d5cfd61cda4909f7c4a78c092959432f6435d094300ab3fd422e1453cdcc8f0b0446b52b65bf8520b0dbb185aaf4d996979ebb3837
- SSDEEP 3072:1w4J95k2o5XG0iRyXDlaO2ikE0Nud7T3LZqrJjrJoK2Z8e1UG:hJ9K2o5XRiRyTlaO2ik9Nud7T3LZqrJ6
- TLSH T1D2C340A84C119BD4C2A1AB6D9D1CF0DCAC36F112F87181A6E17FD1BB583EC79C9A8D41
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1031/License_SysClrTypes.rtf
- SHA256 08cd68d8f45c4666f45766b228234a0f79aba1f0a7831fa1a57a68aa8e38109d
- MD5 7bb97c6c5b3fa858710b17b0d75a28b4
- SHA1 b29627a4340a757df129f4098f9c31cbefb521a5
- SHA512 968042727ab9e94f79a63093376e98c15e46ef45f38e148cf9ea7dba3980fa8a2cdc682697a274b2ec8b7f7d698fb8ce589b2426336deef85d0a54e4759184c7
- SSDEEP 768:lc4YqWmrDcJiILpro6Qg/rHot6qB/nkQWvY7Ggsb3W3CB8yYGTBOrrw9Cgsb32P4:lcwiIqJ5gZd/
- TLSH T1519353B44402B7D6C26297785E16F49CAC37F21470BD6094A2AFC2BEA57FB78C925D02
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1033/License_SysClrTypes.rtf
- SHA256 d45b2eb44417e9bdd800bf0db90c88725540723140a448fb89742a62ca264266
- MD5 f6f55d4cf917c04a43f9bea86576df63
- SHA1 d735f5fce0fc69fbb823854c1d7e32d06b4f45d8
- SHA512 f9a8e64a08e1590842484348be8706d65e2af32af600529fc34768f76b0ff9b22a41a694dd861f96cfbbb6cf300bb3607025a63e1787eb382431fc26a10f1c99
- SSDEEP 768:lLvkQNejs/ZsZfwiiQmskXPl+JksDj1uzIFQjEo3G7KfPsO6f4rNqel8Ssnv0NVm:lLMFWfLoN9JTw8OmOWQj635dL
- TLSH T1659362B84001A7D5C26297799E5AF08DAD37F51070F9A4D4E2BFC2BE913FE78D624902
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1036/License_SysClrTypes.rtf
- SHA256 fa92a28407f529b6223912524e576f4e9a150fbb5e9edb8b69333af8ba29819d
- MD5 dea508f34e9bf89b057baf32210ba022
- SHA1 79c02749b69d0d20c156003687aca0d3de7e164b
- SHA512 5204aed92dc4995db83f523dd7f0556b99b9a8322e85d9f4ccbb827776ed5e3422425bdd4836ce9984bc1788788b22fcc4809dfb8aa3b1a95956fcb4273ba8fc
- SSDEEP 768:lEvITfvFTK9YC1PnGamsdtCBNzHQah0zmvY7Ggsb383CB8yYGTBH9vY7Ggsb32FB:lEwPwFnpGNP9yUpczSHzhs5FdD
- TLSH T1F3A352784441A6C7C261D7785E16F04CAD3BF10070BCA4A4E2BFC2BEA63FA78E575902
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1040/License_SysClrTypes.rtf
- SHA256 7a6abd6464105179622ec76d9d20ab892d35c14866cf23dec3175ed6427504d9
- MD5 d1b4838eacce113758c2b62c239ba8a6
- SHA1 a3f961de8a40fc4ba065bf4afc8d3845b2f6b9ef
- SHA512 1810d30571012ba9411e983d65904653fdf49fd14cfebffb7a4cffa6b07547f449887ab1df4b0341e7d2102ea1ded77b272ed2012241e870ba8c6144ab2bb54f
- SSDEEP 768:lgYsOeqbj0duoDN3AmQoHTjUhmqFDPq2WvY7Ggsb3k3CB8yYGTBOrrw9Cgsb325u:lgM2ocN2yydtlc5ds
- TLSH T10B9350748041A7D5D2A29B789E66F448FC3BF50470F96095E2BBC3BE583FE78C529902
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1041/License_SysClrTypes.rtf
- SHA256 a0d6afe63e1000a16e9851e56e8280b314c438059c34024908f63a1c4c2f25ed
- MD5 b434e82c320fb18cfd61e6bae77538ac
- SHA1 f4f0010960f743679b6d05b045ea6719aa6f4300
- SHA512 e4674c44f3ae3cdee238a4fdc33650db08eb8119346d8236ea9130d53ba4da28701499a3610c03a3918d83bac18c5872f28c8c8818a4f877c1097e3b1f196dd3
- SSDEEP 768:1oaLTZQhcJpkp7qpElp5PAzl+bP6NAAsw+3HC74CbE0/s0w7yRBgf/piyjZCoQb/:1o6GL4E1qLmGTgq6XxUisxwo
- TLSH T1ECE3603B5C517698D6E8879D9F92F0CC6CEBF00268768016B06FE17B483E5798297DC2
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1042/License_SysClrTypes.rtf
- SHA256 dfac806cec5029a47b2012857c2a685904d9b983ce61b0ea6db8b12dace3a442
- MD5 edd85e0543d4d7e0bc700cf5160f0820
- SHA1 c9fa3b524006b899321068b260ececeb66a72d95
- SHA512 9e1bc849dcb324af0e8cac92c79e8f9cbdf5a642ab5c93f409fe69575d3fb188b61706a7dafd0ff6563eff1d009ac591a22058b73c173c64972f4b9af7b8644a
- SSDEEP 1536:dnXzJsZl4j6+6mAlmhgNyqSrzwPBKuKEZdp:dXzwj
- TLSH T1868422F481830ED4C2A1AFBDAC6AF0FDEC62921574794F46C13641AE993FE358969C43
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1046/License_SysClrTypes.rtf
- SHA256 4dd36cefc1fb62c1813ca457a8b9d1d92d8fb773af088b38cdbb8b015b751841
- MD5 31788ccd56b1774ca3c442cda344cf71
- SHA1 c4218b65f763bc72055711ddf5e078448fd1eb6f
- SHA512 4e56b5c6effe62ecfc4db9486515af6feca4bd3f660ddb3149b2d1fa6195620ac05cdf4dc172bcdfe2787369b917ae7c3b22c690f2f3c54ef6f759d8dbeca75c
- SSDEEP 768:lXfmBwpqzMfpMV/g+KAS803P1aFUMXBb60WvY7Ggsb3g3CB8yYGTBOrrw9Cgsb3F:lX4VuLUArzUTwoTLdv
- TLSH T19F9333784401B7D6C252D7786E96F44CAC37F514B0BCA094E2AFC2BEA63FA78D535902
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/1049/License_SysClrTypes.rtf
- SHA256 8f34e86e025a378883a2327f89a767d2ba5e6d0b84a6d8a3fdb15b821b0393f5
- MD5 5bc6753191bcdcc38ad825b304d40a5c
- SHA1 9d275d60ffe0f462f960badae90554d81c9b1806
- SHA512 c387083417956da2bb46da8da8adb8c06076e13b41fdbd91ce2e88e92916217ee3c604b9227c3f02812f11a833b8bf42509ef97bf5257ba5481c85541360a333
- SSDEEP 768:lcvE4tWcsxB2xz5yUaai6YZJ0Dx5xq09ifbvY7Ggsb333CB8yYGTBOrrw9Cgsb3u:lcD2GPEE81VYZaE6dY
- TLSH T16DD36A7848206586C151DE6E4F6FF4495E6AE01DB8F8204F92EBC3B758FED348A63427
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/2052/License_SysClrTypes.rtf
- SHA256 6e3ab98064cc8c03882b7f1d926cd06731507fa45fb9da113acf47dade26f935
- MD5 dc9510c853b34a3dcd5df79edab00d40
- SHA1 6820cca319e1d348b5101408948290e4e23d13f6
- SHA512 7870b6a4cd450e658a1651c29eaee5bfe4fbd7b2ff627355e554cb9287de6e4f167fd558c5dd79e1d03a602d2758750494b19250dd775864123faebfc3b32b89
- SSDEEP 1536:1X8GdwSDoDP+WBR5xRHxCeFvh6l1nVak55SF3DzK3xizysb:1HyP+W9xRHxCeFvYl1nks5SF3DzKhizD
- TLSH T1AFC3326C5D212B9DC16296FECE18F08CAD36F102A4B54499E57FD27F583EE3CC5A9802
- MD5 SHA1 SHA512 SSDEEP TLSH
About/90/Shared/Resources/3082/License_SysClrTypes.rtf
- SHA256 8b22bf1ae6eff48a0db233b3ba578e33fdf5ffb0970fdd4fda5c34b18bd1da12
- MD5 1457bc2916c92669ac1423a4f667bc5c
- SHA1 1b25c6ea070b20e958a640e9a9f44e47aee0eb39
- SHA512 eeb33b102b75d8dc2a3c0b6aa27b8493874ccb120b20df7ec4a880751cd4b993331acb11c0f36cbf136f0bf64aafe3ac4b927fdcddee14edc833db9c79611ca6
- SSDEEP 768:lUlZL0fLAhWvY7Ggsb3t3CB8yYGTBOrrw9Cgsb32dXsIpsAvikCMiiKECM3RECiU:lUbLcANBpsqiiKECM3RECiZSdj
- TLSH T138A342B84441A7D6C2529379DE56F08DAC37F60070FDA494A36BC2FEA93ED38C539902
- MD5 SHA1 SHA512 SSDEEP TLSH
About/ODBC/170/License Terms/License_msodbcsql_ENU.txt
- SHA256 c80b4a4bcc21fe489e877d8cc7b3f3cfe4943801c4bc899a0f3c82244fa0f28a
- MD5 07cf3e505b9c844de73d54d0159e55ec
- SHA1 3db89b017a4ca9ed90ae1297dc25ffd7dde5df63
- SHA512 2b954d025a2278a459445fe809d3ff425797220ed500dfac120991bc1130fbafc4d5025b790aa4d1e84d8d1897f50608b3b3d9e9c111f95bface79d8791bbd3b
- SSDEEP 192:MS8fRlsLqbBDLonGehWyeusZithrBTNH5xc1eKB5wcp6aFWgHSs:MS8fRljbBnoHFeus+rpNH5+1PDDp6aFZ
- TLSH T1784294AE734543624AD203D66E0AD5D5F72F82BA361BAA5078A8C10C1757B2DC37F2DC
- MD5 SHA1 SHA512 SSDEEP TLSH
About/ODBC/170/SDK/Include/msodbcsql.h
- SHA256 3dfa4ac8ba992e3c2751688d192b382911702cc1565c27604b7548a97a5f0fc0
- MD5 bb869705cc8069a5811eeac7457622f9
- SHA1 7ba894271e8a3f57c6bd8cbb6b480ec468cbba03
- SHA512 019a1e3b8988b5b4f2b331a35790b31079a126ec4a92e5fbe1a36937c6a3dc407740804e935cb56480a35a65a045c66e89927ef322546a167f1a18d123a63b2a
- SSDEEP 3072:hu37c3X5ybUH8HiHgGBvCWLK4S4YFIrioyAYtAOfV:vyGBvCWLK4S4YFIrioyAeAC
- TLSH T100B3949C6FC25676063FA105A77E7451EA1AF83F9AA092D43D8C4E0A1F2488513FF4DE
- MD5 SHA1 SHA512 SSDEEP TLSH
About/ODBC/170/SDK/Lib/x64/msodbcsql17.lib
- SHA256 5f303761f4c0cdea25535dc52d4cd310308733443df2887103dd488a9f92d5d6
- MD5 73f16ea2744aac5f7d940e270a15d96b
- SHA1 7e1f685fe901aba5f055571e3712c3b96dd27372
- SHA512 b86d1d45e3d140be227595db43566ff5f83d99cba052d9e207d5337ae73c411efb61c760b9a34a37cc37094e96b5638a67545c36e23cd2a982ee185c73ead487
- SSDEEP 192:GpWH0QpsyzbjX0EKW8JX0vt+RxBxJorDBxqxv5ya7KxmpqxfxJg7oxhxcx1Lx1CA:v9oEoJX0V+RxBxJorDBxqxBya7Kxmpqg
- TLSH T13CD18D356C70580AE2E6C735B53994BCA5BE88C38F07503BB24C85615F392A7DD97D88
- MD5 SHA1 SHA512 SSDEEP TLSH
About/ODBC/170/SDK/Lib/x86/msodbcsql17.lib
- SHA256 0ca1e69a010f5c4a8cea193d5144f277c7370157d68fcf45f2e09d7a8c9871e3
- MD5 992fd89649da9582d7f62ea0953943e8
- SHA1 4fbb7e122f086ef27668eb3046786ab562c46123
- SHA512 e0572abc717dff3891a8d16f9f6a8355a79a9cda97976c1efd45b12cd644077ea10de767b4e33eed77b0f95a70ce1bff141cc84b921e740ad11ea3d40ebadcf2
- SSDEEP 192:3ZaqjLw/BzVj+SasJf2BZ4wfMXm6Dxrx3CWD5quxyfxOx6xaxdxx1xxCxTBxCxVz:kqjLMzVj+SasJFwfMXm6Dxrx3CWD5qu1
- TLSH T100E1473558608DCAD7DEA231F53C817EE14C98874F02D923395CC5A1AFE9197ECD3588
- MD5 SHA1 SHA512 SSDEEP TLSH
Files/Resources/1033/sqlevn70.rll
- SHA256 4790c4c828d21865b556b48bdbb0dc84fec7e49e8fbccfd5e75c9dcfb86cae5a
- MD5 27d0d43f7ee9daefc96eef48620bdb4c
- SHA1 83c84ce3c517871dec311500001db5c501d25be3
- SHA512 fd651fb3cb9335db0a26fd58bc0831a0e91c437ca1a65355b968cf0900fecab1289b6660e64220c330b00c456e1a40e6536e8ad0a3df3f58021f6c1a47861530
- SSDEEP 12288:GgNYGl0T5TJ4IkbB84tgpciKgYLtXU558:GgNcTQtgVKS8
- TLSH T126C5694267F99208F6F73F6069B816A00E767C9AFC79C25C2280945E1DB1E41DEB4B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
ac:95:30:7d:ce:9d:1a:9b:bb:d9:4b:23:7e:11:9d:3d:b4:fd:61:03:c9:1f:f1:93:d9:2d:07:49:f0:ce:39:ca
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
09:04:c5:ba:d8:d8:61:20:7e:8c:96:65:57:98:28:ad:40:1d:4a:f6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/Resources/1049/sqlevn70.rll
- SHA256 09c875779139587ede45c49cf14173d7ce1b68246471a4f5b67dad021e5085ff
- MD5 35e743c24d8eda76966acf60ed8b337f
- SHA1 9eacb67db44b21d2091a50f2d7a7ba7cfa7bfbea
- SHA512 a25e279baca808528e8d9c0d824ca008a3666eb62f483dc3c9f81c503c97d22689c4ef8e525bf45844f865200f85a3b0a9b1911535fc427e51269043f5983a5e
- SSDEEP 12288:Y2LLINEgCKk8WfQV8vdjH6m9csYVkTzwx/1:Y2pgn8vK1
- TLSH T187D59B0FF97C9254B964E2600F7685E311AA7340632895CAD68F7DB970AC63677383CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
9c:92:ad:50:36:26:4b:9a:09:95:f0:2b:2c:fc:cc:17:c8:ae:e3:0a:a1:85:9e:7b:e8:2f:ec:b7:d0:1c:03:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f1:d4:ca:84:8f:57:ab:06:5e:99:5b:39:ff:80:a4:4f:a0:1a:7b:33
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/instapi110.dll
- IMPHASH 5527b371750fc6d80eaa5449ea813923
- SHA256 fc988b3fad95fd8ad36d829c9bfa2f36dcd517de674705a3928ad3384354f34f
- MD5 f9ee4c23a7bdbbb94bbfff3da087b431
- SHA1 b8dad015dcd170bc84e8ae333c66e40c7e4090c3
- SHA512 9ba5b2865854929f6ce41139c0a2db61ff49291b0a4e8a0ba653ed622406c0cd9eaeaa4df44fccddc03f0ad621ae75db071d93b76454d4be468334069d8bf5dd
- SSDEEP 768:6YNhRVG+vZ0Q3V0qOflcSpvxxqGdhO2zUGA1el:Nt48Z0hcexKEUJel
- TLSH T1C4231A02DB90928FD49594B0227C917A7C3C9AB2134060DF5B67F6DA38F53DA7B3075A
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
f8:5c:8d:e0:e1:7e:89:10:e0:74:f6:4b:42:36:23:49:63:8e:eb:73:10:e9:33:bd:b2:4b:74:6b:be:3c:ce:c4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d4:6d:37:76:ff:39:92:b9:72:4f:67:9a:66:5e:cd:2c:76:bb:20:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:19:96:00:00:00:00:00:1b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
26446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
instapi110.pdb
msvcr100
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
memcpy
_swscanf_s_l
_snwprintf_s
swprintf_s
_vsnwprintf
wcsncpy_s
wcslen
memset
kernel32
lstrlenW
CompareStringW
GetProcAddress
GetCurrentProcess
SetLastError
GetComputerNameExW
VirtualQuery
HeapAlloc
HeapFree
GetProcessHeap
DebugBreak
GetModuleFileNameW
ExpandEnvironmentStringsW
GetPrivateProfileStringW
GetFileAttributesW
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
GetModuleHandleW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey
GetCOMPath
GetInstRegKeyAccessMask
GetInstRegPathByID
GetInstRegPathByName
GetInstRootDirPathByID
GetInstRootRegPathByID
GetInstanceIDFromFTSApp
GetInstanceIDFromService
GetInstanceNameFromFTSApp
GetInstanceNameFromID
GetInstanceNameFromService
GetInstancePipeByID
GetInstancePipeByName
GetRegKeyAccessMask
GetSQLBinPathByInstID
GetSQLDataRootByInstID
GetSQLDataRootByInstName
GetSQLInstanceRegStringByID
GetSQLReplicationRegPath
GetSQLRootRegPath
GetSQLServerByID
GetSQLServerByName
GetSQLServiceByID
GetSQLServiceByName
GetSQLServiceTypeByName
GetSQLToolsDirPath
GetSQLToolsRegPath
GetSQLVerSpecificRegString
GetSvcBinPathByID
GetSvcBinPathByInstName
GetSvcBinPathByName
GetSvcInstRootDirPathByName
GetSvcInstRootRegPathByName
GetSvcInstanceIDFromName
GetSvcInstanceIDFromName2
GetSvcInstanceRegStringByName
GetVerSpecificRootDirPath
GetVerSpecificRootRegPath
IsDefaultInstanceID
IsDefaultInstanceName
IsNameAgentService
IsNameSQLService
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=84, id=1, productName=Unmarked objects,
count=3, id=158, productName=VS2010 build 30319, version=30319,
count=11, id=170, productName=VS2010 build 30319, version=30319,
count=2, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=189, version=30716,
count=1, id=184, version=30716,
count=4, id=188, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/lssyscat.dat
- SHA256 5dfc3dac31a3e770489fc90931cf8645206245227d21107ba72eaf9e10eeff32
- MD5 efb94c1070e5506330e9eb45f61f7681
- SHA1 00d607b9b48598f2cafa4d5f2d6239c676c4107e
- SHA512 ece47f038a14817910710811faadd145a05e2ef9a79af655f598450a155947e32ae870fe5096cb4219d2cd4e85edcaeaa44c462a2448801a8917362216fd20d1
- SSDEEP 192:+iv1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1v1vn:+y
- TLSH T18D985E3374105636FA1F61BE489215A20B2B3AA87352DD67348D4171C3D70AC1A7DF2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Files/sqldk.dll
- IMPHASH b0e1af33febb4cf653d41034da247b81
- SHA256 5ab3dfd1f5c303688593e8779dca3fdeb3075647cc675df4d3a23a0a3f90f84d
- MD5 9284cdf83b7b75720344b616864e8766
- SHA1 0ff8fe5eed78440044f1b6afe117e91d2453744a
- SHA512 6b9fbcbafe732720e3bc7b4ff15a1349b55d46fc760ab2961193c4103439aeaa1313a950436de80fa6d2c78e9e4334a1d64c157046ec4ce41c2ce32c6df2665c
- SSDEEP 49152:aBTO/KEiThdwXGn736mpSLa2CWtvhpW6xaf+MBAm7PdQJDdwczf4jW:ZyDThKmWtvhpW6xaf+MBAm7PdQJDp
- TLSH T1BC754A21ABD78039DA2235701EBDF37DA13EFD85022AD71FC164C5661EB1D02A606E7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
5a:44:ea:1d:8a:dd:7b:d4:a3:49:83:55:90:6c:f9:b2:bf:ab:11:fe:ac:32:15:91:d8:22:e1:75:9a:0b:29:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
00:f6:a0:29:a8:1e:2c:c7:3e:72:17:fb:c6:89:ac:df:50:df:a0:64
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
89340
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqldk.pdb
msvcr100
?terminate@@YAXXZ
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_vsnprintf_l
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
bsearch
free
_wcstod_l
_wcstol_l
_errno
isspace
strncmp
wcsncmp
_strnicmp_l
_wcsnicmp_l
_iswprint_l
_wtoi64_l
_wfullpath
memmove
_vsnwprintf_s_l
_printf_l
qsort
wcschr
wcsrchr
_snwprintf_l
wcscpy_s
malloc
_resetstkoflw
signal
_set_invalid_parameter_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
rand
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_clearfp
_fpreset
_controlfp
__pctype_func
_isctype_l
_vsnwprintf_l
strncpy_s
_beginthreadex
_wcsicmp_l
_purecall
_vsnwprintf
memcpy
__CxxFrameHandler3
_CxxThrowException
_CIsqrt
_CIexp
setlocale
_get_current_locale
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?exceptions@ios_base@std@@QAEXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?flush@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
sqlos
GetTlsSlotInfo
kernel32
LoadLibraryA
GetProcessHeap
LocalAlloc
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
DeleteCriticalSection
TlsAlloc
GetUserDefaultLCID
ReleaseSemaphore
CreateSemaphoreW
MultiByteToWideChar
GetFileSize
GetCurrentProcessId
RtlCaptureStackBackTrace
GetDiskFreeSpaceExW
DeleteFileW
SetLastError
GetTempPathW
FindClose
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceW
GetVolumePathNameW
SetEndOfFile
SetFilePointerEx
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
Module32NextW
CreateToolhelp32Snapshot
LocalFree
TlsSetValue
DuplicateHandle
TlsFree
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ReadFile
WriteFile
SwitchToThread
ResumeThread
GetNumaNodeProcessorMask
GetProcessAffinityMask
SetThreadIdealProcessor
GetNumaHighestNodeNumber
PostQueuedCompletionStatus
OpenFileMappingW
CreateFileMappingW
SetProcessWorkingSetSize
VirtualQueryEx
IsDebuggerPresent
GetOverlappedResult
SignalObjectAndWait
InterlockedFlushSList
WaitForMultipleObjects
GetLocalTime
FormatMessageW
SetThreadAffinityMask
GetSystemInfo
GetProcessTimes
GetThreadContext
GetThreadTimes
OpenThread
RaiseException
DebugBreak
SuspendThread
GetThreadPriority
ExitProcess
CreateMutexW
LoadLibraryW
GetVersionExW
GetQueuedCompletionStatus
CreateIoCompletionPort
GetSystemTimeAsFileTime
GetCurrentThreadId
WaitForSingleObject
CloseHandle
CreateFiber
DeleteFiber
SetThreadPriority
GetCurrentThread
ConvertThreadToFiber
SwitchToFiber
WaitForSingleObjectEx
QueryDepthSList
MapUserPhysicalPages
ResetEvent
UnmapViewOfFile
MapViewOfFileEx
VirtualQuery
VirtualProtect
VirtualFree
GlobalMemoryStatusEx
GetModuleHandleW
CreateEventW
GetLastError
FreeUserPhysicalPages
AllocateUserPhysicalPages
VirtualAlloc
QueryPerformanceCounter
GetTickCount
TlsGetValue
CreateFileW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
QueryPerformanceFrequency
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
InitializeSListHead
InterlockedPushEntrySList
SetEvent
Sleep
HeapAlloc
IsProcessorFeaturePresent
HeapFree
InterlockedPopEntrySList
OutputDebugStringA
advapi32
TraceEvent
RevertToSelf
ImpersonateSelf
ControlTraceW
StartTraceW
UnregisterTraceGuids
RegisterTraceGuidsW
EnableTrace
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
QueryAllTracesW
SetThreadToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetLengthSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
rpcrt4
UuidCreate
psapi
GetProcessMemoryInfo
winmm
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
?NotifyShutdown@SOS_OS@@SGXXZ
XEGetEngine
memMgrInfo
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
147KB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
AssertDa
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
CONSTSEC
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=185, version=30716,
count=2, id=156, version=30414,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=296, id=1, productName=Unmarked objects,
count=1, id=152, version=20115,
count=13, id=158, productName=VS2010 build 30319, version=30319,
count=12, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=184, version=30716,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=122, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/sqllang.dll
- IMPHASH 16a8bdf7eba9c8eeff2c4a1eeede524d
- SHA256 f51cf85cfe31f0b447ad5d6000d176b64de50b5e7a09a0af9f59c0a23cbc729c
- MD5 29f692b545d0493d4d2257439c6969e7
- SHA1 fccfcd17acf600abafe4671be0a1e0d9c06ce3f6
- SHA512 dccdd19aba438f40fd944988f4431a905633cd29048de3b45c924350db67ad481bb221546c41145de93bc1f210c5c9e830a6dcb95127c04f8c80924647f027b0
- SSDEEP 786432:bNCDpdcZRUQeXCcIOwpjfUwLMusl6xVxKwDu5ZKj0YPmSRVYUzFLSm9GPW22hlcB:bNSWaQeycIOwpjfUwLMusl6xVxxu5ZKu
- TLSH T15D477D327B97C02AD57226B0167DF27EB03DBD6A163CB60B9184FD251D73902AB05E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1231
Digest
9c:27:c2:dc:73:a4:c5:c7:2b:e4:5c:88:e2:e9:4e:00:81:6b:af:ff:0d:46:d4:07:18:ac:53:ba:92:40:39:92
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
79:2b:e2:6c:4d:66:fc:3f:3b:8d:54:54:b6:5f:35:35:15:71:fe:bf
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
1661148
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqllang.pdb
msvcr100
?set_terminate@@YAP6AXXZP6AXXZ@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
memset
modf
_atof_l
strtok
strstr
_scwprintf_l
_snprintf_s_l
_fpclass
_vsnwprintf_s_l
_wcslwr_l
_wcstol_l
_wgetenv
_strtime
_strdate
_iswcntrl_l
_iswprint_l
_splitpath_s
_swscanf_l
wcscspn
_ltow_s
malloc
_iswalpha_l
_wprintf_l
__iob_func
fputws
wcstol
_ui64tow_s
getenv
wmemcpy_s
_itow
_ltoa
_itoa
__pctype_func
_isctype_l
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_ultow_s
_snwprintf_s_l
_iswdigit_l
?set_unexpected@@YAP6AXXZP6AXXZ@Z
wcsrchr
_itow_s
_ultow
_snwscanf_l
_i64tow
_isnan
_wtol_l
ceil
??8type_info@@QBE_NABV0@@Z
_wmakepath_s
wcsncat_s
wcsnlen
_controlfp
_statusfp
_clearfp
_fpreset
qsort
_wcstoul_l
bsearch
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_wcsicmp
_wtoi
_errno
wcscat_s
_wsplitpath_s
_vscwprintf_l
wcsncmp
wcscpy_s
_CxxThrowException
_recalloc
memcmp
_iswspace_l
_wtoi_l
wcstok_s
wcsstr
_wcsupr_l
_ltow
_swprintf_s_l
_vsnwprintf
_time64
rand
_snprintf_l
_snwprintf_l
_sprintf_l
_printf_l
memcpy_s
memmove
wcsspn
wcsncpy_s
memmove_s
_vsnwprintf_l
_atoi_l
_stricmp_l
_vsnprintf_l
_wcsicmp_l
_ultoa_s
strcat_s
_strtoul_l
strncpy_s
calloc
_sprintf_s_l
strchr
_iswxdigit_l
_stricmp
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_CIexp
_CIlog
_CIlog10
_CIpow
_CIsqrt
floor
__CxxFrameHandler3
_wtoi64_l
_wfullpath
_wstrtime
_wstrdate
memcpy
_swscanf_s_l
strcpy_s
free
_wcsnicmp_l
_strnicmp_l
wcschr
wcspbrk
_towupper_l
_purecall
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?setf@ios_base@std@@QAEHHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?exceptions@ios_base@std@@QAEXH@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
kernel32
lstrlenA
lstrlenW
HeapReAlloc
GetProcessAffinityMask
GetSystemDefaultLCID
SetFilePointerEx
GetPrivateProfileStringW
DebugBreak
SetProcessAffinityMask
GetProcessId
TransactNamedPipe
CreateNamedPipeW
GetSystemDefaultLangID
GetDiskFreeSpaceW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
WaitNamedPipeW
DecodePointer
EncodePointer
InterlockedExchange
OutputDebugStringW
SearchPathW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
TlsGetValue
QueryPerformanceCounter
GetLastError
GetProcAddress
FreeLibrary
CloseHandle
PostQueuedCompletionStatus
LoadLibraryA
GetSystemDirectoryA
GetVersionExW
MultiByteToWideChar
CompareStringA
FormatMessageW
GetCurrentThread
LocalFree
CreateEventW
CreateFileA
CreateNamedPipeA
ConnectNamedPipe
DisconnectNamedPipe
GetTickCount
WaitNamedPipeA
SetNamedPipeHandleState
PeekNamedPipe
ReadFile
GetOverlappedResult
WaitForSingleObject
WriteFile
Sleep
WideCharToMultiByte
ResetEvent
SetEvent
GetSystemTimeAsFileTime
CreateIoCompletionPort
VerSetConditionMask
VerifyVersionInfoW
GetComputerNameA
LCMapStringA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetLastError
GetComputerNameExW
GetComputerNameExA
GetModuleFileNameW
SetHandleInformation
GetSystemTime
WaitForMultipleObjects
CompareFileTime
GetModuleHandleW
GetSystemInfo
QueryPerformanceFrequency
GetCurrentThreadId
LoadLibraryExW
GetStringTypeW
FreeResource
FindResourceW
LoadResource
LoadLibraryW
SizeofResource
LockResource
GlobalMemoryStatusEx
VirtualQuery
VirtualProtect
GetModuleHandleExW
SwitchToThread
HeapAlloc
GetProcessHeap
HeapFree
CreateFileW
GetFileAttributesW
GetFileType
GetFileSize
lstrcmpW
GetEnvironmentVariableW
SetEnvironmentVariableW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
DuplicateHandle
GetModuleHandleA
FindFirstFileW
DeleteFileW
FindNextFileW
SetFilePointer
GetFileTime
MoveFileExW
GetSystemDirectoryW
ExpandEnvironmentStringsW
SetEndOfFile
DeviceIoControl
SetErrorMode
GetDriveTypeW
CreateDirectoryW
FindClose
CopyFileW
MoveFileW
LocalAlloc
IsDBCSLeadByteEx
GetPriorityClass
SetThreadPriority
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
CreateEventA
InitializeCriticalSection
GetThreadTimes
GetProcessTimes
LocalFileTimeToFileTime
GetFileSizeEx
GetLocalTime
SystemTimeToFileTime
GetVolumePathNameW
GetDiskFreeSpaceExW
GetSystemDefaultUILanguage
GetTempPathW
GetTempFileNameW
GetComputerNameW
FileTimeToLocalFileTime
OpenProcess
CreatePipe
CreateProcessW
GetExitCodeProcess
GetLongPathNameW
GetFileAttributesExW
OpenEventW
ResumeThread
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
GlobalSize
QueueUserWorkItem
GetCurrentProcessId
lstrcmpiW
IsDebuggerPresent
GetThreadPriority
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
GetLocaleInfoW
WriteConsoleW
GetStdHandle
GetConsoleMode
GetModuleFileNameA
GetDateFormatW
GetTimeFormatW
GetVersionExA
RaiseException
GetStartupInfoW
GetThreadContext
GetCPInfo
DeleteCriticalSection
ReleaseMutex
CreateMutexW
InterlockedCompareExchange
ReadProcessMemory
GetVolumeNameForVolumeMountPointW
QueryDosDeviceW
CompareStringW
GetConsoleScreenBufferInfo
GetCurrentProcessorNumber
TlsSetValue
GetFullPathNameW
IsProcessorFeaturePresent
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
secur32
GetUserNameExW
InitSecurityInterfaceW
QueryContextAttributesW
FreeContextBuffer
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaLogonUser
LsaLookupAuthenticationPackage
userenv
CreateEnvironmentBlock
LoadUserProfileW
DestroyEnvironmentBlock
advapi32
AllocateLocallyUniqueId
QueryServiceStatus
ControlService
GetTokenInformation
GetLengthSid
LogonUserW
FreeSid
AllocateAndInitializeSid
InitializeAcl
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueW
RegOpenKeyW
RegOpenKeyExA
RegQueryInfoKeyW
RegQueryValueExA
RegSetValueExA
RegSetValueExW
GetSecurityDescriptorLength
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenThreadToken
OpenProcessToken
EqualSid
GetSecurityInfo
ImpersonateNamedPipeClient
RevertToSelf
GetSidLengthRequired
GetAclInformation
AddAce
GetAce
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
TraceEvent
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
DeregisterEventSource
RegisterEventSourceW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
StartServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetSecurityInfo
CreateWellKnownSid
LsaAddAccountRights
CreateProcessAsUserW
LogonUserExW
QueryServiceStatusEx
AdjustTokenPrivileges
ConvertStringSidToSidW
DuplicateTokenEx
InitializeSid
LookupPrivilegeValueW
LsaClose
LsaNtStatusToWinError
LsaOpenPolicy
ReportEventW
ImpersonateLoggedOnUser
ImpersonateSelf
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
ConvertSecurityDescriptorToStringSecurityDescriptorW
AddAccessAllowedAceEx
LookupAccountNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
AddAccessDeniedAce
DuplicateToken
SetThreadToken
CryptGetUserKey
CryptDuplicateHash
CryptGetHashParam
CryptVerifySignatureW
CryptSignHashW
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptSetKeyParam
CryptDeriveKey
CryptGenKey
CryptGetKeyParam
CryptExportKey
CryptImportKey
CryptSetProvParam
SetEntriesInAclW
GetSecurityDescriptorDacl
CryptGetProvParam
CryptAcquireContextW
CryptGenRandom
CryptDestroyHash
LookupAccountSidW
CryptReleaseContext
CryptDestroyKey
GetUserNameW
ConvertSidToStringSidW
CopySid
IsValidSid
netapi32
DsGetDcNameW
NetApiBufferFree
NetLocalGroupGetMembers
NetGroupGetUsers
NetWkstaGetInfo
NetUserModalsGet
sqldk
ord926
ord927
ord916
ord915
ord914
ord913
ord923
ord924
ord922
ord1020
ord1022
ord917
ord1021
ord1001
ord1016
ord936
ord1004
ord1003
ord938
ord934
ord1005
ord937
ord974
ord1006
ord997
ord996
ord964
ord930
ord994
ord374
ord954
ord953
ord988
ord982
ord965
ord961
ord973
ord951
ord935
ord970
ord963
ord1013
ord983
ord928
ord758
ord1009
ord975
ord978
ord979
ord959
ord931
ord992
ord966
ord608
ord607
ord751
ord750
ord732
ord1010
ord1011
ord1012
ord737
ord710
ord727
ord716
ord730
ord721
ord746
ord740
ord718
ord734
ord739
ord728
ord717
ord748
ord714
ord715
ord753
ord986
ord990
ord1002
ord976
ord493
ord640
ord147
ord103
ord50
ord51
ord507
ord52
ord706
ord822
ord230
ord829
ord830
ord241
ord889
ord100
ord45
ord627
ord628
ord191
ord620
ord800
ord465
ord277
ord623
ord813
ord833
ord219
ord802
ord79
ord436
ord427
ord418
ord624
ord492
ord491
ord782
ord234
ord895
ord426
ord318
ord901
ord265
ord781
ord156
ord278
ord429
ord78
ord268
ord424
ord445
ord435
ord447
ord446
ord577
ord376
ord511
ord379
ord510
ord378
ord463
ord480
ord518
ord57
ord56
ord96
ord41
ord344
ord399
ord67
ord407
ord403
ord893
ord894
ord275
ord77
ord459
ord131
ord76
ord501
ord411
ord788
ord293
ord805
ord134
ord274
ord865
ord112
ord74
ord705
ord291
ord809
ord264
ord284
ord256
ord300
ord584
ord882
ord801
ord615
ord141
ord240
ord248
ord280
ord258
ord138
ord137
ord282
ord461
ord62
ord161
ord113
ord75
ord772
ord266
ord163
ord785
ord210
ord133
ord70
ord471
ord457
ord331
ord573
ord670
ord864
ord167
ord333
ord238
ord276
ord213
ord832
ord776
ord777
ord382
ord328
ord892
ord531
ord102
ord47
ord290
ord704
ord757
ord394
ord553
ord551
ord803
ord512
ord752
ord823
ord519
ord888
ord816
ord756
ord815
ord617
ord814
ord116
ord80
ord218
ord631
ord190
ord622
ord251
ord410
ord425
ord431
ord301
ord53
ord355
ord316
ord193
ord648
ord158
ord302
ord904
ord676
ord682
ord128
ord556
ord541
ord127
ord125
ord135
ord243
ord405
ord400
ord396
ord397
ord433
ord215
ord357
ord863
ord65
ord365
ord762
ord299
ord698
ord252
ord853
ord858
ord876
ord598
ord242
ord114
ord866
ord878
ord690
ord46
ord101
ord535
ord884
ord249
ord387
ord687
ord681
ord267
ord292
ord151
ord259
ord808
ord581
ord296
ord244
ord298
ord289
ord890
ord783
ord881
ord658
ord136
ord129
ord85
ord880
ord879
ord189
ord372
ord774
ord754
ord920
ord311
ord664
ord877
ord644
ord599
ord146
ord346
ord675
ord911
ord295
ord178
ord793
ord247
ord444
ord838
ord239
ord362
ord306
ord443
ord666
ord366
ord48
ord755
ord257
ord246
ord283
ord250
ord696
ord594
ord22
ord887
ord524
ord697
ord621
ord152
ord654
ord767
ord886
ord388
ord555
ord885
ord273
ord297
ord574
ord245
ord657
ord192
ord647
ord415
ord157
ord395
ord831
ord559
ord852
ord458
ord254
ord408
ord656
ord212
ord629
ord840
ord626
ord159
ord614
ord841
ord824
ord348
ord373
ord21
ord305
ord110
ord63
ord919
ord358
ord473
ord188
ord363
ord636
ord625
ord232
ord585
ord1018
ord7
ord905
ord896
ord468
ord578
ord579
ord385
ord907
ord775
ord441
ord386
ord912
ord490
ord653
ord908
ord217
ord520
ord768
ord61
ord109
ord350
ord548
ord160
ord49
ord1019
ord925
ord470
ord375
ord115
ord304
ord910
sqltses
ord338
ord593
ord594
ord646
ord422
ord167
ord503
ord175
ord331
ord339
ord592
ord340
ord151
ord484
ord482
ord483
ord218
ord192
ord438
ord583
ord586
ord534
ord535
ord600
ord464
ord548
ord100
ord554
ord620
ord95
ord94
ord565
ord254
ord536
ord456
ord366
ord281
ord196
ord355
ord152
ord308
ord437
ord435
ord436
ord500
ord499
ord501
ord498
ord160
ord266
ord544
ord523
ord358
ord357
ord249
ord117
ord307
ord425
ord283
ord118
ord284
ord329
ord271
ord264
ord636
ord502
ord645
ord513
ord279
ord336
ord335
ord261
ord677
ord634
ord230
ord667
ord184
ord658
ord655
ord662
ord660
ord121
ord123
ord294
ord353
ord470
ord112
ord91
ord111
ord90
ord182
ord392
ord393
ord394
ord398
ord397
ord396
ord317
ord316
ord570
ord568
ord60
ord315
ord58
ord170
ord59
ord527
ord661
ord632
ord69
ord515
ord68
ord75
ord528
ord145
ord478
ord524
ord512
ord333
ord614
ord476
ord285
ord641
ord71
ord161
ord659
ord138
ord269
ord386
ord215
ord213
ord210
ord208
ord187
ord212
ord199
ord380
ord223
ord150
ord53
ord48
ord43
ord38
ord407
ord65
ord66
ord477
ord475
ord273
ord578
ord579
ord580
ord581
ord589
ord587
ord588
ord585
ord590
ord582
ord330
ord323
ord669
ord428
ord572
ord521
ord466
ord127
ord561
ord555
ord622
ord162
ord191
ord259
ord542
ord543
ord390
ord36
ord341
ord225
ord630
ord638
ord631
ord244
ord227
ord207
ord663
ord349
ord441
ord54
ord49
ord44
ord39
ord408
ord83
ord84
ord86
ord545
ord114
ord547
ord416
ord418
ord575
ord474
ord559
ord626
ord166
ord557
ord624
ord164
ord201
ord468
ord556
ord623
ord163
ord666
ord427
ord430
ord195
ord639
ord270
ord372
ord122
ord74
ord451
ord450
ord345
ord233
ord34
ord650
ord139
ord674
ord552
ord551
ord643
ord141
ord134
ord656
ord672
ord538
ord383
ord301
ord314
ord371
ord676
ord133
ord671
ord348
ord596
ord143
ord147
ord146
ord148
ord144
ord509
ord541
ord274
ord321
ord319
ord651
ord302
ord362
ord102
ord529
ord72
ord414
ord73
ord105
ord505
ord379
ord381
ord70
ord106
ord566
ord389
ord571
ord104
ord120
ord564
ord644
ord563
ord567
ord678
ord268
ord194
ord193
ord673
ord429
ord186
ord185
ord135
ord530
ord657
ord569
ord256
ord257
ord359
ord606
ord378
ord232
ord202
ord109
ord85
ord129
ord169
ord540
ord410
ord87
ord149
ord653
ord110
ord533
ord532
ord115
ord80
ord253
ord312
ord347
ord313
ord518
ord303
ord132
ord251
ord517
ord250
ord446
ord402
ord400
ord387
ord79
ord89
ord395
ord88
ord391
ord78
ord246
ord81
ord467
ord108
ord82
ord156
ord142
ord369
ord178
ord299
ord252
ord56
ord51
ord46
ord41
ord411
ord497
ord137
ord197
ord229
ord228
ord239
ord238
ord237
ord236
ord222
ord220
ord219
ord224
ord531
ord496
ord221
ord136
ord455
ord457
ord611
ord613
ord595
ord119
ord604
ord384
ord332
ord403
ord368
ord374
ord665
ord306
ord231
ord131
ord277
ord324
ord463
ord612
ord286
ord522
ord558
ord625
ord165
ord471
ord382
ord485
ord35
ord320
ord519
ord610
ord200
ord174
ord360
ord318
ord420
ord168
ord480
ord157
ord265
ord267
ord101
ord235
ord240
ord598
ord431
ord442
ord439
ord621
ord560
ord126
ord549
ord243
ord440
ord546
ord278
ord618
ord245
ord461
ord247
ord453
ord573
ord159
ord217
ord190
ord537
ord37
ord96
ord404
ord481
ord675
ord305
ord304
ord413
ord405
ord494
ord493
ord399
ord409
ord55
ord50
ord45
ord40
ord385
ord460
ord158
ord642
ord103
ord465
ord605
ord370
ord113
ord97
ord282
ord679
ord140
ord495
ord262
ord507
ord297
ord458
ord520
ord346
ord296
ord388
ord664
ord681
ord504
ord242
ord334
ord574
ord421
ord255
ord298
ord234
ord652
ord506
authz
AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzInitializeContextFromToken
AuthzGetInformationFromContext
AuthzFreeContext
wintrust
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
Name
.text
Size
22.8MB
Virtual Size
22.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
682KB
Virtual Size
768KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
AssertDa
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CONSTSEC
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sdbid
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=109, version=31008,
count=4, id=109, version=41204,
count=3, id=125, version=41204,
count=4, id=185, version=30716,
count=32, id=189, version=30716,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=171, version=30414,
count=2, id=156, version=30414,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=2884, id=1, productName=Unmarked objects,
count=1, id=152, version=20115,
count=15, id=158, productName=VS2010 build 30319, version=30319,
count=12, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=184, version=30716,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=188, version=30716,
count=1137, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=151,
count=1, id=186, version=30716,
Files/sqllangsvc.dll
- IMPHASH 8581aee75ffbe7fb63801df171450a33
- SHA256 b5108ecfc1dd73e8023d609d5edd8e6dbc5279991a0ae1628f0ca2932b61010b
- MD5 fe645bdecf22601e9fdc293aed23ba0c
- SHA1 a665dd12847f2f19a18e68329c98ec543e295027
- SHA512 43ac5d53d58c18c0983cbee628ff31dd3ad643b6b9e2ae1bae6d604885538a6733eb05551984dd7cbbb2ae00904e43ba3755ee007c83f874d0627d891e4162b8
- SSDEEP 384:3xZhtomhKV3lOIEPiswqIWqmxD/lmXruk76OeyO4tepvgizbPVHMgBqPWbdWEWr3:DhteQ/RxlcrP9evjbdH1nlWhMGAedt
- TLSH T16A333D523E28D042DC926DB01AA9EAD22A3CAF851F1051DF3259F3DE2C717C29F7056B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fd:ba:4d:c7:82:63:cf:21:bd:25:aa:d2:5f:d2:19:69:a1:e3:ca:e7:80:25:b2:e1:ab:67:c0:0f:2c:d3:8e:11
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
7c:9e:f2:7e:32:98:f7:fc:49:11:75:c7:a1:05:d1:c6:7c:1c:68:b9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
21588
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqllangsvc.pdb
msvcr100
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_purecall
__CxxFrameHandler3
memset
kernel32
TlsGetValue
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
sqldk
ord896
ord976
ord1002
ord990
ord986
ord1011
ord471
ord48
ord22
ord1018
ord188
ord49
ord331
ord905
ord473
ord358
ord363
ord7
ord457
sqltses
ord101
ord78
ord508
ord35
sqllang
ord6
ord13
ord7
ord8
ord5
ord12
ord9
ord10
ord11
CompareStrings
CreateProject
GetStringHashCode
InitializeSqlLangSvc
ReleaseProject
SignalMetadata
SqlCompileText
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
AssertDa
Size
512B
Virtual Size
110B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=185, version=30716,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=228, id=1, productName=Unmarked objects,
count=6, id=158, productName=VS2010 build 30319, version=30319,
count=10, id=170, productName=VS2010 build 30319, version=30319,
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=184, version=30716,
count=17, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/sqlos.dll
- IMPHASH 0bc8dfc0b9221d71b827dbb163cd86f9
- SHA256 c8fe018e57adbb1a5328192e8e9be4a5eb15829ff5ab2713b00c6be7dca98e1e
- MD5 d5678b23d062bd0acdc4b6d9e88c9585
- SHA1 0f9ea289f11eec5b5bc8a00f70d36b84b33f8455
- SHA512 353669e3d65153425f45fcf0c63b603de96a1213aee9db824865c2a80955c465b2e382f01dc91baf8505ff8b970555cccafacc88f4fb4eb20d32bb1f75703d90
- SSDEEP 384:XkA5+yhXPVGfPPWY7W/hPapBjTeajCCcwvZQlHMv:RhXdyL+GAISm
- TLSH T15FB21982EEBCA043EC825E7012A8E9C37C3CABC32B6550EB1559F1D928927D1973457E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d3:b2:8c:72:aa:74:3f:cc:4d:52:56:1a:fb:aa:c1:51:a7:d3:46:f3:77:a0:e7:da:7c:ce:0b:e5:12:ac:d8:8d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
7c:5e:a5:37:3e:27:af:72:8a:58:3f:52:7b:29:c9:c3:e9:86:cf:25
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:19:96:00:00:00:00:00:1b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
6133
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SQLOS.pdb
msvcr100
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
memset
kernel32
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
TlsAlloc
TlsFree
CreateVersionedSOSHostObject
GetTlsSlotInfo
IsHardwareSupported
SetCreateSOSHostObjectCallback
SetDllMainCallback
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
404B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=32, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 build 30319, version=30319,
count=11, id=170, productName=VS2010 build 30319, version=30319,
count=2, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=184, version=30716,
count=1, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/sqltses.dll
- IMPHASH 22c59a5d4dc0a08dd9bb21e7123d5ba9
- SHA256 ab859a1d945cb99e2e52e218ef442234d1436f9aa9a81b76ebf85068ccdebc05
- MD5 344479af61cacc9c64bca055297afec1
- SHA1 cc5e66e6dffa8a243193a8d25424dd81c8d85eac
- SHA512 cf76823c207ccbdc298a863b123c9a84e28e3e41c796ceb55d77fdebaa0ed9f7eb5262efd39bd393cc86319d98275a485e791d3d28b2f92a8d9d69866ba946e7
- SSDEEP 98304:Pcd0ZA68mlyCINfopv58AROqst91tJ/maN6oOv58ALBU10BV:ksZOGJROqshtJ/FiJLH
- TLSH T195869E62E34BF189D4972831625FA3392034BF3FF419B5A563C6BD35DB10A23B81C95A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:fa:e6:dd:93:7a:a1:ec:d3:5f:7d:0a:9c:65:a3:9d:93:d5:30:2c:fd:bf:1a:bb:cc:ff:0e:f5:38:af:8c:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c6:84:bb:a4:57:57:f8:44:d1:1c:c4:45:99:41:27:58:69:0b:d3:d7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
68924
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
sqltses.pdb
msvcr100
__pctype_func
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_isctype_l
_initterm_e
_amsg_exit
_sprintf_s_l
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
strchr
strspn
strncpy_s
pow
_set_SSE2_enable
atan2
sqrt
qsort
log10
log
exp
sin
cos
atan
asin
acos
ceil
tan
memmove_s
free
malloc
_vsnwprintf_s_l
_snwprintf_s_l
_initterm
memset
memcpy
floor
__CxxFrameHandler3
_CIpow
_CIlog10
_CIfmod
wmemcpy_s
_wcstod_l
fmod
_snprintf_s_l
_iswspace_l
qsort_s
modf
_fpclass
memcpy_s
_statusfp
_clearfp
_fpreset
_controlfp
wcsncmp
_iswalpha_l
_wcstol_l
_iswdigit_l
memmove
_vsnwprintf_l
_wcstoul_l
bsearch
__CppXcptFilter
_purecall
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
sqldk
ord53
ord976
ord1002
ord990
ord986
ord626
ord1011
ord983
ord355
ord22
ord840
ord629
ord696
ord136
ord129
ord363
ord473
ord358
ord188
ord85
ord305
ord362
ord306
ord110
ord63
ord46
ord101
ord25
ord21
ord24
ord373
ord48
ord316
ord476
ord474
ord245
ord621
ord697
ord386
ord49
ord925
ord1019
ord1018
ord7
ord905
ord896
kernel32
IsProcessorFeaturePresent
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
TlsGetValue
IsDBCSLeadByteEx
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTimeAsFileTime
WideCharToMultiByte
GetTickCount
GetLastError
MultiByteToWideChar
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
rpcrt4
UuidCreateSequential
ole32
CLSIDFromString
StringFromGUID2
CoCreateGuid
oleaut32
SysStringLen
Name
.text
Size
4.4MB
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
AssertDa
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=185, version=30716,
count=2, id=156, version=30414,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=311, id=1, productName=Unmarked objects,
count=1, id=152, version=20115,
count=12, id=158, productName=VS2010 build 30319, version=30319,
count=11, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=184, version=30716,
count=103, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Files/xe.dll
- IMPHASH e6501edb409e29f49e6545f67c74dd4f
- SHA256 0ec09cd7d58aeb260fe82ca79ad16c353d7053a665d98f4deb26eba5e2b6e9d3
- MD5 063ca314262d277a92189028a9e094fd
- SHA1 3f8fb62d6b38ae258dbffda4d9470c78753c3814
- SHA512 0ef025c85545377d67562bef8744c0966262fd5ffe7fded4a9958ad01cab19e319b7f29fb45d4187a4930611d6b0dea0be32097cb78ae8423934080f7038193f
- SSDEEP 6144:w92cdRECvTmwWWx3t7893HQPRe/3maKQM:wYVCbm7m3F893HQsfmaKL
- TLSH T16F9409716A89C23BEDF22AB90D7C756E102DBAD61B3080CB93585BFE9A741C11E34717
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:38:ea:66:d6:52:48:7c:f2:20:d1:07:87:93:89:7d:25:c9:f6:72:04:11:0f:26:f3:d9:f3:93:56:f4:9a:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ab:d3:5a:68:e5:7a:c1:44:ad:56:ae:f2:c1:1e:73:7c:18:6a:19:2a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 11, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:1a:f5:ea:00:00:00:00:00:6a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2011 - Feb 1, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:49:55:00:00:00:00:00:0b
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:936C-7AEE-74AE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:4e:aa:00:00:00:00:00:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 15, 2011 - Mar 15, 2013
Minor OS version
1
Major OS version
6
Entry point
292800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
xe.pdb
msvcr100
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
wcschr
_iswprint_l
__pctype_func
_wfullpath
_wtoi64_l
_vsnprintf_l
memmove
_wcsicmp_l
_purecall
strncmp
wcsncmp
_strnicmp_l
_wcsnicmp_l
abort
_vsnwprintf_l
_vsnwprintf
memset
memcpy
__CxxFrameHandler3
_vsnprintf
kernel32
CreateEventW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapCompact
HeapSize
HeapReAlloc
CreateIoCompletionPort
HeapCreate
HeapDestroy
OpenFileMappingW
CreateFileMappingW
ReleaseSemaphore
CreateSemaphoreW
VirtualQuery
GetCurrentProcess
GetProcessAffinityMask
GetCurrentProcessId
GetCurrentThreadId
DebugBreak
Sleep
LoadLibraryExW
GetProcAddress
FreeLibrary
GetModuleFileNameW
GetTempPathW
SetLastError
GetLastError
DeleteFileW
WriteFile
GetOverlappedResult
FindFirstFileW
CreateFileW
FindNextFileW
GetVolumePathNameW
GetDiskFreeSpaceExW
FindClose
CloseHandle
QueryPerformanceCounter
RtlCaptureStackBackTrace
GetSystemTimeAsFileTime
GetModuleHandleW
FormatMessageW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Module32NextW
LocalFree
SetEndOfFile
SystemTimeToFileTime
SetFilePointerEx
GetDiskFreeSpaceW
GetSystemInfo
GetSystemTime
WaitForSingleObject
SetEvent
TlsSetValue
CreateThread
IsProcessorFeaturePresent
HeapFree
CreateMutexW
DeleteCriticalSection
ReleaseMutex
OpenThread
TlsGetValue
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
VirtualAlloc
VirtualFree
GetUserDefaultLCID
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
ResetEvent
MapViewOfFileEx
UnmapViewOfFile
LoadLibraryW
GetQueuedCompletionStatus
GetExitCodeThread
advapi32
EnableTrace
ControlTraceW
StartTraceW
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
QueryAllTracesW
rpcrt4
UuidCreate
shlwapi
PathRemoveFileSpecW
PathRemoveBackslashW
PathCanonicalizeW
PathFindExtensionW
PathAddExtensionW
PathFindFileNameW
PathCombineW
PathRemoveExtensionW
user32
MessageBoxW
SetAssertHandler
XEGetEngine
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
AssertDa
Size
512B
Virtual Size
465B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=156, productName=VS2010 build 30319, version=30319,
count=147, id=1, productName=Unmarked objects,
count=10, id=158, productName=VS2010 build 30319, version=30319,
count=13, id=170, productName=VS2010 build 30319, version=30319,
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=39, id=193, version=30716,
count=1, id=184, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
LICENSE.txt
- SHA256 05a229755cbf3e49aca1f80bdf485bbe86e7adfc8e1008f33a4451db5eef50fa
- MD5 a527d097525659f8320d0a8b7f2f0499
- SHA1 0bbb62481f1221f274065f2325187e939a9c0bd8
- SHA512 bdf0879e2947f06962a6ea940b46ff3e864db8b40f4571532bfa5226e9bd720152e08e1e24d5f9a46f59b0616916dc0a46aa232d669b80b25a9e4d846944b7c6
- SSDEEP 192:8JZVu+P8MXko3A8ehborIKzXdIotKlSCkk8Z8SfZn82Cb3:8JrLkoKhsrIYaotKtkzBfgb3
- TLSH T1E552AA51A3FD5618F6FB3F506EB966684E3ABCA2AD3DC65D1210004E09B6E80DD70B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Set-up.exe
- IMPHASH 7a6da7c5d1116b706b7932d3f11a50c9
- SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
- MD5 6669e10c960f6c2297bcd3d5a27412aa
- SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
- SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
- SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
- TLSH T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b5:4a:2b:77:f5:94:37:43:7c:5b:64:08:db:b0:59:cc:3d:1c:db:be:4a:3b:94:26:c5:c8:55:bf:49:e9:8a:ac
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 6, 2023
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:51:99:0a:2a:60:f6:35:67:60:00:00:00:00:04:51
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 8, 2023 - Aug 7, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d4:e4:e9:03:2f:c0:ac:69:ac:00:01:00:00:01:d4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
21472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MpDlpService.pdb
advapi32
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
RegCloseKey
GetSecurityDescriptorSacl
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
CopySid
FreeSid
CheckTokenMembership
EventUnregister
EventRegister
EventWriteTransfer
ChangeServiceConfig2W
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
NotifyServiceStatusChangeW
StartServiceW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
GetLengthSid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
OpenProcessToken
ChangeServiceConfigW
QueryServiceConfigW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
GetTokenInformation
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
kernel32
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
InitializeCriticalSectionEx
DebugBreak
GetFileAttributesW
WaitForSingleObject
GetTickCount64
OutputDebugStringW
FormatMessageW
GetProcessTimes
ProcessIdToSessionId
LoadLibraryW
GetFileInformationByHandle
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ExpandEnvironmentStringsW
QueryDosDeviceW
CreateSemaphoreExW
HeapFree
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
OpenSemaphoreW
CreateMutexExW
GetProcessHeap
CompareFileTime
lstrcmpW
DeleteFileW
FindClose
OpenProcess
SleepEx
CreateFileW
LocalFree
GetDriveTypeW
DeleteTimerQueueTimer
LCMapStringW
UnregisterWaitEx
MultiByteToWideChar
WideCharToMultiByte
FormatMessageA
GetModuleFileNameW
GetSystemDirectoryW
HeapSetInformation
CreateProcessW
CreateDirectoryW
ReadFile
FindFirstFileW
GetFileSizeEx
CreateTimerQueueTimer
FindNextFileW
WriteFile
RegisterWaitForSingleObject
SetEnvironmentVariableW
SetFilePointerEx
LoadLibraryExW
FileTimeToSystemTime
GetLocalTime
GetSystemTime
DeviceIoControl
HeapAlloc
GetFinalPathNameByHandleW
WriteConsoleW
SetEndOfFile
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
CompareStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
ExitProcess
GetStdHandle
GetCPInfo
LCMapStringEx
DecodePointer
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
SetErrorMode
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetStringTypeW
VirtualLock
mpclient
MpConfigUninitialize
MpClientUtilExportFunctions
MpFreeMemory
MpAllocMemory
MpConfigRegisterForNotifications
MpConfigGetValue
MpConfigOpen
MpConfigUnregisterNotifications
MpConfigClose
MpConfigGetValueAlloc
MpConfigSetValue
MpConfigInitialize
wtsapi32
WTSQueryUserToken
ntdll
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosError
NtQueryInformationProcess
RtlGetVersion
crypt32
CertVerifyCertificateChainPolicy
ole32
CreateBindCtx
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
rpcrt4
RpcImpersonateClient
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingInqAuthClientW
RpcStringFreeW
RpcServerRegisterAuthInfoW
RpcServerUseProtseqW
RpcRevertToSelf
RpcServerInqBindings
RpcEpRegisterW
RpcServerRegisterIfEx
RpcBindingVectorFree
RpcEpUnregister
RpcServerUnregisterIf
NdrServerCallAll
NdrServerCall2
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserW
wintrust
WTHelperGetProvSignerFromChain
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
urlmon
MkParseDisplayNameEx
Name
.text
Size
464KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
152KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=37, id=260, version=32595,
count=229, id=261, version=32595,
count=23, id=259, version=32595,
count=31, id=257, version=32595,
count=434, id=1, productName=Unmarked objects,
count=10, id=126, version=50727,
count=175, id=265, version=32595,
count=1, id=255, version=32595,
count=1, id=258, version=32595,
mpclient.dll
- IMPHASH d8b31f8c03e0c76ff245ed05a15ffe6c
- SHA256 9d435f7547926c1259d52301f8d95a28b0e39c0275a47d3b0e42cc81ef72e252
- MD5 96270f372db337520cc6538ef7426e96
- SHA1 8d67357e0995c58e24bffa1d7d0642e90ac45314
- SHA512 2ad2e9ca35209bbbc9dc58cfb02dc43f677f99ea1fa3c644f3028836d3a0c87f22df9e119d59119ac024bdc209098fc7a2923e4c49c1b49502de12c99e86740c
- SSDEEP 98304:xeqj/VL0SuL6h4iYeEddZuKCIffowPB25Ly8e5gUsk8naB:xbL0SuL6+iYbdTrHfFPM5W8OfsN
- TLSH T161A67B07BC917DA5C09DE23589A78257BBF07C68873223E31E51BAB82F72BD05975720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
16:d1:a2:45:7c:34:de:b2:42:f0:66:2b:21:80:3c:d1:80:7f:1a:f9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=dadada.dododo,O=2cUzH0PNy,L=L6raY,ST=BdEsii,C=US
Chains
Aug 6, 2026
CN=dadada.dododo,O=2cUzH0PNy,L=L6raY,ST=BdEsii,C=US
Subject
CN=dadada.dododo,O=2cUzH0PNy,L=L6raY,ST=BdEsii,C=US
Serial Number
28:c8:cd:0b:3e:cf:93:c4
Issuer
CN=dadada.dododo,O=2cUzH0PNy,L=L6raY,ST=BdEsii,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth
Timespan
Aug 12, 2026 - Aug 12, 2027
Minor OS version
1
Major OS version
6
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredContinueHandler
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
___lc_codepage_func
___mb_cur_max_func
__iob_func
_amsg_exit
_errno
_initterm
_lock
_unlock
abort
calloc
fputc
free
fwrite
localeconv
malloc
memcpy
memset
realloc
strerror
strlen
strncmp
vfprintf
wcslen
MpAllocMemory
MpClientUtilExportFunctions
MpConfigClose
MpConfigGetValue
MpConfigGetValueAlloc
MpConfigInitialize
MpConfigOpen
MpConfigRegisterForNotifications
MpConfigSetValue
MpConfigUninitialize
MpConfigUnregisterNotifications
MpFreeMemory
_cgo_dummy_export
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
346KB
Virtual Size
346KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ