ExtremeDumper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ExtremeDumper.exe
Size 1.7MB
Sample260816-ymdp8sff28
SHA256 f407b67a008fc2186329d5feffe830f7eead7a11f3b169d0d90099495edfcf2e
MD5 58db100b228ff17f83726d4c2738990e
SHA1 d69bfa9ddb32de1999760e8b3b3236bc8934d66c
SHA512 e845a62e00fcb8305ab0ceececec73a2d46a490c04370742290398f5e568ba4cf43bc1caa0529405e9ee07c021a05109873271278a8c45eec67ad409dd670f51
SSDEEP 24576:aOXgZKNbtS8nW+LjE5p8Cu9U2zbwPCDzhClInGWILVk5BkAdtSu9D3Eu:aOXgZKnWsg5VEbwshOgILOcUSu
TLSH
T11885BE07E2E80631E6BB47FC98B6B9429776FC169B71C78F22C5279C0D317845C22B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
ExtremeDumper.exe
unpack001/costura.dll
unpack001/dnlib.dll
unpack001/extremedumper.antiantidump.dll
unpack001/nativesharp.dll
unpack001/ookii.dialogs.winforms.dll

File Explorer

ExtremeDumper.exe

.exe 1.7MB
costura.dll

.dll 4KB
dnlib.dll

.dll 1.1MB
extremedumper.antiantidump.dll

.dll 61KB
microsoft.diagnostics.runtime.dll

.dll 781KB
nativesharp.dll

.dll 41KB
ookii.dialogs.winforms.dll

.dll 126KB
system.buffers.dll

.dll 20KB
system.memory.dll

.dll 137KB
system.numerics.vectors.dll

.dll 113KB
system.resources.extensions.dll

.dll 58KB
system.runtime.compilerservices.unsafe.dll

.dll 16KB

ExtremeDumper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f407b67a008fc2186329d5feffe830f7eead7a11f3b169d0d90099495edfcf2e
MD5 58db100b228ff17f83726d4c2738990e
SHA1 d69bfa9ddb32de1999760e8b3b3236bc8934d66c
SHA512 e845a62e00fcb8305ab0ceececec73a2d46a490c04370742290398f5e568ba4cf43bc1caa0529405e9ee07c021a05109873271278a8c45eec67ad409dd670f51
SSDEEP 24576:aOXgZKNbtS8nW+LjE5p8Cu9U2zbwPCDzhClInGWILVk5BkAdtSu9D3Eu:aOXgZKnWsg5VEbwshOgILOcUSu
TLSH
T11885BE07E2E80631E6BB47FC98B6B9429776FC169B71C78F22C5279C0D317845C22B66
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1650654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\projects\extremedumper\ExtremeDumper\obj\Release\ExtremeDumper.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
MD5 d075a47a551e53e27889f83670a581e1
SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
TLSH
T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\costura\Costura\obj\Release\net40\Costura.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d04369e2fafabb36fdc31fc63b9a4bfd2bba577a203ee8180f9b084d9b344676
MD5 e517eaeabd955f1e0f83ed04a0e6dd86
SHA1 4a376b09ca00c7b934f6b444302773d0420ebd85
SHA512 3c416235e0bb395b000b75f1358bde869c0ba2ff554b64821f5729f0580349fd8d1ba99ebc80e4b6dffa7b4741b4bb45570781d568fa9f5e3272de5d9108fe6c
SSDEEP 24576:qM8euVMm3NxPkVCHKJi9n/PfuMs31MkZxxYyULZ4GBXcO1QmPyu9IFCh2v1DZS31:vhbivwS2IPx+vn
TLSH
T136357E053BEA9B37C09E4776D872499807F2E416B797FB0B4A10A6F92C47795DC023A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1165446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\dnlib\dnlib\src\obj\Release\net45\dnlib.pdb

extremedumper.antiantidump.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d43b68e0fc609b4adac4fbbb859bf16a462515d7e61f87d8af531b1e281c5b67
MD5 8c4b9b06ce7fb7c0ab7b817789edabc5
SHA1 5e687dbd61d0c3f38cc33335e9b202dc9d9d9e76
SHA512 d1d0d14eade51b6f4be0f8daf4137e546027783e3fa4c4ee8b56d3358d0b1ac60b0dae75af402866f7f6bd2d48bfae31341a4d1c6e7253f3e33988b78f6ecf33
SSDEEP 1536:qAn1af8/XTJd6Qn+jweljomwPV+7sssssiboKHNwJIc45u:qsafU6QMhbwPYfHaJ8u
TLSH
T18F538E0457EC972FC9AE8AB4E873621087F0E12E7207E78B6FA566FD58533C0584578B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\extremedumper\ExtremeDumper.AntiAntiDump\obj\Release\ExtremeDumper.AntiAntiDump.pdb

microsoft.diagnostics.runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f8b333dbe4c9ec7d70febf159962c7fd7424c870b4cf63532b7f73563316b6d
MD5 5de70839acbcc25e44672831400ae30e
SHA1 c2b1df7f1e773e3ffc880e52de3224b041b5435f
SHA512 1239a2b813fee4d024f142f1239b82cacc919243bbf41edc9e746eff5583924f05bf7dd258afb00e9f02e72a0d823c0e5dbd17188fee878acd4b22603af1f7b1
SSDEEP 12288:aJvFW+06P4dLsDFlXB6RdgYE5VLFVyD7UiGQTYg9iz+ym7i0BBpT3E:ap06PAyFlXIRdgYISyUi0B73E
TLSH
T132056C1773ACE737C68E073AA4631F1143B2D50A7393DB954264EB6A6C937E01E522E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

63:be:e7:af:38:ef:86:75:97:25:e2:49:0e:90:fc:ea:18:84:98:2b:2f:d6:18:a0:10:fa:37:90:5a:4d:70:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 21, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

795806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Diagnostics.Runtime/Release/net45/Microsoft.Diagnostics.Runtime.pdb

nativesharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a608e648d12d74e473ce3c997755877f56b776dd77d4e914c2b701c3ee565f0e
MD5 733d6f14cb34fa5b46b083a5e7a30a4a
SHA1 fd7af590d150008af42e8b111219f0094ee58427
SHA512 8dbf72e6c8aa1b287006906ae36f9c46f37636d175edb7604c67bf14eb17fc3d457e63dc9bace7addc14d7f0b89c7462d2e15c73a1def0f5531061e4f369bccc
SSDEEP 768:Vt5FdKQh6RhlDbaMlctfTBbB7u6g93UeFmihQkYg:+cMQNbB7Zg9FI4Qdg
TLSH
T18713FA04A7AC4A1BC96F0778E6FA53C10B72DA995F03D78D37CC8276AA427E5141339B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\nativesharp\NativeSharp\obj\Any CPU\Release\net40\NativeSharp.pdb

ookii.dialogs.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9fa0c3c0b7231a75a2a89aba44badfce84c109babc054941b7a3de41ed5bca3a
MD5 5c746cb3a7fe15295ae94b983e615531
SHA1 c5c86485df8b5c33981e82b478ed04be52f899d8
SHA512 e8b24bff89c581058dc5531d67ef056c3e957d899e18cace70d13f61563c5123626389d2170d127a952f71e0a65492cd086740e38ea1126cd0c631555018d597
SSDEEP 1536:/PotFfU6AFxt0FcHdRmN1zbUoGzrP1GA6B/FAdh1lB9Kawt1gQ9qpBh8smd0LWED:/PyFfU6AFx/ktbrwrP/6xFAdzlgev
TLSH
T17EC37D2533AD4A7ECAEF4AB8E82541D58370EE557562FB27448871AC1C733818BA12F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\ookii-dialogs-winforms\ookii-dialogs-winforms\src\Ookii.Dialogs.WinForms\obj\Release\net462\Ookii.Dialogs.WinForms.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

db:b0:3b:7a:83:84:ef:83:06:3f:da:91:51:13:f8:7d:32:fc:46:43:1c:0f:b6:cd:f7:db:87:4b:17:93:f7:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

136106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.resources.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d328477d48f1ed9ea795b22e84ace6e983b939c6bb743c14d460c17c8e4ba4e
MD5 d82e1acc8c8c4ce47b8113f196b44904
SHA1 0dab978015128ed8a7be61f5fe22bdc4adb88029
SHA512 3e5552bd7e12b1dd59f8f63fddeb2b8596e20bac8e79676fd2cfbba6f9c6edae0e1faf9d32d4b241b6172a7dc33bbed477ae3b05de4411eb278a0173c831d3a7
SSDEEP 1536:X/iNlLj2OvH5xEMXfy6lNQYjLO2x5+GhJ7zrkkTWBQ3akScZiNM0EV:Xmskq+Ks0NNm
TLSH
T127433A0177FC0757F7BE0AB4B9B191418B36B4A75C21E35E4C8260EA1DE77E08A60B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c5:17:9d:c5:29:35:77:33:22:da:7a:a6:17:3f:8c:c8:89:90:4c:1f:3f:22:f3:70:d9:24:ae:38:77:3f:a8:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

55018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Resources.Extensions/net461-Release/System.Resources.Extensions.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74
MD5 da04a75ddc22118ed24e0b53e474805a
SHA1 2d68c648a6a6371b6046e6c3af09128230e0ad32
SHA512 26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8
SSDEEP 192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
TLSH
T1CD72294A4BA80313ED736B309AA4D443FE38A7D75812D72F1985F1B91CDB7D4AF21628
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

10:84:6c:5c:c9:e6:39:56:a6:5f:23:06:01:58:8b:e1:ae:37:c4:fe:71:62:f4:b5:f7:ae:87:52:ec:0c:f4:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

12894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ExtremeDumper.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

dnlib.dll

mscoree

dotnet

extremedumper.antiantidump.dll

mscoree

dotnet

microsoft.diagnostics.runtime.dll

mscoree

dotnet

nativesharp.dll

mscoree

dotnet

ookii.dialogs.winforms.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.numerics.vectors.dll

PE Signature issue

mscoree

dotnet

system.resources.extensions.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet