Install-KAMI 2-GooglePlayGames[.]exe

resource
unpack001/brandedinstallerlib.dll
unpack001/brandedinstallerlib.protos.dll
unpack001/costura.dll
unpack001/crashreport.dll
unpack001/feedback.dll
unpack001/gateway.dll
unpack001/installerphenotype.dll
unpack001/installertools.dll
unpack001/ipc.dll
unpack001/metrics.dll
unpack001/metrics.protos.dll
unpack001/microsoft.windowsapicodepack.dll
unpack001/microsoft.windowsapicodepack.shell.dll
unpack001/microsoft.windowsapicodepack.shellextensions.dll
unpack001/observables.dll
unpack001/omahainteg.dll
unpack001/protobufutils.dll
unpack001/shared.protos.dll
unpack001/utils.dll
unpack001/wpfutils.dll

Install-KAMI 2-GooglePlayGames.exe

SHA256 db8097320abffaad7b97569c84f173f182ee350002dc5a98ef8b6762f1a92030
MD5 3a5a513b16589223b65c1e778038e521
SHA1 ceebcd8e567cc342439c352afdc8f374e5c0f258
SHA512 e59f04cb3be470d8474ae7509c3c1f43f48ff5410eb483fc71a2266a43bf84163d4e65cf5024a06015c001d2658f17ed69275ef2faef72ac25631749efd80180
SSDEEP 393216:QVUj4kSMiohxJdVJiuDygSULgjBR2QCPLKsq+YpWhTlilBS+y161FdDEbBLhVACb:QVqvn+uWgLpX16JoY0wDzK
TLSH
T12A97DF13BA9190BCC49BC031E27F53355E327C964F319ADF4194AA182F79BE02B39769
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

82:c8:59:9b:2c:a5:b2:a6:24:cc:b3:25:92:06:fb:7f:d3:3a:85:1e:d4:28:34:41:fd:5c:a2:0e:99:74:8a:07

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 20, 2026

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Subject

CN=Dummy certificate

Serial Number

01

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

T:\src\piper\google3\play\games\battlestar\installer\ProdBrandedInstaller\obj\x64\Release\net48\ProdBrandedInstaller.pdb

brandedinstallerlib.dll

SHA256 7eb1699a7bb7817e94b87ff86feeb8c8fa3d8d0675b826ded607f6c47ff81e17
MD5 d2b9b24f41ca47f4eae7ccdf63bd2683
SHA1 4de0f696058e03aab2b7d874e536747b99fd1f40
SHA512 d61860c556c0117feb0f5f3cacd2f6e3f92bd5c96c8ab5dfae7fd49809a9cd61946313a5000c7eceeb3b3401119832e2a93f9120750e6bbc2841b7bcf3a65442
SSDEEP 49152:fEMYkSoYItIYIrsYezWY3BsYq9DYY9WYkIfYw74zhDkakXzEMvbxtXKciDT8+ey1:fvN
TLSH
T1FB752A41ABFD0A29F5F3AB35BD7A75314976BC20AE12D26E1508034D29B1B64CDB1B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

brandedinstallerlib.pdb

SHA256 e886c0dd86abee1d44de71a2c72b6ffe0f7d16a9b4d28ec553cb5035aae69bb3
MD5 f9479e2493aff50e2ba724bfee964e91
SHA1 976ee4ad02234be781abe5256d107a959059d068
SHA512 30f93b787127c648d1db108a6ac5e895b692af7e511bf19a8533f57e838c3a66cc9b4da64264e04f675b7f8637833bfffd148edf0b6655c975f66b4f9145a23f
SSDEEP 768:tPDst4jcB7U5L91E0RCiexV2tFJBa59JRGLVHkoFayxHsT6AU6lSvjAt6gvo0J93:tbstNB7cJ1Pd85JGmoFBxHi6mIlKoC
TLSH
T1A4432B2BE3544636C411153A256F835A2BBCC210B7056B3BB2E7BB24FCAE75E0E73161
MD5 SHA1 SHA512 SSDEEP TLSH

brandedinstallerlib.protos.dll

SHA256 1fc04b47fabed7367251c96e60459279d9e0298dfa2dc1dfd3a1d31146732936
MD5 5eaec8089dd680b28087ebcbf9035bbb
SHA1 4520b49a3e7fd6eefac924bfebbf88a6e6ad3ad9
SHA512 2e4fa7d24ed976a7e2015dd4d6aba17172fdaeaf97f0629d8a154d22d24b185b56a22ef528345f6bd1f84cee76b4ac740b14cb1fcdce242a6f5f81df27e0f794
SSDEEP 1536:laJRQXvW8/70DVJQe5oOEHJ0VK2x7j8jgH/nBLh3+FO0bj1HLLFOG7GbIUQHhF:lQQ/WK7+JV5oOEHJ4r/WgfBuOgpGQHz
TLSH
T1A2D32B14ECED6639E7AF9B38F8C8249D8FB4A2173100EABB495066A74D07740DE4217F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

BrandedInstallerLib.Protos\obj\x64\Release\net48\BrandedInstallerLib.Protos.pdb

brandedinstallerlib.protos.pdb

SHA256 96026578f0cf8f15ec4b94db18d7904f895b2642334b35e25f731fa37961d46d
MD5 d324a3c41eeaa31960b4e20d5c148bc0
SHA1 daf6ce39279e83153a44e871ac265f385b967aa0
SHA512 7e771161950763f03dc55ac28972d48075ef3a47d20e28cb82ff2123df2de8d1c7b0a98d571f2d8a7d050f4564b33fb4bf15f9395dea97d260860c9da14422c9
SSDEEP 768:Mh3cvZ8Mb3TgDJCGnWRGLVHko01hX/ktW52grHJG8PlEKHoAIPNV:MavZfb3EBnUGmo0GjAH/pHUV
TLSH
T1AB3361E7DA694A3DC401213D297943371B7F04065B058F6797A8F2B8AC997390B2FEB4
MD5 SHA1 SHA512 SSDEEP TLSH

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7fa146704d6681e2280fc34535239b03f6fcbae46e2af191702f43894ac286cb
MD5 3a79254089a401e72ae63232f05da838
SHA1 1e776d573062d1c9c757a8781ddce5bda78f62b7
SHA512 63fa42945139f421ce4079e0aa6c7c17ba9667449b1b2693ce5b0ea4c493b407b162728f7f292466907a9e172cff724c67180b4d27e91266b667da7441cc8bd0
SSDEEP 48:6I+lni2qJfjVRPGwzC94MhTN0v5ETrj2H4CAWk1qyFVqZ2IbS4S:yg7KS5EKYtWpZ2VB
TLSH
T1B4919610C7A8477BE9BB4BB66CA313494275FA51DD37DB1F1A8162161C123140A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\195354\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 4baa725d931b974ee5756d839085cce8736e1f99d405529f825ffa2d6770f2d4
MD5 bd588e0bff281d077d8da9122307adfb
SHA1 9d79504de51e115db26ed0175610fef704182cdd
SHA512 b510c635838383f69b22e4eb93de8f93871b12eac6bc5e113bcc4c02a8c6dbbd35417eb3205a17e139825777b2ac4e21715693c6e96b799d59ec50e25d3fa2bb
TLSH
T1F35173776F44C691ED9881B25013D648363046127612EE7AE6E12705CCBFDF8077297B
MD5 SHA1 SHA512 TLSH

crashreport.dll

SHA256 a6fb4795d9201077a39db261fec598a30282a3453160e0bf355bee10fc566265
MD5 0a1514129d809347327c96c35d68a8b1
SHA1 a21430d7a7c1ee27e64254b1a697af7e09add1dc
SHA512 ffcf1df7dd6883d50405bffddd0741c855c57c1ffeb97410bd9bf4968f8933723f85c013b7a88c1f4ace4e42eafb166586a1d2d332e2b5bf2b0afd887e312a0b
SSDEEP 192:sAjLdvwErhhMdJ1AokAHP5jvLSLIfq0Lmo+x4blghNawQx5lwXWPMm8iwt3y6Wlw:sb8h+J1AIxi0Co4dd6f1PB6Wlhd/kS
TLSH
T18252D615A3E85616F5FF0F35AC7225010A36FD865873E72E265442DE6C33B848A7272B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

CrashReport\obj\x64\Release\net48\CrashReport.pdb

crashreport.pdb

SHA256 7cc8701e6cae10dbe23088787cb8006ebe7f6fb7c738d706267ab65aa159cbb7
MD5 ef7f1375c77a7a36ee549f3c5c280e10
SHA1 14c50083d59ab41adf656f53b9576bc590d8cc38
SHA512 f971daaddced515c66fd02baef4a9db06d4f3d9d5710a43c29ffc1cca4a73227b0be2b1469a642e0e110e1ebe42566179dc7b6e7b867658e0fa32f48e9420e9a
SSDEEP 192:ijj6KlNXrmMnTnkFN1J9Hp9Cld+hPTaNrjLOMv+cNiMiu/iwI0WH7OwcflC3qZFI:CmoTQNVHp9CX+hPTaNrjLOMv+eiMiPHV
TLSH
T187220977A788D621C56216765921C08F3ABC46102B59BF3EF1F43D18ECAFB4B03B2265
MD5 SHA1 SHA512 SSDEEP TLSH

feedback.dll

SHA256 9bacaff2610c68b3ada87d639b817769428ba4fac7b275bd9d512e43c832832f
MD5 8126a51338a44033341fae802e1de321
SHA1 6e9bc76d3708c7e75c95c678571504ba4b325906
SHA512 d7445f4f36d04228a2f95a0482b64fb4716cee8c856e7d6889fc77a522cdc13ced5464daa5ce9aeb167409e1b0c1b2cbfb74206e726c913dc145bcbe5f087236
SSDEEP 6144:sfETQRaqfEc/rOax74KFjlqEfdrC5PMi2/gHvfv0x2ahLwrdMLSjFoTL7uXW6Vsl:sfdJlLcjF1rsT5JLrqe
TLSH
T173A4C70193F8472AF4B39BB6BDB75395163ABD22E932C35E0844566E2C51FD44F22B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

feedback.pdb

SHA256 81d8bc4c56071204e20a0545e97608bf6cda2eb9dcf026fa45869e025519b051
MD5 072842b0cf88b618e332d4fafd73cd31
SHA1 0e738cb5338f9c77e1a88a9ddfafea20f39383b7
SHA512 fa9fafe8a342ca269e84987a26a26e61df963f8e4c19e42f30a70333dbc197fbed361a0e2e9467f8b383f56ef161fe7756f914bdabad6a18e11379d485e2943c
SSDEEP 384:IgiqUpQn9jF7bymdTW/FU+ITe+6iPJHp9Cwz+hPTaNrjLOMv+eiMiPH0WH7Owcff:Igb+Qnf7bymdTgFUvTeVY9JRGLVHkoTs
TLSH
T18FB2A477934C8721C5260576542A839B3F7D86506709BF3AF1A4BE20FCAF75B1BB21A0
MD5 SHA1 SHA512 SSDEEP TLSH

gateway.dll

SHA256 9deadfaa199ff5fb76661948d4ac5e623a982907ef3630a025a5a1acf8c4eae1
MD5 dd6c7fc935fa61c3bf7658e8dc798cb6
SHA1 b78064efd11bbdd02a00b6f4b89e458e08b7fa15
SHA512 dc87130173353ba77bc7104afe8b1daec6cc0a84be84e0e576d0ddd089d6909a12f2ec1ef5b67f742df13e98fd35d1aebb24b3a154eae45b53e6db974d5b867f
SSDEEP 6144:VQlGorIR5iNc9QpiZDKvbNyGXiLAAt6N13A1:WlG2gkNc9QpiZDncisAY
TLSH
T11B84E51C2DEE613CE69F9B32A8F568548B7CF3A335099B6F0A416A970C43741ED411BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Gateway\obj\x64\Release\net48\Gateway.pdb

gateway.pdb

SHA256 a7c7ca36bcd66d7efc98c8f8aadeee51a82e36a5207f66bddccd9464d653f545
MD5 f28ee20e17a011b5828defe626474b9f
SHA1 0ad3326fd06f54dffe031ef5db520b191901d927
SHA512 31af10bc9875e419e9c336293ec491c1ffaf2b8e847945c4075cc56cd9f1d42e7bb4bd2b9c23e9032a0f9436c9b5c53832b12fc0364875711bd02553b995dcd5
SSDEEP 1536:HJl2woZw7tYFOxn7b2KQuWEzuY7g4y6bJU6UGmoYMCbk/70xHlnnxi9/TItroupN:pwk57bdQuFzuYfUcyS70xHVxi9/J7wBj
TLSH
T158D385AACDD8813DC461213F39BD83625B79040A97454B1797DCF2B8ADDA7B8021F7B8
MD5 SHA1 SHA512 SSDEEP TLSH

google.protobuf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b1b4190ce28b3bb4c6e7b96e7cf2f64195cf919a2756ab9f7a688bb3dc726aa
MD5 a6b9e35811777dfa3f4d84b1d31c8d22
SHA1 eeea4b1fc42483f422db7830fe1194a4a4c2de90
SHA512 cb120bdd7ae347875a230b0404f599d34f53ccd5747735ece0899ee6315f2022aae9973bb15438f1a2888e0f5ff263e2d6ad26c14920bdff491e97cd0a34f5c6
SSDEEP 6144:y9W2BJlrusq+60xm5zB5LEbbXtS6c4vPySuCjM9N+9zD2oLqyaLgi7EIqObK0qH:mWMqt0xrYSu2M9N+9fzmL6Bq2H
TLSH
T1B0B44B2826EC4128E6AF5B31F9E0A825F6FDF517711CE76E605062F98983B10FE41277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8d:44:6f:7d:3a:7b:08:25:35:9e:68:3b:6f:b0:4f:0b:31:9c:50:09:3f:9e:05:cb:c4:e4:6f:7d:01:96:ee:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 12, 2026

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 8, 2024 - Apr 10, 2027

Minor OS version

0

Major OS version

4

Entry point

492054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdb

google.protobuf.pdb

SHA256 d9e3f39c85150a45223c0cc89676e579d7a6697dfab2281f65bba46c29e4f5ff
MD5 06a6432b8ccf73ef388678fc72fa1655
SHA1 6f743fd81d01dc7ebbc3ee663278f7e06593da87
SHA512 23e09f3566524ad2c6e3f4507f5bae88fd8f8591a7e0dc5a544e316f6d818d847a7e1639fe99dd0f6bb6678108dbd131bf721c8e2e3bed1e7bc8eb292964da06
SSDEEP 3072:eOdlh5zJfCuVn3t1MqEoVhumACDU6qrH5wdIsGgs:ddfFJl91MqEmum7EJso
TLSH
T12804C69BA988C23ECF9D243D156A06227779C00ADA418B07779CEF7C6C97B78059367C
MD5 SHA1 SHA512 SSDEEP TLSH

grpc.core.api.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d13ba6360fa73140cda545afab6f21d6576475f9644cd153c182dde6aede8f80
MD5 2fce7cf52f2cef8d660a4dda509f2eed
SHA1 9585cbf4e077087a878111eedf9621707d252c54
SHA512 c58788087b5514b4b13fe89fdf6a6dfd5f909ca1ca8067620b10b63e3be420f369f97bcfb3672439b3a5339dd4587b1143d7d507de38a1680fb47cb503c329b3
SSDEEP 1536:5iI8m/ZUzZeXt+0O/QLHEhq6S+WqVs5w8yDYGtZQN7uPxic:5WICM7OdFVs5zyDYGtyN+xic
TLSH
T15F434B25C3DC4A3BDFAF46F8F89421651771F7147883E3AB154CA0E91993B94CBA432A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

35:6e:24:e6:34:7c:9a:52:64:76:af:b8:1a:51:37:66:7b:6c:c2:fd:80:29:5e:93:c5:57:d3:72:f7:ce:5e:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Jan 11, 2023

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

55362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/var/local/git/grpc/src/csharp/Grpc.Core.Api/obj/Release/net45/Grpc.Core.Api.pdb

grpc.core.api.pdb

SHA256 820db50b00a7a68ffad439dcf0b40c3239db6c9b9dd52c430f66a0a71866c23b
MD5 6871f845867fb3a061779c9d50241032
SHA1 06206a364038efbd0c88c88a3018184d368ef3e1
SHA512 4abf20f67213cd7d10dfeb6a6e67cebc02dc6cc0c79cc723f25c07c6a5aac90e115f0b09313b880ef61c3154fc4ea56f572df9bbdb5d94ce90f95230c118bebd
SSDEEP 384:t2/59tu/YjoBD2SZ9GfsRayZ7aw7XQYzA3rRIaPNn5JrTlpdJ/aa58ye2:U/5uAjQ2SZAsRxZOwXiLr58ye2
TLSH
T15192A59BD3488B1DE581957709338B0803348606DAD58B2BA9D87B64CCDB73D1F7B2B8
MD5 SHA1 SHA512 SSDEEP TLSH

grpc.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aa99e6ad71c01997c154be1f0f6e5402266f787422cf67d66c5d59f63d26131f
MD5 6155b91228d88a0cfff0e8f32942e772
SHA1 b855c00124ff8048dd278f3ada5a3392576aa5d6
SHA512 4e6a0c07c09845072ebe16aa7087b572358800e6ff1691b2a2e6f56c60ebddb29eb9cdd4412dc78a8b9738e2d14b76b6c72373dbc7cd444b972e6320a818a728
SSDEEP 6144:VrJLcdXl5xFcQyCmnMENW1H/M8f9Z5mNplX4XmRrcMFADwYCuMsligT/Q5MSg:VrJLcd15XafWN/vZ4NLqmRrctb65MB
TLSH
T168A4AFC40B990D41E46FA2BAD5231302CEF4E157E5F7F3DA0ADB50DDE1137029AA879A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

28:46:96:ad:01:45:73:c2:cd:31:fb:ce:43:93:f8:99:cd:d5:dc:c9:c5:37:b2:8f:39:26:5f:94:cf:4f:f7:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Jan 11, 2023

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

480834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/var/local/git/grpc/src/csharp/Grpc.Core/obj/Release/net45/Grpc.Core.pdb

grpc.core.pdb

SHA256 f079d75403722a0c750af9b4c5972349bb01dba436463ad318dec80e3816cb45
MD5 7c47e786f70be16341877b3f07ed25b6
SHA1 57ffd1da8907e8f1307641eafa3834b12b484cdb
SHA512 2c14d1c10fd0ce677724d43cebfe52640f517938c01a189185fc371188851674ca9754b956b3723f0cdde12b0bdc79b9505514513a3ba2d9575ae1f51226e7dc
SSDEEP 1536:80P4ieUC51gWxVCzR96OzzdZBw4rz8Ww5C:ciXjzhHdZu4rz8W/
TLSH
T11953B66783448A0BDA556B3B40B7573E3334C60197878F0772AC677ADC967280E6F2AC
MD5 SHA1 SHA512 SSDEEP TLSH

grpc_csharp_ext.x64.dll

IMPHASH ddc1242eabc6dfe5e51e45049088122c
SHA256 4151229b6e31dae91d459be70655417dd18e6b0869c9a72fef08a5bb28d980b8
MD5 865c7d285d665fe4d9fb672b111dd54d
SHA1 c3e83e7a8402f0de75a49d5dcc71dd131e9b2cab
SHA512 9be1ca48abfbcfb0964b25613e62ef75a5603876e84dd317d5946a96e1ffc64e219366b4635582d4c455212580e6b94a5de54e5fff6523792abfa2bcf0e18a1e
SSDEEP 98304:T90rvru1gfhuxb58gzjuq8/bx72QJg/+gqms:T9Mvru1+hux/uPTcQK/Zjs
TLSH
T106D64A2A76A88095E176C17DCACBCA9BE6B270044F3157CF5895435E1F33FE849BA231
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

15:26:4a:81:2f:cd:98:50:de:42:d3:7f:d5:f1:fe:2a:c2:12:f0:d5:ba:56:6c:05:a0:de:1b:19:d9:73:c0:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Chains

Jan 11, 2023

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

Serial Number

0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2021 - Jul 10, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

48041

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

T:\altsrc\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb

advapi32

RegGetValueA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA SystemFunction036

ws2_32

inet_ntop WSAStartup WSACleanup htons htonl ntohl ntohs inet_pton getservbyname getservbyport send recvfrom recv ioctlsocket connect __WSAFDIsSet gethostname WSARecv WSASend WSARecvFrom WSAConnect WSASetLastError setsockopt listen getsockname getpeername freeaddrinfo getaddrinfo WSAGetOverlappedResult WSASocketA WSAIoctl WSAGetLastError socket closesocket bind getsockopt

kernel32

UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore SetProcessAffinityMask VirtualProtect GetVersionExW GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue OutputDebugStringW SetEndOfFile HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW CloseHandle CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus FreeLibrary GetProcAddress WaitForMultipleObjectsEx GetVersionExA GetLastError ExpandEnvironmentStringsA GetWindowsDirectoryA SetLastError GetTickCount ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId SetEvent WaitForSingleObject CreateEventA CreateThread GetCurrentProcessorNumber GetSystemInfo LocalFree FormatMessageA GetEnvironmentVariableA SetEnvironmentVariableA InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetModuleHandleA GetCurrentProcess VirtualAlloc VirtualFree GetLogicalProcessorInformation InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue RtlVirtualUnwind FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW SetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID LoadLibraryW IsValidLocale EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageW WideCharToMultiByte RtlPcToFileHeader EncodePointer DecodePointer RaiseException DuplicateHandle GetCurrentThread GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection InitializeCriticalSectionAndSpinCount TlsFree MultiByteToWideChar CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwindEx LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList ReadFile GetTimeZoneInformation CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW WriteFile GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW GetModuleFileNameW HeapFree HeapAlloc ExitThread ResumeThread FreeLibraryAndExitThread HeapReAlloc SetConsoleCtrlHandler GetStdHandle FlushFileBuffers GetDateFormatW GetTimeFormatW RtlCaptureStackBackTrace

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

dbghelp

SymFromAddr SymSetOptions SymInitialize

gprsharp_convert_clock_type gprsharp_free gprsharp_inf_future gprsharp_inf_past gprsharp_now gprsharp_sizeof_timespec grpcsharp_auth_context_peer_identity_property_name grpcsharp_auth_context_property_iterator grpcsharp_auth_context_release grpcsharp_auth_property_iterator_next grpcsharp_batch_context_create grpcsharp_batch_context_destroy grpcsharp_batch_context_recv_close_on_server_cancelled grpcsharp_batch_context_recv_initial_metadata grpcsharp_batch_context_recv_message_length grpcsharp_batch_context_recv_message_next_slice_peek grpcsharp_batch_context_recv_status_on_client_details grpcsharp_batch_context_recv_status_on_client_error_string grpcsharp_batch_context_recv_status_on_client_status grpcsharp_batch_context_recv_status_on_client_trailing_metadata grpcsharp_batch_context_reset grpcsharp_call_auth_context grpcsharp_call_cancel grpcsharp_call_cancel_with_status grpcsharp_call_credentials_release grpcsharp_call_destroy grpcsharp_call_get_peer grpcsharp_call_recv_initial_metadata grpcsharp_call_recv_message grpcsharp_call_send_close_from_client grpcsharp_call_send_initial_metadata grpcsharp_call_send_message grpcsharp_call_send_status_from_server grpcsharp_call_set_credentials grpcsharp_call_start_client_streaming grpcsharp_call_start_duplex_streaming grpcsharp_call_start_server_streaming grpcsharp_call_start_serverside grpcsharp_call_start_unary grpcsharp_channel_args_create grpcsharp_channel_args_destroy grpcsharp_channel_args_set_integer grpcsharp_channel_args_set_string grpcsharp_channel_check_connectivity_state grpcsharp_channel_create_call grpcsharp_channel_credentials_release grpcsharp_channel_destroy grpcsharp_channel_get_target grpcsharp_channel_watch_connectivity_state grpcsharp_completion_queue_create_async grpcsharp_completion_queue_create_sync grpcsharp_completion_queue_destroy grpcsharp_completion_queue_next grpcsharp_completion_queue_pluck grpcsharp_completion_queue_shutdown grpcsharp_composite_call_credentials_create grpcsharp_composite_channel_credentials_create grpcsharp_init grpcsharp_insecure_channel_create grpcsharp_metadata_array_add grpcsharp_metadata_array_count grpcsharp_metadata_array_create grpcsharp_metadata_array_destroy_full grpcsharp_metadata_array_get_key grpcsharp_metadata_array_get_value grpcsharp_metadata_credentials_create_from_plugin grpcsharp_metadata_credentials_notify_from_plugin grpcsharp_native_callback_dispatcher_init grpcsharp_override_default_ssl_roots grpcsharp_redirect_log grpcsharp_request_call_context_call grpcsharp_request_call_context_create grpcsharp_request_call_context_deadline grpcsharp_request_call_context_destroy grpcsharp_request_call_context_host grpcsharp_request_call_context_method grpcsharp_request_call_context_request_metadata grpcsharp_request_call_context_reset grpcsharp_secure_channel_create grpcsharp_server_add_insecure_http2_port grpcsharp_server_add_secure_http2_port grpcsharp_server_cancel_all_calls grpcsharp_server_create grpcsharp_server_credentials_release grpcsharp_server_destroy grpcsharp_server_register_completion_queue grpcsharp_server_request_call grpcsharp_server_shutdown_and_notify_callback grpcsharp_server_start grpcsharp_shutdown grpcsharp_sizeof_grpc_event grpcsharp_slice_buffer_adjust_tail_space grpcsharp_slice_buffer_create grpcsharp_slice_buffer_destroy grpcsharp_slice_buffer_reset_and_unref grpcsharp_slice_buffer_slice_count grpcsharp_slice_buffer_slice_peek grpcsharp_ssl_credentials_create grpcsharp_ssl_server_credentials_create grpcsharp_test_call_start_unary_echo grpcsharp_test_callback grpcsharp_test_nop grpcsharp_test_override_method grpcsharp_version_string

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

476KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

installerphenotype.dll

SHA256 3f30998bb6fdc3c3bc9b9f3fb7ae32791153c7332ef121a720cab32e7a6c9b80
MD5 700a3b97b5828489266bcc5461ce0f7e
SHA1 52df9cbeab088f2e8c34dc5a9990e899a6f708dc
SHA512 36db65886cbf46cda429f022e0273f7451412fb8ef4d7ea50aa6a15c25d8a6d7cc00d36f1d3ca3b8b19cdf0960d5a62f4fc69a1ac707bb0a1a7609750a3683f9
SSDEEP 384:qDFHFNtu/5ZHJx2tFVkyrrmIxyBKCXlWsncnnl2F4pZ/YMBlOgOrExLB9g45Gk:qDNFNtu/D7u7NAonnlV/FBlQrEi45/
TLSH
T1C2C208889EEC5139E3AB6B3CBCE119900BB0A1977452FB6F5A04909B0B937D4D95073B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

InstallerPhenotype\obj\x64\Release\net48\InstallerPhenotype.pdb

installerphenotype.pdb

SHA256 d60593bfd7c6fd6b53772a6d52aeb86a74be3963a23586c925afdda65af34f35
MD5 2477e96fb6ce65b818872460cd293104
SHA1 958da62780149122b670e5b04b17f3ea20cbee65
SHA512 ebd48d62e59f5e56688593a0b3d18a7babb409dfb3202a70cc631fc8c8eb67b34b0eb10b9addd6da91ae2042a3d68e7351a82b73b8fae1d6e0854d009fdb90b4
SSDEEP 384:+td/cE5Hp9CX+hPTaNrjLOMv+eiMiPH0WH7Owcflo9lmS3U5:+v/cEBWRGLVHkoFO
TLSH
T1486230BB47488238C091163E6425878F2B7C06115B49AF7EE2F97934EC9F75B03BA1B5
MD5 SHA1 SHA512 SSDEEP TLSH

installertools.dll

SHA256 6ad16378f18d986a3dc65ab020a0aaee8b24baccef18c283735c74d6e99b4630
MD5 dfa5c2ec1cf276c37eb496be90412e50
SHA1 dc338378aaa8758ae0ed2da42d916df6ae70573e
SHA512 c27377c7ce0042c76af20991d9690c3c4c561a2c62edcfd228455cc387e6a4f681f730a0017560097197bb945af559b0d192d255a99db4e87ddbe08cc943dc0d
SSDEEP 1536:hlcPufZh6K/oegI7CC72g0HHE8NIu3RgoXUtVwNmGyq1kF4TI:wGfDrVn/0HE8bfXUtVwNmGydF7
TLSH
T1C17319501BFA0236E0ABB7387DFC5513CA72B2261569F35F288413DF6553B809C62BB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

InstallerTools\obj\x64\Release\net48\InstallerTools.pdb

installertools.pdb

SHA256 295c2203d5dfba82a17b691b8f25f50893d492639dbb3a26d97cca0099f295ab
MD5 36018e4b14b0408ab81c2e359f938dce
SHA1 31c9e15b0e379115f487b1cb7bea8a4969effade
SHA512 404e3d4a6d1cb816049162dcfb77bbbcc8b45e147d7abe2521e87cd56dec02e1a166bb3e4ac5768a482042d646eaa6946e8251992e9495c93adf60300c7ea5f0
SSDEEP 384:IXyNsrYsZHp9CX+hPTaNrjLOMv+eiMiPH0WH7OwcflowH/7UBCRLL7Pdsr8/sx3g:DsrhWRGLVHkoYgC+4/M3g
TLSH
T1DA92923743488625C515123A456AC29F7BBCC7015B0ABF3AB2E87A34ED9FB5B07B3160
MD5 SHA1 SHA512 SSDEEP TLSH

ipc.dll

SHA256 08190a93719fdb2b48306715e3f238ac7adbfbaa2d4fd620580ec52b48b6a8bb
MD5 b98ac27a074573b8cc9638732665823b
SHA1 949cbf496429417ccf00278d433611d830682676
SHA512 84f9214d8aa6106dd3a89cd1e2c769e393191e90481f618f90266f4b2ac9a8382ea70415a88a33ff7b9647150603b08097b0e71963b36ebfc6651de245f7b3e0
SSDEEP 768:kidznYvW1m8AUkV50AjiWZL2CcMUza0UKpYbWpn5kI7+P0apb/e2evoOFLqZ9rn+:6j8AUkV50IiW92CcDzJ5leJpb/jevoKb
TLSH
T147230906B3DC8B23E6BF6FBE69B16A174772FA066422F74F148CA1E81C527804D60753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Ipc\obj\x64\Release\net48\Ipc.pdb

ipc.pdb

SHA256 c30e9e8987c3ca951f07bc8bbb820644daf8cef8263955fa303a37ca09a3c938
MD5 f7fb269754be70f55e65295970e2a954
SHA1 d59d0a2b8c3ecddb9d13b2a3dde17b047e959ad9
SHA512 678b1f0383f6c68b020aa468f4b7e54d6dd31fd20a755ad9b9a167870106b733d7eaa7a6d4bb7c8e604c3e1dedea1d24d77e0b077ff600fe032875b08e9067bf
SSDEEP 384:OpXw2Wi2eaMHGvECfHp9CX+hPTaNrjLOMv+eiMiPH0WH7OwcfloYcCsIBK9qRWa:qXw2RPHGvpDWRGLVHkoQBxRWa
TLSH
T1BF92707B97488724C01515794929C74F2BBD86012B09BF7AF2E4BE28FC9F71B17B6160
MD5 SHA1 SHA512 SSDEEP TLSH

metrics.dll

SHA256 e587392700a1d897c847ff6768ea892c05bd8fe7ad80c52c5a1d51d823c8f400
MD5 dd07830ab9e4098867ad7d1e013e2d7c
SHA1 a1daa416fc8cff6e926ccf9de261494f1292d12b
SHA512 8e8d7954f13bf6e2b10a76062524358a38ffe8d6e4b36d25685e03c47ec566978b67e2370ea1a7beba29353614d23ad184d31924cab1cb198e6795f5274d05da
SSDEEP 384:hCaZBCSrz8YNo61JpoUJ3baQaLvcMeuKyMuP9ej2AJZ3kLoRniY0xJggKvB6UfO1:hCaZBCSn8/61BbabLpeuTMuP9ej2AJZW
TLSH
T13CB2D784B3E88D55EEBE4B327DF50A044AB1F8A25935C74F45995CEE0E33B982E11713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Metrics\obj\x64\Release\net48\Metrics.pdb

metrics.pdb

SHA256 16327ed0bbbf3d837bec49fd68e88e88f62a8661f0e9590627338b1a6be0c8e5
MD5 53cd241a89f4f01a5c1cbfc996498e3d
SHA1 7066e4bef142d194d4d5f4aa4fd1b6f50b6ab9ce
SHA512 ad3f0f3e6366d19f7ac33b15b47ee08453259c0574aaf5869bdb40e2dded7131db278212430d22d7ccb6c92aadff1297fc7bc34ed13f7ca8f32fe3ada831f1ae
SSDEEP 384:QMtHSXFNv5w3L8hmFYtrPcdHp9CX+hPTaNrjLOMv+eiMiPH0WH7OwcfloqcLQAzX:rZSXFNv5w3L8hmFYtrPkWRGLVHkoZVj
TLSH
T160623C33AB488665C42555760426C38F2B7C83012A49BF7EF2E43E54FC9F38B0BB6161
MD5 SHA1 SHA512 SSDEEP TLSH

metrics.protos.dll

SHA256 482e0463b88c056522fbb57d5812df5e6128507d9317b763a129b34ac179cdf6
MD5 c7f140762a5fa692d5cd356292e171d9
SHA1 4d5e5e43f492ace4a93b6ae90a5a565fd5179f7b
SHA512 4168cc7367e30ec8041a2a6144b2a27dcee9a005c428537f9d08c9ce15056befa0aa0e0d67f7bfed72dd09b9cb0b47ddc433a58ca275de497f68f0e5ebc77e4b
SSDEEP 12288:nKTHAklcgTGk++0+oQDVpmAPM2pNH+gsrDp:nKTHAnF+0OVHPM2pNH+fD
TLSH
T16925E7243DBD4039D25BA7306CD9791BAEB0A2172116A77F5280726B5DC3F42BD422BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Metrics.Protos\obj\x64\Release\net48\Metrics.Protos.pdb

metrics.protos.pdb

SHA256 c7bc036f23ec59ef950851336b95becd8df5c9769a752d5784c988ae4baefca1
MD5 07a4440a63d0cd543200f0757a8b0d44
SHA1 44bda09cf1a78effb639792c99e1c117ad7eb263
SHA512 0e62d660e26a059df47b80e1d0c285a7cc96a5246a9ab69f58589e9a9b4334106abc078bc3c0b04910f79e34d95fd7d8814e2f88136fb55c5315dfbf23e5cef5
SSDEEP 3072:/HA8jQ96nRJr12kqkNTHP7+9V0Hgfv5wn+jR1MTV3E+AFJo0R2:/g8s96nRx12kqKzAeERL8
TLSH
T18D3483499D2976FCC915303E6A7A03164BB5101BAB82935723ACF1F77C69BF8132E274
MD5 SHA1 SHA512 SSDEEP TLSH

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
TLSH
T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

82:11:ea:7c:5c:6c:f6:d8:98:91:57:78:8d:42:43:17:c8:8e:9d:92:b0:d0:16:ba:2e:c7:fd:02:5e:79:f7:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.windowsapicodepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21e140dcafa3e251373a712423bb111570737e95e4dcfb6f56868d7086af7686
MD5 5d7da47c86475dd23094ce4bbb6c9001
SHA1 af31272c451996c8eea7b2e56a79b8088c606c3b
SHA512 cd193963d9c5a5959a8ec2503224079c806804d049ed927d654fe241113af2514d24fabf05489801ae283578f384224ecd1fb887a96123b19c70be0600e36faa
SSDEEP 3072:ApN+OsJcYnyhiV6WPCeC0ImL6HKgqYw3Flih:Ap0OsPnt6WPCeUHxZ
TLSH
T1E8B3392577F8162AF9FF1BBCE4719120CB71B9826A13E72E0F94716E08A3740D858767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

119678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\Windows API Code Pack 1.1\source\WindowsAPICodePack-NuGet\Core\obj\Debug\Microsoft.WindowsAPICodePack.pdb

microsoft.windowsapicodepack.pdb

SHA256 93d4566f27122cdab36dba72444953ea79f1b1734a11fe0da4e916c27a1f3651
MD5 26ade834468a8fef7f147ddb21541ff7
SHA1 ab71a15477c254d2fb760e61a9ecfc8b49555fe7
SHA512 dd78e0cfe456fe1d9313b4ac74d1370ff5efbe86a10762c308fd974908ae3dd5ef8d543998f12ee7718bdab21426d2f45ec8c14f3f0909472803878a15b2c739
SSDEEP 3072:zfWHbWxHWFEdMCW/Xf/L4ALtDCZ7nUxlu/:z8WFMNkQtGnUx
TLSH
T193448263BBA4C632C496C93C6ADB0F2E537CE1C9978357AF4698B06C7DD235A1C86350
MD5 SHA1 SHA512 SSDEEP TLSH

microsoft.windowsapicodepack.shell.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6ea25be49a4e96c43c20bc29eb1ced078f4e0bcec4673ce722271c77bc2fa121
MD5 f6a0bdf17dbfdc16cec93537731571d4
SHA1 22ef1d17448c01f9d06eddc0a4ace8827699a877
SHA512 c665512ac8cd86b93b2f60061cc6101222709112a6f10b18bed76e94aaf6730aaef100c10bd28b71ee96c704f3576ff0641b13af618e1f3d4c2515109771789a
SSDEEP 6144:PpXcF836yvCI++R1yjRbcq/9NlKCuAg496KqMbwFkguan+W86b8c3v6n9c6KwZE4:PPVCbbcC9P96K3wFvuI49Mmn
TLSH
T17AC429247BF5951EF09E977CE1AB162297B0D311F103DB1F0AC026AA1CE37514D89AAF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

593246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\Windows API Code Pack 1.1\source\WindowsAPICodePack-NuGet\Shell\obj\Debug\Microsoft.WindowsAPICodePack.Shell.pdb

microsoft.windowsapicodepack.shell.pdb

SHA256 6eaa6468666ecf851ca10ed8ab61c22cc2e2e5aa4be899c4f060d4b2386e22aa
MD5 cfaeb739e73a9cbcb43482cada6110f4
SHA1 3e4374d22287863c6b3015fbfb525d721b92d55f
SHA512 c8dbcdc55fbb7f48a5aeffc3f3ad64566f8740baf4fd14a9ec4a1f680d97aaaa214a057df9819f64d9c87e2bf8285b53276c81225f62b1cdbd3276ed3bd79462
SSDEEP 12288:+3HfrHhIlIAVBlyekhcmQZAtnNqWPcq/89KRF3i5pFyKp:+XFIl/tyekhcVGrqWUq/89KRF3i5pF5
TLSH
T1387541937B91C631C496C93C66EB0F2E6378E2D88B4257BF578DA02CBDC335A1D85264
MD5 SHA1 SHA512 SSDEEP TLSH

microsoft.windowsapicodepack.shellextensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c21bc4847ac3c75db64b5f7afeb0fcb0e22ba436b7db80692523b4810b046d22
MD5 7f616473bc928975d2d8e9897e41d1e3
SHA1 6b665bf91c0de499b3c94ea94be1e9c44aab0abc
SHA512 d7ebd31e30fc266fc2ca8d4e9f6d3ff2c595cd4f8d2cf60cfd662db2902e8f262f805da0236110979a563a09c08f7908cf66e327761c2e075580c0fd47466d02
SSDEEP 384:3fSzdiw/AuYKDW/SSg5qGhei0kLmmZXLVyRohwhxrqwmzSgaVAap944G/NW2TslW:vI/ARK1Sg5nZXLVyRohe4zFABkMk7
TLSH
T1CB031A0457FD8637D4BE4678FCB2051047F0F543ED43EFAF4B94A19929A73A4C891AA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

44078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\Windows API Code Pack 1.1\source\WindowsAPICodePack-NuGet\ShellExtensions\obj\Debug\Microsoft.WindowsAPICodePack.ShellExtensions.pdb

microsoft.windowsapicodepack.shellextensions.pdb

SHA256 5063907c80d2c9c213e4aea4e87edcdb6a84e665a18169eee3615ba75f898e9d
MD5 e3cb1ba8979f22cff9ba6279ff9979c0
SHA1 569f77faa0af367e69d4aeaaa5856cbe9b818c56
SHA512 102af11572fcf006e9176b53f01a180cac5da54e5282090f8fa6d0cd1faa900c8eb806a63a8422f91007a89f6b3c1e0c89278a2eaa9b8feaa4af11b835dc2419
SSDEEP 768:akevjx+XXUpqs3h+b0a5z50tcrdr9+fIKhwE:arEOT+b0ab0+rdrmhwE
TLSH
T187732E47BFA5CA32C46AC538AA9B0F6D5778ED949B825B8F5399B01C7CF334A1C81350
MD5 SHA1 SHA512 SSDEEP TLSH

microsoft.xaml.behaviors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2ee6a286cd255d180bac4a5cdb97c5f27de2be6b3beb3451f8d77bc94fa59538
MD5 17ce3e7564d93ad1e96f82044f4ecffd
SHA1 f6e9dd67bf6f156c3a8c4ad8e05df8945eef8e9a
SHA512 9b21e6e451b67931b09a32a09f979b009a2e8298deaf53bd29dd39c985996a83d56d7de910c80471fef8e8b30276d646e59237d6f7523178d7829037e51456a8
SSDEEP 3072:7r8zYnrXNHgxAVop9i8eC1dtcLgEEjn5rCyjYJ:v8zYnbNgxAVop9ZEf
TLSH
T1A2E35C6653FC8A29D7FF1A35E4B451208235F743B963D78D5E8492AE04E3782B6112F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c2:20:c6:c8:dd:79:a1:b3:a4:69:93:aa:80:a9:3e:bb:a5:4d:a5:8d:bf:f2:24:ff:0d:f5:c9:bc:cb:40:ce:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 9, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

141622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\src\Microsoft.Xaml.Behaviors\obj\Release\net462\Microsoft.Xaml.Behaviors.pdb

microsoft.xaml.behaviors.pdb

SHA256 90703707fa383d60f00b104f107a5448d5cc4e4afb64d7db494c0ec3d1e813dc
MD5 19d1503d88d0c06045ec346f10074225
SHA1 638bfae7e669203edd62264bfd0cfc7608616cf2
SHA512 fa8cee1df2246a891839a8aba4a59cbbb51c21694318506c05f738025580d1e15aa47381972f278fbce015dba1398a45544f0fcf53932307dda0bafe8639d157
SSDEEP 6144:IaW1eQIbt/UHcniHIdmOp8KtSckD9FIdYKtSckD:9gbOps
TLSH
T1F9A4B223BF44C633D91A94385ADB4F0D123CE2CD5B83AB4F6B85B11C6EE23996D47294
MD5 SHA1 SHA512 SSDEEP TLSH

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

observables.dll

SHA256 66ab0daaf11fcec582d9eb89b3a389619d3d8eff17c54fa726a633150bb509a6
MD5 fdd556b472460769a094c454ac55d6ab
SHA1 a9230e51362c85c71d725cde42ae622782c069e9
SHA512 5e1155053b4cd48e577ca97c3729a4de6ee1dbc798afd197683c0aeaa1cabd81fcf42c6f973db10bb827a0b9e72317e9549d3f63c972d411dcee480993d32404
SSDEEP 1536:K+dHzBn8sLJgf/GTJMpOMcqUHmopuJvJ4Fvr7cUYLnbbhxTM:Fddn8sOONLx7chnbbA
TLSH
T1D4735C00F3EC6A16E5FF9B3FA97411414F36EB4AE063D39D19CCAAA91C833468C65752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Observables\obj\x64\Release\net48\Observables.pdb

observables.pdb

SHA256 f3dd620626874e0518aa7035b3bc3b2bba9d4bbb2eeb85bfa8feceadf54e5655
MD5 9960940452d8096b812eb7d6ac449df7
SHA1 5d8e38d880b3ea182daa12c50c9b1067407c3a00
SHA512 81143f8d206f17989b40c6f384be47f842304ad9b35c580b7719ebe0d482fc255d18249db25eb4a841f92904f9b20032313c0436076bc4f47b19a187fac1602f
SSDEEP 384:FQwNqcXNTQT+15w+k+g7PSccN/uahuHp9CX+hPTaNrjLOMv+eiMiPH0WH7OwcflB:FVqgNY+EKNrhQWRGLVHkoa6InvLM6
TLSH
T172C2C7378B48973AC561157A442A838F37BC87016B496F7EB2E47B25BC9E70B0F76250
MD5 SHA1 SHA512 SSDEEP TLSH

omahainteg.dll

SHA256 d172bda35dab2a70766ac80d4c590fba93c32b73ecc0fd5ec5c4b2ec55ea81e7
MD5 98ae1bb3e0563eee5253c16726aa8d43
SHA1 8488cdb4ed7de8da9cbba75021c339b44092db85
SHA512 1c1ddb40345dad64828b3f7972a0330568b069f4543be30b50ac9551cd98172edd304fb361b9246db542bb45c69ef79e64f4771b7112f97463d8f6003797b34d
SSDEEP 384:VMCDCyy3ORbT9Gq4s16JDn9SEQCFJ+qTT0oQ7utr8/bLvkWNE7jNPUMoMpf:Ou3yQTQq4hmDGP0frbK
TLSH
T1F4924C0AB3ECC33BDDDA47BE58A245514AB3E15AB003DF495D7CB2539B067208911BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

OmahaInteg\obj\x64\Release\net48\OmahaInteg.pdb

omahainteg.pdb

SHA256 ff1dc2dcd7d1ea6868658b47b99dae2770af060376dda3a82542b9c34317ec03
MD5 b5923560f3e9769b32dc068f176f2adc
SHA1 895ebd291446b029130208b82cacef66a91c4b9b
SHA512 646de08f80cc69901b9ea50eca85b4ed1ce183993c0515fd60b003d96a5cf8bef30bef1a650478dc6da7bba6523d2cf5038a7853110a28242dee0b1739ddb5fe
SSDEEP 192:iuJaj6XWe3UQLIEeMzdWTn7KgPi6kp9VWmm01ECaC5d:iHreCGdOPop9VWI1ECas
TLSH
T14CE1C627F384873BC05D117E5917834963F0C101AA05AF6D62B87B25FDEA3990A7A37E
MD5 SHA1 SHA512 SSDEEP TLSH

protobufutils.dll

SHA256 e057e77551cfb16f1dc5764f81ff15f01f9bb2273fc36357cf78f17a596b7c32
MD5 a7ff9dee5f6df03c4052f08e22853902
SHA1 eeae32512a03e6e95034305a2821e2d65e9e1ead
SHA512 ebc65605aad5580a8c18e785c58b5408312cd00fef4bf0ef1b1b6db64d33af1c7fb2d668bdbef6b6c52fdf794110660b329870dcf2999447f1e646d2629ca0ce
SSDEEP 384:EqxeTX9OelSp1vLZMqZUpZa/639Zo+VZLS1vzKlmhn:EqIL9OwgdPW4n
TLSH
T1A072D805B3EC4732E6FE1F796CB151040BF4BA53F822E78D19D862EA1822A11497177E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ProtobufUtils\obj\x64\Release\net48\ProtobufUtils.pdb

protobufutils.pdb

SHA256 8554528352f758805a2b161c810e4bd8cc36b8f3bd0c03442ef479e05c4fa022
MD5 d4804fb0704671d36094aa02cc013943
SHA1 204a13a6ec417f75cf6605d52f05bc9957c1ba59
SHA512 476e61b01197a7319405283ef784ea90c0eb1d14d3aec90512b5695d580a0e8fc77a554e2fe0bfd06a08fa08076f13fe2d24397e7359a4e00649dd9cd79b609d
SSDEEP 192:40bJMu7JinvcXJ9Hp9Cld+hPTaNrjLOMv+cNiMiu/iwI0WH7OwcflC3GPVsjftK:4GRJiWHp9CX+hPTaNrjLOMv+eiMiPH01
TLSH
T11332E677A3489B60C02519765922C28F3BBC86112A48BF7DF2F93954FD9F74B03B21A5
MD5 SHA1 SHA512 SSDEEP TLSH

shared.protos.dll

SHA256 80babb757a2a2da2f08d11321d1dd95f42b2754353bbe563e44bc4eeb60cdf99
MD5 847429feb2b3aa90bcfbb6eac32b27cc
SHA1 896d0939cf997cb1455e5c7602fd4abf0334064d
SHA512 b5ccde7e4b1a9e849154ed0919012bf6175e6d5a83db57194db10d082f398a5bc3b37bca356aebfb4a4f5e80f9cba01408a418abee1623f9200249fe1e163c09
SSDEEP 3072:njhtqWaiKrV2l6Cio53RlkaFVmrcc+/0zT+G6:njDqWXoclzia3RfVUcc+szT+G
TLSH
T187F3D8196DEC5229DBBFBAB9BCD42411C7F0A25B3502EABF974066970903F80ED4117B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Shared.Protos\obj\x64\Release\net48\Shared.Protos.pdb

shared.protos.pdb

SHA256 68512a556da6ff51b47b7a513be48e47b9ed09582b777fe5e6ed9060525a144b
MD5 5ebe15a53f10c2fefcdc720c1108b1f9
SHA1 4789849e8087006766aa3c579caa4762dff6de04
SHA512 5e2bf92f68993312ecfadeff4850505f67e492e9916ee0b537202127e356e5508e7f1a1b29404ddcb195a7ce8e17e9d6e3d8df4feca3fda92dff7410c33133ad
SSDEEP 1536:2psAMOe3Cr1LftBKzOzexH3UgfAbH4hWtkE:2+Akyr1724rOFE
TLSH
T18C4342AAE4798B3EC441253D6D7D035A5B7D140ACB838727479CF239AC99B780B1F2B4
MD5 SHA1 SHA512 SSDEEP TLSH

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

db:b0:3b:7a:83:84:ef:83:06:3f:da:91:51:13:f8:7d:32:fc:46:43:1c:0f:b6:cd:f7:db:87:4b:17:93:f7:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

136106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

utils.dll

SHA256 a1dc271c53cc8c9b501c2af5b692822f9bc5ba141000a984f389b780fe4881d0
MD5 ded6c6b375277efdbb70c6a80854f8fc
SHA1 57344a6e4d8c13626adb50aa837cd695efd28886
SHA512 3dcf3983c053e566cec1b5f916d3567088cac742b11a0daa52053c6a9cd1f8176c6893537678bde14f0cabb41b0ce71f4aa20f5682ba3294377998c67262fa0c
SSDEEP 3072:TRo0Ev85stQzUbtxZAoVQ1YxeYzWUS7PvlXo:TRZ5rst3AoGnSW37
TLSH
T106E34B40A3F84A15E7AF6B79A8741212CBB2F40BD437F79F184895ED2A23751E9413B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Utils\obj\x64\Release\net48\Utils.pdb

utils.pdb

SHA256 59676c3e381037df68b75a9912d89ab0918704b826427d7420724f8e289036c5
MD5 fa3a189d2841b964dd7258a3f76f78aa
SHA1 4dd81db9cca4c8f9411878a8af2a88686617e8c1
SHA512 d0fab54e5c0d8488dadde35adbbc448578846f974f021e96a0384f057f733dbcddcd226b97d589539cddca54a1dcd5abb0f7e4bc744a2154e1d97fb9d0661178
SSDEEP 768:+0kha4Gu9ziTVeooSqudBJztqYLuzMsAe2RGLVHkoL480L2OFFY0eCZrKB:nQGGzMVLzk0ugs50GmoQFt4B
TLSH
T1CA331A3AC7484A39C955173944F7820B37FCC2415B07EF6BA2A4B734AC9E75A0B73668
MD5 SHA1 SHA512 SSDEEP TLSH

wpfutils.dll

SHA256 f6f405dad6c10ea7e2d0a36f8e55c2325abd9fd65b2f88a6bef6f3c7f1e31719
MD5 04d9537557bb3a3ec7f4cffd07fee278
SHA1 d0766087f9e5aaeed8cab8b90b6cb9b3c1c98378
SHA512 28771137879a7c4a6cd77e985b7f24932a0cfe638e11da696aa15f4a8d987a8cdd2e848d6aa1caa586acd4b019687fd651b2f711774265f1eb20e0d6fd32aa7c
SSDEEP 49152:b70elFMCJ34YQlEHoEdSlnfg/6uRDo1yYWSMtsSf+evpAbVH+qWMVGSyhkL6qXSB:bdq66wP/6uJo1nWSO2h+DQGHqO
TLSH
T1FF265D02F3B397CEE6067E7CD262E3B155D6743685A9418DFFD11532E08EB908899AC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

WpfUtils\obj\x64\Release\net48\WpfUtils.pdb

wpfutils.pdb

SHA256 df4fd83b943f6c58168a771f3cdf57016efbbf8ae2fc83e7ca27a6803f4c5ebe
MD5 24f64fe9b14e223bc8d54171bb719396
SHA1 95b22b5a61d1f156900f760cd2c10b1a8a63c98b
SHA512 30abc9885cd2dd49d7c789dd1a99bd2ce2a62945c7d0487b71551713a09c6da5692c796084350c2e1cfebcf5695ba9be825136141ea36d66172646b3771d9dff
SSDEEP 384:+U8HiTbYIqXc78/dOjRKxVBwHp9CwN+hPTaNrjLOMv+eiMiPH0WH7OwcfloUiLg+:+H02Xc7fITe9HRGLVHkoHi90tR
TLSH
T1D49271B7A3098625C16616364426C28F7B7D83116B49BF3AF1A93D01FD9F78B03F2295
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

Install-KAMI 2-GooglePlayGames.exe

generic

brandedinstallerlib.dll

generic

brandedinstallerlib.pdb

brandedinstallerlib.protos.dll

generic

brandedinstallerlib.protos.pdb

costura.dll

mscoree

dotnet

costura.pdb

crashreport.dll

generic

crashreport.pdb

feedback.dll

generic

feedback.pdb

gateway.dll

generic

gateway.pdb

google.protobuf.dll

mscoree

dotnet

google.protobuf.pdb

grpc.core.api.dll

mscoree

dotnet

grpc.core.api.pdb

grpc.core.dll

mscoree

dotnet

grpc.core.pdb

grpc_csharp_ext.x64.dll

advapi32

ws2_32

kernel32

bcrypt

dbghelp

generic

installerphenotype.dll

generic

installerphenotype.pdb

installertools.dll

generic

installertools.pdb

ipc.dll

generic

ipc.pdb

metrics.dll

generic

metrics.pdb

metrics.protos.dll

generic

metrics.protos.pdb

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

microsoft.windowsapicodepack.dll

mscoree

dotnet

microsoft.windowsapicodepack.pdb

microsoft.windowsapicodepack.shell.dll

mscoree

dotnet

microsoft.windowsapicodepack.shell.pdb

microsoft.windowsapicodepack.shellextensions.dll

mscoree

dotnet

microsoft.windowsapicodepack.shellextensions.pdb

microsoft.xaml.behaviors.dll

mscoree

dotnet

microsoft.xaml.behaviors.pdb

newtonsoft.json.dll