Installer.zip
- SHA256 685792e9c018bf5117c86624c697e99805744c726ba51bf8a54afb9e068016ba
Overview
overview
7Static
static
3Installer/Setup.exe
windows10-2004-x64
7Installer/Setup.exe
windows11-ltsc_2024-x64
7Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
6Installer/...64.exe
windows11-ltsc_2024-x64
6Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Installer/...64.exe
windows10-2004-x64
4Installer/...64.exe
windows11-ltsc_2024-x64
4Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Installer/Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Installer/Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer/utils/HidHide_1.5.230_x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
Installer/utils/VC_redist.x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Installer/utils/VC_redist.x64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Installer.zip
- Size 357.9MB
- Sample260815-svs71adn3y
- SHA256 685792e9c018bf5117c86624c697e99805744c726ba51bf8a54afb9e068016ba
- MD5 0dd78e9ffc92732a8d5908ecd58ae842
- SHA1 6609a2e34f758df8a3a432c55ee7018f3481e616
- SHA512 4ce6cb217af74a378892a1e471f25cb5a044c7d5de3f04eabc059ad3bf7fd0df93ad0259697cdfb21a50553f1d88ba25e374785546a818ca2afe60b310b19d04
- SSDEEP 6291456:eCdjQj1Z8zu//yz4NBl+hzgfaNzR5+G8l7jqJkoEomxJzCH6A+U4o2R4Rqo48cO:eCmwQzl+qfaNz+rXkD+Jz+6A+UlgO
- TLSH T1FB0933B7924CDFEAE2422872C4797E0D47883012A5AF5467D75CCBB14B97BC325BAC84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Installer/Setup.exe
File Explorer
-
Installer.zip.zip 357.9MB
-
Installer/Setup.exe.exe 128.2MB
-
Installer/utils/HidHide_1.5.230_x64.exe.exe 7.7MB
-
Installer/utils/VC_redist.x64.exe.exe 24.4MB
-
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe.exe 6.0MB
-
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe.exe 214.8MB
-
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe.exe 55.8MB
Installer/Setup.exe
- IMPHASH 8addd127e62f99608158da990ad94d74
- SHA256 9e25e843112fd3ea66778c951880a57d523a96311af3e9dc7449ac4707b86b16
- MD5 6c6bbf0774af7a1f0d827f6a4d891279
- SHA1 f27b91be3a510c805fec19dc4d140029c4780616
- SHA512 2780e45cffd4d5e2ea055b747751ebd0d61025e08a88f02f3f7df2aa2d96318d0c21d0d673d900b5418b0ea563d882d3bb6c7e39f804e0543d4befc0c4b186ab
- SSDEEP 786432:0bAJS0EvC8Tz/rNSBwRvJ4Rp4+asz0SCfwOsHZ4vxXAE8mYEOb:0bAc0Evlvv6eKif4MPYLb
- TLSH T13658AE14B3E80A15E67F827DCA738112EAB1B8531321C1CF1499DA4D2FA3BD19A76377
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6225488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb
kernel32
RaiseException
FreeLibrary
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocateXStateFeature
AddVectoredExceptionHandler
MultiByteToWideChar
GetTickCount
FlushInstructionCache
QueryPerformanceFrequency
QueryPerformanceCounter
RtlLookupFunctionEntry
RtlDeleteFunctionTable
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
GetTickCount64
DuplicateHandle
VerSetConditionMask
VerifyVersionInfoW
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
GetCurrentThreadId
TlsAlloc
GetCurrentThread
CreateThread
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
WriteFile
GetStdHandle
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetCurrentProcessId
InterlockedPopEntrySList
GetModuleHandleW
ExitProcess
Sleep
CreateMemoryResourceNotification
VirtualAlloc
VirtualFree
VirtualProtect
SleepEx
SwitchToThread
SuspendThread
ResumeThread
InitializeContext
SetXStateFeaturesMask
RtlRestoreContext
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ReadFile
GetFileSize
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
SetEvent
ResetEvent
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
CopyContext
WerRegisterRuntimeExceptionModule
RtlInstallFunctionTableCallback
GetSystemDefaultLCID
GetUserDefaultLCID
RtlUnwind
GetCurrentProcessorNumberEx
FreeEnvironmentStringsW
GetActiveProcessorGroupCount
GetSystemTimeAsFileTime
GetSystemTime
GetEnvironmentStringsW
CloseHandle
RemoveDirectoryW
CreateActCtxW
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
LoadLibraryExW
LoadLibraryExA
GetACP
LCMapStringEx
FormatMessageW
LocalFree
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
GetThreadGroupAffinity
GetProcessGroupAffinity
GetProcessAffinityMask
QueryInformationJobObject
HeapAlloc
HeapFree
CreateFileMappingW
HeapCreate
GetProcessHeap
HeapDestroy
SetConsoleCtrlHandler
FlsAlloc
FlsSetValue
FlsGetValue
GetLocaleInfoEx
GetUserDefaultLocaleName
GetModuleFileNameW
CreateFileW
GetFileAttributesExW
GetFullPathNameW
CreateProcessW
GetCPInfo
RtlAddFunctionTable
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
OpenEventW
ReleaseMutex
ExitThread
CreateMutexW
HeapReAlloc
CreateSemaphoreExW
ReleaseSemaphore
OutputDebugStringA
SetFilePointer
MapViewOfFile
QueryThreadCycleTime
GetStringTypeW
TlsSetValue
TlsGetValue
GetSystemInfo
GetCurrentProcess
OutputDebugStringW
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
GetProcAddress
GetModuleHandleExW
SetThreadErrorMode
FlushProcessWriteBuffers
SetLastError
DebugBreak
WaitForSingleObject
InitializeCriticalSectionEx
DecodePointer
GetFileSizeEx
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
GetTempPathW
FindClose
GetConsoleMode
LoadLibraryA
GetCurrentDirectoryW
WriteConsoleW
IsWow64Process
CreateFileMappingA
GetNumaHighestNodeNumber
GetLastError
CreateDirectoryW
WideCharToMultiByte
GetExitCodeThread
TryAcquireSRWLockExclusive
TlsFree
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
RtlVirtualUnwind
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalMemoryStatusEx
GetLogicalProcessorInformation
K32GetProcessMemoryInfo
IsProcessInJob
GetLargePageMinimum
SetThreadAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
advapi32
LookupPrivilegeValueW
RegGetValueW
SetKernelObjectSecurity
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
EventRegister
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
AdjustTokenPrivileges
ole32
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoRevokeInitializeSpy
CoGetContextToken
CoGetObjectContext
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CLSIDFromProgID
CoTaskMemFree
CoReleaseMarshalData
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoGetClassObject
oleaut32
SysAllocString
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayDestroy
QueryPathOfRegTypeLi
SysStringLen
SafeArrayGetVartype
VariantChangeType
CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
LoadTypeLibEx
SysStringByteLen
SafeArrayGetElemsize
SafeArrayAllocData
SafeArraySetRecordInfo
SysFreeString
GetRecordInfoFromTypeInfo
GetErrorInfo
SetErrorInfo
VariantClear
VariantInit
SafeArrayAllocDescriptorEx
VarCyFromDec
user32
LoadStringW
MessageBoxW
shell32
ShellExecuteW
api-ms-win-crt-string-l1-1-0
strncpy
_strnicmp
_stricmp
isspace
wcscat_s
towupper
iswascii
isupper
iswspace
strnlen
_wcsdup
isdigit
wcsnlen
islower
isalpha
towlower
strtok_s
wcsncat_s
strncat_s
strcmp
__strncnt
_wcsnicmp
strlen
wcscpy_s
wcsncpy_s
_wcsicmp
strcpy_s
strcat_s
toupper
tolower
wcsncmp
strncmp
iswupper
_strdup
strncpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__stdio_common_vsscanf
__acrt_iob_func
_set_fmode
__stdio_common_vswprintf
fflush
__stdio_common_vfprintf
ftell
fseek
_setmode
_dup
_fileno
_flushall
__stdio_common_vsnprintf_s
fputs
__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fgets
fgetc
fputc
_wfsopen
__p__commode
fputwc
_wfopen
fwrite
fopen
__stdio_common_vsprintf_s
fclose
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_beginthreadex
terminate
_wcserror_s
abort
_errno
exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_controlfp_s
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo
api-ms-win-crt-convert-l1-1-0
_atoi64
strtoul
atol
wcstoul
_wtoi
strtoull
_wcstoui64
_ltow_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_aligned_malloc
realloc
free
calloc
_aligned_free
malloc
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
acoshf
modf
atanh
acosh
cbrt
asinh
atanhf
tanhf
_fdopen
acos
acosf
asin
copysign
copysignf
ilogbf
trunc
truncf
asinf
atan
modff
atan2f
atanf
ceil
asinhf
ceilf
cos
cosf
cosh
coshf
exp
expf
floor
floorf
fma
fmaf
fmod
fmodf
log
log10
log10f
log2
__setusermatherr
log2f
logf
pow
powf
roundf
sin
sinf
sinhf
cbrtf
sqrt
sqrtf
atan2
tan
round
tanf
tanh
sinh
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_unlock_file
_wremove
_lock_file
api-ms-win-crt-locale-l1-1-0
_lock_locales
_unlock_locales
setlocale
__pctype_func
___lc_locale_name_func
___lc_codepage_func
___mb_cur_max_func
_create_locale
_free_locale
_configthreadlocale
CLRJitAttachState
DotNetRuntimeContractDescriptor
DotNetRuntimeInfo
MetaDataGetDispenser
g_CLREngineMetrics
g_dacTable
Name
.text
Size
6.3MB
Virtual Size
6.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
215B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=36, id=260, version=34810,
count=10, id=259, version=34321,
count=18, id=260, version=34321,
count=102, id=261, version=34321,
count=8, id=260, version=33140,
count=13, id=257, version=33140,
count=518, id=1, productName=Unmarked objects,
count=20, id=259, version=34810,
count=597, id=265, version=34810,
count=1, id=256, version=34810,
count=1, id=255, version=34810,
count=1, id=258, version=34810,
Installer/utils/HidHide_1.5.230_x64.exe
- IMPHASH 36aca8edddb161c588fcf5afdc1ad9fa
- SHA256 f4bbbcb82e6258641b887c74bc81c4c5f66e4aa811808dfc304347687b7605f6
- MD5 705173711090d36275d62ca7b111bfc3
- SHA1 f7de49272cbd8a8912f511c3a11471be05b44e2a
- SHA512 d535b8a7ad3d72c2e9b602c59b68ca265c41d500294a7d56d94d8c188277f7f69b8526f5c9a57af3f5bceec18560cb3622aa767e4571c724a299733e78c1f1bc
- SSDEEP 196608:fWFsTuRN2zahf1Y7EcnGf7a+JJIlAmnVTvQf2bu:OFsTuRN2zsmEzRJJPm2ebu
- TLSH T19286D030765EC52AD56205F0592CAB9B911CAE3D0B61E4C7B3CC6D6F2B744CB0636E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:29:14:99:ad:26:d8:a5:8a:38:39:3e:21:6a:b5:e9:e8:71:de:c2:58:64:b5:c3:b0:95:6d:37:bb:26:bd:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
Chains
May 12, 2024
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
Serial Number
0e:2c:47:7d:f0:b6:73:84:ef:24:19:39:05:f8:3b:fd
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 13, 2023 - Feb 16, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
2146720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
kernel32
WriteFile
DeleteFileW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateEventExW
WaitForSingleObject
CreateProcessW
GetLastError
GetExitCodeProcess
SetEvent
RemoveDirectoryW
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
CreateDirectoryW
GetTempPathW
GetTempFileNameW
MoveFileW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
RaiseException
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
CreateEventW
FindClose
FindFirstFileW
GetFullPathNameW
InitializeCriticalSection
lstrcpynW
CreateThread
LoadLibraryExW
GetCurrentProcess
Sleep
WideCharToMultiByte
GetDiskFreeSpaceExW
DecodePointer
GetExitCodeThread
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryW
lstrlenW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpiW
LoadLibraryW
GetDriveTypeW
CompareStringW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
GetShortPathNameW
GetFinalPathNameByHandleW
SetFileAttributesW
GetFileTime
CopyFileW
ReadFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
MultiByteToWideChar
GetSystemInfo
WaitForMultipleObjects
GetVersionExW
CreateSemaphoreW
ReleaseSemaphore
GlobalMemoryStatus
GetModuleHandleA
GetProcessAffinityMask
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
LocalFree
LocalAlloc
SetUnhandledExceptionFilter
FileTimeToSystemTime
GetEnvironmentVariableW
GetSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetEnvironmentStringsW
InitializeCriticalSectionEx
CloseHandle
GetModuleFileNameA
GetCurrentThread
GetConsoleOutputCP
FlushFileBuffers
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringW
GetTickCount
GetCommandLineW
SetCurrentDirectoryW
SetEndOfFile
EnumResourceLanguagesW
GetSystemDefaultLangID
GetUserDefaultLangID
GetLocalTime
ResetEvent
GlobalFree
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CompareFileTime
CopyFileExW
OpenEventW
PeekNamedPipe
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetFileType
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
WriteConsoleW
LoadLibraryA
CreateFileW
imagehlp
SymGetModuleBase
SymFunctionTableAccess
SymGetLineFromAddr
SymSetSearchPath
SymCleanup
SymInitialize
SymSetOptions
StackWalk
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
718KB
Virtual Size
717KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=187, id=261, version=29395,
count=1, id=262, version=29395,
count=20, id=260, version=33030,
count=25, id=259, version=33030,
count=109, id=261, version=33030,
count=12, id=259, version=29395,
count=27, id=260, version=29395,
count=9, id=257, version=29395,
count=1, id=263, version=29395,
count=738, id=1, productName=Unmarked objects,
count=388, id=265, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Installer/utils/VC_redist.x64.exe
- IMPHASH e277f1464e7729ad9df5ec047611738a
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:62:10:49:14:17:51:9e:9c:73:fb:fd:ea:34:29:32:27:5d:b9:88:20:0e:c9:2b:38:f9:0e:0a:f5:28:65:40
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 11, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
197349
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetFileType
GetStdHandle
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
CreateFileW
CloseHandle
ExitProcess
CreateFileA
SetFilePointer
WriteFile
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
lstrlenA
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
FormatMessageW
lstrlenW
MultiByteToWideChar
IsValidCodePage
LCMapStringW
ExpandEnvironmentStringsW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
SetFileTime
Sleep
GlobalAlloc
GlobalFree
CopyFileW
GetLocalTime
GetModuleFileNameW
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
FindFirstFileExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetSystemWow64DirectoryW
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
GetStartupInfoW
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetCurrentThreadId
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
GetTimeZoneInformation
rpcrt4
UuidCreate
Name
.text
Size
307KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=28900,
count=145, id=261, version=28900,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=44, id=261, version=26706,
count=23, id=260, version=28900,
count=2, id=262, version=28900,
count=17, id=257, version=28900,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
Installer/utils/ViGEmBus_1.22.0_x64_x86_arm64.exe
- IMPHASH 608505ff1e7e27ff4a42ea9c4e9f4192
- SHA256 89220a7865076b342892f98865f3499fb7c4cfd673159e89d352c360fd014c6a
- MD5 a62717e3e4306de1dca4fb5c2fa0ac6c
- SHA1 5ec1b1077b43e82c2d3712909c7ed80dd59504dd
- SHA512 960b2cf7d3e301fc8a260ed49a136ffe8c1e30406a4eb64b7ceeaf7f56f33bbb5153825670258a2e254d3dbdb09c0f0f4abffcbb70395416f213a0e2b8061366
- SSDEEP 98304:shxzP3MqBfTluw4yctnfZeos/9/5oe3UOv2NkHLcgpn78NpoEXBhLlvRJSvr0/Pr:s/PdfTUHNY/5oe3UdNWVx78NpBXBhETS
- TLSH T1E756AE31724AC53BD96211B11A2C9E9F612CBE350BB254C7B3DC2E6E1BB54C21736E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
98:58:f5:2c:c6:45:c8:49:e3:93:8f:00:68:6c:50:c2:64:cc:59:49:a1:d9:ec:ed:35:70:ce:29:a3:34:e8:83
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
Chains
Nov 2, 2023
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=505039f,CN=Nefarius Software Solutions e.U.,O=Nefarius Software Solutions e.U.,L=Wels,C=AT,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130457656c73,1.3.6.1.4.1.311.60.2.1.2=#0c0f4f626572c3b6737465727265696368,1.3.6.1.4.1.311.60.2.1.3=#13024154
Serial Number
0e:2c:47:7d:f0:b6:73:84:ef:24:19:39:05:f8:3b:fd
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 13, 2023 - Feb 16, 2025
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
2031622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
kernel32
CreateFileW
CloseHandle
WriteFile
DeleteFileW
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CreateEventExW
WaitForSingleObject
CreateProcessW
GetLastError
GetExitCodeProcess
SetEvent
RemoveDirectoryW
GetProcAddress
GetModuleHandleW
GetWindowsDirectoryW
CreateDirectoryW
GetTempPathW
GetTempFileNameW
MoveFileW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
RaiseException
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
CreateEventW
FindClose
FindFirstFileW
GetFullPathNameW
InitializeCriticalSection
lstrcpynW
CreateThread
LoadLibraryExW
GetCurrentProcess
Sleep
WideCharToMultiByte
GetDiskFreeSpaceExW
DecodePointer
GetExitCodeThread
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryW
lstrlenW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpiW
LoadLibraryW
GetDriveTypeW
CompareStringW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
GetFileAttributesW
GetShortPathNameW
GetFinalPathNameByHandleW
SetFileAttributesW
GetFileTime
CopyFileW
ReadFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
MultiByteToWideChar
GetSystemInfo
WaitForMultipleObjects
GetVersionExW
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
LocalFree
LocalAlloc
SetUnhandledExceptionFilter
FileTimeToSystemTime
GetEnvironmentVariableW
GetSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetEnvironmentStringsW
InitializeCriticalSectionEx
LoadLibraryA
GetModuleFileNameA
GetCurrentThread
GetConsoleOutputCP
FlushFileBuffers
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
SetConsoleTextAttribute
GetStdHandle
GetConsoleScreenBufferInfo
OutputDebugStringW
GetTickCount
GetCommandLineW
SetCurrentDirectoryW
SetEndOfFile
EnumResourceLanguagesW
GetSystemDefaultLangID
GetUserDefaultLangID
GetLocalTime
ResetEvent
GlobalFree
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
CreateNamedPipeW
ConnectNamedPipe
TerminateThread
CompareFileTime
CopyFileExW
OpenEventW
PeekNamedPipe
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetSystemTimeAsFileTime
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetFileType
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
WriteConsoleW
GetProcessAffinityMask
GetModuleHandleA
GlobalMemoryStatus
ReleaseSemaphore
CreateSemaphoreW
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
689KB
Virtual Size
689KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=29395,
count=187, id=261, version=29395,
count=1, id=262, version=29395,
count=19, id=260, version=32533,
count=25, id=259, version=32533,
count=109, id=261, version=32533,
count=26, id=260, version=29395,
count=3, id=257, version=29395,
count=1, id=263, version=29395,
count=746, id=1, productName=Unmarked objects,
count=383, id=265, version=32824,
count=1, id=255, version=32824,
count=1, id=151,
count=1, id=258, version=32824,
Installer/utils/dotnet-sdk-9.0.301-win-x64.exe
- IMPHASH 15c8c157ab5b8b7133c4a38e5957e81c
- SHA256 3eceab630f7523658aea4c47463ed6b105b06b9061c89bd00bfca3378ac166e3
- MD5 f3ed2970b82174f290e9dee9003c65bb
- SHA1 537ab56543c559e520f61f231d8ac8e265765677
- SHA512 2a7a1d35ebe1c6911037ba36ecd041b16401985bf00d19280fae5d0780bd9fc3a69186b77e7a204bd51f07ac22dbd898f99adda56dbe8f89a8d42819763a4c55
- SSDEEP 6291456:Nrg+NNjgVo+RDoTS0uoo9LqkRESOe2ExmmH:bJgV1DoTS08ZmLGmmH
- TLSH T1B7B83337AA2CDFB6E6C12872D478371D1B0C3111560AD46BD3C8DAB62A87AD325B3DD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:c6:7e:39:dd:4e:8b:98:46:47:85:ac:fa:98:24:4a:a1:6a:ad:db:59:1b:4b:9d:1f:f0:34:37:b6:40:2a:db
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 19, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:05:3c:75:6c:82:44:87:cd:fe:00:01:00:00:02:05
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
197963
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
D:\a\_work\1\s\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetFileType
GetStdHandle
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
CreateFileW
CloseHandle
ExitProcess
CreateFileA
SetFilePointer
WriteFile
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
lstrlenA
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
FormatMessageW
lstrlenW
MultiByteToWideChar
IsValidCodePage
LCMapStringW
ExpandEnvironmentStringsW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
SetFileTime
Sleep
GlobalAlloc
GlobalFree
CopyFileW
GetLocalTime
GetModuleFileNameW
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
FindFirstFileExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetSystemWow64DirectoryW
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
GetStartupInfoW
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetCurrentThreadId
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
GetTimeZoneInformation
rpcrt4
UuidCreate
Name
.text
Size
296KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26213,
count=143, id=261, version=26213,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=43, id=261, version=26706,
count=21, id=260, version=26213,
count=2, id=262, version=26213,
count=17, id=257, version=26213,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,
Installer/utils/windowsdesktop-runtime-8.0.3-win-x64.exe
- IMPHASH e277f1464e7729ad9df5ec047611738a
- SHA256 4c41b24b8ca6c188abd126b09f16903c8902113b7a2763c32906f52a83b30aa4
- MD5 f40b9f69c37efb31447cacc8b8123565
- SHA1 98df32bf470edf3cf78d1cb72bea5d5eeaaaa948
- SHA512 f4cf0300eb4e1750b75a9d973db2d100cd8fb244ef0c7bc5ab448dcc72091055c516d7fe6ea41215bdccec13fc08c5b3c444400c74b214af7f996e5780275f08
- SSDEEP 1572864:2TMRsTq/Mxu8+MjFgbOa0BW1mY5w4Hhb:ISj/Mx5+O2aa02PFBb
- TLSH T112D7337390958739E1E00173B57DFB252D38703853928456F3C8DD64AFA9A83BB3BA52
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:5d:76:c3:0c:1e:b3:01:bf:c1:6b:9c:24:a9:12:3c:52:8c:2b:61:10:c5:c4:cb:bb:7e:a5:5b:0f:c0:6e:c9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 16, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e6:d9:42:9e:ea:00:f8:7d:e1:00:01:00:00:01:e6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
197143
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
C:\agent\_work\35\s\wix\build\ship\x86\burn.pdb
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
GetUserNameW
CloseEventLog
OpenEventLogW
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CreateWellKnownSid
InitializeAcl
DecryptFileW
SetEntriesInAclW
ChangeServiceConfigW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
SetNamedSecurityInfoW
CheckTokenMembership
AllocateAndInitializeSid
SetEntriesInAclA
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
QueryServiceConfigW
user32
PeekMessageW
PostMessageW
IsWindow
WaitForInputIdle
PostQuitMessage
GetMessageW
TranslateMessage
MsgWaitForMultipleObjects
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
IsDialogMessageW
LoadCursorW
LoadBitmapW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
DispatchMessageW
oleaut32
VariantInit
SysAllocString
VariantClear
SysFreeString
gdi32
DeleteDC
DeleteObject
SelectObject
StretchBlt
GetObjectW
CreateCompatibleDC
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeEx
CoInitialize
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CLSIDFromProgID
kernel32
GetFileType
GetStdHandle
EncodePointer
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
CreateFileW
CloseHandle
ExitProcess
CreateFileA
SetFilePointer
WriteFile
GetLastError
GetCurrentProcessId
GetSystemDirectoryW
LoadLibraryW
lstrlenA
HeapSetInformation
GetModuleHandleW
GetProcAddress
LocalFree
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
FormatMessageW
lstrlenW
MultiByteToWideChar
IsValidCodePage
LCMapStringW
ExpandEnvironmentStringsW
GetFileSizeEx
GetFullPathNameW
ReadFile
SetFilePointerEx
SetFileTime
Sleep
GlobalAlloc
GlobalFree
CopyFileW
GetLocalTime
GetModuleFileNameW
CompareStringW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
GetCurrentProcess
FindFirstFileExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateProcessW
GetVersionExW
VerSetConditionMask
GetVolumePathNameW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetWindowsDirectoryW
GetNativeSystemInfo
GetSystemWow64DirectoryW
GetModuleHandleExW
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
DuplicateHandle
LoadLibraryExW
CreateEventW
ProcessIdToSessionId
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
WaitForSingleObject
GetProcessId
OpenProcess
CreateThread
GetExitCodeThread
SetEvent
WaitForMultipleObjects
LocalFileTimeToFileTime
SetEndOfFile
ResetEvent
DosDateTimeToFileTime
CompareStringA
GetExitCodeProcess
SetThreadExecutionState
CopyFileExW
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetThreadLocale
GetStartupInfoW
IsDebuggerPresent
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetCurrentThreadId
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
GetTimeZoneInformation
rpcrt4
UuidCreate
Name
.text
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=28900,
count=145, id=261, version=28900,
count=19, id=260, version=26706,
count=19, id=259, version=26706,
count=44, id=261, version=26706,
count=23, id=260, version=28900,
count=2, id=262, version=28900,
count=17, id=257, version=28900,
count=334, id=1, productName=Unmarked objects,
count=75, id=261, version=27051,
count=1, id=255, version=27051,
count=2, id=151,
count=1, id=258, version=27051,