IttihadPack-123.rar
- SHA256 88a9da68236c688eed0dfc09b808c31ce7c954cecabe0bde6eed063711ff4466
Password
123
Overview
overview
10Static
static
10IttihadToo...V1.exe
windows10-2004-x64
7IttihadToo...V1.exe
windows11-ltsc_2024-x64
7IttihadToo...er.exe
windows10-2004-x64
7IttihadToo...er.exe
windows11-ltsc_2024-x64
7IttihadToo...PL.exe
windows10-2004-x64
7IttihadToo...PL.exe
windows11-ltsc_2024-x64
7IttihadToo...fy.exe
windows10-2004-x64
1IttihadToo...fy.exe
windows11-ltsc_2024-x64
1IttihadToo...xp.exe
windows10-2004-x64
1IttihadToo...xp.exe
windows11-ltsc_2024-x64
1IttihadToo...mp.exe
windows10-2004-x64
1IttihadToo...mp.exe
windows11-ltsc_2024-x64
1IttihadToo...er.exe
windows10-2004-x64
1IttihadToo...er.exe
windows11-ltsc_2024-x64
1IttihadToo...al.exe
windows10-2004-x64
1IttihadToo...al.exe
windows11-ltsc_2024-x64
1IttihadToo...er.exe
windows10-2004-x64
1IttihadToo...er.exe
windows11-ltsc_2024-x64
1IttihadToo...co.exe
windows10-2004-x64
1IttihadToo...co.exe
windows11-ltsc_2024-x64
1IttihadToo...il.exe
windows10-2004-x64
1IttihadToo...il.exe
windows11-ltsc_2024-x64
1IttihadToo...il.exe
windows10-2004-x64
3IttihadToo...il.exe
windows11-ltsc_2024-x64
3IttihadToo...mp.exe
windows10-2004-x64
3IttihadToo...mp.exe
windows11-ltsc_2024-x64
3IttihadToo...CA.exe
windows10-2004-x64
1IttihadToo...CA.exe
windows11-ltsc_2024-x64
1IttihadToo...xp.exe
windows10-2004-x64
3IttihadToo...xp.exe
windows11-ltsc_2024-x64
3IttihadToo...al.exe
windows10-2004-x64
3IttihadToo...al.exe
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
IttihadTools/IttihadBinder/IttihadBinderV1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
IttihadTools/IttihadBinder/IttihadBinderV1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
IttihadTools/IttihadBomber/IttihadBomber.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
IttihadTools/IttihadBomber/IttihadBomber.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
IttihadTools/IttihadCPL/IttihadCPL.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
IttihadTools/IttihadCPL/IttihadCPL.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbExp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbExp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbImp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbImp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/Tracker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/Tracker.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/clrver.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/clrver.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/disco.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/disco.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcUtil.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcUtil.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbImp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbImp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WCA.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WCA.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinMDExp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinMDExp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target IttihadPack-123.rar
- Size 47.5MB
- Sample260918-3mfbaatepd
- SHA256 88a9da68236c688eed0dfc09b808c31ce7c954cecabe0bde6eed063711ff4466
- MD5 4acb65e19ab1bf6ef891c85cf2c187a4
- SHA1 2cbc4601e44d3df8b27cc5761ce9832c3f79b176
- SHA512 7629da0d9daca3e5d086ff9549bfb0ebe1f0ffe930c3647426a964426b6c621626d88612d54f0895fc3f950cdfc57aac36753f871b5c1000c57b628a27cb1f89
- SSDEEP 786432:D7o9L2WkEvUE3poIFOYdJFntGNP6fbD45HxLmG43UJEu+ek9Xv1GCPmbd1FfgjEl:sSWrUE3zFOCn26fb0XCUJ+pxvUsQpD1
- TLSH T1E8B7335A3FC0A8D06FAC06BEF047741FE0C6BEEA86569B1E3A4D3706343941B771459A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Extra.dll disable_win_def - Detects BlankGrabber stealer in memory 1 IoCs
resource yara_rule static1/unpack001/IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe blankgrabber_dmp - Detects DonutLoader 2 IoCs
resource yara_rule static1/unpack001/IttihadTools/IttihadKit/Programs/donut.exe family_donutloader static1/unpack001/IttihadTools/ServiceBuilder/donut.dll family_donutloader - Detects Umbral payload 1 IoCs
resource yara_rule static1/unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Grabber.payload family_umbral_obfuscated - Unsigned PE 67 IoCs
Checks for missing Authenticode signature.
resource unpack001/IttihadTools/IttihadBinder/IttihadBinderV1.exe unpack001/IttihadTools/IttihadBomber/IttihadBomber.exe unpack001/IttihadTools/IttihadCPL/IttihadCPL.exe unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/NSBin.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll unpack001/IttihadTools/IttihadCrypter/IttihadCrypter.exe unpack001/IttihadTools/IttihadInjector/IttihadInjector.exe unpack001/IttihadTools/IttihadKit/IttihadKit.exe unpack001/IttihadTools/IttihadKit/Programs/donut.exe unpack001/IttihadTools/IttihadLoader/IttihadLoader.exe unpack001/IttihadTools/IttihadLoader/dnlib.dll unpack001/IttihadTools/IttihadObfuscator/IttihadObfuscator.exe unpack001/IttihadTools/IttihadProtecotrV2/IttihadProtector.exe unpack001/IttihadTools/IttihadProtecotrV2/MetroFramework.Fonts.dll unpack001/IttihadTools/IttihadProtecotrV2/MetroFramework.dll unpack001/IttihadTools/IttihadProtecotrV2/dnlib.dll unpack001/IttihadTools/IttihadProtectorV1/IttihadProtector.exe unpack001/IttihadTools/IttihadProtectorV1/dnlib.dll unpack001/IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Chat.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Extra.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/FileManager.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/FileSearcher.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Grabber.payload unpack001/IttihadTools/IttihadRAT v1.2/Plugins/LimeLogger.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/LockApplications.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Miscellaneous.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Options.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/ProcessManager.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/Recovery.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/RemoteCamera.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/RemoteDesktop.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/SendFile.dll unpack001/IttihadTools/IttihadRAT v1.2/Plugins/SendMemory.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Mono.Cecil.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/NSBin.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/System.Management.Automation.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll unpack001/IttihadTools/IttihadWorm/IttihadWorm.exe unpack001/IttihadTools/RDP Killer/RDPKiller.exe unpack001/IttihadTools/ServiceBuilder/IttihadServiceBuilder.exe unpack001/IttihadTools/ServiceBuilder/donut.dll unpack001/IttihadTools/VirusBuilder/VirusBuilder.exe - Untrusted Codesign Signers 16 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/IttihadTools/IttihadBomber/Guna.UI2.dll unpack001/IttihadTools/IttihadCPL/Guna.UI2.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll unpack001/IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll unpack001/IttihadTools/IttihadCrypter/Guna.UI2.dll unpack001/IttihadTools/IttihadInjector/Guna.UI2.dll unpack001/IttihadTools/IttihadKit/Guna.UI2.dll unpack001/IttihadTools/IttihadLoader/Guna.UI2.dll unpack001/IttihadTools/IttihadObfuscator/Guna.UI2.dll unpack001/IttihadTools/IttihadProtecotrV2/Guna.UI2.dll unpack001/IttihadTools/IttihadProtectorV1/Guna.UI2.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll unpack001/IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll unpack001/IttihadTools/IttihadWorm/Guna.UI2.dll unpack001/IttihadTools/ServiceBuilder/Guna.UI2.dll unpack001/IttihadTools/VirusBuilder/Guna.UI2.dll
File Explorer
-
IttihadPack-123.rar.rar 47.5MB
-
IttihadTools/IttihadBinder/IttihadBinderV1.exe.exe 699KB
-
IttihadTools/IttihadBomber/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadBomber/IttihadBomber.exe.exe 628KB
-
IttihadTools/IttihadCPL/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadCPL/IttihadCPL.exe.exe 600KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Analysis.vb.backup.vbs 2KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Application.Designer.vb441B
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Application.myapp481B
-
IttihadTools/IttihadCPL/Stub/CPLApplet/AssemblyInfo.vb.backup203B
-
IttihadTools/IttihadCPL/Stub/CPLApplet/CPLApplet.vbproj.backup5KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Exclusion.vb.backup720B
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Resources.Designer.vb.vbs 3KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Resources.resx.vbs 6KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Settings.Designer.vb.vbs 2KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Settings.settings279B
-
IttihadTools/IttihadCPL/Stub/CPLApplet/Test.vb.backup.vbs 6KB
-
IttihadTools/IttihadCPL/Stub/CPLApplet/packages.config136B
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/IlDasmrc.dll.dll 59KB
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/TrackerUI.dll.dll 22KB
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/flogvwrc.dll.dll 21KB
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/gacutlrc.dll.dll 34KB
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/pevrfyrc.dll.dll 23KB
-
IttihadTools/IttihadCPL/Stub/SDKs/1033/snrc.dll.dll 35KB
-
IttihadTools/IttihadCPL/Stub/SDKs/AxImp.exe.exe 60KB
-
IttihadTools/IttihadCPL/Stub/SDKs/CorFlags.exe.exe 169KB
-
IttihadTools/IttihadCPL/Stub/SDKs/FUSLOGVW.exe.exe 186KB
-
IttihadTools/IttihadCPL/Stub/SDKs/IlDasm.chm.chm 17KB
-
IttihadTools/IttihadCPL/Stub/SDKs/MSBuildTaskHost.exe.exe 168KB
-
IttihadTools/IttihadCPL/Stub/SDKs/MSBuildTaskHost.exe.config.xml 1KB
-
IttihadTools/IttihadCPL/Stub/SDKs/PEVerify.exe.exe 206KB
-
IttihadTools/IttihadCPL/Stub/SDKs/PEVerify.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/ResGen.exe.exe 90KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SecAnnotate.exe.exe 1.2MB
-
IttihadTools/IttihadCPL/Stub/SDKs/SqlMetal.exe.exe 292KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SqlMetal.exe.config156B
-
IttihadTools/IttihadCPL/Stub/SDKs/StoreAdm.exe.exe 41KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SvcConfigEditor.exe.exe 2.3MB
-
IttihadTools/IttihadCPL/Stub/SDKs/SvcConfigEditor_4.0.chm.chm 58KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SvcTraceViewer.chm.chm 59KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SvcTraceViewer.exe.exe 675KB
-
IttihadTools/IttihadCPL/Stub/SDKs/SvcUtil.exe.exe 197KB
-
IttihadTools/IttihadCPL/Stub/SDKs/TlbExp.exe.exe 62KB
-
IttihadTools/IttihadCPL/Stub/SDKs/TlbImp.exe.exe 188KB
-
IttihadTools/IttihadCPL/Stub/SDKs/Tracker.exe.exe 121KB
-
IttihadTools/IttihadCPL/Stub/SDKs/WCA.exe.exe 52KB
-
IttihadTools/IttihadCPL/Stub/SDKs/WFC.exe.exe 57KB
-
IttihadTools/IttihadCPL/Stub/SDKs/WFC.exe.config.xml 4KB
-
IttihadTools/IttihadCPL/Stub/SDKs/WSatUI.dll.dll 235KB
-
IttihadTools/IttihadCPL/Stub/SDKs/WinMDExp.exe.exe 1.3MB
-
IttihadTools/IttihadCPL/Stub/SDKs/WinRes.exe.exe 151KB
-
IttihadTools/IttihadCPL/Stub/SDKs/al.exe.exe 190KB
-
IttihadTools/IttihadCPL/Stub/SDKs/al.exe.config.xml 182B
-
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_intern.exe.exe 73KB
-
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_merge.exe.exe 917KB
-
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_merge.exe.config.xml 279B
-
IttihadTools/IttihadCPL/Stub/SDKs/clrver.exe.exe 82KB
-
IttihadTools/IttihadCPL/Stub/SDKs/disco.exe.exe 67KB
-
IttihadTools/IttihadCPL/Stub/SDKs/gacutil.exe.exe 115KB
-
IttihadTools/IttihadCPL/Stub/SDKs/gacutil.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/ildasm.exe.exe 497KB
-
IttihadTools/IttihadCPL/Stub/SDKs/ildasm.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/lc.exe.exe 47KB
-
IttihadTools/IttihadCPL/Stub/SDKs/lc.exe.config.xml 182B
-
IttihadTools/IttihadCPL/Stub/SDKs/mage.exe.exe 89KB
-
IttihadTools/IttihadCPL/Stub/SDKs/mageui.exe.exe 705KB
-
IttihadTools/IttihadCPL/Stub/SDKs/mgmtclassgen.exe.exe 46KB
-
IttihadTools/IttihadCPL/Stub/SDKs/sgen.exe.exe 65KB
-
IttihadTools/IttihadCPL/Stub/SDKs/sn.exe.exe 223KB
-
IttihadTools/IttihadCPL/Stub/SDKs/sn.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/wsdl.exe.exe 100KB
-
IttihadTools/IttihadCPL/Stub/SDKs/wsdl.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/IlDasmrc.dll.dll 59KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/TrackerUI.dll.dll 22KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/flogvwrc.dll.dll 21KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/gacutlrc.dll.dll 34KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/pevrfyrc.dll.dll 23KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/snrc.dll.dll 35KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/AxImp.exe.exe 59KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/CorFlags.exe.exe 187KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/FUSLOGVW.exe.exe 213KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/IlDasm.chm.chm 17KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/MSBuildTaskHost.exe.exe 168KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/MSBuildTaskHost.exe.config.xml 1KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe.exe 233KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/SvcUtil.exe.exe 196KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbExp.exe.exe 62KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbImp.exe.exe 188KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/Tracker.exe.exe 129KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe.exe 215KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe.config.xml 182B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/clrver.exe.exe 82KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/disco.exe.exe 67KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe.exe 127KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/ildasm.exe.exe 557KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/ildasm.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/lc.exe.exe 46KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/lc.exe.config.xml 182B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/sgen.exe.exe 65KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/sn.exe.exe 245KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/sn.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/wsdl.exe.exe 100KB
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/wsdl.exe.config.xml 223B
-
IttihadTools/IttihadCPL/Stub/SDKs/x64/xsd.exe.exe 88KB
-
IttihadTools/IttihadCPL/Stub/SDKs/xsd.exe.exe 88KB
-
IttihadTools/IttihadCPL/Stub/SDKs/xsltc.exe.exe 58KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/3rd-party.txt521B
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg.nupkg 3.5MB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/License.txt1KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/Readme.md7KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/changelog.txt3KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.dll 4KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi216B
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw.dll 5KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1.ps1 5KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll.dll 42KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll.dll 88KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll.dll 36KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll.dll 263KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/NSBin.dll.dll 15KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/NSBin.pdb39KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll.dll 55KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb117KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll.dll 90KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb241KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll.dll 352KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT1KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT2KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/README.md688B
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/_Version.txt632B
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/changelog.txt1KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll.dll 3.6MB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe.exe 343KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe.exe 344KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll.dll 29KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll.dll 1.2MB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll.dll 989KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/init.ps1311B
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/install.ps1.ps1 2KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll.dll 31KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb49KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets5KB
-
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/uninstall.ps1969B
-
IttihadTools/IttihadCrypter/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadCrypter/IttihadCrypter.exe.exe 818KB
-
IttihadTools/IttihadGuard/IttihadGuard.py21KB
-
IttihadTools/IttihadGuard/setup.bat525B
-
IttihadTools/IttihadInjector/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadInjector/IttihadInjector.exe.exe 613KB
-
IttihadTools/IttihadKit/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadKit/IttihadKit.exe.exe 414KB
-
IttihadTools/IttihadKit/Programs/donut.exe.exe 247KB
-
IttihadTools/IttihadLoader/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadLoader/IttihadLoader.exe.exe 427KB
-
IttihadTools/IttihadLoader/dnlib.dll.dll 1.1MB
-
IttihadTools/IttihadNuker/IttihadNuker.py26KB
-
IttihadTools/IttihadNuker/setup.bat388B
-
IttihadTools/IttihadObfuscator/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadObfuscator/IttihadObfuscator.exe.exe 820KB
-
IttihadTools/IttihadProtecotrV2/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadProtecotrV2/IttihadProtector.exe.exe 2.1MB
-
IttihadTools/IttihadProtecotrV2/MetroFramework.Fonts.dll.dll 656KB
-
IttihadTools/IttihadProtecotrV2/MetroFramework.dll.dll 149KB
-
IttihadTools/IttihadProtecotrV2/dnlib.dll.dll 1.1MB
-
IttihadTools/IttihadProtectorV1/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadProtectorV1/IttihadProtector.exe.exe 3.2MB
-
IttihadTools/IttihadProtectorV1/dnlib.dll.dll 1.1MB
-
IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe.exe 19.9MB
-
IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe.config.xml 5KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Chat.dll.dll 24KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Extra.dll.dll 29KB
-
IttihadTools/IttihadRAT v1.2/Plugins/FileManager.dll.dll 30KB
-
IttihadTools/IttihadRAT v1.2/Plugins/FileSearcher.dll.dll 123KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Grabber.payload.exe 233KB
-
IttihadTools/IttihadRAT v1.2/Plugins/LimeLogger.dll.dll 25KB
-
IttihadTools/IttihadRAT v1.2/Plugins/LockApplications.dll.dll 10KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Miscellaneous.dll.dll 90KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Newtonsoft.Json.xml.xml 553KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Options.dll.dll 27KB
-
IttihadTools/IttihadRAT v1.2/Plugins/ProcessManager.dll.dll 25KB
-
IttihadTools/IttihadRAT v1.2/Plugins/Recovery.dll.dll 263KB
-
IttihadTools/IttihadRAT v1.2/Plugins/RemoteCamera.dll.dll 59KB
-
IttihadTools/IttihadRAT v1.2/Plugins/RemoteDesktop.dll.dll 34KB
-
IttihadTools/IttihadRAT v1.2/Plugins/SendFile.dll.dll 25KB
-
IttihadTools/IttihadRAT v1.2/Plugins/SendMemory.dll.dll 27KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Analysis.vb.backup.vbs 2KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Application.Designer.vb441B
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Application.myapp481B
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/AssemblyInfo.vb.backup203B
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/CPLApplet.vbproj.backup5KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Exclusion.vb.backup720B
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Resources.Designer.vb.vbs 3KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Resources.resx.vbs 6KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Settings.Designer.vb.vbs 2KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Settings.settings279B
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Test.vb.backup.vbs 6KB
-
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/packages.config136B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/IlDasmrc.dll.dll 59KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/TrackerUI.dll.dll 22KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/flogvwrc.dll.dll 21KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/gacutlrc.dll.dll 34KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/pevrfyrc.dll.dll 23KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/snrc.dll.dll 35KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/AxImp.exe.exe 60KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/CorFlags.exe.exe 169KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/FUSLOGVW.exe.exe 186KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/IlDasm.chm.chm 17KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/MSBuildTaskHost.exe.exe 168KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/MSBuildTaskHost.exe.config.xml 1KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/PEVerify.exe.exe 206KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/PEVerify.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ResGen.exe.exe 90KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SecAnnotate.exe.exe 1.2MB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SqlMetal.exe.exe 292KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SqlMetal.exe.config156B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/StoreAdm.exe.exe 41KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcConfigEditor.exe.exe 2.3MB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcConfigEditor_4.0.chm.chm 58KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcTraceViewer.chm.chm 59KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcTraceViewer.exe.exe 675KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcUtil.exe.exe 197KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbExp.exe.exe 62KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbImp.exe.exe 188KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/Tracker.exe.exe 121KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WCA.exe.exe 52KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WFC.exe.exe 57KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WFC.exe.config.xml 4KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WSatUI.dll.dll 235KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinMDExp.exe.exe 1.3MB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinRes.exe.exe 151KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe.exe 190KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe.config.xml 182B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_intern.exe.exe 73KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_merge.exe.exe 917KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_merge.exe.config.xml 279B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/clrver.exe.exe 82KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/disco.exe.exe 67KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/gacutil.exe.exe 115KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/gacutil.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ildasm.exe.exe 497KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ildasm.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/lc.exe.exe 47KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/lc.exe.config.xml 182B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mage.exe.exe 89KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mageui.exe.exe 705KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mgmtclassgen.exe.exe 46KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sgen.exe.exe 65KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sn.exe.exe 223KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sn.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/wsdl.exe.exe 100KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/wsdl.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/IlDasmrc.dll.dll 59KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/TrackerUI.dll.dll 22KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/flogvwrc.dll.dll 21KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/gacutlrc.dll.dll 34KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/pevrfyrc.dll.dll 23KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/snrc.dll.dll 35KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/AxImp.exe.exe 59KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/CorFlags.exe.exe 187KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/FUSLOGVW.exe.exe 213KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/IlDasm.chm.chm 17KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/MSBuildTaskHost.exe.exe 168KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/MSBuildTaskHost.exe.config.xml 1KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/PEVerify.exe.exe 233KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/PEVerify.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/SvcUtil.exe.exe 196KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/TlbExp.exe.exe 62KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/TlbImp.exe.exe 188KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/Tracker.exe.exe 129KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/al.exe.exe 215KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/al.exe.config.xml 182B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/clrver.exe.exe 82KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/disco.exe.exe 67KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/gacutil.exe.exe 127KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/gacutil.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/ildasm.exe.exe 557KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/ildasm.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/lc.exe.exe 46KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/lc.exe.config.xml 182B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sgen.exe.exe 65KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sn.exe.exe 245KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sn.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/wsdl.exe.exe 100KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/wsdl.exe.config.xml 223B
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/xsd.exe.exe 88KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/xsd.exe.exe 88KB
-
IttihadTools/IttihadRAT v1.2/Tools/SDKs/xsltc.exe.exe 58KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/3rd-party.txt521B
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg.nupkg 3.5MB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/License.txt1KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/Readme.md7KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/changelog.txt3KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.dll 4KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi216B
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw.dll 5KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1.ps1 5KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll.dll 42KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll.dll 88KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll.dll 36KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Mono.Cecil.dll.dll 263KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/NSBin.dll.dll 15KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/NSBin.pdb39KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll.dll 55KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb117KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll.dll 90KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb241KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/System.Management.Automation.dll.dll 352KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT1KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT2KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/README.md688B
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/_Version.txt632B
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/changelog.txt1KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll.dll 3.6MB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe.exe 343KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe.exe 344KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll.dll 29KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll.dll 1.2MB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll.dll 989KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/init.ps1311B
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/install.ps1.ps1 2KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll.dll 31KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb49KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets5KB
-
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/uninstall.ps1969B
-
IttihadTools/IttihadTroll/IttihadTroll.py7KB
-
IttihadTools/IttihadWorm/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/IttihadWorm/IttihadWorm.exe.exe 628KB
-
IttihadTools/RDP Killer/RDPKiller.exe.exe 30KB
-
IttihadTools/ServiceBuilder/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/ServiceBuilder/IttihadServiceBuilder.exe.exe 545KB
-
IttihadTools/ServiceBuilder/donut.dll.exe 247KB
-
IttihadTools/VirusBuilder/Guna.UI2.dll.dll 2.1MB
-
IttihadTools/VirusBuilder/VirusBuilder.exe.exe 289KB
IttihadTools/IttihadBinder/IttihadBinderV1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f9b84199a250cd4c6b5a587b02df6260d6d4e3472c85959d223b779edc70bab5
- MD5 17380504f908762afaf58d7af1d3d71d
- SHA1 c7bdbfa2ed86e29bc8501cfebd0f5c5c2aee7a59
- SHA512 883ff23c9ebcfbc02e4593127fbc49ebe10f6127af35d0a451b0a35751695656e1d9b5029370cf7c385f93269f751705064fd71060876683fa6c68bd6779b591
- SSDEEP 6144:c85dCbmJdDtFAjI/SqAg8m5xA+eylyI385dC:xCIAjIaqAg8GxPTWC
- TLSH T164E458CA7657D619D087213CE8A2CDF08A20FC96FA59425B3BA8BF1E717F193470560B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
521598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
501KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
196KB
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadBomber/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
123
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadBomber/IttihadBomber.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ef376c0c13d42e1473770db48cf63ed5b8707b2081f25564089cc70c8f56fffe
- MD5 68b9182d4714c5f67b4bbf1e45590888
- SHA1 9bc9d0310b75e12dae570de6e4e385536164f9b3
- SHA512 3873594c662ad9455f1918120f54262c4bfb04888944c80731e31c474c357c403a47761a8368d3461eee037811b0d5deb74f72beaa8813260b3fe10f45529e0a
- SSDEEP 6144:jtYHseBhgviIaGfC7eMGtSi5tFAjI/SqAg8m5xA+eykyCWtqDuV+iiI/LRFD+MSX:jePhgr5qGVAjIaqAg8GxPTyW0D8FyMQ
- TLSH T1B7D48D0E3359AD34D892F63433F4A6B70B3D5AAF5A03D209F6657A7E1D2B810A75138C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
4
Entry point
463438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
445KB
Virtual Size
444KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
123
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/IttihadCPL.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 ee66d0ecfb70b4950be0fdea69b24a68e7b1cd00463acf44711b4476e947dada
- MD5 80fbaa4d84d7096e90a46964fc90c5b2
- SHA1 69960c8bb8207bb44016646249eb7bebf23f69a6
- SHA512 84839ed4e567eac59a18099f7f846efe7202b71a3ec42259ed6f770d305209ec3ea6013e8ddc42769b21f2a209afa398b175553a4edbabaecd15319c51e73d9d
- SSDEEP 6144:cKM+sWHcUKi8wpR7ILCbIGVn9IeygEu01u/6ZM2JvoZz2vyq++tAWc:bzJ83i8Att9ITgr8Q6ZfJvgz2qq++tbc
- TLSH T135D44C5ECDA573A5C2F88CFDC6438C132887F64EE989C755201BAA5C06DBCD494F2E29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/CPLApplet/Analysis.vb.backup
- SHA256 e31ca298188029e8a4c1f571d6d048e9c1e7b2b6f87d4396f5859c58d5c9a204
- MD5 5f214b6fa3c529973312febec4538833
- SHA1 50661414bbe80a707dff68c96e4e89b320a3600a
- SHA512 37950f87efc3538cb495b980214266051c5b14282ba242a51c48df730722500c00a7231c3d218c6559e286299e472d9dd95fe097ece522b4cf8f15d6ce36bc9b
- TLSH T19451B82AB996B5B2843EC839C81FB057FD94065391598C81F9CCB2D91F361CCB261AB2
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Application.Designer.vb
- SHA256 043ae3ae093cdf8b175cdd82a0352c6198000def6a344c389e5fd0bb2985c7f3
- MD5 4e8a0729963262004a4bebf1327489cd
- SHA1 73cae6f853229d8e145a0a9353232258fb735a0d
- SHA512 81fdf80f18264845426a2ad4e7e23b8569d3a2cce49e74143f58a3ecffc3a5ad771f34410bbfbcd2508f1b28b95fc3deafca5b03cfad01b06cb5dffb43371997
- TLSH T15DF02B711C85BA7191B2C1C0210BC921C9B2B2CECE95CD773D4E9B4EE72061D911C5D4
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Application.myapp
- SHA256 76cc1f6d4aadf6efbc2c62c21ed4cb987d55b7036d4380851aada1e05d48dee8
- MD5 9a61ce94d05f84833fa4cff2de9a56b2
- SHA1 52e3c4e058b93f0e314eb8889eb871beda2f7709
- SHA512 3f77b9f1fd1f8a3782e03b41c4dbaa1e7904d88d207bc9a866f859946d0fdaf53a768629b30c84af6bc08f7dd141d96882fa4ae4260d5d85ea53c66c0b6055de
- TLSH T13DF0278882D1546486D2E6B2F568CAC92163F63C8BE48C98B4E05C8F62410CC22D79CB
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/AssemblyInfo.vb.backup
- SHA256 581bdee2c73a75d08fe2550f42adad631f1172735307e555e3c3d0f3f5324f67
- MD5 6de7b4b867660aca8e852c4265b6490d
- SHA1 a69be8a3d96d3b16af17d62ce73c8c26d6209f7a
- SHA512 204abdc9d3dc2956ccd5bfe977ec0718555d12046d1691996a5782b34356a09e0ef4820f72fa8828d59d4aa31b9c88cf0584fd382c51f144ba04e0c6bd136959
- TLSH T148D012E00146FBD20F1209C7BE93B495053A073522E86CA8B0CE3A22C6E7D6C02346D7
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/CPLApplet.vbproj.backup
- SHA256 3362d5f91f138e18f7e3ad902e582091d9b26528d7ee1bd90bc01de6a0fefc8d
- MD5 014f83d93f53c2071667e8a3c57ca947
- SHA1 c1906fb59655657773a3f068fc74f94e45e89ac7
- SHA512 14ec9309e720c16d94cc92a2926be3c74c1282c628a67f778d480a05dd77adeaa6ed8b7496d2bb791e4eb06808e6e203a9efa45ba4a6e27e6348e4e4501b3602
- SSDEEP 96:pWnpu5Yxu9c9u2/TMTQMlHzEAiNrhPEOsHNSL5vB5+NAqLJRKR0RfUdOSepL+U:vou9c9u27r8VgSNvHU7egU
- TLSH T159B14F35E6CC7EEC03B22136A123E604EE6493E315B00C64B28DE6879FB35905167B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Exclusion.vb.backup
- SHA256 5d2368bc37b64415e88aeda0bc133c4f7a3adff942bddae037991e78ab3c458e
- MD5 b5317dc91a5dcaf500be83edcebe3027
- SHA1 44743dec5d8672a457f35324410ae4a93375604b
- SHA512 b97f80681bed371c89a54d27532953b0dcb30da7db1b4cc4cbe5fdb8cb8a0f41c432bffc821f5ebebf81329394af04df26b6f12fea8521389596e8f9e96f8e47
- TLSH T12801AC27382363A2CA7F1E0454AA5307E4AB653391654D60B0BC2258BF3C4D7C32429F
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Resources.Designer.vb
- SHA256 903af345f0ed40b68069826e771280276ecaad05041e8cda10eb8d6978ef2a23
- MD5 c88998161398e6fbc0c161349a41697d
- SHA1 e2b4183f2924efe665bb33dd3b6bb97f7e23bbc4
- SHA512 91a7a65878e1e59b95c7e193f6e28640136f3e560f9d85b318ea19c70e8d257405ae029627fa6b97c89ecc091663df18963cf344f2a16d6bfe11bb859873d773
- TLSH T1CB519BB71F8E91311432DD476A05B452C9A211A7C53C6DA9F9DE41A98FF338403BEDB2
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Resources.resx
- SHA256 88abaf8ff9dc2a85f2f09da1ec4fceddd84e61c8b4d2012e073c1e76529c49e3
- MD5 f1bfe5efeda1d212752d2860168f6606
- SHA1 5d0a199b3d41b7acda7924d415e4be16e3594822
- SHA512 46fcc6cece177680f1a1fb553159b7b35814d54ccbc2c2ed1de6b2a51a0b7b009df476c80f4a42c131271929d86d5348ffff38461666c90667d54b9e3007d294
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuF88EJs:KjrbLPD9sLvIzSvKgIqUyahF8F2l
- TLSH T150D12145B1C5DD260FB3482DE6523988F7A8823B02356C90B4DC661F5F73885A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Settings.Designer.vb
- SHA256 d59d90a75f20df11ae31c503e80e991a4965ba939133361560da4bb3939f1ec3
- MD5 896d1a4703c651eddd63c0cdf93697b7
- SHA1 9bffea15650b7bb4e278eda0fb2edb54ead52fef
- SHA512 feed56d29e7825157f2207d30682bdebe6a3f31f43b18821ff0cc45204915d0f2d2d82e96d24e7556610eb440aeec5e42ec44a1c54de32116b117c34d9948ade
- TLSH T1A751EDBE2F49A27D1971DF84DB0AB553CEB002A7891D78B0748C21C9CF3678413BDA60
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Settings.settings
- SHA256 aee1c3cda12a474a7a8ead292418eb734cde3c4a74a4977e0bb0ed160613a1eb
- MD5 4a12ce12282d0ee237b12e7513037c50
- SHA1 9a820bef12266f5e641770f44af881f9517f5222
- SHA512 c8229ffec5e3a2df33855a22f53fade99c88e7c92404c35529d2168ef21597de0477164fb888da7192fb3745d47980fa4e8a6259485dfe5a34b481ddd780a432
- TLSH T189D0A789A4C88C0A93317AB0F4ACE33C95146767856E9974B2743C4F19071D61AD75EB
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/Test.vb.backup
- SHA256 488488aa340d14db174611f61cba99b3803a5d5205c026b238c7c26c719cd50c
- MD5 b97102cb2894bb49bf9498c21bf4e3ae
- SHA1 2d1bbbf980682e711cf31aac24dc54c406b4a68e
- SHA512 173def7af8e09ec81d903b2780823d67f9391366f0a320e5968d1de7822b5d4a8fb4bff3c7f53e446ca30930017ef11343bb19afd9c5c26ff6f22117c138ba46
- SSDEEP 96:N2/F7PWFQqD95+WaXTRMtrpsY7L9XYDYwJ+Co4H/GP/IlIgjPTZL3gkmDDHGI2ax:ohPUbqsj4uP/IbuVGI2ax
- TLSH T1E4E19626BD4B967481BF44816D5BA48EEFE71633301858A0B8CCE7448FBA0C853E87DD
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/CPLApplet/packages.config
- SHA256 b9eed04f111d200c41660aa0f8a5370cbd85444519eacf326d145a1edc8cf4df
- MD5 abbd3be67d319a4db1e6ff4cb0d27bd9
- SHA1 c6087627df0b91093c1ffca58c42b19a18977ae8
- SHA512 3ac44d6d6a4c3364a49dc581dbd1a801ed03fe1529e68095b45df4dd1c1a2629fe30efe4eef7f1c7ae29d1bf44e4af6d4da65d1ff517e0b694018db54e6892b1
- TLSH T1ADC02B04122497330B601C24F3B8C4085B7C7127B0210BCC7D90420187220490287695
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/1033/IlDasmrc.dll
- SHA256 5d7c2f2b975af894be11a560971b018eb8bf498da5c9056bcdd7bca88bbb3113
- MD5 9d0c1bd1ea78db915f6b5daf9c53fdb0
- SHA1 5c69d5bcbb7ccdd95a2a3a9334c460e7c1668938
- SHA512 539cecb94a9b393a30741065a20a1338c742ee491877d045ae09281136b9ce95d84706c1a087519a3a845d015d46ff227c0f06ee1f2ecb85cbeb67b994db6e7c
- SSDEEP 384:8b3nqW3BHWOubNYAL1PWbYe3jKESkYqgzPk/SMnC0GftpBjEUa3GRNFtAHRN7MVD:8b3NPubhYKESkxi6UaBMGmkmx
- TLSH T1B053CB83D3EA84C0D4A199B0AD3B94A59E373D50643282DA4E64FF3F6E7BB109552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Digest
62:7f:96:15:84:51:82:1c:e8:fb:2b:8b:d0:dd:67:9d:f6:4b:70:61:cd:32:1d:9c:0e:c5:0d:ab:11:a1:54:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e9:a3:98:5d:06:ad:23:6e:72:0e:70:76:14:71:64:b4:51:60:39:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/1033/TrackerUI.dll
- SHA256 458a438434c49581b052fdcd0db5b1e21ca966e738440426963b24177ff9559b
- MD5 0aa38010fc32780174009c5530925c40
- SHA1 802a3933d4a401bdeae237d39beb24564e483913
- SHA512 ce5d8cc7c7504baa3ffdbdf11dfcaa27df087e6bb13baaca4a04bce0fac32ee202dab42bc7cf52e8476dce05119714b7425b1f8db63b2eb89d91c940e5c39d39
- SSDEEP 384:MXWD8WQTK78xJ8xClRAtkQG47h0GftpBjV4X3FtAHRN7LUklrhfbi:1jRG1iD6ALUOji
- TLSH T1F5B2A55057F84042F9F369B02AF9C9536D3BBAD25930D21D109DE29E0FF3BD19A14B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
75:a4:4c:39:91:61:a6:9b:d9:69:62:6a:bf:4a:40:22:8a:46:43:c3:4a:3d:6c:a7:70:86:f1:65:3d:6c:bc:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9b:bf:6c:80:5c:0e:5b:6f:b1:11:6b:50:98:fa:d6:ea:46:0a:82:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/1033/flogvwrc.dll
- SHA256 19b0cac27da5ce62d473c9620463b7d2fd17dee8de3268b5a08e120964b743bb
- MD5 6a7ec16333a987c588deb9edd2d645bd
- SHA1 8a21b738dd8ed1374aefee79f72b7c4abbce0d02
- SHA512 88ced1634396968c1855e9eef67fcfaa17205e451f2472dcf487e10201ed84539afc6e941224d6a168583398ce11dbaf5320dd33f4fc81ae8051077b00e7a474
- SSDEEP 384:iWzcqWZRQxnq2ELDF5RKfwMnC0GftpBjiu8wFtYbFtAHRN74lrhfN:0dcfXi+KRSV
- TLSH T187A2198187BC9406ECE36DB067F8DA837D3DFBD20D20951E2595F2991C92BD1EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
123
Digest
ed:b2:11:ae:df:b0:3b:c1:e7:2d:4b:d0:bf:cc:f1:03:17:76:b6:7c:2c:22:de:4f:a4:ab:5a:5c:43:da:f3:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:84:84:57:47:7e:36:ef:a2:51:19:b5:5b:f4:f0:41:82:e0:bd:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/1033/gacutlrc.dll
- SHA256 950f6c8ed8c61a11b66108a7143006f28351d1a46585ca4b2781aa0b0089697c
- MD5 0ad7732dac1ddde05a48cd7ffe0868dc
- SHA1 33792687aecab9e6b1e606cb426c4d3b20b06681
- SHA512 286cd7c9c568c68eb2a944a96b7f4e43874d6c93ba42058facf7b1310ee95b5c3b591901b4bd5166eff0784180e9ce9e44d699a96b4bb9e5f9ad534b8a741a78
- SSDEEP 384:go1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWm/L0GftpBjW5FtAHRN7Ob:gAIecY0QrQNCeK8iEaowk
- TLSH T16FF2FB8297EC0105F5F73E307DB5A5A21E7ABD92AD39D21D2198916D0AE3B80CD3077B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:80:4d:59:0a:6a:6e:82:a3:ce:4b:53:06:9b:fe:ca:a2:6b:7b:15:fb:75:14:dc:da:a1:7c:d2:17:af:b2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
4a:19:2a:59:9a:1e:53:e4:0a:17:1e:85:90:0f:cb:8f:a1:7d:fb:9c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/1033/pevrfyrc.dll
- SHA256 84e1f46ba4c03134d96bc9f3b6bfa0132ea8eff8fdf72969a7989b4753b02584
- MD5 af37abb1080964dbfdd56da426b336cf
- SHA1 46a1b404f7ca2619b63dbab771f177efedc0f4d9
- SHA512 07e5ea73a63d7f7c8129ffb659f3f86ed0ccfc31417f75f03d0990e127b71c9667822e29f416f4beb514063e8d454c4c9ea237fb14fcf776cd5889b7b129d22b
- SSDEEP 384:3uyneWNJXWbh8eMnC0GftpBjEso/FtAHRN72ClumkLet:3uyLQh8Ri6ImmkW
- TLSH T16BB2C6819BF84146FCF36E3066B8D9463D3FBFC15930921D0198E16D2EB37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:04:26:58:be:74:d3:e5:e0:85:55:82:9f:f0:cc:f0:84:ca:27:71:c5:e5:3a:f8:d3:2c:00:50:11:d9:01:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f7:89:1d:50:84:1e:f9:db:57:d4:7e:c6:08:47:58:6d:55:88:b0:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/1033/snrc.dll
- SHA256 2e6caa99964a3fd86ee7c3f554750f866faecb02112da698f578d02adc3b3b48
- MD5 703f3f14aaee73373ce01d9e68f1a950
- SHA1 a9019d12161699b148a803ab095c0273ac855d33
- SHA512 c69681e2bdb5384b8e824ac4c947c826c924a127ab2e1fc9d3098f14893c8d3c34790f6703d6244d67905fdafc27a719553efe4e317f67b0c492644aaf44ec4f
- SSDEEP 384:mDWJBkWS2ekwaaRGm7+bNItWIbdInm8J55M/L0GftpBj0IOFtAHRN7ClumkLR:DI/sIddInmU3iy0lmkR
- TLSH T102F22C8193FC8505F4F36F706AB496A21E3BBD91BD38C61E2185D56D09B2B90CA70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:26:cf:de:54:42:bd:b3:08:27:64:97:65:0c:b9:c4:4c:ca:c1:1b:b9:a8:59:5a:30:50:b4:30:7c:a0:6d:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
7e:28:f6:48:5e:33:a2:ff:4d:ca:6a:43:87:0f:b4:14:d5:57:31:d1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/AxImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9d5a7bb49a0133d3658a45ff08f5adfc6740e4085f9ff1d482a239a0c2d997ae
- MD5 e1d5d953e848d0a0808e31d11add3dd5
- SHA1 e29c00a39d3326fc0256c26a42af36161bfc922b
- SHA512 ec75c9a16668ec0d06e3b9189e939e9bc9f6878f701b785bebcdc95e93871ac6a2cfa49dde00d9079c945677cc2650bbd79c5a5c8b144589d6c71f54d0213d0e
- SSDEEP 768:4/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrn3itSc/Bk+:4/uG/5O7QBkcpoVTrEdg73YS6Bk+
- TLSH T10453D614A7E81212FAFB4B74ADF5C047597ABA53AE26D75C248D434D0E337808663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:5f:2c:29:66:5e:7e:87:90:03:83:81:24:e1:99:b7:6e:0f:30:60:a0:c2:0b:1c:dd:ac:1b:b5:fe:c1:fc:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:db:70:79:76:d0:4a:15:05:b2:fa:8f:3b:29:58:12:a7:8c:7d:bd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
AxImp.pdb
mscoree
_CorExeMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/CorFlags.exe
- IMPHASH fb1db825db945cf1996cb2b13e56c7f9
- SHA256 36b16cb0cffec65f99eb1a442dcba8696946c0a8fd10f9cb5f98629663f0da66
- MD5 3f10de142d081aff5efbde5be98999c3
- SHA1 d5232ff17d255d84df18516dfe2a53f01ec00618
- SHA512 d05d69bf3176f210429198fc7c988d467a077071adeee3fc512cf4c6f36a8cbeaf2ca3c935d6bc05c272a9e43e4d4126b2416237dd53224fbe648ee10de59671
- SSDEEP 1536:4AJelZaeQ+Ph5gS2/dvzeeyv8+WN18HWcq2bFX+IKCQTaudzrNr:4AJelZaePhESKcq2bZ+nxTagNr
- TLSH T14B04285337E1C072E8A20975D5F4D7F2697FF8614B3454C7A2886A1F6E213C2AA347E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c3:f2:08:90:37:a3:df:da:8f:33:d5:65:a7:15:d7:45:ed:75:48:ea:f9:a1:02:1e:84:23:41:a6:0a:1c:97:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
73:22:80:4c:b6:8e:7d:a2:d3:ce:b1:9d:6b:60:1a:70:ae:c9:12:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
70511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CorFlags.pdb
kernel32
GetConsoleMode
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
SetStdHandle
GetProcAddress
GetModuleHandleW
GetVersion
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleFileNameW
MultiByteToWideChar
GetLastError
RaiseException
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
IsValidCodePage
GetOEMCP
LCMapStringEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
GetConsoleCP
WriteConsoleW
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=172, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/FUSLOGVW.exe
- IMPHASH ed217f59b96438ffdaf4447d2e2f667a
- SHA256 c3e1f381588e6614d4ad1810710b8bd855dc03ce7d0f87d58007da9eed3c3ade
- MD5 51c6739dcb693b84cbcd66478a384e25
- SHA1 fa069f7183d39857d38a06f3331793a9cf2d08c5
- SHA512 85ad0b05aa8a724879bc0f247c09dd12e08110492caf0ae9c385fe1db6ed81bdeae2db5dcd827b06584d720687568d8c9b8ad47228f19c611f5ca625d83c6fba
- SSDEEP 3072:om5lkC3+WeDLO3Luj5lqQHPubRFMesSDdhBv:okkyIL5jHq1RFsyBv
- TLSH T1A11439237AE1C072E8A20975D5E8D7F2357EF8325B2454C3A3916F1F6C613D26A386D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:7d:c7:33:db:cc:91:6d:53:e9:01:ee:a2:95:5d:95:82:60:df:ab:03:f8:22:60:60:7c:c7:c4:49:06:50:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:11:10:34:43:cb:29:75:a7:35:d3:98:c0:ff:84:f2:ed:d1:11:44
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
85620
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
GetVersion
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
RtlUnwind
LoadLibraryW
LCMapStringEx
HeapSetInformation
HeapSize
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedDecrement
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
GetStringTypeW
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=201, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/SDKs/MSBuildTaskHost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b8ed1f99bdfd678d7f57ec11260cbf1c9ca9bdc1acd726fc78b8edb9bbf8b39
- MD5 6e745b8dd6d9353d8ff33d4db9074b6d
- SHA1 f9c384ebea0c56596c21cd5a5e00b483c6ef1fa1
- SHA512 fb02c7ebfc674c6eb0224d1c9ccf0806669d500ebd50c91bff0899700ca346a747a4e31bb4a4563327f7c66dfbff54bf669123333a86b32e8494a8a3b6ce1197
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0B52rUIEd7yjoVy2:s+vFZNOgbiWmNLzpRK2
- TLSH T1E5F35A0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d4:ec:45:a2:7b:ef:01:8f:1f:92:e7:e8:f1:fe:54:45:ee:ba:ca:7b:92:0b:a7:9c:22:bc:3b:d9:82:f7:fd:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
64:9a:87:0d:99:97:26:25:20:fe:b0:5a:0f:e0:48:a7:a4:f5:fa:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
161422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\x86\MSBuildTaskHost.pdb
mscoree
_CorExeMain
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/MSBuildTaskHost.exe.config
- SHA256 d6aea281c52a98c633586f0fb44641efc41f533acee10ce9322aa2d03379aaa6
- MD5 c9db610d35202b83dae4ac19c8db4471
- SHA1 919ee3f49b4e6f20c9d622a645add595352a2c05
- SHA512 ddb2e93d818344fcb87d229203b3330f2f3c9ae3d1457813f9a2b38e27183f3e39cc67fd9a1a9bcb073e896bdb7d81f581fed8d6345c75abd91b88e06e09b8a6
- TLSH T1B021AAA4E1C8BFB14F7109A77A661C64EBAD03A3684D450DB09D7A474F3699A430B132
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/PEVerify.exe
- IMPHASH cf2381f1ac623f10a51e0b293248761f
- SHA256 4179f460a7595f6d8c174fec75249f9b68288eec009fa5556a70a2f920b82c45
- MD5 e149a9e4d6f03e1f20180d9a04408dd7
- SHA1 ed743bf3d05eaf0f3caa06094dc5bc938e71506d
- SHA512 2a0b5288e92015300d61d57ad83e029132287e6f5583578ee20674d568efeca740fed1f067c4c89ee8ae86a7e4a7c34688e86878b2fedd3743aceb3137f6af44
- SSDEEP 3072:vYyJ2eYoEIzFF48LpbjOG6aSD15TRHjibAVNJmtFi:AA9ZOG6bJobqJWFi
- TLSH T102243B2377D1C072E8920475D2E8CBB2257EF9729B6454C3A3806F5F6C653C26A38BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:ec:83:c4:fb:10:13:77:74:06:43:df:c2:15:39:f7:6d:60:7f:45:32:8a:f9:9d:23:86:aa:51:e8:09:0e:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
47:f7:f4:51:34:16:a9:ec:4a:49:9c:86:34:ef:a7:57:37:77:c9:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
81344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
GetModuleHandleW
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
IsValidCodePage
GetOEMCP
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=47, id=207, version=50323,
count=17, id=205, version=50323,
count=129, id=206, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=181, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/PEVerify.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/ResGen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0fdefe2f4e84a6899d668bb57e6a815211847a63961b9814d31eb019dc5fd772
- MD5 6246a38965d8f5f21ef48f6335eff60f
- SHA1 93402944985a534194c88ff21e1683bfd52d5ed0
- SHA512 d0f62783ee7a50e4e6877df05f22f33515de20dbb1e4433bae3716824e6f6ca8c5974fd67ab569ebaf8721728fc2d6204dd43d59d9cece9c94958f0016254f3c
- SSDEEP 1536:DGcZg4cHAqgLsVmXitf8TLCnZc/xW7FocH2fQfiHs75HdjJCY8cJCjGL:DGSg4sFg4VmXitf8TLCZyIocH2fQfSCj
- TLSH T1A993191493F84212E6F74B717EF490435D36BA539E22C79D7C89634D1F627808AA2B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
20:cd:af:26:3a:2a:c7:e7:db:02:b1:42:75:d3:b7:98:73:a0:60:0f:91:6e:0e:ae:1d:90:9e:3c:95:c0:01:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3c:09:2a:c7:8f:af:2a:d2:ef:03:36:40:af:0e:50:68:14:ed:0c:4c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
81902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ResGen.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SecAnnotate.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 558c66f7c5584a92e7b414d037dfc04d60d8d06423ee846802a2dba825eb189b
- MD5 4f6b31d613b55cde700fb5cd3e485177
- SHA1 c78b8a02b3ff5c812c57b3a1939fe2c3897fffb8
- SHA512 e6184ee61830d6318ba7137b26e1272f9cbf597ad1d18392bff9a47d39904f110e1bf31548444971d370f4ffd792d5b0e8e1335376162d3b0a083f026c1a2297
- SSDEEP 24576:F836z8thQhhm0hK+H1GgJeVinsjh3MggZuGQu7xU7:Xm0hK+H1GgJeVinsjh3MggZuGnVi
- TLSH T116456C0AE7D88377D55F4B37A03104453FF2D44B6B43EB4A7A98AAB56C03BA09D92173
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a4:e5:35:9c:0c:12:23:7b:9f:e2:21:b0:e4:85:82:ff:7e:fe:04:ae:e0:51:23:4a:44:0b:7d:b3:c7:ec:e4:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d1:18:4b:65:bf:29:8f:30:c9:53:2d:6d:52:c7:65:0a:fe:98:da:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
1253438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SecAnnotate.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SqlMetal.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0ba2dbe554d85a843468f964ce932a9247d3652e804e687fc002110234b1558c
- MD5 69384c8a0d4597b4cfbe2a049bf5020f
- SHA1 99423e8fac1f706df77b19629d178a33a8826b2e
- SHA512 bf61e1b283a29542bb8975f4b5464f4261075b51465fa663218a198766f55d69880f310e40b7e9a0d157c6a8cbd1e3652006702ba52c8c33ebc852db9b99a90d
- SSDEEP 3072:MH8OfRNxUMYiX7CYxYawPw64WpVNljLEMLKq7+iip6upr0KLodUBosc1DieMcDJD:MdUhiX7CYxvwPw64WpTl5ur0fWe4pgF
- TLSH T19054193567FC0218F6FF6A3455B951098AF3FA139536E66C145C51AE0F63B808AB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:68:a2:45:3c:fb:fe:46:10:f1:27:55:19:8f:ef:76:2e:7a:15:d1:70:4d:15:07:e6:e2:ee:c2:45:74:61:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3a:e6:b4:8a:be:90:12:18:02:cc:54:03:2a:dc:31:8e:d6:ed:8f:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
287998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SqlMetal.pdb
mscoree
_CorExeMain
Name
.text
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SqlMetal.exe.config
- SHA256 3aabdcdb9ecb5252171e23b366c46afd593b860a7eb9346de4c3739b6968a66a
- MD5 e59a817454f452bbc6202823210177ff
- SHA1 7ddbf2c0fad4c6eee69392404e3d05b96a8378e8
- SHA512 6ff764740de133ac811ab7ae8812190a1bac41c36ae875c69383546a4135bacb7aa55fbaf409107167d607769fdbe5b711ef3be41f2ed2ade9b9713e45fc4525
- TLSH T155C08C8108C46C235B32463386B28968FBB5F3C244180814F8AF61B7090206803A3270
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/StoreAdm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad17cd90a078c4b37085e0f065f7af1426667d73408d9acfb74d81e232f4711d
- MD5 bce790978c48589199f2f1c4d153eaab
- SHA1 862fbe3a0abc4b8f81ec8192277714c832420529
- SHA512 2790e3052cbcbd743d08e39af281b0900fd2e4306adaa431554799633a7051a03b31aa3b374e4e015c85153ba9f1bb0e571b92ccefe33c8ab40e1a9d80dff5cc
- SSDEEP 768:NDNlLjCRr4pkoceXe6Iq8bgQXRPiIFzzp:NBtLcedCgiPnzzp
- TLSH T12713B624D7F80213F2F74BB099F5D087A876BA53AE34D65D28DA534D09227C08A52B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:7b:62:7c:0c:8b:98:7b:d2:8d:d1:62:cb:eb:14:33:bb:f6:54:50:dd:60:81:e1:fb:13:fc:77:66:b9:b1:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
81:da:1a:9a:5a:ff:8f:db:6a:53:d9:ba:4f:37:b5:83:2b:8d:bc:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
32126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
storeadm.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SvcConfigEditor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19dbd5d07c117ebfc9c39dd64cceff3499314280f1df611e380f835d80486c04
- MD5 1552f3e5390a30bce06a70069a09b6b7
- SHA1 0970aa17d307c5e5b8e14545f17876956abab840
- SHA512 62fdb9a957631fda1e058e14b64bd65bac050b250f9a5c2cae9e4659c7938df4bcd5558c03af8dc66c5978276b2351dbfd11343be07d5ffc45844202209c9c09
- SSDEEP 24576:ioQ+mP31vZo106r09Ni4SaqKj9yqBR++m0izcmhCDUv5CT9Z9GTtK:Ser09R++m0izcmhCDUvMGxK
- TLSH T119B5C72037EA110CE9FB1B712D3A81D517B6BE6A7E04CB5D21A9124C8D73B538B22777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:2d:c6:8e:51:0c:1c:58:64:aa:82:84:1e:ea:38:b2:f8:85:0a:58:6e:a6:c0:4b:07:9a:2c:14:b4:75:62:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
19:87:54:4d:f4:f2:12:3c:b7:a0:03:ae:da:06:ad:06:41:26:90:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
2405086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcConfigEditor.pdb
mscoree
_CorExeMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SvcConfigEditor_4.0.chm
- SHA256 731d8a58fb9e20d8a74f9b563a1eebaaa3a1aad5c904b76f8421fb92eb261818
- MD5 301b0030c9e35ef5ecd8dff7d005e6ac
- SHA1 505527ad90d24f89649d5b738093630529a2402a
- SHA512 010da137194f9fed7344546709b63aeac981f9ca7a80a13fedc986f6d8436bc0d0a1abc74cbe3ad428d5aa37d18bf14ab8a88c96540a0cc2a62a676402634fa1
- SSDEEP 1536:A2NPu7MV1k8yjSzSJVWA3sh1bfiIvYSRDNCfYsB:jNtm5Nsh1WwsB
- TLSH T1CC43F17353AB663ED6946BFCAFC69C25BA115B04C94550EE853CB23430AAB4F22D1CF1
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/SDKs/SvcTraceViewer.chm
- SHA256 bd58ad22dabaaff41dd9a7317c9154fbb6bac0af79693fdf8b143488cb93b759
- MD5 b2ca8bd7fb01ab0be666b7274dd536d5
- SHA1 f56e0be005aa64d2f5611a71960577579f508540
- SHA512 a4f73b464ca24842fe43d50453ba38072019c8765b14c335aa5f68a9357fb5c7d8604a29bd4a1bb5c8a1143977603a95bcddf30ad3d6839deacc3856e0bf7ab9
- SSDEEP 1536:qJUgqfkk52CjyL6BdR6Q5WU5Pj+Nvzr+hQfB4:GUz52Ce0FD1jW+h6O
- TLSH T15C43F152DC13E4A1E1A929BDBCE3414B8A007208D34DDBA4D576F18E7025FCEB0F911B
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/SDKs/SvcTraceViewer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d0246bcef7da19aa8e3efdf59f83e512e77fb11b913e59e543f511ee5d71f7a
- MD5 d0a66c70d8d724895a4aa39b9ff52f23
- SHA1 881855e21e3c0e9247422f71748a4f7df31ee980
- SHA512 d9228e69e6484ccff07193f6e2ad7ca3321a7bc9cffbb9e1b0c4578b5a14a482c529c8b592a102efa02578735ef18fb2f8fba796934074b0c12ea83b23689d70
- SSDEEP 6144:ewvHeaP2EcsiQ6HxtuHH+xeqKr5lxDp3nuGuHCFxoQ2/TEFxiw3AeD4sdYH4oPd0:Ji6J7nuGF5XxiRsI4oPYDhHkje
- TLSH T1CCE4290033E84B2AF4FF4B75B47854D597F6BE979699C24E1D89B1CE1EB27808813263
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:7c:05:d9:69:03:77:41:3c:67:51:8b:53:c2:3e:68:63:63:6f:d6:4a:ec:a7:2f:b6:af:7f:89:ff:65:f6:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
05:b2:92:6f:1e:08:f1:08:20:96:74:22:49:cc:59:e8:9d:7f:86:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
678382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcTraceViewer.pdb
mscoree
_CorExeMain
Name
.text
Size
654KB
Virtual Size
654KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/SvcUtil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 acb7bf20e53fde4e171067a6de2581bd2df374e26b75349c42c14278e5595024
- MD5 9f2bf87473dc29e0ed74d026101d80dd
- SHA1 71bbc200110ef22e6b2c90e9bbc0f49f7a6b4088
- SHA512 c12cb4ad24403fbd7eddb44f5d447e31b19171db94a8ac6ec6c4b9cbdc642ba69b55294a0f60f6e8f52b16b3bacccfa93a459d63b1c344fa3d001db4f92730a9
- SSDEEP 3072:Q3O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerFwyegYm1/K0UJ:SBGxsI46nYNs0xcXxY7J
- TLSH T17E142A3937EC1726F9FB4BB4BCB9C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:3b:47:3e:2e:6b:cd:9d:09:54:e8:2e:a2:2a:5c:90:24:c7:f6:1d:7e:0e:d3:ca:31:60:3e:76:e2:fe:63:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
cc:37:f1:ee:1b:a3:37:8d:09:ef:e5:6e:1d:ae:92:32:c8:43:15:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
191246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
svcutil.pdb
mscoree
_CorExeMain
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/TlbExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 502282813e8087248708a0a5841381e6a2d75478e22453e076e21b7c62ec2989
- MD5 466371c28d4604976360c08240a6a05c
- SHA1 c276d350e5091e332561a0a4b7f1515620311eb9
- SHA512 20d4280243524c6ee14b6934f495deb02f6a4a3f1e7b09172675bd2cd8e46ad5984bae17a600efc64508ee2a04025a45c3c0800d7662fd1cec6f904ddacc8c98
- SSDEEP 1536:/k8soxMSqgD2LJ6lXi/KcTGBWEc6b2G2ouwR0J0F:/k8WSFD2LJ6lXvcTGBWEc6b2G/uwRc0F
- TLSH T1A553F714ABF84212F6F74B71ADF5C0479976F697AD25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:1e:96:1a:d8:14:2b:bf:24:44:1e:68:2a:bd:13:2a:98:86:b2:09:a0:bb:4c:5e:f9:8f:23:18:ff:ae:e3:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a0:d9:7b:b0:24:12:ff:44:ed:97:0b:84:31:7f:e4:6f:6f:c6:87:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
53726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbExp.pdb
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/TlbImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 044910a5c27e72ee21d7ce09962a8b30d4be77458e629451cc1fb73deccf6cd4
- MD5 7b60fb55c7df5f801f8ea31859f0923f
- SHA1 e51079cd87c7dbf2aeb5795a4ec10c4ca4b0eed5
- SHA512 0f37ffbab2e714460630e5de345d391b1804c129787077dddf52f0331c6a95e6b09354b7167a0f7b44daf589c51ab7cca81d1404a7967ead82410ace613d8ae1
- SSDEEP 3072:r4v7VpD9Zp5q4l0QSmIydxiC7ieldIVr61c87Cw5uGjsJx9BzdcOyK7f8y1EAxbO:r4v7V19L5qfytldIZ6CuDjj
- TLSH T1D1142A2567EC4A2AF6FA5774E8F5840687F2F55B3A1BD30C285816FA0A237C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:c6:41:d2:f9:97:a5:4a:85:bc:a2:59:91:b8:fa:2f:f5:46:78:e4:e8:1e:a2:0d:f4:fb:07:0f:24:c0:b2:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d5:0c:1b:59:c6:e3:7e:d0:51:84:54:d6:78:a8:eb:ff:ec:61:e5:ea
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
182494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbImp.pdb
mscoree
_CorExeMain
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/Tracker.exe
- IMPHASH edb7de4623ae335f2538be97ec2d53e8
- SHA256 84f8b8e2fa0a5fa5e9f3401851a7d2cbf7e8b3e903b9b563d1703b91eb917a6b
- MD5 2920b40a1463fdb24a682f10e32b3f5a
- SHA1 7fe2eb274c97a608e7fed9bd7e352a6076612a2f
- SHA512 9929c97d375eeb41e86e071b45fc9da46ebc3f7991eaf4e160b0d90a07b24bd05f240895808714693272d584875b0cb82b6ca53a0b9bbb061ce62a8d1ee7e4c7
- SSDEEP 1536:LfD75vVY3LmG8OfRAEB8lwPS8WvcREScYlVb95TDS+BxYIJLZGj2XBkx:LfD75O7mGvg1YflhvDBhJLZGsBa
- TLSH T11CC37D127AA1C032FCD2103496FC9E635A7DF9725B3890C3B794964E5DA0BC1AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4d:77:26:91:af:3a:ce:5d:95:72:50:79:69:fb:cb:6d:2b:fc:e7:45:2f:55:43:cb:de:a2:0f:92:73:e0:ec:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
14:1b:e6:71:75:cd:ae:f4:35:e1:72:ef:9d:ce:d4:3c:80:e4:b7:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
21275
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetVersion
GetModuleHandleW
GetProcAddress
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=13, id=205, version=50323,
count=119, id=206, version=50323,
count=119, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=1, id=207, version=40602,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/WCA.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2089cfba8e27c693adc7bff30fe174b7584832b0fd342b162dc6993e9eae282b
- MD5 c6846a484e08a5b12466a077db6c3e5d
- SHA1 fe50b5a8b5378478b65a8217841f2616d513c48d
- SHA512 395e58186ba9a5230c1b2c93fe83aa6dade8c0126d1ca58cb72b17ae905a9230c519692aa6920e7d70e403d0c9a7744bc4c09d38c3e52e636c4a60740b7dd4a6
- SSDEEP 768:0YLUUzqRtIzYAQ1gqiF9ZvCkEoONcit/E1isyc/:0YHmRtSYBgRbEo+cIE1Ny8
- TLSH T1D0333A5073EC8356D9BF4A302AF0A5864B7CBBC21911C56E2DC4B1AF0993FC19E51B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
42:8a:71:6d:3e:da:51:a8:17:b6:fb:c6:c3:6f:5c:5c:61:91:38:fc:be:5f:fc:ec:4f:bf:29:ee:5e:ae:fa:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c1:ef:c2:1f:a5:2b:80:7c:68:4a:f5:a2:ba:fa:1d:fe:e4:1f:13:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
42590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wca.pdb
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/WFC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 785c6b25fbbfb5d00eef40feec4fdf59f46a88cfc781aeb21d65812bbe3e527f
- MD5 7f04e827f35e2f6848abb1dcccea8c73
- SHA1 c87f3e90b488d4cad413e8e274f32255c0e7bd76
- SHA512 b394312136276da998f56a86329f81db2ed52bce7604a05bf2634d087283a665640eec2e044d00328edf57711ef7eb2362e698555621e8cb1987a3a8545eba3d
- SSDEEP 1536:JAILVy0+uumc78EarZaT/Iz12o1LMDukAF8lpBkv:3Vy0+uumEEZS/Iz126LMDuk68LBg
- TLSH T13643E821BBFC4156FABB49B029B18092A97EF7E36842D40F388D65485753BC09A3177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:fb:c4:8b:50:62:b5:6e:8f:41:b9:45:ff:24:42:b0:b0:0d:70:27:ca:24:17:fd:9d:b5:68:02:b3:a3:78:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
67:93:ca:e9:4b:ce:b6:42:db:e0:f3:81:80:3d:2a:38:58:80:2d:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
48206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wfc.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/WFC.exe.config
- SHA256 89a77b141f15908e801e9345a0fa4174bee150691a6cd76d4ac54be8a387824e
- MD5 b87c9ba8b9de80232ddc5653c321086d
- SHA1 e278c1e5c976d95593829be7d87c93e7e66ea36f
- SHA512 e2606ea815132fa8652742a6f12486a8db717c8b8167599802a8c053a02c2297bde8f5992648205e6f0fcf161e3075305700d6db829798f853a7d744d946bc8d
- SSDEEP 48:htrT+rht8T+eToH98QHtL/oHYtrT+06CM0SBxCTPBxCt22xhM2xCN2x3uq3tCM0D:Wrresd2xo0uz0uhTXdPZkuZf
- TLSH T1548159302280FFAE1B5253157F70E5F2D29AD3BE1B580859F95CA729CB2349F43136A6
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/SDKs/WSatUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a376a95c516641164d9f9bd6bdc162d6c9cccb4e1cb9efae29079bd63201a90a
- MD5 c2789058405bdff29e7070738bddb0fb
- SHA1 f39b839aba53c61fbb1c12f379b239fb3d3b39cc
- SHA512 fb90b41398feeea2c4b5a550bfcb9dfb1c6eb17afe76d6a3ab995ef9a5e06371f670cb009a8d1b47746b6564b8f67cb6fa864151c43a9b7914e542f5553ab757
- SSDEEP 3072:Cm4uRNrlmBELV+VuZFquunlSiYV+n8nkTrcp3ScYRs6SXfCzE75Foc:VNrl+ELV+VkElQ7+u7Xf8Jc
- TLSH T17134F62033F91209FAFA4B3159B580C29B7BBE277E19CB5D5445124D4E72B82CB22B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:aa:f9:11:e2:4d:39:53:2a:fb:27:ca:ea:86:a3:e3:94:f7:f7:bf:dc:7a:fa:aa:b5:6b:c6:53:4b:6b:42:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
58:8e:33:8b:f9:91:4f:8e:86:4f:4d:d1:7c:6b:45:e3:5f:b0:0e:f2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
231342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WsatUI.pdb
mscoree
_CorDllMain
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/WinMDExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1b3e76e8934d690eb462d77d3fd20266e70c6ff9fd223202a7f58b04a4109c85
- MD5 72ec26d29e040b53d1bf329141f9bf57
- SHA1 15e5f21fc209d73a0fb13449f51430ec35bf956f
- SHA512 66af8071416246e1171b4aa3f3757cfbeb08e79af3ca56fbce02bc916ebd035190db09369beafbd1368511fedc2bf87bad8dd7dfa47087c9306ce7c92a73abc2
- SSDEEP 12288:Y3mUaWs/++jX9O1NKV1BTP7EVFFP8NHQsFnBLCqGiWSNAPY9WqphQpR:kW7w1NolPFVp3WS3WmsR
- TLSH T1DE556C07ABE8A777C68B0777A03205097FF1D04B7717EF057948A6BA1C1BB909DA2163
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:36:27:45:4a:79:37:a0:aa:34:78:82:c6:13:56:d3:f8:38:6b:f0:89:85:fd:68:4c:dc:58:d7:9b:f4:bc:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
5e:44:ee:2b:46:23:fc:ac:94:8a:0d:7c:9a:68:97:60:0f:f9:06:43
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
1355662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinMDExp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/WinRes.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79b0e33fc7d5771b3e1f4144b3aa9c6e69667dbd7467506f07355da2ceb2d860
- MD5 f941a325df85318c5c976d2df750d579
- SHA1 8ff7e49a6cf5e488159a8e4deb687d3ab2c9a673
- SHA512 ef88868769d1857a3a222c2f25f338167952196823ffce1c28fbe529dd6e87cf0ff6304e644b1c97481cf3cbb4b0c26a4acc93d384e572cb6c8137b248d4fcdb
- SSDEEP 3072:V3LDQXGAJHPxTeN4hWtrYyldospVa4B3WRUzctcNm9RnLevrRxD5w2:JQXGAZZ24otrYyldoiVdbGk9k2
- TLSH T1D3E36C2473F88652D1BF0B322AF19482CD76BA43DD36C75E189166DE1D7338086627BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e1:4d:36:9e:76:4b:14:2c:77:20:7c:03:5f:0a:ec:ce:04:58:86:0a:f5:30:b0:ad:de:a1:4a:3b:55:dd:aa:8c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
53:08:57:5e:bd:17:63:78:c2:db:c7:15:75:75:e7:0f:65:2e:cd:02
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
143342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinRes.pdb
mscoree
_CorExeMain
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/al.exe
- IMPHASH 35f7d7b0035d9d9c7dd3306a0690f78d
- SHA256 f6c6ca66956bc2a63136c769433cb4ca0a820351dc22515f791a098f0b3e4471
- MD5 9d381cc31bd46357f144acd242b8eb22
- SHA1 a2394f1737f4a16abdf527e4c00e91b0f147ed28
- SHA512 1037cd5aef45db81e24d86a0eb150f7e52d121ca09caab9ea74da89ca6d309f6fc9c219e6cc56ea8cfddf3a57f31f82fa6a4a356032a9f09431c6990d753641e
- SSDEEP 3072:gmzrEJqNKpw8oG4VO9ntat9uYpsYzFDL+wYZfP5q:1zoh8G4Kn8uYb9CU
- TLSH T183147B127681C072E9B345B016BCE3736D7E7D325A259A4FB3A8AD9D4A70380E735363
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c9:15:f8:55:89:f0:f4:ca:96:39:87:3f:39:25:09:c5:08:35:35:23:1d:6a:f4:91:3d:3c:3d:bc:ed:9e:96:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b9:d7:85:84:51:be:32:ab:c9:cf:c1:0b:1d:9c:98:d1:6a:88:43:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
15180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
InterlockedExchange
InterlockedCompareExchange
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
WriteFile
GetVersion
GetModuleHandleW
LoadLibraryExA
GetTempFileNameA
GetTempPathA
RaiseException
GetTempPathW
GetTempFileNameW
GetFullPathNameW
GetFullPathNameA
SetLastError
GetShortPathNameW
GetShortPathNameA
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
LCMapStringEx
WriteConsoleW
GetEnvironmentVariableA
LCMapStringA
CreateFileW
HeapDestroy
CreateFileA
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathIsRelativeW
PathCanonicalizeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=18, id=205, version=50323,
count=148, id=206, version=50323,
count=61, id=207, version=50323,
count=171, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/al.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_intern.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c16b0f36a32b40f255c9316fe9538ebc310d07398998de3d8187290f736f4dc9
- MD5 ddb0b409c437cb59e30d236a200a92f2
- SHA1 990bc9c2a3d7acc2ef5bd60c6750cc908c388d26
- SHA512 c7b666cdd4b17638db71efc4bc2aa6b90b599b93e29822fab892206206627febb54c288e9e127b66283f34af5c8708de1b4a5d265638eee87cc82982535ce799
- SSDEEP 768:WYHti7yDXWiAcoT1/lxfYx6iOgge8XckdH9U6Iq82UOVsQGDuiZrq2/u:W4oIX7AcoT1fffiO26ck9pNU3S2rX/u
- TLSH T1CA73E61497F85222F6FB8F70A9F480439D36BAD36D21EB5D189A534E08337C09662B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:aa:91:ed:74:59:29:00:f2:54:16:2f:45:77:20:c6:23:5d:5a:a6:e0:43:c4:5d:ff:d8:a9:74:6b:74:cc:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
1a:1e:f0:d8:46:82:cd:37:92:17:70:65:11:64:d3:55:01:4b:c6:86
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
63758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_intern.pdb
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_merge.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 32d524fff75a202cf963da6cc509b7e46ce694f99a3470f58e33754ff7edef14
- MD5 23f2879d2524112653377f869da8cbb9
- SHA1 01c92d9277a1735f63e1ce3ed670a9a56dff64a5
- SHA512 f4ab6aaa623ccb4baca830db942e5606741a06c163b6c0846358179456b0501116b1c5dc5df621ad903cfa41194c9dc48776a60bda863fcab16203e679da1e07
- SSDEEP 6144:0nzj4nK4m+qSneJ4YleygNmqnodRu/GZLt+2AdBZyW4msGBQ2I3zlPRNs+q16xPC:0nzj4K/efMuuZLg2AHfI3BjORsVnvQ9L
- TLSH T1CD153B0077E8D217D2AF83B691F95509A7F8D006F313FF5A48285EE41C53742AE692BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:f8:b6:d2:94:66:79:b9:0e:af:97:42:8c:fa:4e:42:5f:7f:c4:11:e7:3d:a8:cd:bf:02:e9:db:27:d0:80:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
28:93:db:6f:ed:1d:e5:f5:b9:89:7c:76:8a:1d:47:4e:30:15:e5:25
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
928454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_merge.pdb
mscoree
_CorExeMain
Name
.text
Size
899KB
Virtual Size
898KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/aspnet_merge.exe.config
- SHA256 6451500097507ad131e6ccc39cc376c31807770ca223741b4a8ed20ca82723da
- MD5 4d2e83f50d7d1e32468d98f079cb1b95
- SHA1 e73bee0f16decb2f4328c33f6e14306ba8a34869
- SHA512 11a60653d274a1e51fc1ad88352b75cc7893f2c641b2e0e9dc8ade8a276aafd43a22b9a65fba13f9a094848da22a3cf4d90341fc4ebeaa159877b38c448e8c65
- TLSH T192D05E8008C4BD275E33162766A28A92FF74A1D290184014F8AF37730F7249947A3331
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/clrver.exe
- IMPHASH 8b2123e573c22d47c97d402c43d0b828
- SHA256 3f6829d51e8530ee4b81ca1be060cf81944717ffa8cf52ea507f3f260288c914
- MD5 e169cf1292d139312be5d094261cd179
- SHA1 96cecf59a4a2b758e2a901fe6ece7c84c1fc55fd
- SHA512 3db41631e4b2715cf8fea91836ae5b0815f9a03528441ce8000a51606992bf3af8766d1653974828daabd1cf04d352da780bbc8e6bb3cca3c928976753c72de4
- SSDEEP 1536:73f9CV+/tnJWGC0WzxGMZ2suPutLkOz0lwR44+I/:73VCSpAdRCGL3z06P/
- TLSH T1D9833A12B6558031E8A1583943ECC6936A3D79728B794ADF6BD45DDE0FB03C0B6347A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:e7:aa:bc:a7:72:94:4f:85:f8:e6:53:c3:1f:19:ce:67:f8:6f:99:4b:ad:0d:6b:6d:b8:a6:f1:54:12:c5:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
02:c2:6b:a1:0d:44:de:7a:8e:44:8c:3e:a5:21:45:97:e3:61:bc:8a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
15077
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetVersion
GetModuleHandleW
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=10, id=205, version=50323,
count=95, id=206, version=50323,
count=84, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/disco.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1fd270bd647b7c9d55ebb3a3e2417136a2ff01120e9fec9976ecef76d1536bfd
- MD5 399c5ab3b0dd977a5dee5004ee030e4e
- SHA1 9cd3ce91461890a6b7862d5e5e3e55b42b664e9e
- SHA512 3600eb502687e8be616065d61b46f8d00b05831e1f81458807d0b776269be0ea17692a673f9139ee578b9bf20e7184df52b0810955b27b310ebab237ce01c2f4
- SSDEEP 768:7PJD0SLoVy6f/IELS5c7d1ZstJC6Iq8fhHxoCwiGp7pJ:7xzkVy6fScJgJBohHx9wNptJ
- TLSH T1DF63E71493E84212E9BB4BB0ABFBC3C387BEB5875D21D75D2895534C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
73:60:9c:21:94:a3:4b:2f:22:51:68:d7:27:01:e1:47:8d:05:9c:b7:54:74:de:bf:95:4c:60:93:e8:8f:fa:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
79:cc:6d:9e:41:4d:0c:4b:a7:93:3b:e0:71:c1:96:0b:29:9e:c1:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
48430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
disco.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/gacutil.exe
- IMPHASH 1d5d62a00aa56ac222a0558af3bce499
- SHA256 01841c1e9ea4ce1af3ca7b8e6c7b4244cdab178709dc9c295688ead6517e5d44
- MD5 aa1feead921075878fb4a8337f0a83fa
- SHA1 77d0db38a20716cfe2d634fc6851188c8a61c2cb
- SHA512 d57f62eb9cfd275913607c8e51e986d3e6527db7baefa919ac1e0fbd13e8da0d03e638044e917fb43cb127fbda445d84272d96440028d4fb73618f7bcb0d88c9
- SSDEEP 1536:ot+3UJxD3I8kNB4ZKSF158B+1qEWZBRxByquayaHMRBkj:ot+3qx1kstunZuayaHGBC
- TLSH T148C35B2279E1C472E8D205359AFCAA435A7EFB721B3454C7B398128D5DB0BC25E353A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:51:2e:51:da:30:19:a1:27:f0:a2:12:57:b8:3c:fa:67:d2:cb:df:63:f1:93:dc:7f:1e:fa:4d:20:94:bc:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f9:67:eb:3d:3e:50:0f:3e:23:d5:6b:c0:39:92:38:62:59:7c:d2:a3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
37561
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
GetVersion
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RaiseException
OutputDebugStringW
LoadLibraryW
RtlUnwind
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=42, id=207, version=50323,
count=13, id=205, version=50323,
count=97, id=206, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/gacutil.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/ildasm.exe
- IMPHASH b59f10d55307ec747fb67fa01d1ec22f
- SHA256 94edb927d1e4d7b4bb0c17d19f455ba0d4348bacca8c0fd38f9ba3b8cd40e46d
- MD5 48130efc4eeb45983655ccc822cf666a
- SHA1 4d264687a92eeebbc5ced79ef91158114365aedf
- SHA512 88a269dcb95d99e06773f183f705230e7e4f5353432919e204fb0a916f2b5e76d3f9fad7058094d2ef56853391d6f78c515c222b0d31b22a7c44cf249052900a
- SSDEEP 6144:zzN7KmpR6JjQMIsjZlFVMsp+/Y++zyFDSbZFq/mSSkmdI0ZtQmU56BE:zRKaR6iAFVMspC9N0NSSkyIxmO6C
- TLSH T142B48D33BAD0D075E8910176C598DF6978BAA971572A04C3738CAA9E5F303C1AF386D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
df:f1:6e:fe:37:74:ba:8e:bf:a0:4a:7c:25:51:0a:08:88:34:6c:04:d1:a6:7b:43:26:e9:91:c5:93:91:ff:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bd:e5:fc:eb:14:f6:65:e1:e9:b5:0f:9d:5b:70:c9:43:6e:f4:46:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
319535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ildasm.pdb
kernel32
WriteConsoleW
HeapReAlloc
SetEndOfFile
LoadLibraryExA
GetCommandLineW
GetVersion
CreateProcessW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
SetStdHandle
SwitchToThread
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
RtlUnwind
CreateFileW
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
InterlockedDecrement
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleMode
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
DeleteCriticalSection
ExpandEnvironmentStringsA
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
421KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
874KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=50, id=207, version=50323,
count=23, id=205, version=50323,
count=145, id=206, version=50323,
count=264, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=1, id=207, version=40602,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/ildasm.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/lc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4265e6a8c272b414eb9fa6f8e1ca1a43562c873e794a64519c2a68b863a3f9b3
- MD5 f27fe843c8753ce852fffc6e92934ded
- SHA1 ca9fe2ac13ab8a06e051e767e896bc742a5a28ab
- SHA512 f0a0d6f3cb7ce9a1946921b95b82ea9992aebb5c6f5e2ffc19fa2d3c9f31327e19ddf48f007c4c818d51b610cf1948aaf35854a7a7aa224b878ed1ae99e6f035
- SSDEEP 768:wnSMzuxFp27Nc8DO536Iq8Wg5YZiRHdyi+:WS+uxFp27NcQOMfgOZKdy9
- TLSH T13523D82897F81213E6F74BB0ADF5C487AD76F653AE35C75C2889834D09227C09652B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:ad:9d:bd:14:34:87:a4:5c:98:43:67:b4:03:9c:e6:b5:ec:ab:91:47:f1:b0:33:12:71:21:9e:b9:c5:ee:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
46:df:ae:57:18:e7:15:ce:e3:7e:bb:c3:af:5c:76:03:9b:a2:70:e7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
lc.pdb
mscoree
_CorExeMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/lc.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/mage.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7bcca9c675e5d5fa19228b908f3782aa471b3dcadfad5e74e59f714e5987892f
- MD5 fb385070072163697b84bfce9048bc83
- SHA1 dd4450919f4b479481c0069bfb8a26564071aac9
- SHA512 5398c4bb46af8f42ccc81a381fa48f6b54def0074de607c637c8099ca6c963c0ecc2e182c520aafe1e716f639232413cd8f823582eb5f30a95771922ca34846f
- SSDEEP 1536:5PNEYvp+o4ncDe2zHB2l1YdhfZyA1YdhfZymCiL1fuMVPQRHQBugjh43Xosh3:5yYvp+o44eAHBCYdhByGYdhBydiL1fuJ
- TLSH T124933B416BDC4316E9FB0A746979E043AE75F25B1922D7093CCD91DC2FA3B9086623B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0e:82:2d:bb:fa:67:7f:10:8e:e6:1b:04:1f:f5:b1:af:9d:16:be:9c:a6:f1:32:bf:97:d1:b7:b9:c2:88:2f:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:87:b2:9d:25:ab:40:06:cd:10:da:52:97:31:3c:38:48:92:9f:12
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mage.pdb
mscoree
_CorExeMain
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/mageui.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dba6c3285b9da61c866409567d6a80b2bd50c9805697bfb1eda230f45288fce1
- MD5 adc82c51e6bf961d693c76c8bec7ef7e
- SHA1 989903893150acae7cec0dad9cc354df6dac8377
- SHA512 25d08647a4ad8ff6db89564bf778e2dc370f99135f01cafe22dc49043214d6f1850a735dbdfeaff814e4c2db4897cab63f62d1ac2fbc3d2febc8b1a598cc7538
- SSDEEP 6144:0KbZEDs1H2IDvhTp0rfcn6IkfQOfyAZK4hTp0rfcn6IkfQOfyAZKD3WkAfaPn0oq:0KbZEDs1H2ivhV0rfcnMhV0rfcn/yaAr
- TLSH T118E4843137AA5208D87A1B705C3692C953BB7E6BBF18CA5F2859320C9D3365787127E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:ef:ba:27:6b:e3:97:fe:0f:e4:52:c9:ff:e3:c4:69:73:61:77:86:2b:0c:ab:5d:5d:ba:dc:ee:cb:91:1e:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
97:5f:e2:d0:0d:fe:68:98:3b:02:3f:cf:12:84:40:44:e8:bf:21:9b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
701342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mageui.pdb
mscoree
_CorExeMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/mgmtclassgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e7c7ad12ac7bcbbe9a0416b3ab85b7b6dd6c8e623f1f72ad3ab876abf774ce39
- MD5 57430d13dc79af2a5e0c814eded25953
- SHA1 19eb454582ea78b3fd02fbdfd98880b84e790f1b
- SHA512 3ea4a1de6f4c22800a9fac16f9c51ee04cc6b75cab112cafecb1989f8cff4c0af4fe993db3d1a7919b54b5251e884eb4845be9982ab9770606395cee5834e7c2
- SSDEEP 768:ipJl9YLfWjlpO0lccT6Iq8oYh2ib0UGqeJ:mJbCUHlcc6la2NUGqeJ
- TLSH T16623D824D3F85313F6B78BB099F4D0836D76BA53AD60DB7D248A538D09127809B52B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
13:a1:52:fc:39:f8:c2:27:68:a5:7b:b9:64:fc:db:ad:59:a5:c4:34:ef:63:ca:3c:e2:17:01:9a:a2:20:eb:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2a:22:d0:bb:03:8c:04:69:d6:41:9b:46:53:26:a0:33:6f:da:b3:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
MgmtClassGen.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/sgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e180af8f6c824647199cec379347f9cdbf769595c571fbaf325d365bee73a2d
- MD5 e4797f6000ffc97067011845d580bfb0
- SHA1 6302fd7bd2d5a41b47293e4560e5adbe5450819f
- SHA512 ee34f20b13d25b2c058fd3d3f0309eff03a580e887ecb4b2ec88b01378a2b23e44f9c8cb1fd51e291b8cfd391e1fddf95202b5d7080cee9489cadf0dcddbae60
- SSDEEP 768:FbRwSIUjOjyET3c8oQyqC56Iq8CUX5oxdijflQwc:NRwMO33cdQRCQFUXEd+Qwc
- TLSH T17D63C61493E81212EDB64AB09FFBC3C39BBEB6835D15D79D345903490D2A7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:67:44:05:e7:83:c6:53:e6:bf:b6:14:96:2c:7c:4c:f7:5f:17:9c:a0:dc:57:68:74:75:4a:3c:5a:84:70:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
dc:ff:3a:a6:4d:19:cc:8d:25:f3:ab:0c:6a:4a:8c:cd:e8:bd:f7:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
46302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sgen.pdb
mscoree
_CorExeMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/sn.exe
- IMPHASH 6fd1c67b79af1ea44f7e5d30b1500226
- SHA256 9e74b92f2ed1625772156c0b9a65f59c9d001c1a3ba26e7a064e7dd77ec6813a
- MD5 b849aa942c2c19dfb2009d6d9ee4a694
- SHA1 d6d57344cdbc5677ca3b6e05227b563c70d09733
- SHA512 c1aac1d4ab70648776de1501fed068333810f2c60e66c753cc5cf22370508dd267b3e91d85b4f143f8a9b278088b99f8b0cffd5db366c8784d5bc6323d8b1421
- SSDEEP 3072:P/SWuNmOqFea8F1g+oG1IZga1084irw6pUJVqaDpYRalv8ECONXy2LFXPOfkS:PSNne8F1g+oG1IZgaZOpOOI2JikS
- TLSH T1D5246C237AD1C031D862053985F8C7F2397AF822AF2545C7B3952F5F2E352D26638AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:a6:df:7d:77:a6:e9:6e:a7:72:8f:f0:de:83:16:24:74:f8:bc:99:05:1d:46:24:c8:96:6b:d9:e4:e3:45:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
29:e3:a5:26:f3:99:ac:c3:85:47:ac:3e:d1:d3:76:70:d9:8e:6a:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
104842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
GetVersion
GetModuleHandleW
HeapReAlloc
SetFilePointerEx
RtlUnwind
MultiByteToWideChar
CloseHandle
FlushFileBuffers
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GlobalUnlock
GetStdHandle
GetOEMCP
IsValidCodePage
GetTickCount64
QueryPerformanceCounter
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
InterlockedDecrement
InterlockedIncrement
FlsFree
FlsSetValue
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
LoadLibraryW
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
WriteConsoleW
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=111, id=206, version=50323,
count=217, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/sn.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/wsdl.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80145d05468bb9a81560241758c812940553927c945b4bbb384d2f942424e36a
- MD5 52efb69ba051c03a12ac24034ec48291
- SHA1 8dfead7e8d9b87d343774560bd73ecc5ccefe92f
- SHA512 f532e5667e91ccb50b77d46b53ebf3f86c3e7a1a4efd5866c7ae75ef5d8b1514199cb6a7184dd6b49472c417c01b3ff2e030eeac8aafeb256af7d341e612a1fd
- SSDEEP 3072:YYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZw6OgqJIE:2T8rLo9YJ/bhuK3fSRbfMA97cZbC6xg6
- TLSH T1C0A3F71573E80612F9FB0BB06BF692C287FEB5466911D78D2C94128D0C7ABC1AB53727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:0f:15:2e:c4:06:38:9e:17:18:14:ff:5e:3c:f5:cb:8f:d1:ad:08:19:b2:8f:bf:f3:1f:73:d9:9b:bf:bd:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
84:14:df:73:02:51:ff:1f:73:3b:07:46:bb:01:04:27:5c:84:61:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
82302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsdl.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/wsdl.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/IlDasmrc.dll
- SHA256 f21839bc8431056c6f215db3689181d92bf5b290ce26a6493fe538878fda7a9f
- MD5 840fc4b1cf2a5fa0ceb496a00844caae
- SHA1 59408c85e007ff54d5a5f3cca1a1c16904744f62
- SHA512 0c3627955d229566025ae577667514919c40d996ff10262247581b8256eabdb5476f0aae9282addd6c29fb9c25098f06ed7254e32870f16f5624b059363353e0
- SSDEEP 384:mb3nqW3BHW1ubNYAL1PWbYe3jKESkYqgzPk/57h0GftpBjOzFtAHRN7wslumkLUi:mb3NcubhYKESkkikEImkJ
- TLSH T1CF53B983D3EA84C0D4A199B0AD3B94A59E373D50683282DA4E64FF3F5E7BB509552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
ad:32:17:62:f8:40:7a:b0:b4:0e:43:15:e9:11:dd:6f:43:1b:91:7e:c7:a2:e7:24:c8:3c:eb:04:18:0c:90:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
56:be:bb:c1:74:c1:35:34:0f:08:ed:67:8c:fd:1a:e3:e7:96:35:b6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/TrackerUI.dll
- SHA256 e65bcd147059c12c94f2600f6d730e70229560b91aa24578e67788d93d003c6a
- MD5 2335713f3d19c960b94fb69c65ad25af
- SHA1 eb909377b3c5232ea97b16ff63ffd87a43aa8fce
- SHA512 6f222462b87297f17164add8e01443e386434663071eb8b199816cd6aca82a1e6031ae2a5304c67edaa2524aa3ef0943c25e147571a5be5da0847a3632dbb35d
- SSDEEP 384:wXWD8WQTK78xJ8xClRAtkQGb/L0GftpBjN74FtAHRN7qplGBSjZlH:JjRGkijvqiBkH
- TLSH T176B2A64147F84142F8F36DB12AF8C9536D3BBBD65930D21D109DD29A1BE3BD09A24B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:3f:c4:a3:7d:6d:90:dc:ad:0c:ad:db:1a:79:a6:13:89:e5:c6:1b:d2:49:76:29:e8:4c:b5:0b:fb:3a:55:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:80:0b:75:85:22:0c:f0:af:52:5e:ae:4a:fb:0c:76:2d:88:4c:ab
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/flogvwrc.dll
- SHA256 c804e695bd2791992f502c3114ea0c89bd4e7e106a26fffdea408f6d556c83e1
- MD5 740459c9f7e1029ba0b5debdfe79e13d
- SHA1 26b714aa485d1707d9c9f3b21b3d5e15fc505ea5
- SHA512 1855703daa1967e07e269e31cc4e2c7ee9369e1d389300fa850eee5ac0161fd6d2e14acb338f08bd2e8b46c09b1318ae89b578b8aa48fc4b241ff2ff3763a0d8
- SSDEEP 384:KWzcqW8RQxnq2ELDF5RKfPMnC0GftpBjNLFtAHRN71zlGBSjZl/:cIcfyiAuBk/
- TLSH T121A21781CBBC8447E8A36DB067B8DA837D3DFBD25D20911E1655F19D2CA27D0EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:b6:80:60:74:85:47:a3:8b:00:49:6c:1e:af:82:55:22:e5:ea:27:83:a2:5f:8b:2f:48:5b:af:d7:37:32:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:b7:5f:0f:4f:60:61:be:e5:ff:2b:d9:0f:fb:5b:18:cd:81:bb:53
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/gacutlrc.dll
- SHA256 d0c9faf8ca3086be7bda156f833439b86338763e8ef9bef237b85cbf6bc42c7a
- MD5 fd0e244299b906f943838fc7ca1ff710
- SHA1 b61b97d58c0b327c5777d22e796d99dbd2360548
- SHA512 dd097586017bca60dd1998745bac83f1a664203c571b69b2e9713af8b7079d63ed54648a50222cec6966f119f2108aabb7bd6728415d4e3a8f3de46ad6c0e314
- SSDEEP 384:ao1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWI/L0GftpBjn0TFtAHRN7B:aAIecY0QrQNCeKei9pr/Bkch
- TLSH T121F20C8257EC0105F5F73E307AB5A5A21E7ABD82AD39D21D2198916D0AE3B80CD30B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:dc:b9:4c:cf:00:4e:81:0d:0c:2b:c4:29:a5:1d:9f:52:c8:09:95:f4:50:1a:5a:a8:8e:5e:e1:b2:99:18:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:d7:dd:19:eb:4a:12:ea:25:1d:e7:48:f5:12:5c:22:5d:5f:a4:2b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/pevrfyrc.dll
- SHA256 211c5a12176338f7cb507ff427eb57396c6c5439d4bd3e01958f61c130bc2725
- MD5 be48a25b015a104103e45ea7ff0ad9d7
- SHA1 56271c4126dd400cb0cd1c5c341f16e5606dad66
- SHA512 bd9350c5f2a8f22a45eef63d63f315cce34181af4888a8f6ba9eb0477d2e0512ad70c6a5995a1ebb6834e643b64ca5df646433c3390e07c804714f064b3d054d
- SSDEEP 384:guyneWNJXWyh8YMnC0GftpBjEG+FtAHRN7R2lumkLTF:guyL9h8vi6SRhmkTF
- TLSH T153B2D6819BF84142F8F32E7066B9D9463D3FBFC55930D21D0198E16D2EA37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
af:a5:2c:6a:32:22:52:4a:9a:5c:43:c3:91:22:d6:b2:6d:48:b3:cc:0a:42:a4:0f:6d:00:88:85:91:74:3c:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
fb:62:b9:47:46:5b:ea:35:8e:bd:91:df:c4:0d:35:00:68:7b:35:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/1033/snrc.dll
- SHA256 a4fe8f62b2cbe33a375be673db70359a20d90327af0d75f4e2c3aae58f3e827a
- MD5 3845b003456449eb0a5bf2dbf37f1770
- SHA1 562bac7d9ef1a35641a1f482be2f6d083f46dad3
- SHA512 1a07f3031887930b1a20b5898cd0d9ab4339c547f24519d461e21f3d55d0563089f4455460feb5230d2af585baaefaa767c04cbdde9c4e4d79afbf4ba1c4159e
- SSDEEP 384:54DWJBkW72ekwaaRGm7+bNItWIbdInm8J58MnC0GftpBjEAHFtAHRN7FlumkLa8:LV/sIddInmUji0Wmkt
- TLSH T1D0F22B8193FC4505F4F36F706AB496A21E3BBD91BD38C61E2248D56D09B2F90CA70B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:83:85:4e:dd:4b:53:b8:f1:b8:a9:69:9b:c6:a7:d3:a6:3b:a9:d7:17:91:db:b7:8e:03:a0:46:35:e9:2f:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
24:d0:74:85:24:1f:02:34:12:75:7f:93:2d:f9:ce:37:ab:ae:1d:5f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/AxImp.exe
- SHA256 bbd3ea037031f6984c6986af3601ce5f9320f7185ff7c2690e0223b68e88c746
- MD5 ee74e6e742c3c4fdd7ec1f746a42c4c7
- SHA1 048ec50664e7bc05bbd598843a3cef5b45018262
- SHA512 3e88202630b3cdbd4c71db7ba90da2e0049d78e2532e5472a3ad3e2757de67e7c5e03da47ff6f9126350f65c0f4ab79cc9156a5f3db74bd748343836729a0691
- SSDEEP 768:Ngs/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrj4iRdQpjimki:Ngs/uG/5O7QBkcpoVTrEdgn4oQpjimki
- TLSH T15D53C514A7F81216FAFB4B74ADF5C047593ABA53AE26C65C248D434D0E337809663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:1e:72:a8:9e:05:bd:73:bc:ac:8c:e0:c3:20:9b:11:c4:5d:17:53:15:1d:50:7a:51:4c:49:ab:71:81:6c:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ea:5b:ba:e3:5a:41:bc:cd:4e:e9:9c:cf:4c:58:d1:e1:90:0d:27:5c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AxImp.pdb
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/CorFlags.exe
- IMPHASH 737eed44e0e3e2f740cf6c506763184a
- SHA256 71d08b20122df9419bbc21b86e754e5e53c8bdd1cd1ba2c562450a54e936cee6
- MD5 bdf5b8b320a7273a0d04b7eeabcf49f0
- SHA1 b77f839b382173f65802e66728e9621c2dd66ed8
- SHA512 c6861bfb45d4ba0f07b8d75b9290d688d5e5438e4a37c56fcdcf70425b8714c1a1efcd7d4da78e3465f2189d9eae0bd2b71342261f2f6b539586e65d9e29e6aa
- SSDEEP 3072:VoiaiIGBdEEImASTwxm+/jjsHf3JF4z17YGPPclzi/zKOfiHRQ/A8uLMkw:VrrRBdELmjTg9rkfH017YyPoVYagkw
- TLSH T153143B4373A490F6E0668538C8D0C7A6A776B8250B3186CF52546B6FBE737D09E387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
83:2f:7a:c5:c1:d5:a5:06:75:3f:7e:1d:1a:90:bd:31:46:bc:bc:95:a5:f1:52:97:27:6c:89:8d:54:31:ef:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2b:9c:cf:68:d2:c0:37:40:78:1b:fe:c1:13:d2:53:c7:c4:c6:14:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
35664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
CorFlags.pdb
kernel32
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
SetFilePointerEx
SetStdHandle
WriteConsoleW
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetProcAddress
RaiseException
DebugBreak
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetOEMCP
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegQueryValueExW
RegOpenKeyExW
EventWrite
RegCloseKey
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=173, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/FUSLOGVW.exe
- IMPHASH e6d4b494c7c8b97faa526620511ba540
- SHA256 e4fd3e973e7228419929e5ab2908bb8f2ba7b618a1c7dbf6e9a1c5bc94e60f6a
- MD5 30ba20235c77f2c02f70011c34fb0c2d
- SHA1 49dfcf90c80b0283a81b7d0aa78adc244c136c0d
- SHA512 c2d4aa4205f6dc46dd889fd3c18e67ab3c0ce25b53f688528bb39034a38e48386ba432c0c5dee7a87b681f622cfd11661c833e25e9ac2617341cd24633ed6052
- SSDEEP 3072:yzJYFWJCAGLPggaRtQDIpkkuwT81+CNCktKIaLQqG3lADFHNwy9U945OkDa41OIB:rLog0+DIpkkfT8tQ+aLQpVAtMIO4ykj
- TLSH T18D245A43739480E6E0665638C9D1C7A6F376B8210F308BCF52645BBEAE236D19D387E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:1f:d8:35:fb:7c:5b:32:68:de:ce:fe:82:ca:19:a7:3d:be:37:d9:94:de:7d:cc:3d:1a:1f:c0:64:7f:0d:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6d:ad:a1:a0:4c:84:7d:db:79:71:da:d4:a9:62:7c:83:87:cf:46:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
57124
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapSetInformation
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
HeapSize
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=202, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/MSBuildTaskHost.exe
- SHA256 f564a371a9a800df01446911c144ed527ee59b3556f8d559b1384e210ddcdc26
- MD5 59b2329778331d09b5a08f2964e4bd9e
- SHA1 a89521b9b9eb2b6fa9018c1ef38301ffc073c898
- SHA512 dc2cb734e3a50470ccb700fcc2f577e06a46ce34e13e407307d4a97978d6e54340c38f9e948c5c989054b78d9400bd102feaa1f3e56b8f1e56671a76ba3cea27
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0BK2rUIEd7yjdVj79S:s+vFZNOgbiWmNLzpRRS
- TLSH T122F35B0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:4f:21:3b:a2:19:12:17:8f:0a:c6:1b:ec:35:ed:57:a0:da:51:fc:48:b7:d4:08:0f:a7:f5:a6:e2:77:30:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f1:35:c7:51:82:99:89:73:56:a3:8e:05:81:8e:7b:d8:de:69:fa:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\amd64\MSBuildTaskHost.pdb
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/MSBuildTaskHost.exe.config
- SHA256 d6aea281c52a98c633586f0fb44641efc41f533acee10ce9322aa2d03379aaa6
- MD5 c9db610d35202b83dae4ac19c8db4471
- SHA1 919ee3f49b4e6f20c9d622a645add595352a2c05
- SHA512 ddb2e93d818344fcb87d229203b3330f2f3c9ae3d1457813f9a2b38e27183f3e39cc67fd9a1a9bcb073e896bdb7d81f581fed8d6345c75abd91b88e06e09b8a6
- TLSH T1B021AAA4E1C8BFB14F7109A77A661C64EBAD03A3684D450DB09D7A474F3699A430B132
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe
- IMPHASH 8c709d5483b1595d7a170659e58b93aa
- SHA256 3bfc496f6836e8262ed508bc05cbf7ca86f0246b0317b6e0b17bbc7507aa0ad7
- MD5 53d51690d74ab0151a1c5906fea155a4
- SHA1 2d6b034371ce6652dc37cb8aee0b4c381747b265
- SHA512 31942f384600f2580c6e42d6a70fa35ac3c21ae8026f4431ec03a7dda05b5d3f33c0e569c402f68fc99bdb93a35512b77c1202f517807768e0f5e4728414a241
- SSDEEP 6144:BL2oLyPCNNqFT+LXiXRof1kIQRrLJYWFgbkp:BaEyPCNNqvRoSxgo
- TLSH T156345B5A73A4C4F5E4628538CAD1CB96F672B8150B3186CF12641B6FFE23AD11D387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:a2:60:3c:ac:8b:6c:73:c6:9f:d1:6d:b5:36:46:14:64:4d:84:a8:ec:f2:2b:42:23:e4:77:d6:15:1b:6c:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bb:19:9d:14:40:6e:d8:16:ff:ed:e4:ad:ac:fb:6f:f3:b3:2e:a8:7f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
50772
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
DebugBreak
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidCodePage
GetOEMCP
RtlPcToFileHeader
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=48, id=207, version=50323,
count=129, id=206, version=50323,
count=10, id=205, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=183, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/PEVerify.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/SvcUtil.exe
- SHA256 ebd0c516b5a866a0252c30fc8eaa42d58876a44ac22e45d49a5e49467f66b1ed
- MD5 f773f80240c6e2311e808b3c0e06e571
- SHA1 ac8136c8e70a0277dbdbccc04245cc16ea744f88
- SHA512 a57ecd15263058d380d4198e632f0955741ac6b421252876d454ae456cec9b210af59871cccf6ba34a402a4ad9d3365e061823bf9e86ae0b9b5b75e70f05dfa9
- SSDEEP 3072:33O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerZwyegYm1/KTSf:nBGxsI46nYNs0xcX5Y+f
- TLSH T150141A3937EC1726F9FB4BB4BCB5C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2a:67:17:08:44:81:14:7c:fb:fa:52:be:69:2a:bd:13:45:18:fb:71:73:53:dd:0d:f4:f8:2e:fd:09:09:83:fe
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
34:f1:1a:79:55:07:12:85:fe:be:04:c6:00:12:30:5f:07:56:82:79
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
svcutil.pdb
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbExp.exe
- SHA256 97f595488aa88df5331096c5f8c5ba51499c23598305202ec6f0223d18c06f85
- MD5 7112bbd499e542405ec42a3bb52488a5
- SHA1 561118517c796d1ac405924e150f16cb4daa6f79
- SHA512 5a880ca58a833f3b9602bdb28146a80b6f025ecbfd9b163f7e6b8fe901a7e9db137e767eb69768eb5603799807a3bd2b3cbaf7c7802d57de24799a865ec5f23b
- SSDEEP 1536:68sTxMSqgD2LJ6lXi/KjcTGBWEc6b2G3oJaQinq:68PSFD2LJ6lXTcTGBWEc6b2G4JaQ0q
- TLSH T1BF53F6149BF84212F6FB4B716DF5C0879976F657AE25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0b:7b:cc:3b:37:21:63:52:66:50:2b:1c:ce:6a:a7:14:e1:16:ea:7d:87:d2:a0:d7:85:98:94:16:c1:ec:0d:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
91:a1:69:dc:f9:b6:af:71:e2:cd:a9:05:5d:a0:38:3b:0d:ee:10:f0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbExp.pdb
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/TlbImp.exe
- SHA256 76c24910eae1b750141d0c446b0fb18125cc43c4388fa66d29b0fe0da9a4e220
- MD5 acef4e9b8b39de4c677621fdf95049eb
- SHA1 4a130290334e8bf0b8f8df54ff1cd872cb6c7e95
- SHA512 0604709d84d96928687fec7c9bd57d1daed064ba335c9eaa9be3e3423a1dbc9b97f98ce97dc2c77a1eb3b73d4e8cda22e2321b2ec330d61cc031ac180b11b56c
- SSDEEP 3072:x4v7VpD9Zp5q4l0QSmcydxiC7ieldIVr61c3N07Cw5uGjsJx9BzdcOyK7f8y1Ev5:x4v7V19L5q7ytldIZ6C3NmDHh
- TLSH T120142A2567EC4A2AF6FA5775E8F5800687F2F55B2A1BD30D285817FA0A233C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:fb:bd:b8:5a:e5:63:96:0f:d5:b5:fa:ee:66:d1:16:74:da:fa:d0:29:5b:e4:ba:68:1f:4c:ac:35:47:8b:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
0c:1c:15:b5:6b:a5:d2:97:55:15:95:be:aa:bd:2c:fc:c5:fe:f1:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbImp.pdb
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/Tracker.exe
- IMPHASH b517539aa03ef87abb610ee2854c1cd8
- SHA256 5d963c4282e4886b7d45e2af6d66fe3e670988325d6c8c767f45db374c704d0c
- MD5 e75207c8611f4a259640801e4c999aae
- SHA1 14984b5d9e8a22c74e4f187595e17f2442aafd08
- SHA512 b699044d55b24247ba5df79c9fe8d45b91d9c59b5e8708f22094fded77321a7072a5eb3076d8574a422e40ff10852479a08e8a46654012feb632903d9a8106da
- SSDEEP 3072:Wq9nBVeTEle6ef5eFqPmi/Q5hF1pOujmsFxT7XcrCjDu/Gl:dlbeT1Df5s6mntzOuiMhjuU
- TLSH T11BD36C1632E850F6D8A79178DAE18A46E7B6B4B7433153CF076482AA1F637D06E3D331
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:69:24:4f:e4:41:ef:6b:1f:bd:c8:b9:b4:0d:ab:ba:48:c1:cf:7d:0e:73:fa:26:d2:04:2b:c3:34:7f:c2:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9a:c4:d6:e5:38:a2:c5:3f:f1:b6:4d:45:3d:d6:0b:84:54:01:68:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
11468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
RtlPcToFileHeader
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=118, id=206, version=50323,
count=8, id=205, version=50323,
count=120, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe
- IMPHASH 364ede3acace322dd1076fa9279da829
- SHA256 53470f7ad31a60a5f058b851f0eecb121dc1ff044d2ce754609dc1335919847c
- MD5 736b03c2b5ee26241be7d01ebf61c320
- SHA1 ad85dd06e7dd97e71f5f11492e62dc32d6341ca0
- SHA512 0d37f34c420928469793998a118d527ea775ce5619f103b37cc75fdce4ca4f9d74f4e706001bec761b0557b196adf2377b466d5b72019a6c51060f69a27ad54c
- SSDEEP 3072:8Bv+81lr0ArllqD1IPLZHTMVCD4Cu1EmoQIhwd75qW3KKvj6rVWOY39wxZQXD4Li:0v+S5lqDQpTnGGmPqwdAYKKLUVY+8oi
- TLSH T1DC246C1132D810F6F4B79638C9A19656EA76BC5A173083CF13A456B99F73FD0AE38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:63:7f:d6:cd:7b:ae:e4:db:d0:d1:28:8a:d8:15:34:db:d8:b8:3e:09:2a:5e:4c:6e:36:1d:78:91:a0:56:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:3c:39:9a:1e:2f:50:bb:37:70:3e:88:9d:b4:6f:c3:ca:4d:51:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
54464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
CreateFileW
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
GetTempPathW
GetTempFileNameW
WriteFile
DeleteFileW
LoadLibraryExA
RaiseException
HeapDestroy
LCMapStringA
GetEnvironmentVariableA
WriteConsoleW
LCMapStringEx
SetFilePointerEx
HeapReAlloc
LoadLibraryW
OutputDebugStringW
GetEnvironmentStringsW
SetLastError
GetShortPathNameW
GetShortPathNameA
GetFullPathNameW
FindFirstFileW
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
RtlUnwindEx
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
RtlPcToFileHeader
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathCanonicalizeW
PathIsRelativeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=146, id=206, version=50323,
count=10, id=205, version=50323,
count=61, id=207, version=50323,
count=147, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/al.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/clrver.exe
- IMPHASH 3a07376d2c7c5610b71b0d9a122bf39b
- SHA256 92a572073cdd25c0b487911fdad52430299d8a6e0349dbf136cdebe3630cf762
- MD5 3df1900f00aee7b9e767de9d3276c386
- SHA1 71a35be8cbc01a74edb174450a1edf3d3aa6ccb7
- SHA512 5b6bc4ee39c2db89d6b3128d76c8b8e48ac93f984db1ddbadbe8fe3cf6d543a1bf94a56953b94c26d2f11d6c0910c30d02a8a3fee882e28a2230ecf36442b993
- SSDEEP 1536:UwbG7iTd8NzuoYGszYD69kgwobfMrhd24WmnbI9uBkA:rPTeNzuoYc8kgwobkP2fmnblBv
- TLSH T186837E5822A400FAE8639538D6F1CA16EBBAF893177147CF4754829E1FA37D15E38732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d3:05:8b:0f:50:ba:09:6d:89:56:15:4f:eb:85:4d:e8:05:1b:b1:83:b9:87:64:ab:ed:25:ab:cf:2d:b1:1c:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:e0:7d:37:13:7d:fb:cb:5e:e1:30:ae:23:a6:47:77:cc:be:cb:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
7368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=93, id=206, version=50323,
count=8, id=205, version=50323,
count=83, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/disco.exe
- SHA256 e3f437bf0475c59627ec6df7fa41770a372a62655f53cbf6ea582ebf7d06e46a
- MD5 4ba26b1bf9d687438a84df3fe72c3427
- SHA1 7adc99bae76bdfe4f6bb9f902df4c50fe9f890b4
- SHA512 c6f32bed9366cae9e0c385586b0212642158846a699e2f580c101aea3444a8e12186053f6ed0b8e5b689445c76efed2f6ebabee7e762d4cf9b7bbdb97b2ceccf
- SSDEEP 768:JPJD0SLoVy6f/IELS5c7d1ZstJI6Iq8fhHxox0iMUg8:JxzkVy6fScJgJ3ohHxy0rUg8
- TLSH T1D663E61493E84212E9BB4AB06BFBC3C387BEB5875D21D75D2895634C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:01:82:46:69:d9:17:5e:75:ef:ef:d8:e6:eb:be:0f:b3:3a:ce:87:67:33:3c:03:c9:79:c7:03:99:fe:0b:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6f:ac:f4:b7:c8:01:c5:82:00:42:66:aa:38:b4:e2:8d:5f:51:dd:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
disco.pdb
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe
- IMPHASH 1859f09c53c6a7ccf0c78b8dbd0cc5a9
- SHA256 7f25f497ee07285262b185af7434f38a21a1770c437b70df32ea61d2902c423b
- MD5 beb512a9b84f30319b01ab27448963f6
- SHA1 0a3eee699071ef0ab96207369d3c4209181a56bd
- SHA512 37af2b1b152e03b712e037e82cadc19183b32fae2a3d00c9fbd12652b94cf9d456337aa5a104e67361fa8611163df6083a8187f22daff5c135e95ba21df9d164
- SSDEEP 3072:OX46OsHdZTdvZsTy7BYqlXW7X2o2cjOWpSjQrqpiLteyLSk7L:OoMZTH8y5KGzcSwDik7L
- TLSH T101D37E6736A860F9D497853889E18A46D776B4731B7193CF026443A91F23BC46F3E332
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e6:e6:fa:e4:60:e9:9e:9e:01:41:7f:91:e9:72:c0:ee:c5:2b:39:e3:36:d6:70:8b:b0:e2:0c:90:a4:bb:bd:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6b:30:52:18:46:f8:f4:93:91:7a:f1:02:8c:bf:a3:0a:33:1e:3b:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
26496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RtlPcToFileHeader
RaiseException
OutputDebugStringW
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=43, id=207, version=50323,
count=95, id=206, version=50323,
count=9, id=205, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/gacutil.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/ildasm.exe
- IMPHASH ad5fa249b30d415c373e2bb8cdc77172
- SHA256 d7a8fe9448d0a86251b5e45893fb4e367ef95f950f689a1d82a1a2aba04f48df
- MD5 66886aebf02f9339f9b74e1ea41ec1ca
- SHA1 1d88d8890e1d4c996dec4438df10a1b16bff18e0
- SHA512 d4a79f067a46a7e2d681405cc1fa56ea9521ddf566473be9ed005535b9ef9b3a0ba65bbcb268048368c3057a551fe91429160f49742a9d0422c940b7146983fa
- SSDEEP 12288:X8iPgHkKugX5Sgn03FzdS2axJBRdVJAuK+ft63FcJIU:9YkKugX5Rw3YxrRdVJAumcJR
- TLSH T152C48CA6F39842F9D426817CC892C257F6B278450B3186CB729C5A9F1F337E15E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
40:10:51:ca:31:06:d0:d4:ee:3b:16:52:64:57:a9:08:7f:46:2a:ce:db:07:d8:ee:dd:3b:a0:68:9e:c5:73:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ce:20:ad:e9:f4:66:0f:31:38:50:da:1a:73:9d:4e:97:83:3e:f5:3f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
278072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ildasm.pdb
kernel32
GetStdHandle
SetEndOfFile
LoadLibraryExA
GetCommandLineW
ExpandEnvironmentStringsA
CreateProcessW
GetConsoleOutputCP
SetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
WriteConsoleW
SwitchToThread
HeapReAlloc
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
GetConsoleMode
CreateFileW
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
DeleteCriticalSection
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
WideCharToMultiByte
CloseHandle
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleCP
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
RtlPcToFileHeader
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
883KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=51, id=207, version=50323,
count=143, id=206, version=50323,
count=11, id=205, version=50323,
count=265, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/ildasm.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/lc.exe
- SHA256 ffa352f9ea4380a4ef04c080160cd5f6663928dee609a884ae81abcb99a7cf8a
- MD5 e83f4a38d95ad5e83826f7f1a1f66a0f
- SHA1 8984668625c487cb333a415d4d198da48afc9cf2
- SHA512 95c75dae48be257d390999594c634aa42cda9d080c79dd0d92a7140ac3fa2d01ef16f6d0ee1de116aa7458a899c46d74a442992c2962d74b6d440f62d6124c70
- SSDEEP 768:zSMzuxFp27Nc8DO5O6Iq8Wg587iGdBNGa:zS+uxFp27NcQObfgG77HNGa
- TLSH T1C723E82897F84213F6B74BB0ADF5C487AD36FA53AE75C75D2889434D09227C08A5273E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:b6:a6:e0:32:e8:ef:ef:25:b5:e0:8c:2e:7b:81:13:a1:0c:2c:d1:ac:f9:ee:c5:d3:7b:58:1a:84:94:93:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:a3:18:26:12:66:06:7c:a8:c5:c1:9c:25:db:68:87:ff:e7:65:ce
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
lc.pdb
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/lc.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/sgen.exe
- SHA256 e218a5fca6a07f65de07c4152df2d551ee541b91c69b13fac9fbec60e8a82c69
- MD5 69b6756b81b10ccb9ba0674f548ee264
- SHA1 8f88bcb4f15e15375a59b1f35118b857e8129986
- SHA512 8db6e9b29c3cdbca582ea9af1b798c0136f42f831411d0ae4a030c4959b39269b35ef55dff2518a0cc3968a3c8d768dbef6f296d298182d0ec3fe1c28c70dffb
- SSDEEP 768:ubRwSIUjOjyET3c8oQyqCP6Iq8CUX5xxYidd8z:ERwMO33cdQRC2FUXhYq8z
- TLSH T10563C61493E81212EDB64AB09FFBC3C39BBEB6835915D79D345903490D2E7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:fe:e8:99:1d:b2:41:88:6d:e3:62:7e:f2:5b:de:23:12:97:75:92:26:e3:42:88:ac:7d:2c:1d:b2:9d:3c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f0:88:e7:bb:74:fe:a8:40:f5:71:b9:a3:cb:0f:a1:79:bb:a6:0e:2c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sgen.pdb
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/sn.exe
- IMPHASH b43e39f72141c38455537524fa7ef186
- SHA256 bb9a9594ca93e51d9f465ff68127fca1c5dfacf289be08a532da40e5c858c5f7
- MD5 b1074a14788df5c8f231027a838bc2ca
- SHA1 c2e2e1381933ed5701260f389e1df82b52e3e8c5
- SHA512 0a1a748e9ae90c32be5a9d9e9b2a01be1885e692eb95c6ce7d18872e027b2f0f857c79062e1bd65e3703cfe9f7389edca45ae7ff436c3295a5cd2670c2d04568
- SSDEEP 6144:rH9xY5bF43aCJbGsT35SD2D5b+lrdLtoInBK:rdxYlF43aC1GB2DuM
- TLSH T164343852739488F6E8264538C8D0C7E5B272B8151F35CBDB32A4176EAE337E05D387A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:42:18:8c:1d:28:0c:07:7d:54:1a:a4:24:47:be:b5:61:37:f0:3b:33:5d:3d:63:1d:21:c7:bb:43:3b:ae:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:77:d5:d2:7c:f8:64:ef:37:ba:db:fc:67:17:78:51:ff:07:4a:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
74168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
WriteConsoleW
HeapReAlloc
SetFilePointerEx
LoadLibraryW
MultiByteToWideChar
CloseHandle
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GetStdHandle
GlobalUnlock
FlushFileBuffers
RtlCaptureContext
Sleep
GetOEMCP
IsValidCodePage
RtlUnwindEx
GetTickCount64
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
FlsFree
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetModuleHandleW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
HeapSetInformation
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
DebugBreak
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
FlsSetValue
RtlPcToFileHeader
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=111, id=206, version=50323,
count=10, id=205, version=50323,
count=219, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadCPL/Stub/SDKs/x64/sn.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/wsdl.exe
- SHA256 2f483df7d102648951048bd274a1d3e1aa0edc74ec9caf23c4baab03473deaba
- MD5 94d7f58c6ac2e333f67d4d32dc4d127b
- SHA1 3f0658f6f8339320d8e61f71bb38c6feba41efc5
- SHA512 95596da07781532f97199a11749ae90e61217a20b56fb008d59a64ef5b3b6b6a45138d2c444adc2ef379d7d9c12fbe34d4e1e98a16df0b8a3e07d4f100a4dbbc
- SSDEEP 3072:qYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZweOglyRGQ:IT8rLo9YJ/bhuK3fSRbfMA97cZbC69gy
- TLSH T101A3E71573E80711F5FB0BB0ABF692C287FEB9566911D68D2C94124D0C7ABC1AB13727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:fa:3c:f9:14:e5:89:d7:dc:79:e0:c7:40:46:08:26:9c:3f:42:7c:8d:11:25:80:96:4b:4b:71:38:43:07:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a5:50:34:6c:a4:1b:00:49:83:1d:b7:a3:fe:e9:41:1a:43:9a:25:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsdl.pdb
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/x64/wsdl.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/SDKs/x64/xsd.exe
- SHA256 4f5f82d032ab09ec1c429345374d64a6acae525532a1b349a182d25ac333563e
- MD5 1d5d04263b58807df2c9feeff1fc5b96
- SHA1 cff0338da55579f74650e4d9c5b59b53f69cc768
- SHA512 2e8bc0831e3d45841ee183759076a503f9b11c7eb8b1a34e3a2c632508f1f1601b800d182f6608208ac892bb94447016652ceeae6ffb12da290d24fb72fe23b3
- SSDEEP 1536:vYfan8nrNH7alpJjucAdfYPHccoxK2WpFBVGU:9nMMlpJjucAdOccoc22F3GU
- TLSH T135930A15ABFD4205F1FB4F34A8F5C0625A7BBA166D31D75C189D928C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:ba:7b:98:21:eb:67:54:d7:3b:64:28:b7:b1:f1:ea:77:4b:40:01:31:6b:15:75:44:be:c6:03:e2:e7:bf:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b5:1d:ff:45:19:ad:ee:f5:f3:e0:98:3b:72:19:79:02:35:be:ac:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
xsd.pdb
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadCPL/Stub/SDKs/xsd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a20c0479bfd55ed5680d4652d86944d1282fd135994669012e3047628e8844d3
- MD5 e885af77cf8dea8a891f14b5eef4a400
- SHA1 28b570055dbad10778e062245131622480beb141
- SHA512 c0ca5210cd273d72eb4639072034bfdc9ae19ba239dbe53b1eb1748f541fc43c8282f6c024da98ebc7602f60ab067fc2c1acb73ee764e4cee8c1429f19d719e7
- SSDEEP 1536:tYfan8nrNH7alpJjucAdfYPHccoiK2W+OD70GeQ:jnMMlpJjucAdOccot2NOD7uQ
- TLSH T1FA930A14ABFD5205F1FB4F34A8F5C0625A7BB9166E31D65C189D938C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:32:7e:01:07:d4:f2:ab:9c:5b:1c:29:8a:88:dd:11:a6:14:e3:ff:80:92:43:7a:74:5d:29:61:e8:13:ed:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
75:18:fb:16:70:1a:b0:99:65:a6:5e:c0:31:39:79:f5:99:61:3b:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsd.pdb
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/SDKs/xsltc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a9fda11778afc8d4517e89afa36159aa5f4fb971d677ad7fa4b78b824a48ca2a
- MD5 a7239515201dfe38668bf54bd16de93f
- SHA1 b31fe9a9e53dfc939a1c0542de0589ad902cf230
- SHA512 35ac063d062843038c57b03dc2938d19bfcc2656f361c95e7e8f8b8f2f30d11cd3063c21eac8b31648ef9d93b8ced6d582097ceed7a84ae83e3ab36803d8028b
- SSDEEP 1536:nIuzQF3kgdNtQLXWGHAOjoa/MACRB3rZh:nIuzQFUgdNtiWGHAOjzELRBbz
- TLSH T1C0435B55B7FC1213DAF70F71AA7591420F3EEBA32922E52E2888D19D09133C887217B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:99:f3:d5:39:4b:b7:49:96:8f:55:e3:f4:cc:27:12:e2:99:a3:36:eb:5c:89:b6:1b:89:ba:c0:be:af:96:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:b6:ea:45:8a:b1:ec:59:38:98:31:f0:d7:78:69:6e:87:f0:00:42
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsltc.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/3rd-party.txt
- SHA256 6cfbe8553463d2056029563beb188bce1bec4c5d56ad79ac907b52f61e70fd82
- MD5 b9b2c78a4a5a31e52ae7116d72dfe616
- SHA1 5d3f5b4a6d0a53e5f49b04ad1646d1bb11982c20
- SHA512 db879236c444a2b70383dcd4870a231819fc783caed378bce20bf9eb70e67a2f1ae25ce2303fdef9d0cd39200fecc8af6a6c05079c4de6e50503df8282962e3f
- TLSH T1C8F05971024A41DA0D644F58C0A9C385F369258FD716FC8C397E5138E7B4E9243DF04D
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg
- SHA256 618e90213655c042c966673d95648b4b152dadd4c4874c4e193df018f6eda05e
- MD5 fa0463eb37f30431e785112bb3bfe293
- SHA1 a4f042abe3bc9f6e162aeab1969347eef590495e
- SHA512 269ef668f8451dd6c67e1a53ddb73163bcb3389b247e78de941f633a1e75df72a3c65b98fa5bd8d5dcdf9df944f67fe3ecd0f786945fd45eef96b9bdb39323ee
- SSDEEP 98304:gekPhpW1Q7lk4GBi8ZL8ny/V8DO3ihMO2AraYcrGrAd:shs0lk4GBlZgy/V5fsW+rAd
- TLSH T1F20633CBCE49B9C2DF15517A429CDEFE76CBCBCD2380499F831B199101569E80AD37A8
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/License.txt
- SHA256 ff80d40f93f7f62756bc0ce65a47b2e44e4328ca49534c6ce661dcc24e4aba36
- MD5 fc189290a4a863ea831be8ed1123f18c
- SHA1 8fb97b2015b38ede68b5a85cdd0b299f40b7d78b
- SHA512 f54fca9255308039712de28cd763551ab70eff0a5cc822795c90f5b220a91799e87204d72fea4254db64d341492baebaf5e81e1487f5811899e8f786d886f83d
- TLSH T17021A30EB29907621C42536256AAEC86F12FB05A7FAF1E85702EF3495326448D9FB854
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/Readme.md
- SHA256 64b1179453be7d51cb7cbdfceb6dc2a122c7e4d604e557b55e27d82cda209814
- MD5 c3b8507a7b4deab8b7537b808def50e7
- SHA1 d230417dd9acd71c920789162ea9dca044de9119
- SHA512 522ac816c553b1e1eb41b6406fb75c360ae687d7b7e54b8974b3d75f04d5a0a9bfa661e6a0c61a178da9a1c43dfe5da79434403a5370b53098f1583be4c33f63
- SSDEEP 96:j8Vd7N0azzOT7xo9qF3xFvLV9BbdrRnij9jnNdd52X/qZgNoKteRKahoq39HoQmF:4x0aHS3x305Q/qzKA0Rciblj
- TLSH T109F1A5AF0B0914CDAF12599B6B44F1E9EF13421BADC1D8B878AD4334F3DA16501BBA48
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/changelog.txt
- SHA256 3c6a0254f0f9f7b8733dc8498cbc64f291a690d6326a9849d325e54d3b9cd594
- MD5 1a9769ba9b6276dec1f6f8da710254de
- SHA1 866e8c975baa63c6b1f7ceddefc43010b28eecfc
- SHA512 bfb746dc5787132c37a0c9c29de7222686d6b3574211e83bb70595f2c577cc9805ab650150cf0786e586977495ced7d853d7cd7c82c6c46b38e5d42771ba0db9
- TLSH T19581722A56C151EE1AB306B2275DA560FB77110FE743ACC8B44E433C3F76B844697A35
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2ee2037a59920bbc2f8c942e25ab71448d64d5d1d38dd358257aaac1bf2c5c0
- MD5 e37edd3c83ac1c3d35b5cd73fabfd93b
- SHA1 082a588b197b4f2d10193f8eba565c96378d48c5
- SHA512 e0f18fa36a0feda4e814faffa4a3e47bb5d0e827cf48a2a7513d1c4f940b186e4e40803d5d4d4ba10e9cc5e582cde7e53376838257e42eef5a7e723bbc938390
- SSDEEP 48:6gdGASB7rEr0Jd6tzif2HJKubOrPhBnueJot6Ut/MogqkNXTw:EAy7rzJkef2jOuckrk
- TLSH T18B91622267AC07BFFCBB4B35BEB3934112B5B610DA13CB6E4D8216165C267644C22AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi
- SHA256 683a4fe842732bc2e5faf03b4c999a51fb07be8bfbe4579c355677d4c1f1d282
- MD5 196488e18bb1d3d1eef97cb0618372df
- SHA1 0d04ba96799b214acd726657662c575c1f48981e
- SHA512 3f117c5b7c34d59388bcc7e41a7166296ae825b4e48b388f647d36a6223aee3cd3e1f336d40ff7b2a72c364b50ec72438991b686a93531b1838406350ed13f91
- TLSH T1A9D022D07F006489C38680780460A8E113FAA0DA4EF4920F30C8220EAC43A376F52451
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afe62d5447c2961d89b763fc60380744df38e785f4a386d61556ac0138e70c1b
- MD5 b5e099f5aa58eb62248d02eabb633f65
- SHA1 d447c68f05d70f36cad9e4955b35e9d8bc03947a
- SHA512 0e0e1d0afa2154cdd2e47803162abf44155ab810481766c5bf2be04d28e270314c969c2d2d7b46ad37c890a7a93376de27da0a17a0667a727efb79b2c4ad2cab
- SSDEEP 48:6F1S+014jrjWmqghYhPhjhcuR8SFMDfqKOrPVzu7KysYt6Ut/MogqkNXTw:Mh0OjrykMZdcuRGku2Zkrk
- TLSH T1BAC17422D7A803BEFC7B0B31EE93B74215F1F5158BD3DA2A05811B4B7C267145922B64
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Metadata\obj\Release\DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1
- SHA256 185b42f00826a38260a51601c8fa87a3af78f19c682f2dbd216deaf7b8605ab0
- MD5 1b821fecb7745515c13825f641eed70a
- SHA1 c627bd27393f7225c5ba57c193f0dbe403ecc963
- SHA512 bf57c8932824f4f9fd2cdabe6fb9e4231ec63a0a2c219927e1ddcf52b021b667ee60c044c85d3665c9be0bea269121482773047188ac8de8972862b6c4a02312
- SSDEEP 96:d2qHTUeaEnqOAzgTuUPUzVt+ZYRJTdPbm4eSnzyxB6/E5:MG9aUDAouUPUzGZCJTdLeSnzyxB6M5
- TLSH T158B141527B05E6C1BBF35766DA42DD49FD4A143701659528F0ACC2C62F32E14C3F2EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d83b3daa7fc17c7361c8c205a76f92e0d6a881c80375fa518662ceb386af1b4
- MD5 ae1d4372a93befe78284457a0e2d2c94
- SHA1 4f6097cf6a2cfbd1ec9257dc01ab6d34bbf8a4cc
- SHA512 d06e8395f4d077b9341d5210ea86ccef1eb4f9c7c7177de39dd8bd689f6d448b7cdf84d4a1abb6233c73864ea5658df55c69d08ad8903495bb8a3ddd24134e0c
- SSDEEP 768:9v3pyNQdgmg72Ger0Gb1xB1q2aEmPc4YSad5BKMi2jXHUttH:p34NQdgmPGNMLs2ePcYyd9rHUr
- TLSH T17F131A182785CEBEEDB90E74FC6056352731C386F826C71B5764B5AC64C238F66E2A48
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
17:2d:e7:d0:2d:52:fd:a6:20:2d:22:71:ee:22:7c:2b:29:66:27:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
42622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7761b1955c5a0822ddbb86dfed6801d952a6c65281e6d29c65265285096b01c5
- MD5 0015d9b1cfb6abc0bb8c59aa1849abb7
- SHA1 eea52f295115c4b2152f5f4635477fd0a1e6e336
- SHA512 739b5adb8bcf577ee95a5a45f2a92df24de71ae0452c4b434b17f5646a6925344d9d718b4149a124ed7cad29c78cf9347d780196d080a99c80e06b7dd0363fd0
- SSDEEP 1536:jcXfve+YEEYBqqTU6qNScWXqS7ScM6Nnqj+R8KEOv1hL6THlZ0Nj7BTWWYKVN+RH:w3e+YEEYBqqTU6qsXasScMry+KEOv1hm
- TLSH T1E193D70563FC0229FEB71BB5BDB541190B77FA966923C75E1000125E0B72B5B8AB2B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
99:6b:ca:86:0b:d2:4f:9e:29:f0:66:22:58:b3:7d:6c:db:82:07:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
90162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbec9a910488cadbad860c850ceae521a2a346619c5a9da579e5051e270f114c
- MD5 3998804194188c25df75f505ac5c531a
- SHA1 6b15b2d779e7c46e31fcc864fc1ef326fb3d2b50
- SHA512 d7cd7457c753190fd1ae5386a62dffbe5907ace02227ef873f4c890f4a4e987914fb94ab1ec8318f48a76fc55cfe8e7de83b75cfcbec0bb8ff0e18d2d956abdc
- SSDEEP 768:droEzop6gC66+666M66666+vvvvvvvvvvvvvF66666K66n6666666666ZpkLEyXD:nNLEyXCL
- TLSH T1D9F2E8C24341D52ECDEB92BAF0D512E02339F34D67539B0BA718A01EA95FBAD7307A45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4dfe61f79efe3a8e686a2f045f372476c5fec704ce3015c24608c84270b408cd
- MD5 dd97f2c3467656a5eaccb0ab679dbbb3
- SHA1 b11b247f96054fa0d2eaf52f080b0c759e0b6ce6
- SHA512 162a403dea6cca3381d4b8854057814178c858ad7a2a4c9ad0bdd8bd77cc25497c286832b7aab804a708fa927c2347ca925afcb3cb08fb870c711e080d72a4fb
- SSDEEP 6144:9F7O4dMG5Q4RMYAkUSHzqu4OJDW4i8BO:7OvG5Q17VOJ28B
- TLSH T195447C1627AC5ABFD7CE8B3BE0409A1AC2F8C05E724FDB419CD8D5F92C277959910263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\net_4_0_Release\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/NSBin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c39024083771329805ee9e30c3529397e39eb98174cd4dcdfab62442bbcc7ef6
- MD5 0a3ed8a4f354f7516c91f68cfb1e4ece
- SHA1 5a569a08427b66237b20ba90d12efcaa7fca9e80
- SHA512 21293b72bcda196ebcda5430e04f67948c5a99b19d1126f495d1f352c47f02d1aeeb7944f61b96e3765b999774266df209494649f856e68426a4bd1e1ac60f3e
- SSDEEP 384:ZqY1VhOF+5avamTEDbrXSS8yAF1KWNftgpl:RDUF+gvamniU1KUtIl
- TLSH T1E462F6002BF8832ACBBF0B3978F3565106F1EA05AA33C75F1964F4571817B5906B177A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\NSBin\obj\Release\NSBin.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/NSBin.pdb
- SHA256 540e4b28a65346f82a2a4e699d09475e6d7fd6bd603e483675c2ab0243f7e210
- MD5 1c3ef4be1c1a17390a655d328e40f363
- SHA1 30ad53e3259a36b144b21a74752c978b94661764
- SHA512 763dbc54b82de4831c3fc173dce084b8d8d50553afab4c4632d901b3266826b210d0a05adf874fb850103dacdb80e42a43ef6c653db55e9472573e5d4f30993a
- SSDEEP 192:DAoA0AsLATAwAhAqAodOgR1kjxs8Pg2cl64LIkJWw9wd66sn/lGfREhSbPy8eCsL:NDBcx4HYmihy8zV5AjZnZ
- TLSH T179032017FF40DA32E46981347AEB8F2D47B5EC8C9B81975F6345B1683CB23A92D82354
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39faf6e347ac0c31c572193dcfb2d61b7a3eb184b29e8b1b82f90917aec599ef
- MD5 2dad575e994c4ec82023c903c8f89404
- SHA1 14eef09004f1e0c5d726a25a3b74887b3098ef42
- SHA512 c54f0c1b67dab869507b7918df69032af6b3f7186ef38b07603effb67c4a991fefcf9890cd26c071589f1f0399ab2b8db54c5983f0a9ac66a1a491fbdd5f0f01
- SSDEEP 768:TMaXJ/C/iKATxUnlFL5JL3vv1FfmQ91hv/nDE/TV0ZXwtr84ZJ+LZkKZjk6ZH4tC:TMzbAT6lFXZBmQ91hvg/ReX8lZT8/
- TLSH T1F7431904BBE80534F3BB2E7BB07154944F35F787AD12EF5E6891A49E0E527011AA13AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport.MSBuild\obj\Release\RGiesecke.DllExport.MSBuild.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb
- SHA256 929d7c913329c6705f2be9d8d65abf522a38c5f3852c2674709936bd94baba8f
- MD5 610b0b6619fba7cf145e0e83aa889638
- SHA1 638dc3fbd365267f941f10b3196baaeaafe2edf0
- SHA512 81cd6c71abc35ee9a09f1824bc0d9304f0810298accad75063b52a811d7df9148ab9764114153649b8a70e539ea49b56fc0fc547b2d3d1603533a784702aa869
- SSDEEP 768:uTIHnYYZOT/pVRFk12TfPD1fY/lo0R8A8HEQq5q:uTIpZOPRk6BfMlFj2EQq5q
- TLSH T1AFC38257BF14CA72D81985386EEF4B1E0638EACD4B43979F9706B0683EF23761C86254
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04fffee97413dd15c7150fce8c2ec4eb6ba668a919e2aec7be8b44da3cbe19dd
- MD5 76f1a829fe3a0e01490bf68c9a0e96ba
- SHA1 780653b5edccdfb13707673f9b73e8addac4ca01
- SHA512 ebe62260807c58fe1691095ad7745ae6b021818feb963bafa722f09522df33a4576e7eea18d55950248df7c8e0378fbb61007097471b0d3442d8705cccadeeb5
- SSDEEP 1536:AJdpmcyf4uxDoNj8RrewhfVI/j12m6fz9w37vPRnUwoLSE+jHgAUqn:AJfmjguxgQreayH6fzs7vZnUwpEFPqn
- TLSH T159935D2527EC4A69F7AB0E39B8B560120FB5FAC62403EB5D4E44789E1D233418E72777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport\obj\Release\RGiesecke.DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb
- SHA256 3380f7127b016409a0b73aa5c333df308abff9b01d51761e881fba4c04e2f1e8
- MD5 1667a09c0b87fb46b0fc8a3176d6e88c
- SHA1 519b62a38104345d05efa0e8f2ea5c01537be5f2
- SHA512 39f784f84a6ca8111dd4839f7bd2fbed9e9670c5b6cd1fd617aa884b9cc8bab54a198f60a43ff10a09156890bc800f70d72c747e92224497b564e56dd67594b2
- SSDEEP 1536:DlZJBMr/6JOw8NvX22Of2TqGcHdgXZguegKxmuRnUNLEAIc+787uughTF+422z7D:DFBMr/vtYfrWyufaUNw78arTZ2UD
- TLSH T156348417BF44CAB2E46A85392BDF8F0D4B34E6884F42572FA785B12C3DE23551D872A4
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c
- MD5 835e9ede7e7c774e7a2d56cfdf6e9b17
- SHA1 a43ed886b68c6ee913da85df9ad2064f1d81c470
- SHA512 74284fd44497beb74326d11a0f63d96aff20aa44cfa8385f6b63b7e6743403c36e2ea4fb0d991767117a97d320e04d2b21f0a4730916244af4ffdaf51e834a26
- SSDEEP 3072:d/SDqTIE+QQVVBCTmAG17iT+Lt8D/1L2iLZdrs81sDotEKjRmarzRm+5gSBZqoEJ:d/PXS6WK2iLZdgotEKj9rzRmkgSBAot
- TLSH T1377408253764DBAFC8AFA276F96544304637DB183922C72359182D2C59CF76BBF12382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
359678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT
- SHA256 119ff5570dd386f9db9878c0fef47d29aebcc6814a3753ccea8eebd9f65ec852
- MD5 e407a499be3c99b945b783bdea9f13d2
- SHA1 005b44116bfa6323283296cc059b0ed10bd8bb56
- SHA512 e497eed62cee874771a80c0bd83632954f583799d97210a6dc28b5d97304fb4eb37655116fa53949ee709f5de8bbb02426a0c1845d8532d739100b54a1536bcb
- TLSH T11E21931E7256036218A2476145A9ACC5F12BB15A7E6B0985206DF209132A058CAFF868
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT
- SHA256 28aaf37474f9d460b44c5f45001784540f68df3d27c24f04c103542d8d3d27ec
- MD5 c40c5ddda4168114579a752f75561bae
- SHA1 24d97511a8b0f32ae3ed2ab662d8618ca34a7c24
- SHA512 fb439acc8f4136cc6e0f735b905809abdb81e4e034c47b70c62c9cb88bc5633d8ca93bc452e1d298ccf68dc7beabed1c0d94f0a09149f96af9686a4ee3641e5e
- TLSH T11E5173AAAB4E5253CEF14293615638C4B32EF05E7F76585024AC001CB367B7A433BB1D
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/README.md
- SHA256 3319cafc0d27de589d831969161089bb80b0300d4bf06624c338823cccbfd2ce
- MD5 59097c1b59d7a3ba19cae75d0b0e41e5
- SHA1 b77a5d3291d4324fdafe9b0931e01abc506a9df9
- SHA512 cc72f68059782690852a150e208ac036b8bdb5d49a18ff56634198d599f0f004615526b923f003fa750dfbc649cae206708900a040bd3bbb30404f4170c65693
- TLSH T19F01DD114D1DD5E21BE2E1E21048A9BECF4AE4446AFB28903C9E411C23103CB46EF329
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/_Version.txt
- SHA256 5fd7d8d04ab51112c09404a09e4ebc6bdf2d581301867c6ca3fbc96d1de396e7
- MD5 27afea6aa7c8f8dcdb8bbd61ee810eec
- SHA1 9b8cc9df02992ce2049535333bef53eb64c4b14c
- SHA512 08d72ec35b4b0fa9135d9394d8f024d3949d9b39c65b9f0e8f6c17ea87812e85b23af6150c2356de05d28d663a9a51e2dbfde7f948aac7e33d431c8f0aa5cbb7
- TLSH T199F0978F2C371689C1F3D301B64A0728FE9C130CCB41D84A341D0024FBB7A97385DA06
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/changelog.txt
- SHA256 7de8201e673498edf93c22c8a00ad699a2fd922e76895af7b92c38f9991c7855
- MD5 d121612a9fb3a8dd2a58dac73ed15c92
- SHA1 b74c23372477a535bb3e7d3115fec84129a18a40
- SHA512 d228dd79ac061824ef88ff77d71f334351f6ff8852e8ea17c94811da18bfbce6ad49c371b510ac11fc5008b0d9149ee847bcb60bc3b9f5ebfd30681afd522bd5
- TLSH T1691127838C1A506A5A71E3935AC97606E925020FEA873C8CBD6C1339AF79F4116DFB48
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll
- IMPHASH 4ec23ad5e3f71ff3322a6bac0917b9bd
- SHA256 611784b6c322814f1a1cc5dc29bf966d31146d277c9b115ad208b221071fc0d9
- MD5 cedc881566715873534c5d8fec3ca48d
- SHA1 e4808ec9da3aff012331997a5c5c1661d5399d00
- SHA512 693003053b6f8d5a8db6f0bd7bb3ec780fffbfcb870130642e8c2bc6ee5c0908a0e6a839c23715aef8ba38a27d517140e73c54fe22caf0e1bc4894ebc24306ec
- SSDEEP 98304:wNi1VdVSf5bm7Nz0XOlWJHxINuN0jI5aTpV8Ymg:wNi1VdVi6Jz8OlWJR6uNuI5r
- TLSH T178069F31BAA5803AEA5F1231593FA64E94E972704B3100CBB2F49B1E3EF54D33639657
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb
kernel32
GetSystemTimeAsFileTime
RaiseException
FreeLibrary
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
TerminateProcess
GetCurrentProcess
GetSystemDefaultLocaleName
GetUserPreferredUILanguages
GetUserDefaultLocaleName
GetLocaleInfoEx
CompareStringEx
CompareStringOrdinal
LCMapStringEx
FindNLSStringEx
GetCalendarInfoEx
LCIDToLocaleName
LocaleNameToLCID
EnumTimeFormatsEx
EnumCalendarInfoExEx
ResolveLocaleName
GetThreadPreferredUILanguages
EnumSystemLocalesEx
GetSystemInfo
GetModuleHandleW
SwitchToThread
GetProcessAffinityMask
FlushInstructionCache
VerSetConditionMask
VerifyVersionInfoW
IsWow64Process
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
CloseHandle
CreateProcessW
GetCurrentThread
WriteFile
GetStdHandle
GetConsoleOutputCP
GetLogicalProcessorInformation
SetThreadLocale
MapViewOfFileEx
UnmapViewOfFile
GetTickCount
QueryPerformanceCounter
GetStringTypeExW
WaitForSingleObject
GetTickCount64
CreateFileMappingW
GetFileSize
GlobalMemoryStatusEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateSemaphoreExW
OpenProcess
SetConsoleCtrlHandler
GetCurrentThreadId
GetVersionExW
InterlockedPushEntrySList
GetThreadContext
SuspendThread
ResumeThread
SetThreadContext
Sleep
FlushProcessWriteBuffers
QueueUserAPC
VirtualQuery
QueryPerformanceFrequency
InitializeSListHead
InterlockedPopEntrySList
GetCommandLineW
RaiseFailFastException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
DuplicateHandle
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
SetThreadStackGuarantee
GetThreadTimes
VirtualAlloc
VirtualFree
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SleepEx
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetThreadLocale
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ExitProcess
SetFilePointer
ReadFile
GetProcessTimes
InterlockedFlushSList
GetDriveTypeW
CreateMemoryResourceNotification
RtlUnwind
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcessorNumber
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReadProcessMemory
lstrlenW
OutputDebugStringA
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualUnlock
ResetWriteWatch
GetWriteWatch
SetThreadAffinityMask
MapViewOfFile
FlushFileBuffers
GetLocalTime
GetTimeFormatW
GetDateFormatW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
FindStringOrdinal
GetSystemDefaultUILanguage
GetLocaleInfoW
IsValidLocaleName
LocalFree
FormatMessageW
WideCharToMultiByte
IsDBCSLeadByte
GetCPInfo
GetACP
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetLongPathNameW
GetLastError
EncodePointer
GetFileAttributesExW
GetFileAttributesW
CreateFileW
LoadLibraryExW
SetLastError
MultiByteToWideChar
CreateThread
ExitThread
OpenEventW
LoadLibraryW
LoadLibraryExA
advapi32
SetKernelObjectSecurity
ImpersonateLoggedOnUser
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
EventRegister
GetTokenInformation
EventWrite
SetThreadToken
OpenProcessToken
RevertToSelf
OpenThreadToken
RegEnumValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateGuid
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CLSIDFromProgID
CoReleaseMarshalData
StringFromGUID2
CoRevokeInitializeSpy
CoUninitialize
CoWaitForMultipleHandles
CoRegisterInitializeSpy
CoInitializeEx
IIDFromString
CoGetObjectContext
CoGetContextToken
CoGetMarshalSizeMax
CoMarshalInterface
CoUnmarshalInterface
CoGetClassObject
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SafeArraySetRecordInfo
VarDecMul
SetErrorInfo
CreateErrorInfo
SysFreeString
LoadRegTypeLi
SysAllocString
SysStringLen
GetErrorInfo
SafeArrayGetVartype
VariantChangeType
VariantChangeTypeEx
SysAllocStringLen
VarDecCmp
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
VariantClear
VariantInit
VarDecFromCy
VarCyFromDec
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
VarDecRound
SafeArrayAllocData
SafeArrayGetElemsize
SafeArrayGetRecordInfo
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetDim
SafeArrayGetLBound
VarDecFromR4
VarDecFromR8
VarR8FromDec
VarDecFix
VarDecInt
VarR4FromDec
user32
LoadStringW
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
shlwapi
PathFindFileNameW
bcrypt
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
api-ms-win-crt-string-l1-1-0
towlower
wcsnlen
_wcsicmp
towupper
_strnicmp
isdigit
isalpha
iswascii
_stricmp
strnlen
iswspace
iswupper
strcat_s
strcmp
strncat_s
strlen
wcsncat_s
wcscat_s
strncmp
wcsncmp
strncpy_s
strcpy_s
wcsncpy_s
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
fputs
fclose
_putws
__stdio_common_vfwprintf
_flushall
fflush
fwrite
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vsnwprintf_s
_wfopen_s
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_invalid_parameter_noinfo
_errno
_configure_narrow_argv
_controlfp_s
_initialize_narrow_environment
abort
terminate
_initialize_onexit_table
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initterm
api-ms-win-crt-convert-l1-1-0
wcstoul
atol
_itow_s
atoi
_ltow_s
api-ms-win-crt-utility-l1-1-0
ldiv
qsort
bsearch
api-ms-win-crt-math-l1-1-0
__libm_sse2_asin
_isnan
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_copysign
__libm_sse2_atan
ceil
floor
__libm_sse2_acos
_CItanh
_CIsinh
_CIfmod
_CIcosh
__libm_sse2_atan2
_except1
__libm_sse2_cos
__libm_sse2_pow
__libm_sse2_sin
__libm_sse2_tan
modf
_libm_sse2_exp_precise
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-heap-l1-1-0
_free_base
_calloc_base
malloc
free
GetCLRRuntimeHost
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
g_CLREngineMetrics
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
91B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
650KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=206, version=65501,
count=17, id=203, version=65501,
count=422, id=1, productName=Unmarked objects,
count=23, id=259, version=24123,
count=33, id=261, version=24123,
count=18, id=260, version=24123,
count=6, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=385, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe
- IMPHASH ced05e986d6b96987cf3863cf7e57f3d
- SHA256 cc7593007ab383579584b2cb9f3104a316e8f75b9b4b7daa334daf8bf4aaa401
- MD5 755781ba89b1841c7a542ba09c6b359d
- SHA1 0b1a7051ffc05617cb2572e90b1deb60ca8d84a3
- SHA512 4a96bc40c42a89e056594b528ee0dd5ca7596333156a9b4cb06733917d5789366b3eaae5dcf4db98f7668967a52a195b4832fb2666d1cce14eac77c30569e0ea
- SSDEEP 6144:p9gIO4gkniw89wTXb8Jy6nudUunD2mRYZD6zsw2kGfjqoAu:TLOX5wrTXb8Jy9b2mRs6zVoA
- TLSH T154749E217F47403ACE7303364A96A73562BF50215F6503CB33DCDA5CAA742E2A67D2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
198528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ilasm\Release\ilasm.pdb
coreclr
MetaDataGetDispenser
ole32
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
IIDFromString
CoTaskMemAlloc
oleaut32
SetErrorInfo
SysFreeString
SysAllocString
CreateErrorInfo
kernel32
GetLastError
CloseHandle
GetFileSize
GetFullPathNameW
GetConsoleOutputCP
SetEnvironmentVariableW
UnmapViewOfFile
GetBinaryTypeA
DeleteFileW
HeapSetInformation
CreateFileMappingW
MapViewOfFile
GetStdHandle
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryExW
CreateFileW
SearchPathW
GetModuleFileNameW
GetTempFileNameW
GetTempPathW
GetEnvironmentVariableW
FindFirstFileExW
GetACP
GetCPInfo
FormatMessageW
LocalFree
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FlushInstructionCache
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
SetLastError
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
IsDebuggerPresent
CreateProcessW
GetCurrentThread
lstrlenW
WaitForSingleObject
ReadFile
GetExitCodeProcess
WriteFile
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
CreateSemaphoreExW
advapi32
SetThreadToken
RevertToSelf
OpenThreadToken
IsTextUnicode
user32
LoadStringW
shlwapi
PathFindExtensionW
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fopen_s
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
fread
__stdio_common_vsnprintf_s
__acrt_iob_func
_wfopen_s
__stdio_common_vswprintf
__stdio_common_vswscanf
fwrite
fclose
api-ms-win-crt-string-l1-1-0
isdigit
wcscpy_s
_wcsicmp
strcat_s
strcpy_s
strncmp
wcsncmp
strncpy_s
isspace
wcscat_s
wcsncpy_s
_stricmp
api-ms-win-crt-convert-l1-1-0
wcstod
atoi
strtod
api-ms-win-crt-runtime-l1-1-0
_set_app_type
exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_controlfp_s
_errno
terminate
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_c_exit
__p___wargv
__p___argc
_get_initial_wide_environment
_exit
_initterm_e
_initterm
_configure_wide_argv
api-ms-win-crt-multibyte-l1-1-0
_mbsinc
api-ms-win-crt-heap-l1-1-0
_free_base
_set_new_mode
free
_calloc_base
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
227KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=206, version=65501,
count=16, id=259, version=24123,
count=39, id=261, version=24123,
count=20, id=260, version=24123,
count=12, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=240, id=1, productName=Unmarked objects,
count=51, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe
- IMPHASH 04376759df9b9515a9f9fabe4dd97d99
- SHA256 1847a66b7a7ae14269589e7648a063fbe741bf172ca73b484ac6d72c1e72287b
- MD5 c80200ca7ee6db914ee94994ad4e7867
- SHA1 75e69c145b2a1b9f61710a4fdb44f2f4cea00c5e
- SHA512 a6124dda96de3792de50df82c7b7148955793a6789276db7ad8272c895203316236e242db16830a12129c186d513efa18249f8a15f227c3ffa063c0abf6d06a6
- SSDEEP 6144:kZhtoA8d2CkbjmqcqOovby/Q2cxBRuaybMpjk2xc:MHPs2vbjFOS2UBUa3c
- TLSH T147748E15FB20F436C89201B3874AA256E4BE69707F434287739C5BDCAB753D2A62C71B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
220720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\exe\Release\ildasm.pdb
coreclr
MetaDataGetDispenser
GetMetaDataPublicInterfaceFromInternal
GetMetaDataInternalInterfaceFromPublic
GetMetaDataInternalInterface
ole32
StringFromGUID2
oleaut32
SetErrorInfo
VariantInit
SysFreeString
GetErrorInfo
SysAllocString
SysAllocStringLen
VariantChangeType
VariantClear
kernel32
UnmapViewOfFile
CloseHandle
GetFileSize
CreateFileMappingW
MapViewOfFile
SetLastError
WriteFile
MultiByteToWideChar
GetLastError
WideCharToMultiByte
CreateFileMappingA
GetCommandLineW
GetFullPathNameW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
LoadLibraryExW
CreateFileW
GetFileAttributesW
GetModuleFileNameW
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
HeapFree
GetACP
GetCPInfo
FormatMessageW
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetLocaleInfoW
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
EncodePointer
IsDebuggerPresent
GetEnvironmentVariableA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
user32
LoadStringW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
_set_fmode
fopen_s
fgets
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf_s
__p__commode
fwrite
__stdio_common_vsprintf_s
fclose
_wfopen_s
api-ms-win-crt-string-l1-1-0
wcsncmp
wcsncpy_s
_wcsnicmp
iswprint
isprint
strcat_s
_wcsicmp
_stricmp
strncmp
strcpy_s
wcscat_s
wcscpy_s
strncpy_s
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
_itow_s
atoi
_gcvt_s
atof
strtod
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
exit
_register_onexit_function
_controlfp_s
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
__p___argc
_errno
_cexit
_get_initial_narrow_environment
_exit
_initterm_e
abort
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initterm
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
852KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=206, version=65501,
count=15, id=259, version=24123,
count=39, id=261, version=24123,
count=18, id=260, version=24123,
count=10, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=234, id=1, productName=Unmarked objects,
count=45, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll
- IMPHASH d792987269cb06308dbf75f94f5169c6
- SHA256 29b9b70111cdbfc46bafe00a1429f01cc6f9251afca7700c4a7d0e9b17cd5bdf
- MD5 c4dfeecb6877c1370201851ba638d04d
- SHA1 8570424e3f7d39dd8037d891dbb734d30f722aca
- SHA512 f649f0512fe62a678a70c7c71aa06b57efc3bfe20a5218c13010c4a7750d672f7b49a7be967573db8f777c0202532f0b0a0e878cd8c992808466c75c50dd7565
- SSDEEP 384:JWU23lTkOLvg/YtHvdEfEbZj8gW34OWyWbYe3jKESkYqgzPk/:JWH3lTk+LNEEDvKESk
- TLSH T161D21C1067F91614F5F77A70ADB595624A3B7D90AA71C70E074C428E0FA7A81CEB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\rcdll\Release\ildasmrc.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_cexit
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
kernel32
GetSystemTimeAsFileTime
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcess
SetLastError
IsProcessorFeaturePresent
GetLastError
TerminateProcess
RtlUnwind
InterlockedFlushSList
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=203, version=65501,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=49, id=1, productName=Unmarked objects,
count=5, id=259, version=24123,
count=21, id=261, version=24123,
count=13, id=260, version=24123,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll
- IMPHASH 7a08a43df1dd263450c1a5425087d37d
- SHA256 f87d4d6910c92ab8495d0b4dbf2331d45fca86fa5c6ef5fa9efe5658c6b01343
- MD5 1f7e9db6d2abf2c8ef8e57652728d291
- SHA1 a51717409e8c6f1738da6d495447ef2c2198aee7
- SHA512 27f1285214879c8d6258034cf172dd9f5d2da34a19f0e61ff13a10245a8f0da31423b4b9a3ac3cfab74a55bd3a6d0eb973e73a2ff93e4f84c73168d7940529c5
- SSDEEP 24576:C+yfe57XLtwfvxkHM3i3ABlY/59Yjnlx2Zo/Wi1gHYcS9vvqKuO:4w7hwHxkf3+lY/59YnlxCohKYcCvyKuO
- TLSH T1E3457D2235858836D55E02B08D3EB58F96ADB1314B7001CF32B4AE8D6E75DD2B635AF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
857888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb
kernel32
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
RaiseException
HeapFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
ReadProcessMemory
SwitchToThread
GetProcessAffinityMask
GetEnvironmentVariableW
GetFullPathNameW
DebugBreak
TerminateProcess
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
LCMapStringEx
OutputDebugStringW
IsDebuggerPresent
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateFreeThreadedMarshaler
CoTaskMemFree
IIDFromString
CoCreateGuid
oleaut32
CreateErrorInfo
SetErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncpy_s
wcsncat_s
strcmp
strncat_s
strlen
strncmp
wcsncmp
wcscpy_s
_wcslwr_s
strcpy_s
wcscat_s
strcat_s
strnlen
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
abort
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
_flushall
_putws
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
_calloc_base
_free_base
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
934KB
Virtual Size
933KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=211, id=1, productName=Unmarked objects,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=200, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll
- IMPHASH d7f1402eeabd14c4f5992750bb791f74
- SHA256 0b962100fb006469b74609e66ab182b3044519ec8be6d4792cfae6e5d2421567
- MD5 339d8f882bb7fa33ec7d73c9bcad982f
- SHA1 ebf63e40d54aac542769d3418e72bde371e6d5b9
- SHA512 7f37dbd93f2c3bb13892e2298a8da4b8858b6df15b617132cf2da87d3b584af7418dd458aec35c0405dcbdfbb3a2d464bd2d01028ff5d523f30200af2530f5b1
- SSDEEP 24576:zjKo2UQBxpa768zGFxPXwc3zq4tHTI1diI:/aUexpae8zoPjRTI1diI
- TLSH T18A256C723E4CC83ADB9F16719D1D625AA07D63314B6104C723B4BA5E2BB01D39E3CD9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
667056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb
kernel32
ResumeThread
FreeLibrary
DuplicateHandle
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
ContinueDebugEvent
OpenProcess
TerminateProcess
GetCurrentProcessId
IsWow64Process
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
GetEnvironmentVariableW
GetFullPathNameW
CreateThread
GetSystemInfo
MultiByteToWideChar
SwitchToThread
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
CreateProcessW
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
LCMapStringEx
WriteFile
SetFilePointer
FlushFileBuffers
ReadFile
OpenThread
FlushInstructionCache
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetProcAddress
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoCreateGuid
CoTaskMemAlloc
IIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SetErrorInfo
VariantInit
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncmp
strcpy_s
wcsncmp
wcsnlen
strncpy_s
wcsncat_s
wcscat_s
_wcsicmp
wcscpy_s
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_cexit
abort
_register_onexit_function
_initialize_onexit_table
_errno
_invalid_parameter_noinfo
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsnprintf_s
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-heap-l1-1-0
_free_base
free
malloc
_calloc_base
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-math-l1-1-0
_except1
CoreCLRCreateCordbObject
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
Name
.text
Size
748KB
Virtual Size
747KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=259, version=24123,
count=28, id=261, version=24123,
count=16, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=225, id=1, productName=Unmarked objects,
count=123, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/init.ps1
- SHA256 117a6ab1449e7d8543519c958ac943cbfb89aa0cd7955e9e498ed1f3b0797ea1
- MD5 5dd6c8248017d5944453220a5282fd0c
- SHA1 46705ccd6d0018be21014637fb64dc8575ba99a8
- SHA512 18ce52cabebfcdcb1a368086f1ee3dc2967540aaaa590762a978650f7a2124ade076d1d18c878466c723bb780ffe6c9aa3e6419a833951a238cc669532dfbbda
- TLSH T147E0E791F16197066CE69BD774C7CCC8265F790652557000B16FC71C5CDED405B4F02C
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/install.ps1
- SHA256 36f5aa39be23e188fa75857197dacf6e02b4eb9ca05b1a27276ee83bd8117862
- MD5 abaccf5a753a04a987f0ae95f16d52df
- SHA1 c7dc15e4c2c54cbb5f42a0ccfa170baeeef97eb9
- SHA512 42debc7186973b0a1358bbc078f13de9b1b1c6f57635f4c992d00a03e04b52ee5540bf1da072ca49be58276f49d85adb9511cf8509b4038e5061e1a8efbbb227
- TLSH T15C4123165E0296F17BF31343CE01EE9AFF8E165E515E5B28F0ADD2803B19806936746B
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51cbdb2203775f1f578b53939c843bc6a469e798fea7954daccabd45ec0cece1
- MD5 dc0914413399f9c29cda5637ee1f4c16
- SHA1 0012f717ec62b136419282e4abaf62605f2e45b1
- SHA512 c66ae88d304b205973372b5f106696a90e1aa242a9b9d6c31d6119da31067ef4bd6c2f19ca342f7fa6a1ec7c511fda6a479b413f01f581adc499afd1cef3d96f
- SSDEEP 768:WO9yZtvT62StYtXYHr3tiCB6iosctkYtNb+DGtIYtNtPXH5t0gtYfv6ct69w4e7V:vyZxaYer3BNYGGKY7vxGHP7dNaWBe3Q
- TLSH T1C7E2C51137ADA933E7FE8BF52D31A14447B6B512A862DBCD1DC5A19A40E3F804782F93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Configurator\obj\Release\net.r_eg.DllExport.Configurator.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb
- SHA256 c661ac05d38bce60a65a050b48604f9113d2e833037fa2616453b52f692bb134
- MD5 0f82fefb9b67a8912c616d367c98ca78
- SHA1 7738041a0a17f703294eca3aebf8b744f5f5cb92
- SHA512 6eba882ddf627ab458e29d448a9651860e60a2d2b51e911e0da53827a6de18bc8da255ebe4850f1499110ca966c506def0602d2e9afa0e720884903d110f54fb
- SSDEEP 384:2rPxPpRN92oMQ3NNk2ZoDA//VnVO7T4RbFd8/YL:2rlNBMs+A/lVOARbL8
- TLSH T16F332003FF40CE32E46A867562D78F3D9AB5ED848B42579F538AB15C3DF13551E82260
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets
- SHA256 a0e208637101895b2f5bff6aec30fee69151b0040da97f895bd44ff10e2b171a
- MD5 edc613b613939c64607e875b6355c8bf
- SHA1 61446927a6be6cc676852ac2ae776ae035d49987
- SHA512 c4b6faf59d049cfd1e30d8ddaedd684747c958168cd3a81112766aaddc83f60dc9e4cac7b0be7ce84fe43e0a14071b7ef1f8b12ec789c6bb1d81b07d0d3877a9
- SSDEEP 96:AUvZG/WiEz41BD3WzCCFedZF81pEsNznhfonBZzhrAa:5ZG/Wi041BDGduO1pEqznhfo/zhca
- TLSH T1C1B1CA23DF89B4D735A7831617A0C084AD3052B7356125D878AE93627FB762211DFBE3
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadCPL/Stub/packages/DllExport.1.5.2/tools/uninstall.ps1
- SHA256 7ed414f0f451ff56c4cbd69c8eec50a9768c8882f40ab511632ae8ac9c8e125c
- MD5 a79da006efb58ebdc6f947feba22c89c
- SHA1 2ac7ad3aaccdb329f1ef8bb54d81bc8a7fd0e982
- SHA512 e5c94e1a043a2ebb2a2274dd010b31ca3706fd3c3db6836b6d33d56281ebe24d1d9eda0b6c8f0f305b36eb46fbc354d2199d017074680736d7f258eb7df49091
- TLSH T10F1123419101D2A6F7E35303C941DC8AFED61E1F215AD134F4FFE1C45B9D501A2624A7
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadCrypter/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf7d9118ab89765e88511df4640512299eb9010a46174afe4cdf4350d1ce8365
- MD5 9fcbe894dfa1844276b14342392aab9d
- SHA1 583ce776edc9979470e949b5cfb7211501b10895
- SHA512 ee06da4cf0a30f62f4cf060aef10067aadc7b5bedb6019d7317792862335e483944d13c7fed6b5ca22a2ba37103ff595b9a3e228fa064130354439774895697b
- SSDEEP 49152:KO+VeD5Lh7opHbNCs2qIzx9rgVaYmVBzhF1:KO+ID5LEGp9
- TLSH T18CA50A187DD4EA27D16FCE33D5E24011E2F1E4932EB1EB0E66E3576818427857C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f1:6c:08:b7:ac:c9:9e:fc:c1:db:56:c7:df:77:55:27:10:1b:c6:c4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2196366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadCrypter/IttihadCrypter.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 bbe1e1d7fa84978ec38af2f0b5686dbef6d8a79c28ebc9a4979634f7e851f6d6
- MD5 63edb588ba766c39d178a6e50dba25a3
- SHA1 dd3875cc6df93a9266fed3ef61bae50cb92368b7
- SHA512 430d9b8181927aefcf87a2f8d9ed2d33ebea052de1249a5a1cdb1f65449aefbd393a93d93c6fec8a8bd8893f0425d61cd81fcae45d1363d67c8b458976cb8f4a
- SSDEEP 12288:iGhsVHkplZXbHeL6cdN5DuRMAo2DX49d8z:5qHQXblADuvo2/z
- TLSH T1BE0519D8A003D98EF352A97CBE4596FD0B009E30DD45455B61BBBECDBDB6028DF0A198
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
181KB
Virtual Size
181KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadGuard/IttihadGuard.py
- SHA256 24057c3cdc9f256e202dea87aa81bedc81c348e9b1c80b068f7a976bfe685f75
- MD5 b4f00af3b03131f370e97d632f4234e9
- SHA1 dc1dd90d49cc9e35de2534e4aa1ecca0a2878332
- SHA512 f364ddc1bab6295e3d733865248490bab4fa09ea82ca1416db032fc47a44cb6ecd047d99af97f17bbb949c0b4179869a6f7d326af7be35c9ac6b8f4814a413a4
- SSDEEP 192:kZIDnMPTcxnIQhrLTD+RsHQvWF3dp5WQPxapHUri6H/WBD4OzdhJCka:kZID4HoKAncUEhw
- TLSH T16DA29615980268C6A797CD3B292775177B2F4043450EAC383ABF81449F9C271AADAFFD
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadGuard/setup.bat
- SHA256 5f78c09e83e5caf00dd38901be27a8293d8ccc0120a66cb3eb9c0091bfe690e6
- MD5 5b4b5da993053b5f9c10ddf24ab9d1f2
- SHA1 175a2f434a3b16936025bf524ffb3800a0c788e7
- SHA512 a9c9d5d58145459af63dbff3da354fc523dabf1fd016fde71e88dfbe7ee45da8a8379381d2e4e72e8676f287571e9c00a864cf66aeba01a99ba1fbf6160f9dd1
- TLSH T1F0F0C90B525D88BDE2D80628C0B92403F94380D728A436EEB0FFA4E40F9B80096E631A
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadInjector/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadInjector/IttihadInjector.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 dabfc117f7fa811bf10baa6215f5d4835d2d0e29e56abccdf59e5b2e99babb8a
- MD5 58c2037abfb9adc329e1ac15b14c19ce
- SHA1 62b107a30a7ff919c552cf70faa9d6f165d86c92
- SHA512 52a84acbcaeaf7655561ca4d85cdb2944130b7ebde1efe8b2e92a834be5c040f8639c839ed9199e6816b35fc11e9a6b578f0c8a9b54529dfcf2cf22775e8c474
- SSDEEP 6144:ybCRW5JGfqTJa0d8fUAiCN4qMGMnn49z5m3kekiQY/85lEUqU:RCMWs0d88NEtMGMn4h5MkeNFE5lV
- TLSH T1A8D4FA547A44703ECCA256F1EC5ABBD66BDC8BE282DB3476F4616C0DF5098049DE3EA0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadKit/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadKit/IttihadKit.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 8aed288328eabd5c211f04aac89cd96861030e97c2cf4da095898b5ce9a6afe4
- MD5 b3495d67afd9893ebb3fec2f017a37a6
- SHA1 ea62ec8c99ac8f2c9c82da9de2e6ed607d054998
- SHA512 1f4bcbc200b87d0a57cf21e2745e6623013c7dc0f07aa8a2dac38fa12bc9803cb2a47e6fcf3115c9784f42672cb0544cd62d5589138c34d175664bdf612e8d0b
- SSDEEP 6144:zmJtpNAD6xiIR7VQIEfjTx21OdCOKbMVFvdxCXQpB7mBfqz:zmJtpiD617VQ5vdNlym+qz
- TLSH T1B2943A0FBBCF8BCFD555687000818BC534928A6BEFB5BD4E6414CE99DE28C05A1AD3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadKit/Programs/donut.exe
- IMPHASH 21b1752e7eea2cc224406a71808830f9
- SHA256 3c6710646d8eb93fc6055378a71a6114518c5f456e634dab028a72a40c3f47aa
- MD5 45336a23b777f9bc23781f13ba04d3de
- SHA1 ab1b0046761a8e735cd7871573745333342d40b9
- SHA512 2a34facb93a84a8451754cb73fb5214164f3378f32c5f0a3ed8e1b5eeae7f61b29bd102ba3df3e75052d73b9a49bf6b4d7d0f30f0cf9f2d28f045eae84e715fa
- SSDEEP 6144:vlt6D7xhNh2LeL0AGTaObuzrY6ysBcq8n:P6D7xhNh2a0rVK86JBD
- TLSH T15C448C15B3A510F6E8738234C9119706FEB27C4543A09B8F23A85BB6AF776E06D3D790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
kernel32
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
CreateFileMappingA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
SetEndOfFile
ReadFile
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
HeapSize
RtlUnwind
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
38KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=159, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=253, version=33218,
count=40, id=261, version=33218,
count=17, id=260, version=33218,
count=17, id=259, version=33218,
count=5, id=257, version=30795,
count=106, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
IttihadTools/IttihadLoader/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadLoader/IttihadLoader.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 8bb1e3d2b9bdac2f5f266a7244bac20ef370db4e1a84e51313b9674d03af3257
- MD5 f95507d1b4034570601cda9e2e8b081c
- SHA1 a50330ec6e206040fa714248ad4a2f6ad235cfea
- SHA512 388a35bc1bde520e2d12c339b6e607fe3ff4a9fad196846df33f9dab44989c2508a4af2022feb9a81728def492d61f0ac5bdfcd3fb3c76ee7f507842f3e1be4e
- SSDEEP 6144:QWPl5JIeX8C+Cp7oi+OMVilapVNnrmOwCMDvY8QT0QHXPEU:QWPl5dMC+0+OMgYpVd3MbYVYQfEU
- TLSH T17294F800BFE6F6D5DB3856B24813988E4A26F74EC50389EE43898ED57B81473DA148F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadLoader/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadNuker/IttihadNuker.py
- SHA256 4939474c6517e7ef1a00fcc5afaa9c60e3237758c6c35ba942725b3f17a27ca8
- MD5 4d0a0a727fe3ea61d7496b6d2316e5b8
- SHA1 57c1e4f830ecc61387904c033c04fb4e0967340e
- SHA512 5055b96028b93aa91110011979a75d2dd4b3d61e5ab3c5c41ad9abd37e2b4d117f1f57e3b694c751465c4cc5196575203f6f2d75ee39846768aaf8e2270ac2cd
- SSDEEP 384:VVEgYyE+SfCXh+ICh3g4Gt97yNkhq39aiOGEaBaVs4XBzRpJL0O:ogYyE+SfCXh+IChYtJ9lfJ
- TLSH T117C2ACA468C02E2187079C6EC4E7AC079E9B394FD5682470F5EC54D09F7A931FDA1EE8
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadNuker/setup.bat
- SHA256 1b20fabb70ea74f88c19a1b81a35225d42a4eb4add11dc91a0d8fd77560f1622
- MD5 fede021bf4492304918d99492b5da325
- SHA1 b0c7b3885599e68cce47b9832f2fa64bd0141336
- SHA512 aeeeca9ae2484c28ac2f74c8cf43984d6683d582b70ab0d792ae814160f91b308f7d30848cb72da1411c20abd3d2b20fb0cc3238b4cf743f78682fdbeeb0dc4d
- TLSH T1A2E061171510CD6983F445ECD1761161F51352D42C0B26DBB1FE94641E449199BD5644
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadObfuscator/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadObfuscator/IttihadObfuscator.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 b666a343042084aefd22af50e9772f4e8152d7a18b5b8460f1fbbb9824e29983
- MD5 a2bec531e19113a9ae836a720c43b6fa
- SHA1 157ebbbf5a9c0cd333376ed2d4317ccd631310cd
- SHA512 8b220a59ce5205d58abfcbb1f6edb6fa711a7eea99383e5f9ea6bb07b99d9835a029c6158ee09aa5a6dde7800c75111e5b33997d269fadee488ee88333b0c671
- SSDEEP 12288:OuFdeEcyHqoWDwiErxFMofB0oqrAHzIJrJRHL1eXWBF2:t8yHqcr7YAUJrnHL1ev
- TLSH T184050A49DFAA6DDADC778F35473C18D45C222CE84781F8F6E516392122BB0ACAE523D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
193KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadProtecotrV2/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadProtecotrV2/IttihadProtector.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 0269cea0a60ea36fe71208ac9386627114f53eae13f9cf014bdcbf0e8bde2409
- MD5 2699e7e9e648aaccd9df6f68a9fa1a97
- SHA1 6d14bdc402a78dd2b5ac912a97a6c6be8459e845
- SHA512 c91d846ddc32f059e9b45ef64224705b29451bdf9c3b3fde8b3023e9219207b9fc296ea75c45a656ddc78c93438d06eebfed0c31be069320c4dcaea8dcc68751
- SSDEEP 49152:TLJbC/tcRcOThqLLTmiIDFxEMu6mLRZ/eteSXrzhnQHi0iareWWFvAjk0+:TLJGIu/ecSPhnwi0pCDV
- TLSH T18AA5D0A1B3EED15BDD1A2372CE88DBF0A8917D19D61725BB7065BCBE3434093807522B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadProtecotrV2/MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e96030fddaf7e78401567ee82480ad75ee48d3556199a3f85c0ec669edac2ef4
- MD5 612080028164b12939751dcccbb68d4a
- SHA1 db066593c63d2eff41a5af1b49a3e098b60e0013
- SHA512 1879c960e27e32941c0c992b84803e7a1f8d243bfc88d17d3d32baca772290b9ea60a6ea90d53170be3bf7f0a58fe71ec901dc66aa560b4bf68b1da56c09fe18
- SSDEEP 12288:H+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:H+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH T1BDE429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
677630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\home\dvlp\ManagedXLL-branches-4_0\MetroFramework\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadProtecotrV2/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
157918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadProtecotrV2/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadProtectorV1/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadProtectorV1/IttihadProtector.exe
- SHA256 bacb3e4de47ca697d7e5068630975fd79d4daff4c9ef64ccfe8a474ef5d629d5
- MD5 e335ccdcc26cdd8e295f0e034ca760fb
- SHA1 97ea34e24d4ad1d88e29cd3ddb0b27dc14587caf
- SHA512 7774646c415c06b6ac0ef70890c7cf62a28e9feef16e648096dedac3c26c176630af957d12019f81a0f4c228f701787aaf6345e482d544481012792c072bb4b4
- SSDEEP 24576:lppxIPiPFVOM938AcR0E0cy+2wBRnADHLqI9ksP8dHSvwry0XSa:1KvM19EzioNQHeIXPcSvr0ia
- TLSH T136F5365B73E67658EDE9233937D64B088E237CFB1AC1511B2A3FFA291522D20C6027D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadProtectorV1/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9eb9570bc20705b3da34f970b537067bea004ca863967567eea23db5d776e839
- MD5 ada760f12e46ff53dcb8d95f092977e9
- SHA1 833cd89a2d18f9f6fa95abb6ab144bf880b37c9d
- SHA512 57fb6a7413c96c251170105fe5f296f1d228ad8bc72fc3fa83735b82bc60a245b05328d47964dce7c4bc0e798612ae578c2b80ea8652d03dadc5b2a88d0a38c9
- SSDEEP 393216:/9FOgKbe5CrrrrrlRV7rrrw5rrrrrrMAO1eE0gsfqH13D7BIqh://fK65CrrrrrlRV7rrrYrrrrrrjtERT3
- TLSH T12527F11BB312A655D1CC433934D39B348F356C7A5B02460E7BED7D6E3BAA9A09B132C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BlankGrabber stealer in memory
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20751742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
19.8MB
Virtual Size
19.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/IttihadRAT v1.2.exe.config
- SHA256 b540e7697dda46f5d60f5c963e4db7a3b908e1e0a97756abb035482396958518
- MD5 99159dc780341927b9e588b880fcd68a
- SHA1 29060c07aef28a96effa00f7495870dcef32833c
- SHA512 e389e12e5451236692b964fb3fa3c1dde34a393dba0bcabcb65e294b9edd96292b6928d0db0b004e59887a4026ff7ce035316fa26e0229910aa771d1f1ca61a0
- SSDEEP 96:ur71Y7KT7KTrZ0BGivir/273I2TpV6RF4DVI60BGiviR273I2TpV6RZGoKS4Ypym:ur7S7O7kr9evGoKS/pv7sJ+J/qJvS
- TLSH T1FEB1D408B1C19E9A02366B32EB3056D1EDA006671176B4F478ED31679F71CDB4BB33A6
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e13bd48c0cc1041e991aba780f49366142a59edf76889cc518d87508113229ff
- MD5 715873a8af3f7e6ca5ad655a7f7fce20
- SHA1 4a1eb56d11091c1e0221c3cd72d5a9f4a785bb36
- SHA512 b3ab394b2239a5af5cc167588ed582336a9d363f855e22c2d8e71fe533784e843d350c6b90fca07061482ee7307efe90c5644b558e354d25e25718830f88cf29
- SSDEEP 384:BUIVjPmmjJz7mD/PT0UzkoiEEEEEEEESEElAEEwXEE1OvBhfgV1pLr+zAHMaC8Zm:vVLRjJ2Dj00OhIV7iEzih
- TLSH T122B22904A7A8C73BCFAD0BB9A477521807B2C22B6503EF955DDC50EA5A177CE0742AC6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac97863ec874bb62f3fd168209ef35670b6cd9d42850f13aee57b5022c044818
- MD5 25ae0ab0846697abe27d6b502a652eee
- SHA1 ea6cb7c769b8dea7a70b18dd75803fcd3a3cabca
- SHA512 abf1e152b6031462f2048b7c0b182baa390fa9d93976e19408cfa8f5d67d19b25fef097acb962509b5e3127ceb4b7835396c27576d21d51246b5ca365282c62b
- SSDEEP 384:/XETRbFmmOFgTNv7/dseXG07xEDgS7B30uBstoui1QyLp0L7amE:/McmOFg/FE0OLmyLGamE
- TLSH T14FD21A017FE89667F67D1B349DF313088776F89A7903DF4E4C8020AA49237C95A217EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e8e62da362fa239b4393a7d1df7cb5ce95adff03260db831a6f6749cabd855f
- MD5 581fbba705cb144d7e314a92ae8f0d0f
- SHA1 e2a3b771a9ee4345a45577bd4ca5ff70cf377428
- SHA512 a77b8d69363622238485d6faa295d0004065fdda2adde1dd66c9e02f19777a210fb0d7d896719c39f1bb71c5453693d6371c2e5f4b41839f98e31a880322aee3
- SSDEEP 384:NG7GeJ/d/D3gfmjLEzCHJC74dseXGDssEDg8mquuU8OVYlVUMza1QLuwbXMQMWX:NQ9d/rgO/Vi4Y4pUHC/XSUXMjWX
- TLSH T108E20914BFA4D653E77C4338A8B3231C02F6906B6252EB4B9CD521F11A2B7CA9611DCB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a8a3589b13896feca1efa37873d34465b2f59ee335ebdebdb3060b55504efbdc
- MD5 4e423dde700a48a023025917632b4ba3
- SHA1 bd217df54a5a73b8b9b5f5cf07c9210a1d30d799
- SHA512 9f0e4defde62bc4e1debfea14e55281a393c1a10a23c613500ba8c33aab939e0be8b31814cf68df1f28cc951f86c8a8165b1807c5ff96bdfaa43444502c06270
- SSDEEP 3072:PGGaSHMdcvIe3NFJutuI0CSXVGB9yDXcfTwvd/H:PGHSsdqjJiulCcVWimsd
- TLSH T165C3029863A45F93D1BA87FC3A7263809AB9D507B501C3C5ECC860C65F1A7D3AB74C92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
132382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/Grabber.payload
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d3f7e225d4141f37c7f15c146176247180a84714456a4583c80d9d9bec4d4ad0
- MD5 7b3a8d85be96e31fbc784302c4563c47
- SHA1 133e3b6b9847e7724273a92446d04f7d0b8a4791
- SHA512 b1f2124a25eca63dcdf7cd76d5a1df67f8e6c53ae719ac36350ba369e5f06c729ef6c90b065854c4892f1cd827952e9c8d02bf26bb5c71e3afd1978b5dd64a9c
- SSDEEP 6144:k6XeHyvlG8YAPEi/8edJ856fTF32q2qh4/+KG6hSDu8e3OpzY:9XeHyhYAPEi/DJ3rv4O
- TLSH T1BB346D4453B4DF31D3AFCBB45560456B8BB1F10BF50EFB8E4D849AD92827742A880E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
244142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\MussoliniStealer\Mussolini.payload\obj\Release\Grabber.payload.pdb
mscoree
_CorExeMain
Name
.text
Size
230KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/LimeLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 181aa268ae0d1ad19acf1c9ec7df3758f5692cfac11290185365884d1d941c39
- MD5 0cfc03fa0ebb38cf8c51388501edf5c1
- SHA1 96e622d133786fdfc0b55cec873258ff3871fb70
- SHA512 30a404a74ac4965024d12d91c3e2850b95654d37d993724ae49eed21942c295f885344e09f02b35f9b8d51f48232aeff0f43a9281026d91eb7a206e91942d9a4
- SSDEEP 384:KgXy4TVo1a1/mbOqB9btOKPdseXG8IdEDggu1LBsWwQgrnbfuaQV:Ka1uqqrPZDKpQrnjuN
- TLSH T144C23A057F98C7B7C6AC17B8ACB7831643B1D1A66C13EB875C9810F60A533D75706ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/LockApplications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20a28a50e694f840461a2b7a089114d6356af61a097fefc36727a9c2d395ba4b
- MD5 8183c705b0b6161270cbf9156be74d73
- SHA1 1332b8b5c54d2ba20cd2dc713f6abd4b9562bdac
- SHA512 725530e11a33a7503826d7660cbb258ca429f06c6684b4f7abe7b96cfedef93b38fd946fd1e6f1aead9e0133506fecca14df8509638e67f297a0eace4ff55905
- SSDEEP 192:R7QHqDQqpMrGO5ib1EiTxIW1Pn/+kMpC0ewL2H:RWqH+qqwFTbn/+kMpC0iH
- TLSH T1AA22E925E7E44275DDFB1B726CA362410775FD088D23B72F1DC4B0661CA36958BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 96426f9b6d59264a69831a2cb89e56697a678e2ef9559f58cf084673d38b4595
- MD5 612f31a94270f6b880b95624df406eff
- SHA1 ecf15b7f1aa1b629747c843f50c4ee8b19350fa7
- SHA512 4e41ce4e53a2553aef98e187f88a2e5d942acb93b69ffaab7c47f08c1bc959e247fb875fb55276781e0453ded852c35279c7a9b9b4fb512ef82f5b37a2a92717
- SSDEEP 1536:4/uamNPCs3SvpqnS99qYofrWV2klnn83OQ4Qfh0Vu/7NFuMko0DC:ramNPCnvUTKV2b3OQ4QfhYu/BoJvDC
- TLSH T12F936E186FD4C92AE5FF8BBA31B2194843F1D056A523DB4E5C9420E65F633820B277DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/Newtonsoft.Json.xml
- SHA256 bcf6406c1cdc42e378c8072ae511a29e34de2affdefabce9fc96a8b0321e3f15
- MD5 7349351bdd2cd0279fc36c2cc0f09532
- SHA1 8bd801ad9f14b3bc1b756e5db597c27fda33d6b7
- SHA512 94d9b930bb57d99a521b43c87e5cba9a3d3540b78249c4af1a5a8d95739f8a8bc3c80cf4cbe6776b71488b9e943e851d398f2241b3bd63bbbf007a3b4ce4896a
- SSDEEP 6144:XqqU+k/RikErH6dl0/IHHXpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUD
- TLSH T15EC49D2976C4CF220C7A012A4D1CF0C5FF2009B716197C96358C5DDB9FBAEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec3113ecc436c81242b8936a6d366f3baa2f47f9bfee8b61030229083d12995b
- MD5 56b95a89484b49342f9d6ebe96c30661
- SHA1 92ff33a5d79c74513be24d3debcfb0a672a20bb0
- SHA512 416a8c460fdc8fcb9fa110ba4ae5763a911022a972a920d7160514e67cbb49141e34ad4dd3f9d3405b0051bf7cf2baaf9a0164da11a66e7a7c20419e010da2a7
- SSDEEP 384:L5A+KmSrODx5w74vdseXGZcbiEDgs7+dz6XRcy5R8FUYSK5MC4DH6lMkRNsB5G:L6mSrODxi4vC89nKF3SK5onkPp
- TLSH T197C23B01BBA8C7A3DA6C5778A0F3530103B4D55A6543EF8A5CE920FA4F137DB1A127CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b5805ebc25c972fc875632c0e54f2e68255d932f4c07a8a07e216882f4659058
- MD5 21a3cfdbc903eadd7602a89230b13df9
- SHA1 1e82a236f55fdc8f88189ff584c5246b36ba68b1
- SHA512 8965d0355e9c9d4ddcfbee4192e8991f67b7560b0545f34dffa89e831be9ec5344e7803fa66615c8a0c6ed2d0c22b53ce650a7b00efe367f54dd6831284bc436
- SSDEEP 384:Q1y3xGUfJC71mIT33T9OZNA8z/CguRvDPNHdseXGW2OZDWl9UZUQDBMqhuoNokof:Q1y3gSC4IL3BS/UvDPllUoNeslgL
- TLSH T18DB23A056F88E777DABC077AA86353184774C1B6A502EF8B5CC824F26B077C91A147DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 89023945df7db3f454c9d0778b437990da95310aebae76a8dfa788e7e94f094b
- MD5 b12f2c89ed4f2ae00b1e3a1d8649ae25
- SHA1 bd12e18d60eacc4d3fd1fe26a23b89268b10f645
- SHA512 4c27a41142da281fd8dbda2edde0afbe4666b0e771c5664c6459b44a9e398ebc413c22d19ae3b97adff08dabfc41d5cb20d64a8d6fe5330d5369d624b8e12df2
- SSDEEP 6144:9MMCsd4t/cdcR1KcBitApmdHJxnVuGGCGxg0yyXTTEppK:g5ZRJBitCmdHJxVMK0yEEp4
- TLSH T1EC44126923EC9917E7BD4EBA947B4420877372536E10DA4B1FC5A48F4A33B934720B87
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
275214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a98ac3cfbb973e03a78dd82f184214a75ed261b05c3584e18151aa79c0b6301b
- MD5 9bc58526e985b80684595638ec7b120c
- SHA1 74651d580ddf2a3e18797f8c75afd0392c86e241
- SHA512 d8730cfda641ece4d5ba6a472c783814926939a0ddac9ea3a0ed8ad43d0ff15e3d32e08ed2459f1564d944e68b31ad44d45d60ad62020aab061e8e831795e33d
- SSDEEP 768:IUOIAr5LNpEuAtgbJWU3lJfOZKkcxb6aLBZRuA22z37n5FfWPSGoJp4WIMwM/IRh:IFrhMuZJGMku64RN3C0JFIMwMJ8n
- TLSH T1F9434B956BACD573F69D07F5A8770B000775C49A2013F74BAEA861A92C33B844E1A7CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bbf66fdc351e3d0071b33e8ffb186bfaf4920f5128d247d60f06ff732b916fc9
- MD5 02ac0dc2ea2c29298cb2cfce7a9cca62
- SHA1 f38543b130600a73b7b8289f354a61eedce5218a
- SHA512 92a7d9689e9c8f85be5cc15cb17b2128ebf25483404f92ad52307a83d06796bebefdc5e98fbd4d04e16301f3b648a3fadcdf2b962665d75460226894f551ff03
- SSDEEP 384:hcNHynhWZJKvOD+XkmVa4P8s1/NRdseXV2paBEDgjDJGLwV81cEmCyPUcc2kMPK9:hcHyn0ZMv5/Va4FRZcWEchC8Pr4Xh
- TLSH T12EF21700EF58C677D7AC43B9E8B71354437EC5A66403EB8B2C9400F52A137CB1EA96DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 024942b726379b8e1c40c9676e611cde38f131a2333936d909a08f65fdf308cc
- MD5 f42508f71a8e70e0042a4fc3d1373dc7
- SHA1 71dfe476c012402e71dac771b467d1086fdf7bd8
- SHA512 5bc78e5895f0106c8ca56ecda5fbe3554efc8f2e04648ab043125c58c48079ac5b66f085f1b67f477beae273299331f1a16f86b5699e2ad811743ac05e7a58de
- SSDEEP 384:02BaZm6a5fmmdKEKl5h+dtu5dseXG+snEigu7vugRWhTh5tzsu8i+5icyKAAb:5qxacmdRu5PQNWN52Fmj6
- TLSH T125B22905FF98A663DB7C0B38A87313090271E56BA913EF4E6C9810F74E137CB5A11AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31714
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22159a7097def5e47defd1b40893c8c6cb3b99fef11f983684951469fbb3b6d8
- MD5 6f48d6430b79649e340b3856fb01da11
- SHA1 a36aff156e917bb8f0a0520fdfe50c78bcf1ce22
- SHA512 21171c5e1cc655e3de8ecbaecb8dbb1810bf732569a7dc14998207d34209325b7b9ceda4e930607351b5b7352df84c825226561748194dc950befb3c4a734cf1
- SSDEEP 384:fX+GxmCJW3Am8xvMZadseXGUvfEDg+uR5MZb/8CAn9ksBZE5xWk3ep65:fO1CJWt6Ya96PEldZE5xWAepA
- TLSH T15FC22A06ABA857A7D7BC067DA8B3030943B5D56B5903DB8B6CD8D0F61B13BF206607C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Analysis.vb.backup
- SHA256 e31ca298188029e8a4c1f571d6d048e9c1e7b2b6f87d4396f5859c58d5c9a204
- MD5 5f214b6fa3c529973312febec4538833
- SHA1 50661414bbe80a707dff68c96e4e89b320a3600a
- SHA512 37950f87efc3538cb495b980214266051c5b14282ba242a51c48df730722500c00a7231c3d218c6559e286299e472d9dd95fe097ece522b4cf8f15d6ce36bc9b
- TLSH T19451B82AB996B5B2843EC839C81FB057FD94065391598C81F9CCB2D91F361CCB261AB2
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Application.Designer.vb
- SHA256 043ae3ae093cdf8b175cdd82a0352c6198000def6a344c389e5fd0bb2985c7f3
- MD5 4e8a0729963262004a4bebf1327489cd
- SHA1 73cae6f853229d8e145a0a9353232258fb735a0d
- SHA512 81fdf80f18264845426a2ad4e7e23b8569d3a2cce49e74143f58a3ecffc3a5ad771f34410bbfbcd2508f1b28b95fc3deafca5b03cfad01b06cb5dffb43371997
- TLSH T15DF02B711C85BA7191B2C1C0210BC921C9B2B2CECE95CD773D4E9B4EE72061D911C5D4
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Application.myapp
- SHA256 76cc1f6d4aadf6efbc2c62c21ed4cb987d55b7036d4380851aada1e05d48dee8
- MD5 9a61ce94d05f84833fa4cff2de9a56b2
- SHA1 52e3c4e058b93f0e314eb8889eb871beda2f7709
- SHA512 3f77b9f1fd1f8a3782e03b41c4dbaa1e7904d88d207bc9a866f859946d0fdaf53a768629b30c84af6bc08f7dd141d96882fa4ae4260d5d85ea53c66c0b6055de
- TLSH T13DF0278882D1546486D2E6B2F568CAC92163F63C8BE48C98B4E05C8F62410CC22D79CB
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/AssemblyInfo.vb.backup
- SHA256 581bdee2c73a75d08fe2550f42adad631f1172735307e555e3c3d0f3f5324f67
- MD5 6de7b4b867660aca8e852c4265b6490d
- SHA1 a69be8a3d96d3b16af17d62ce73c8c26d6209f7a
- SHA512 204abdc9d3dc2956ccd5bfe977ec0718555d12046d1691996a5782b34356a09e0ef4820f72fa8828d59d4aa31b9c88cf0584fd382c51f144ba04e0c6bd136959
- TLSH T148D012E00146FBD20F1209C7BE93B495053A073522E86CA8B0CE3A22C6E7D6C02346D7
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/CPLApplet.vbproj.backup
- SHA256 3362d5f91f138e18f7e3ad902e582091d9b26528d7ee1bd90bc01de6a0fefc8d
- MD5 014f83d93f53c2071667e8a3c57ca947
- SHA1 c1906fb59655657773a3f068fc74f94e45e89ac7
- SHA512 14ec9309e720c16d94cc92a2926be3c74c1282c628a67f778d480a05dd77adeaa6ed8b7496d2bb791e4eb06808e6e203a9efa45ba4a6e27e6348e4e4501b3602
- SSDEEP 96:pWnpu5Yxu9c9u2/TMTQMlHzEAiNrhPEOsHNSL5vB5+NAqLJRKR0RfUdOSepL+U:vou9c9u27r8VgSNvHU7egU
- TLSH T159B14F35E6CC7EEC03B22136A123E604EE6493E315B00C64B28DE6879FB35905167B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Exclusion.vb.backup
- SHA256 5d2368bc37b64415e88aeda0bc133c4f7a3adff942bddae037991e78ab3c458e
- MD5 b5317dc91a5dcaf500be83edcebe3027
- SHA1 44743dec5d8672a457f35324410ae4a93375604b
- SHA512 b97f80681bed371c89a54d27532953b0dcb30da7db1b4cc4cbe5fdb8cb8a0f41c432bffc821f5ebebf81329394af04df26b6f12fea8521389596e8f9e96f8e47
- TLSH T12801AC27382363A2CA7F1E0454AA5307E4AB653391654D60B0BC2258BF3C4D7C32429F
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Resources.Designer.vb
- SHA256 903af345f0ed40b68069826e771280276ecaad05041e8cda10eb8d6978ef2a23
- MD5 c88998161398e6fbc0c161349a41697d
- SHA1 e2b4183f2924efe665bb33dd3b6bb97f7e23bbc4
- SHA512 91a7a65878e1e59b95c7e193f6e28640136f3e560f9d85b318ea19c70e8d257405ae029627fa6b97c89ecc091663df18963cf344f2a16d6bfe11bb859873d773
- TLSH T1CB519BB71F8E91311432DD476A05B452C9A211A7C53C6DA9F9DE41A98FF338403BEDB2
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Resources.resx
- SHA256 88abaf8ff9dc2a85f2f09da1ec4fceddd84e61c8b4d2012e073c1e76529c49e3
- MD5 f1bfe5efeda1d212752d2860168f6606
- SHA1 5d0a199b3d41b7acda7924d415e4be16e3594822
- SHA512 46fcc6cece177680f1a1fb553159b7b35814d54ccbc2c2ed1de6b2a51a0b7b009df476c80f4a42c131271929d86d5348ffff38461666c90667d54b9e3007d294
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuF88EJs:KjrbLPD9sLvIzSvKgIqUyahF8F2l
- TLSH T150D12145B1C5DD260FB3482DE6523988F7A8823B02356C90B4DC661F5F73885A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Settings.Designer.vb
- SHA256 d59d90a75f20df11ae31c503e80e991a4965ba939133361560da4bb3939f1ec3
- MD5 896d1a4703c651eddd63c0cdf93697b7
- SHA1 9bffea15650b7bb4e278eda0fb2edb54ead52fef
- SHA512 feed56d29e7825157f2207d30682bdebe6a3f31f43b18821ff0cc45204915d0f2d2d82e96d24e7556610eb440aeec5e42ec44a1c54de32116b117c34d9948ade
- TLSH T1A751EDBE2F49A27D1971DF84DB0AB553CEB002A7891D78B0748C21C9CF3678413BDA60
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Settings.settings
- SHA256 aee1c3cda12a474a7a8ead292418eb734cde3c4a74a4977e0bb0ed160613a1eb
- MD5 4a12ce12282d0ee237b12e7513037c50
- SHA1 9a820bef12266f5e641770f44af881f9517f5222
- SHA512 c8229ffec5e3a2df33855a22f53fade99c88e7c92404c35529d2168ef21597de0477164fb888da7192fb3745d47980fa4e8a6259485dfe5a34b481ddd780a432
- TLSH T189D0A789A4C88C0A93317AB0F4ACE33C95146767856E9974B2743C4F19071D61AD75EB
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/Test.vb.backup
- SHA256 488488aa340d14db174611f61cba99b3803a5d5205c026b238c7c26c719cd50c
- MD5 b97102cb2894bb49bf9498c21bf4e3ae
- SHA1 2d1bbbf980682e711cf31aac24dc54c406b4a68e
- SHA512 173def7af8e09ec81d903b2780823d67f9391366f0a320e5968d1de7822b5d4a8fb4bff3c7f53e446ca30930017ef11343bb19afd9c5c26ff6f22117c138ba46
- SSDEEP 96:N2/F7PWFQqD95+WaXTRMtrpsY7L9XYDYwJ+Co4H/GP/IlIgjPTZL3gkmDDHGI2ax:ohPUbqsj4uP/IbuVGI2ax
- TLSH T1E4E19626BD4B967481BF44816D5BA48EEFE71633301858A0B8CCE7448FBA0C853E87DD
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/CPLApplet/packages.config
- SHA256 b9eed04f111d200c41660aa0f8a5370cbd85444519eacf326d145a1edc8cf4df
- MD5 abbd3be67d319a4db1e6ff4cb0d27bd9
- SHA1 c6087627df0b91093c1ffca58c42b19a18977ae8
- SHA512 3ac44d6d6a4c3364a49dc581dbd1a801ed03fe1529e68095b45df4dd1c1a2629fe30efe4eef7f1c7ae29d1bf44e4af6d4da65d1ff517e0b694018db54e6892b1
- TLSH T1ADC02B04122497330B601C24F3B8C4085B7C7127B0210BCC7D90420187220490287695
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/IlDasmrc.dll
- SHA256 5d7c2f2b975af894be11a560971b018eb8bf498da5c9056bcdd7bca88bbb3113
- MD5 9d0c1bd1ea78db915f6b5daf9c53fdb0
- SHA1 5c69d5bcbb7ccdd95a2a3a9334c460e7c1668938
- SHA512 539cecb94a9b393a30741065a20a1338c742ee491877d045ae09281136b9ce95d84706c1a087519a3a845d015d46ff227c0f06ee1f2ecb85cbeb67b994db6e7c
- SSDEEP 384:8b3nqW3BHWOubNYAL1PWbYe3jKESkYqgzPk/SMnC0GftpBjEUa3GRNFtAHRN7MVD:8b3NPubhYKESkxi6UaBMGmkmx
- TLSH T1B053CB83D3EA84C0D4A199B0AD3B94A59E373D50643282DA4E64FF3F6E7BB109552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
62:7f:96:15:84:51:82:1c:e8:fb:2b:8b:d0:dd:67:9d:f6:4b:70:61:cd:32:1d:9c:0e:c5:0d:ab:11:a1:54:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e9:a3:98:5d:06:ad:23:6e:72:0e:70:76:14:71:64:b4:51:60:39:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/TrackerUI.dll
- SHA256 458a438434c49581b052fdcd0db5b1e21ca966e738440426963b24177ff9559b
- MD5 0aa38010fc32780174009c5530925c40
- SHA1 802a3933d4a401bdeae237d39beb24564e483913
- SHA512 ce5d8cc7c7504baa3ffdbdf11dfcaa27df087e6bb13baaca4a04bce0fac32ee202dab42bc7cf52e8476dce05119714b7425b1f8db63b2eb89d91c940e5c39d39
- SSDEEP 384:MXWD8WQTK78xJ8xClRAtkQG47h0GftpBjV4X3FtAHRN7LUklrhfbi:1jRG1iD6ALUOji
- TLSH T1F5B2A55057F84042F9F369B02AF9C9536D3BBAD25930D21D109DE29E0FF3BD19A14B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:a4:4c:39:91:61:a6:9b:d9:69:62:6a:bf:4a:40:22:8a:46:43:c3:4a:3d:6c:a7:70:86:f1:65:3d:6c:bc:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9b:bf:6c:80:5c:0e:5b:6f:b1:11:6b:50:98:fa:d6:ea:46:0a:82:a0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/flogvwrc.dll
- SHA256 19b0cac27da5ce62d473c9620463b7d2fd17dee8de3268b5a08e120964b743bb
- MD5 6a7ec16333a987c588deb9edd2d645bd
- SHA1 8a21b738dd8ed1374aefee79f72b7c4abbce0d02
- SHA512 88ced1634396968c1855e9eef67fcfaa17205e451f2472dcf487e10201ed84539afc6e941224d6a168583398ce11dbaf5320dd33f4fc81ae8051077b00e7a474
- SSDEEP 384:iWzcqWZRQxnq2ELDF5RKfwMnC0GftpBjiu8wFtYbFtAHRN74lrhfN:0dcfXi+KRSV
- TLSH T187A2198187BC9406ECE36DB067F8DA837D3DFBD20D20951E2595F2991C92BD1EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ed:b2:11:ae:df:b0:3b:c1:e7:2d:4b:d0:bf:cc:f1:03:17:76:b6:7c:2c:22:de:4f:a4:ab:5a:5c:43:da:f3:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:84:84:57:47:7e:36:ef:a2:51:19:b5:5b:f4:f0:41:82:e0:bd:db
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/gacutlrc.dll
- SHA256 950f6c8ed8c61a11b66108a7143006f28351d1a46585ca4b2781aa0b0089697c
- MD5 0ad7732dac1ddde05a48cd7ffe0868dc
- SHA1 33792687aecab9e6b1e606cb426c4d3b20b06681
- SHA512 286cd7c9c568c68eb2a944a96b7f4e43874d6c93ba42058facf7b1310ee95b5c3b591901b4bd5166eff0784180e9ce9e44d699a96b4bb9e5f9ad534b8a741a78
- SSDEEP 384:go1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWm/L0GftpBjW5FtAHRN7Ob:gAIecY0QrQNCeK8iEaowk
- TLSH T16FF2FB8297EC0105F5F73E307DB5A5A21E7ABD92AD39D21D2198916D0AE3B80CD3077B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
10:80:4d:59:0a:6a:6e:82:a3:ce:4b:53:06:9b:fe:ca:a2:6b:7b:15:fb:75:14:dc:da:a1:7c:d2:17:af:b2:a6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
4a:19:2a:59:9a:1e:53:e4:0a:17:1e:85:90:0f:cb:8f:a1:7d:fb:9c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/pevrfyrc.dll
- SHA256 84e1f46ba4c03134d96bc9f3b6bfa0132ea8eff8fdf72969a7989b4753b02584
- MD5 af37abb1080964dbfdd56da426b336cf
- SHA1 46a1b404f7ca2619b63dbab771f177efedc0f4d9
- SHA512 07e5ea73a63d7f7c8129ffb659f3f86ed0ccfc31417f75f03d0990e127b71c9667822e29f416f4beb514063e8d454c4c9ea237fb14fcf776cd5889b7b129d22b
- SSDEEP 384:3uyneWNJXWbh8eMnC0GftpBjEso/FtAHRN72ClumkLet:3uyLQh8Ri6ImmkW
- TLSH T16BB2C6819BF84146FCF36E3066B8D9463D3FBFC15930921D0198E16D2EB37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:04:26:58:be:74:d3:e5:e0:85:55:82:9f:f0:cc:f0:84:ca:27:71:c5:e5:3a:f8:d3:2c:00:50:11:d9:01:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f7:89:1d:50:84:1e:f9:db:57:d4:7e:c6:08:47:58:6d:55:88:b0:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/1033/snrc.dll
- SHA256 2e6caa99964a3fd86ee7c3f554750f866faecb02112da698f578d02adc3b3b48
- MD5 703f3f14aaee73373ce01d9e68f1a950
- SHA1 a9019d12161699b148a803ab095c0273ac855d33
- SHA512 c69681e2bdb5384b8e824ac4c947c826c924a127ab2e1fc9d3098f14893c8d3c34790f6703d6244d67905fdafc27a719553efe4e317f67b0c492644aaf44ec4f
- SSDEEP 384:mDWJBkWS2ekwaaRGm7+bNItWIbdInm8J55M/L0GftpBj0IOFtAHRN7ClumkLR:DI/sIddInmU3iy0lmkR
- TLSH T102F22C8193FC8505F4F36F706AB496A21E3BBD91BD38C61E2185D56D09B2B90CA70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2b:26:cf:de:54:42:bd:b3:08:27:64:97:65:0c:b9:c4:4c:ca:c1:1b:b9:a8:59:5a:30:50:b4:30:7c:a0:6d:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
7e:28:f6:48:5e:33:a2:ff:4d:ca:6a:43:87:0f:b4:14:d5:57:31:d1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/AxImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9d5a7bb49a0133d3658a45ff08f5adfc6740e4085f9ff1d482a239a0c2d997ae
- MD5 e1d5d953e848d0a0808e31d11add3dd5
- SHA1 e29c00a39d3326fc0256c26a42af36161bfc922b
- SHA512 ec75c9a16668ec0d06e3b9189e939e9bc9f6878f701b785bebcdc95e93871ac6a2cfa49dde00d9079c945677cc2650bbd79c5a5c8b144589d6c71f54d0213d0e
- SSDEEP 768:4/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrn3itSc/Bk+:4/uG/5O7QBkcpoVTrEdg73YS6Bk+
- TLSH T10453D614A7E81212FAFB4B74ADF5C047597ABA53AE26D75C248D434D0E337808663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:5f:2c:29:66:5e:7e:87:90:03:83:81:24:e1:99:b7:6e:0f:30:60:a0:c2:0b:1c:dd:ac:1b:b5:fe:c1:fc:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:db:70:79:76:d0:4a:15:05:b2:fa:8f:3b:29:58:12:a7:8c:7d:bd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
AxImp.pdb
mscoree
_CorExeMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/CorFlags.exe
- IMPHASH fb1db825db945cf1996cb2b13e56c7f9
- SHA256 36b16cb0cffec65f99eb1a442dcba8696946c0a8fd10f9cb5f98629663f0da66
- MD5 3f10de142d081aff5efbde5be98999c3
- SHA1 d5232ff17d255d84df18516dfe2a53f01ec00618
- SHA512 d05d69bf3176f210429198fc7c988d467a077071adeee3fc512cf4c6f36a8cbeaf2ca3c935d6bc05c272a9e43e4d4126b2416237dd53224fbe648ee10de59671
- SSDEEP 1536:4AJelZaeQ+Ph5gS2/dvzeeyv8+WN18HWcq2bFX+IKCQTaudzrNr:4AJelZaePhESKcq2bZ+nxTagNr
- TLSH T14B04285337E1C072E8A20975D5F4D7F2697FF8614B3454C7A2886A1F6E213C2AA347E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c3:f2:08:90:37:a3:df:da:8f:33:d5:65:a7:15:d7:45:ed:75:48:ea:f9:a1:02:1e:84:23:41:a6:0a:1c:97:07
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
73:22:80:4c:b6:8e:7d:a2:d3:ce:b1:9d:6b:60:1a:70:ae:c9:12:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
70511
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
CorFlags.pdb
kernel32
GetConsoleMode
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
SetStdHandle
GetProcAddress
GetModuleHandleW
GetVersion
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleFileNameW
MultiByteToWideChar
GetLastError
RaiseException
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
IsValidCodePage
GetOEMCP
LCMapStringEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
GetConsoleCP
WriteConsoleW
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
121KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=172, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/FUSLOGVW.exe
- IMPHASH ed217f59b96438ffdaf4447d2e2f667a
- SHA256 c3e1f381588e6614d4ad1810710b8bd855dc03ce7d0f87d58007da9eed3c3ade
- MD5 51c6739dcb693b84cbcd66478a384e25
- SHA1 fa069f7183d39857d38a06f3331793a9cf2d08c5
- SHA512 85ad0b05aa8a724879bc0f247c09dd12e08110492caf0ae9c385fe1db6ed81bdeae2db5dcd827b06584d720687568d8c9b8ad47228f19c611f5ca625d83c6fba
- SSDEEP 3072:om5lkC3+WeDLO3Luj5lqQHPubRFMesSDdhBv:okkyIL5jHq1RFsyBv
- TLSH T1A11439237AE1C072E8A20975D5E8D7F2357EF8325B2454C3A3916F1F6C613D26A386D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
33:7d:c7:33:db:cc:91:6d:53:e9:01:ee:a2:95:5d:95:82:60:df:ab:03:f8:22:60:60:7c:c7:c4:49:06:50:20
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:11:10:34:43:cb:29:75:a7:35:d3:98:c0:ff:84:f2:ed:d1:11:44
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
85620
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
GetVersion
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
RtlUnwind
LoadLibraryW
LCMapStringEx
HeapSetInformation
HeapSize
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedDecrement
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
GetStringTypeW
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=107, id=206, version=50323,
count=201, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/MSBuildTaskHost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b8ed1f99bdfd678d7f57ec11260cbf1c9ca9bdc1acd726fc78b8edb9bbf8b39
- MD5 6e745b8dd6d9353d8ff33d4db9074b6d
- SHA1 f9c384ebea0c56596c21cd5a5e00b483c6ef1fa1
- SHA512 fb02c7ebfc674c6eb0224d1c9ccf0806669d500ebd50c91bff0899700ca346a747a4e31bb4a4563327f7c66dfbff54bf669123333a86b32e8494a8a3b6ce1197
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0B52rUIEd7yjoVy2:s+vFZNOgbiWmNLzpRK2
- TLSH T1E5F35A0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d4:ec:45:a2:7b:ef:01:8f:1f:92:e7:e8:f1:fe:54:45:ee:ba:ca:7b:92:0b:a7:9c:22:bc:3b:d9:82:f7:fd:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
64:9a:87:0d:99:97:26:25:20:fe:b0:5a:0f:e0:48:a7:a4:f5:fa:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
161422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\x86\MSBuildTaskHost.pdb
mscoree
_CorExeMain
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/MSBuildTaskHost.exe.config
- SHA256 d6aea281c52a98c633586f0fb44641efc41f533acee10ce9322aa2d03379aaa6
- MD5 c9db610d35202b83dae4ac19c8db4471
- SHA1 919ee3f49b4e6f20c9d622a645add595352a2c05
- SHA512 ddb2e93d818344fcb87d229203b3330f2f3c9ae3d1457813f9a2b38e27183f3e39cc67fd9a1a9bcb073e896bdb7d81f581fed8d6345c75abd91b88e06e09b8a6
- TLSH T1B021AAA4E1C8BFB14F7109A77A661C64EBAD03A3684D450DB09D7A474F3699A430B132
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/PEVerify.exe
- IMPHASH cf2381f1ac623f10a51e0b293248761f
- SHA256 4179f460a7595f6d8c174fec75249f9b68288eec009fa5556a70a2f920b82c45
- MD5 e149a9e4d6f03e1f20180d9a04408dd7
- SHA1 ed743bf3d05eaf0f3caa06094dc5bc938e71506d
- SHA512 2a0b5288e92015300d61d57ad83e029132287e6f5583578ee20674d568efeca740fed1f067c4c89ee8ae86a7e4a7c34688e86878b2fedd3743aceb3137f6af44
- SSDEEP 3072:vYyJ2eYoEIzFF48LpbjOG6aSD15TRHjibAVNJmtFi:AA9ZOG6bJobqJWFi
- TLSH T102243B2377D1C072E8920475D2E8CBB2257EF9729B6454C3A3806F5F6C653C26A38BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9d:ec:83:c4:fb:10:13:77:74:06:43:df:c2:15:39:f7:6d:60:7f:45:32:8a:f9:9d:23:86:aa:51:e8:09:0e:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
47:f7:f4:51:34:16:a9:ec:4a:49:9c:86:34:ef:a7:57:37:77:c9:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
81344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
GetModuleHandleW
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
IsValidCodePage
GetOEMCP
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=47, id=207, version=50323,
count=17, id=205, version=50323,
count=129, id=206, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=181, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/PEVerify.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ResGen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0fdefe2f4e84a6899d668bb57e6a815211847a63961b9814d31eb019dc5fd772
- MD5 6246a38965d8f5f21ef48f6335eff60f
- SHA1 93402944985a534194c88ff21e1683bfd52d5ed0
- SHA512 d0f62783ee7a50e4e6877df05f22f33515de20dbb1e4433bae3716824e6f6ca8c5974fd67ab569ebaf8721728fc2d6204dd43d59d9cece9c94958f0016254f3c
- SSDEEP 1536:DGcZg4cHAqgLsVmXitf8TLCnZc/xW7FocH2fQfiHs75HdjJCY8cJCjGL:DGSg4sFg4VmXitf8TLCZyIocH2fQfSCj
- TLSH T1A993191493F84212E6F74B717EF490435D36BA539E22C79D7C89634D1F627808AA2B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
20:cd:af:26:3a:2a:c7:e7:db:02:b1:42:75:d3:b7:98:73:a0:60:0f:91:6e:0e:ae:1d:90:9e:3c:95:c0:01:ae
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3c:09:2a:c7:8f:af:2a:d2:ef:03:36:40:af:0e:50:68:14:ed:0c:4c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
81902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ResGen.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SecAnnotate.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 558c66f7c5584a92e7b414d037dfc04d60d8d06423ee846802a2dba825eb189b
- MD5 4f6b31d613b55cde700fb5cd3e485177
- SHA1 c78b8a02b3ff5c812c57b3a1939fe2c3897fffb8
- SHA512 e6184ee61830d6318ba7137b26e1272f9cbf597ad1d18392bff9a47d39904f110e1bf31548444971d370f4ffd792d5b0e8e1335376162d3b0a083f026c1a2297
- SSDEEP 24576:F836z8thQhhm0hK+H1GgJeVinsjh3MggZuGQu7xU7:Xm0hK+H1GgJeVinsjh3MggZuGnVi
- TLSH T116456C0AE7D88377D55F4B37A03104453FF2D44B6B43EB4A7A98AAB56C03BA09D92173
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a4:e5:35:9c:0c:12:23:7b:9f:e2:21:b0:e4:85:82:ff:7e:fe:04:ae:e0:51:23:4a:44:0b:7d:b3:c7:ec:e4:87
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d1:18:4b:65:bf:29:8f:30:c9:53:2d:6d:52:c7:65:0a:fe:98:da:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
1253438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SecAnnotate.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SqlMetal.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0ba2dbe554d85a843468f964ce932a9247d3652e804e687fc002110234b1558c
- MD5 69384c8a0d4597b4cfbe2a049bf5020f
- SHA1 99423e8fac1f706df77b19629d178a33a8826b2e
- SHA512 bf61e1b283a29542bb8975f4b5464f4261075b51465fa663218a198766f55d69880f310e40b7e9a0d157c6a8cbd1e3652006702ba52c8c33ebc852db9b99a90d
- SSDEEP 3072:MH8OfRNxUMYiX7CYxYawPw64WpVNljLEMLKq7+iip6upr0KLodUBosc1DieMcDJD:MdUhiX7CYxvwPw64WpTl5ur0fWe4pgF
- TLSH T19054193567FC0218F6FF6A3455B951098AF3FA139536E66C145C51AE0F63B808AB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c5:68:a2:45:3c:fb:fe:46:10:f1:27:55:19:8f:ef:76:2e:7a:15:d1:70:4d:15:07:e6:e2:ee:c2:45:74:61:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3a:e6:b4:8a:be:90:12:18:02:cc:54:03:2a:dc:31:8e:d6:ed:8f:d5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
287998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SqlMetal.pdb
mscoree
_CorExeMain
Name
.text
Size
273KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SqlMetal.exe.config
- SHA256 3aabdcdb9ecb5252171e23b366c46afd593b860a7eb9346de4c3739b6968a66a
- MD5 e59a817454f452bbc6202823210177ff
- SHA1 7ddbf2c0fad4c6eee69392404e3d05b96a8378e8
- SHA512 6ff764740de133ac811ab7ae8812190a1bac41c36ae875c69383546a4135bacb7aa55fbaf409107167d607769fdbe5b711ef3be41f2ed2ade9b9713e45fc4525
- TLSH T155C08C8108C46C235B32463386B28968FBB5F3C244180814F8AF61B7090206803A3270
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/StoreAdm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad17cd90a078c4b37085e0f065f7af1426667d73408d9acfb74d81e232f4711d
- MD5 bce790978c48589199f2f1c4d153eaab
- SHA1 862fbe3a0abc4b8f81ec8192277714c832420529
- SHA512 2790e3052cbcbd743d08e39af281b0900fd2e4306adaa431554799633a7051a03b31aa3b374e4e015c85153ba9f1bb0e571b92ccefe33c8ab40e1a9d80dff5cc
- SSDEEP 768:NDNlLjCRr4pkoceXe6Iq8bgQXRPiIFzzp:NBtLcedCgiPnzzp
- TLSH T12713B624D7F80213F2F74BB099F5D087A876BA53AE34D65D28DA534D09227C08A52B7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5e:7b:62:7c:0c:8b:98:7b:d2:8d:d1:62:cb:eb:14:33:bb:f6:54:50:dd:60:81:e1:fb:13:fc:77:66:b9:b1:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
81:da:1a:9a:5a:ff:8f:db:6a:53:d9:ba:4f:37:b5:83:2b:8d:bc:50
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
32126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
storeadm.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcConfigEditor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19dbd5d07c117ebfc9c39dd64cceff3499314280f1df611e380f835d80486c04
- MD5 1552f3e5390a30bce06a70069a09b6b7
- SHA1 0970aa17d307c5e5b8e14545f17876956abab840
- SHA512 62fdb9a957631fda1e058e14b64bd65bac050b250f9a5c2cae9e4659c7938df4bcd5558c03af8dc66c5978276b2351dbfd11343be07d5ffc45844202209c9c09
- SSDEEP 24576:ioQ+mP31vZo106r09Ni4SaqKj9yqBR++m0izcmhCDUv5CT9Z9GTtK:Ser09R++m0izcmhCDUvMGxK
- TLSH T119B5C72037EA110CE9FB1B712D3A81D517B6BE6A7E04CB5D21A9124C8D73B538B22777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:2d:c6:8e:51:0c:1c:58:64:aa:82:84:1e:ea:38:b2:f8:85:0a:58:6e:a6:c0:4b:07:9a:2c:14:b4:75:62:4e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
19:87:54:4d:f4:f2:12:3c:b7:a0:03:ae:da:06:ad:06:41:26:90:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
2405086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcConfigEditor.pdb
mscoree
_CorExeMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcConfigEditor_4.0.chm
- SHA256 731d8a58fb9e20d8a74f9b563a1eebaaa3a1aad5c904b76f8421fb92eb261818
- MD5 301b0030c9e35ef5ecd8dff7d005e6ac
- SHA1 505527ad90d24f89649d5b738093630529a2402a
- SHA512 010da137194f9fed7344546709b63aeac981f9ca7a80a13fedc986f6d8436bc0d0a1abc74cbe3ad428d5aa37d18bf14ab8a88c96540a0cc2a62a676402634fa1
- SSDEEP 1536:A2NPu7MV1k8yjSzSJVWA3sh1bfiIvYSRDNCfYsB:jNtm5Nsh1WwsB
- TLSH T1CC43F17353AB663ED6946BFCAFC69C25BA115B04C94550EE853CB23430AAB4F22D1CF1
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcTraceViewer.chm
- SHA256 bd58ad22dabaaff41dd9a7317c9154fbb6bac0af79693fdf8b143488cb93b759
- MD5 b2ca8bd7fb01ab0be666b7274dd536d5
- SHA1 f56e0be005aa64d2f5611a71960577579f508540
- SHA512 a4f73b464ca24842fe43d50453ba38072019c8765b14c335aa5f68a9357fb5c7d8604a29bd4a1bb5c8a1143977603a95bcddf30ad3d6839deacc3856e0bf7ab9
- SSDEEP 1536:qJUgqfkk52CjyL6BdR6Q5WU5Pj+Nvzr+hQfB4:GUz52Ce0FD1jW+h6O
- TLSH T15C43F152DC13E4A1E1A929BDBCE3414B8A007208D34DDBA4D576F18E7025FCEB0F911B
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcTraceViewer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d0246bcef7da19aa8e3efdf59f83e512e77fb11b913e59e543f511ee5d71f7a
- MD5 d0a66c70d8d724895a4aa39b9ff52f23
- SHA1 881855e21e3c0e9247422f71748a4f7df31ee980
- SHA512 d9228e69e6484ccff07193f6e2ad7ca3321a7bc9cffbb9e1b0c4578b5a14a482c529c8b592a102efa02578735ef18fb2f8fba796934074b0c12ea83b23689d70
- SSDEEP 6144:ewvHeaP2EcsiQ6HxtuHH+xeqKr5lxDp3nuGuHCFxoQ2/TEFxiw3AeD4sdYH4oPd0:Ji6J7nuGF5XxiRsI4oPYDhHkje
- TLSH T1CCE4290033E84B2AF4FF4B75B47854D597F6BE979699C24E1D89B1CE1EB27808813263
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:7c:05:d9:69:03:77:41:3c:67:51:8b:53:c2:3e:68:63:63:6f:d6:4a:ec:a7:2f:b6:af:7f:89:ff:65:f6:a3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
05:b2:92:6f:1e:08:f1:08:20:96:74:22:49:cc:59:e8:9d:7f:86:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
678382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
SvcTraceViewer.pdb
mscoree
_CorExeMain
Name
.text
Size
654KB
Virtual Size
654KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/SvcUtil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 acb7bf20e53fde4e171067a6de2581bd2df374e26b75349c42c14278e5595024
- MD5 9f2bf87473dc29e0ed74d026101d80dd
- SHA1 71bbc200110ef22e6b2c90e9bbc0f49f7a6b4088
- SHA512 c12cb4ad24403fbd7eddb44f5d447e31b19171db94a8ac6ec6c4b9cbdc642ba69b55294a0f60f6e8f52b16b3bacccfa93a459d63b1c344fa3d001db4f92730a9
- SSDEEP 3072:Q3O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerFwyegYm1/K0UJ:SBGxsI46nYNs0xcXxY7J
- TLSH T17E142A3937EC1726F9FB4BB4BCB9C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9c:3b:47:3e:2e:6b:cd:9d:09:54:e8:2e:a2:2a:5c:90:24:c7:f6:1d:7e:0e:d3:ca:31:60:3e:76:e2:fe:63:67
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
cc:37:f1:ee:1b:a3:37:8d:09:ef:e5:6e:1d:ae:92:32:c8:43:15:85
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
191246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
svcutil.pdb
mscoree
_CorExeMain
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 502282813e8087248708a0a5841381e6a2d75478e22453e076e21b7c62ec2989
- MD5 466371c28d4604976360c08240a6a05c
- SHA1 c276d350e5091e332561a0a4b7f1515620311eb9
- SHA512 20d4280243524c6ee14b6934f495deb02f6a4a3f1e7b09172675bd2cd8e46ad5984bae17a600efc64508ee2a04025a45c3c0800d7662fd1cec6f904ddacc8c98
- SSDEEP 1536:/k8soxMSqgD2LJ6lXi/KcTGBWEc6b2G2ouwR0J0F:/k8WSFD2LJ6lXvcTGBWEc6b2G/uwRc0F
- TLSH T1A553F714ABF84212F6F74B71ADF5C0479976F697AD25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
7a:1e:96:1a:d8:14:2b:bf:24:44:1e:68:2a:bd:13:2a:98:86:b2:09:a0:bb:4c:5e:f9:8f:23:18:ff:ae:e3:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a0:d9:7b:b0:24:12:ff:44:ed:97:0b:84:31:7f:e4:6f:6f:c6:87:e9
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
53726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbExp.pdb
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/TlbImp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 044910a5c27e72ee21d7ce09962a8b30d4be77458e629451cc1fb73deccf6cd4
- MD5 7b60fb55c7df5f801f8ea31859f0923f
- SHA1 e51079cd87c7dbf2aeb5795a4ec10c4ca4b0eed5
- SHA512 0f37ffbab2e714460630e5de345d391b1804c129787077dddf52f0331c6a95e6b09354b7167a0f7b44daf589c51ab7cca81d1404a7967ead82410ace613d8ae1
- SSDEEP 3072:r4v7VpD9Zp5q4l0QSmIydxiC7ieldIVr61c87Cw5uGjsJx9BzdcOyK7f8y1EAxbO:r4v7V19L5qfytldIZ6CuDjj
- TLSH T1D1142A2567EC4A2AF6FA5774E8F5840687F2F55B3A1BD30C285816FA0A237C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
75:c6:41:d2:f9:97:a5:4a:85:bc:a2:59:91:b8:fa:2f:f5:46:78:e4:e8:1e:a2:0d:f4:fb:07:0f:24:c0:b2:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
d5:0c:1b:59:c6:e3:7e:d0:51:84:54:d6:78:a8:eb:ff:ec:61:e5:ea
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
182494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
TlbImp.pdb
mscoree
_CorExeMain
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/Tracker.exe
- IMPHASH edb7de4623ae335f2538be97ec2d53e8
- SHA256 84f8b8e2fa0a5fa5e9f3401851a7d2cbf7e8b3e903b9b563d1703b91eb917a6b
- MD5 2920b40a1463fdb24a682f10e32b3f5a
- SHA1 7fe2eb274c97a608e7fed9bd7e352a6076612a2f
- SHA512 9929c97d375eeb41e86e071b45fc9da46ebc3f7991eaf4e160b0d90a07b24bd05f240895808714693272d584875b0cb82b6ca53a0b9bbb061ce62a8d1ee7e4c7
- SSDEEP 1536:LfD75vVY3LmG8OfRAEB8lwPS8WvcREScYlVb95TDS+BxYIJLZGj2XBkx:LfD75O7mGvg1YflhvDBhJLZGsBa
- TLSH T11CC37D127AA1C032FCD2103496FC9E635A7DF9725B3890C3B794964E5DA0BC1AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4d:77:26:91:af:3a:ce:5d:95:72:50:79:69:fb:cb:6d:2b:fc:e7:45:2f:55:43:cb:de:a2:0f:92:73:e0:ec:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
14:1b:e6:71:75:cd:ae:f4:35:e1:72:ef:9d:ce:d4:3c:80:e4:b7:ca
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
21275
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetVersion
GetModuleHandleW
GetProcAddress
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
RtlUnwind
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=13, id=205, version=50323,
count=119, id=206, version=50323,
count=119, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=1, id=207, version=40602,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WCA.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2089cfba8e27c693adc7bff30fe174b7584832b0fd342b162dc6993e9eae282b
- MD5 c6846a484e08a5b12466a077db6c3e5d
- SHA1 fe50b5a8b5378478b65a8217841f2616d513c48d
- SHA512 395e58186ba9a5230c1b2c93fe83aa6dade8c0126d1ca58cb72b17ae905a9230c519692aa6920e7d70e403d0c9a7744bc4c09d38c3e52e636c4a60740b7dd4a6
- SSDEEP 768:0YLUUzqRtIzYAQ1gqiF9ZvCkEoONcit/E1isyc/:0YHmRtSYBgRbEo+cIE1Ny8
- TLSH T1D0333A5073EC8356D9BF4A302AF0A5864B7CBBC21911C56E2DC4B1AF0993FC19E51B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
42:8a:71:6d:3e:da:51:a8:17:b6:fb:c6:c3:6f:5c:5c:61:91:38:fc:be:5f:fc:ec:4f:bf:29:ee:5e:ae:fa:1b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c1:ef:c2:1f:a5:2b:80:7c:68:4a:f5:a2:ba:fa:1d:fe:e4:1f:13:81
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
42590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wca.pdb
mscoree
_CorExeMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WFC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 785c6b25fbbfb5d00eef40feec4fdf59f46a88cfc781aeb21d65812bbe3e527f
- MD5 7f04e827f35e2f6848abb1dcccea8c73
- SHA1 c87f3e90b488d4cad413e8e274f32255c0e7bd76
- SHA512 b394312136276da998f56a86329f81db2ed52bce7604a05bf2634d087283a665640eec2e044d00328edf57711ef7eb2362e698555621e8cb1987a3a8545eba3d
- SSDEEP 1536:JAILVy0+uumc78EarZaT/Iz12o1LMDukAF8lpBkv:3Vy0+uumEEZS/Iz126LMDuk68LBg
- TLSH T13643E821BBFC4156FABB49B029B18092A97EF7E36842D40F388D65485753BC09A3177B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:fb:c4:8b:50:62:b5:6e:8f:41:b9:45:ff:24:42:b0:b0:0d:70:27:ca:24:17:fd:9d:b5:68:02:b3:a3:78:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
67:93:ca:e9:4b:ce:b6:42:db:e0:f3:81:80:3d:2a:38:58:80:2d:e6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
48206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wfc.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WFC.exe.config
- SHA256 89a77b141f15908e801e9345a0fa4174bee150691a6cd76d4ac54be8a387824e
- MD5 b87c9ba8b9de80232ddc5653c321086d
- SHA1 e278c1e5c976d95593829be7d87c93e7e66ea36f
- SHA512 e2606ea815132fa8652742a6f12486a8db717c8b8167599802a8c053a02c2297bde8f5992648205e6f0fcf161e3075305700d6db829798f853a7d744d946bc8d
- SSDEEP 48:htrT+rht8T+eToH98QHtL/oHYtrT+06CM0SBxCTPBxCt22xhM2xCN2x3uq3tCM0D:Wrresd2xo0uz0uhTXdPZkuZf
- TLSH T1548159302280FFAE1B5253157F70E5F2D29AD3BE1B580859F95CA729CB2349F43136A6
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WSatUI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a376a95c516641164d9f9bd6bdc162d6c9cccb4e1cb9efae29079bd63201a90a
- MD5 c2789058405bdff29e7070738bddb0fb
- SHA1 f39b839aba53c61fbb1c12f379b239fb3d3b39cc
- SHA512 fb90b41398feeea2c4b5a550bfcb9dfb1c6eb17afe76d6a3ab995ef9a5e06371f670cb009a8d1b47746b6564b8f67cb6fa864151c43a9b7914e542f5553ab757
- SSDEEP 3072:Cm4uRNrlmBELV+VuZFquunlSiYV+n8nkTrcp3ScYRs6SXfCzE75Foc:VNrl+ELV+VkElQ7+u7Xf8Jc
- TLSH T17134F62033F91209FAFA4B3159B580C29B7BBE277E19CB5D5445124D4E72B82CB22B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:aa:f9:11:e2:4d:39:53:2a:fb:27:ca:ea:86:a3:e3:94:f7:f7:bf:dc:7a:fa:aa:b5:6b:c6:53:4b:6b:42:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
58:8e:33:8b:f9:91:4f:8e:86:4f:4d:d1:7c:6b:45:e3:5f:b0:0e:f2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
231342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WsatUI.pdb
mscoree
_CorDllMain
Name
.text
Size
218KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinMDExp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1b3e76e8934d690eb462d77d3fd20266e70c6ff9fd223202a7f58b04a4109c85
- MD5 72ec26d29e040b53d1bf329141f9bf57
- SHA1 15e5f21fc209d73a0fb13449f51430ec35bf956f
- SHA512 66af8071416246e1171b4aa3f3757cfbeb08e79af3ca56fbce02bc916ebd035190db09369beafbd1368511fedc2bf87bad8dd7dfa47087c9306ce7c92a73abc2
- SSDEEP 12288:Y3mUaWs/++jX9O1NKV1BTP7EVFFP8NHQsFnBLCqGiWSNAPY9WqphQpR:kW7w1NolPFVp3WS3WmsR
- TLSH T1DE556C07ABE8A777C68B0777A03205097FF1D04B7717EF057948A6BA1C1BB909DA2163
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:36:27:45:4a:79:37:a0:aa:34:78:82:c6:13:56:d3:f8:38:6b:f0:89:85:fd:68:4c:dc:58:d7:9b:f4:bc:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
5e:44:ee:2b:46:23:fc:ac:94:8a:0d:7c:9a:68:97:60:0f:f9:06:43
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
1355662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinMDExp.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/WinRes.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79b0e33fc7d5771b3e1f4144b3aa9c6e69667dbd7467506f07355da2ceb2d860
- MD5 f941a325df85318c5c976d2df750d579
- SHA1 8ff7e49a6cf5e488159a8e4deb687d3ab2c9a673
- SHA512 ef88868769d1857a3a222c2f25f338167952196823ffce1c28fbe529dd6e87cf0ff6304e644b1c97481cf3cbb4b0c26a4acc93d384e572cb6c8137b248d4fcdb
- SSDEEP 3072:V3LDQXGAJHPxTeN4hWtrYyldospVa4B3WRUzctcNm9RnLevrRxD5w2:JQXGAZZ24otrYyldoiVdbGk9k2
- TLSH T1D3E36C2473F88652D1BF0B322AF19482CD76BA43DD36C75E189166DE1D7338086627BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e1:4d:36:9e:76:4b:14:2c:77:20:7c:03:5f:0a:ec:ce:04:58:86:0a:f5:30:b0:ad:de:a1:4a:3b:55:dd:aa:8c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
53:08:57:5e:bd:17:63:78:c2:db:c7:15:75:75:e7:0f:65:2e:cd:02
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
143342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
WinRes.pdb
mscoree
_CorExeMain
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe
- IMPHASH 35f7d7b0035d9d9c7dd3306a0690f78d
- SHA256 f6c6ca66956bc2a63136c769433cb4ca0a820351dc22515f791a098f0b3e4471
- MD5 9d381cc31bd46357f144acd242b8eb22
- SHA1 a2394f1737f4a16abdf527e4c00e91b0f147ed28
- SHA512 1037cd5aef45db81e24d86a0eb150f7e52d121ca09caab9ea74da89ca6d309f6fc9c219e6cc56ea8cfddf3a57f31f82fa6a4a356032a9f09431c6990d753641e
- SSDEEP 3072:gmzrEJqNKpw8oG4VO9ntat9uYpsYzFDL+wYZfP5q:1zoh8G4Kn8uYb9CU
- TLSH T183147B127681C072E9B345B016BCE3736D7E7D325A259A4FB3A8AD9D4A70380E735363
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c9:15:f8:55:89:f0:f4:ca:96:39:87:3f:39:25:09:c5:08:35:35:23:1d:6a:f4:91:3d:3c:3d:bc:ed:9e:96:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b9:d7:85:84:51:be:32:ab:c9:cf:c1:0b:1d:9c:98:d1:6a:88:43:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
6
Entry point
15180
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
InterlockedExchange
InterlockedCompareExchange
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
WriteFile
GetVersion
GetModuleHandleW
LoadLibraryExA
GetTempFileNameA
GetTempPathA
RaiseException
GetTempPathW
GetTempFileNameW
GetFullPathNameW
GetFullPathNameA
SetLastError
GetShortPathNameW
GetShortPathNameA
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
SetFilePointerEx
LCMapStringEx
WriteConsoleW
GetEnvironmentVariableA
LCMapStringA
CreateFileW
HeapDestroy
CreateFileA
DeleteFileA
DeleteFileW
FindFirstFileA
FindFirstFileW
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathIsRelativeW
PathCanonicalizeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=18, id=205, version=50323,
count=148, id=206, version=50323,
count=61, id=207, version=50323,
count=171, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=207, version=40602,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/al.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_intern.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c16b0f36a32b40f255c9316fe9538ebc310d07398998de3d8187290f736f4dc9
- MD5 ddb0b409c437cb59e30d236a200a92f2
- SHA1 990bc9c2a3d7acc2ef5bd60c6750cc908c388d26
- SHA512 c7b666cdd4b17638db71efc4bc2aa6b90b599b93e29822fab892206206627febb54c288e9e127b66283f34af5c8708de1b4a5d265638eee87cc82982535ce799
- SSDEEP 768:WYHti7yDXWiAcoT1/lxfYx6iOgge8XckdH9U6Iq82UOVsQGDuiZrq2/u:W4oIX7AcoT1fffiO26ck9pNU3S2rX/u
- TLSH T1CA73E61497F85222F6FB8F70A9F480439D36BAD36D21EB5D189A534E08337C09662B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
00:aa:91:ed:74:59:29:00:f2:54:16:2f:45:77:20:c6:23:5d:5a:a6:e0:43:c4:5d:ff:d8:a9:74:6b:74:cc:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
1a:1e:f0:d8:46:82:cd:37:92:17:70:65:11:64:d3:55:01:4b:c6:86
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
63758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_intern.pdb
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_merge.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 32d524fff75a202cf963da6cc509b7e46ce694f99a3470f58e33754ff7edef14
- MD5 23f2879d2524112653377f869da8cbb9
- SHA1 01c92d9277a1735f63e1ce3ed670a9a56dff64a5
- SHA512 f4ab6aaa623ccb4baca830db942e5606741a06c163b6c0846358179456b0501116b1c5dc5df621ad903cfa41194c9dc48776a60bda863fcab16203e679da1e07
- SSDEEP 6144:0nzj4nK4m+qSneJ4YleygNmqnodRu/GZLt+2AdBZyW4msGBQ2I3zlPRNs+q16xPC:0nzj4K/efMuuZLg2AHfI3BjORsVnvQ9L
- TLSH T1CD153B0077E8D217D2AF83B691F95509A7F8D006F313FF5A48285EE41C53742AE692BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c8:f8:b6:d2:94:66:79:b9:0e:af:97:42:8c:fa:4e:42:5f:7f:c4:11:e7:3d:a8:cd:bf:02:e9:db:27:d0:80:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
28:93:db:6f:ed:1d:e5:f5:b9:89:7c:76:8a:1d:47:4e:30:15:e5:25
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
928454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
aspnet_merge.pdb
mscoree
_CorExeMain
Name
.text
Size
899KB
Virtual Size
898KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/aspnet_merge.exe.config
- SHA256 6451500097507ad131e6ccc39cc376c31807770ca223741b4a8ed20ca82723da
- MD5 4d2e83f50d7d1e32468d98f079cb1b95
- SHA1 e73bee0f16decb2f4328c33f6e14306ba8a34869
- SHA512 11a60653d274a1e51fc1ad88352b75cc7893f2c641b2e0e9dc8ade8a276aafd43a22b9a65fba13f9a094848da22a3cf4d90341fc4ebeaa159877b38c448e8c65
- TLSH T192D05E8008C4BD275E33162766A28A92FF74A1D290184014F8AF37730F7249947A3331
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/clrver.exe
- IMPHASH 8b2123e573c22d47c97d402c43d0b828
- SHA256 3f6829d51e8530ee4b81ca1be060cf81944717ffa8cf52ea507f3f260288c914
- MD5 e169cf1292d139312be5d094261cd179
- SHA1 96cecf59a4a2b758e2a901fe6ece7c84c1fc55fd
- SHA512 3db41631e4b2715cf8fea91836ae5b0815f9a03528441ce8000a51606992bf3af8766d1653974828daabd1cf04d352da780bbc8e6bb3cca3c928976753c72de4
- SSDEEP 1536:73f9CV+/tnJWGC0WzxGMZ2suPutLkOz0lwR44+I/:73VCSpAdRCGL3z06P/
- TLSH T1D9833A12B6558031E8A1583943ECC6936A3D79728B794ADF6BD45DDE0FB03C0B6347A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6c:e7:aa:bc:a7:72:94:4f:85:f8:e6:53:c3:1f:19:ce:67:f8:6f:99:4b:ad:0d:6b:6d:b8:a6:f1:54:12:c5:ce
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
02:c2:6b:a1:0d:44:de:7a:8e:44:8c:3e:a5:21:45:97:e3:61:bc:8a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
15077
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetVersion
GetModuleHandleW
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=10, id=205, version=50323,
count=95, id=206, version=50323,
count=84, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/disco.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1fd270bd647b7c9d55ebb3a3e2417136a2ff01120e9fec9976ecef76d1536bfd
- MD5 399c5ab3b0dd977a5dee5004ee030e4e
- SHA1 9cd3ce91461890a6b7862d5e5e3e55b42b664e9e
- SHA512 3600eb502687e8be616065d61b46f8d00b05831e1f81458807d0b776269be0ea17692a673f9139ee578b9bf20e7184df52b0810955b27b310ebab237ce01c2f4
- SSDEEP 768:7PJD0SLoVy6f/IELS5c7d1ZstJC6Iq8fhHxoCwiGp7pJ:7xzkVy6fScJgJBohHx9wNptJ
- TLSH T1DF63E71493E84212E9BB4BB0ABFBC3C387BEB5875D21D75D2895534C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
73:60:9c:21:94:a3:4b:2f:22:51:68:d7:27:01:e1:47:8d:05:9c:b7:54:74:de:bf:95:4c:60:93:e8:8f:fa:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
79:cc:6d:9e:41:4d:0c:4b:a7:93:3b:e0:71:c1:96:0b:29:9e:c1:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
48430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
disco.pdb
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/gacutil.exe
- IMPHASH 1d5d62a00aa56ac222a0558af3bce499
- SHA256 01841c1e9ea4ce1af3ca7b8e6c7b4244cdab178709dc9c295688ead6517e5d44
- MD5 aa1feead921075878fb4a8337f0a83fa
- SHA1 77d0db38a20716cfe2d634fc6851188c8a61c2cb
- SHA512 d57f62eb9cfd275913607c8e51e986d3e6527db7baefa919ac1e0fbd13e8da0d03e638044e917fb43cb127fbda445d84272d96440028d4fb73618f7bcb0d88c9
- SSDEEP 1536:ot+3UJxD3I8kNB4ZKSF158B+1qEWZBRxByquayaHMRBkj:ot+3qx1kstunZuayaHGBC
- TLSH T148C35B2279E1C472E8D205359AFCAA435A7EFB721B3454C7B398128D5DB0BC25E353A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a3:51:2e:51:da:30:19:a1:27:f0:a2:12:57:b8:3c:fa:67:d2:cb:df:63:f1:93:dc:7f:1e:fa:4d:20:94:bc:97
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f9:67:eb:3d:3e:50:0f:3e:23:d5:6b:c0:39:92:38:62:59:7c:d2:a3
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
37561
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
GetVersion
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RaiseException
OutputDebugStringW
LoadLibraryW
RtlUnwind
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=42, id=207, version=50323,
count=13, id=205, version=50323,
count=97, id=206, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/gacutil.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ildasm.exe
- IMPHASH b59f10d55307ec747fb67fa01d1ec22f
- SHA256 94edb927d1e4d7b4bb0c17d19f455ba0d4348bacca8c0fd38f9ba3b8cd40e46d
- MD5 48130efc4eeb45983655ccc822cf666a
- SHA1 4d264687a92eeebbc5ced79ef91158114365aedf
- SHA512 88a269dcb95d99e06773f183f705230e7e4f5353432919e204fb0a916f2b5e76d3f9fad7058094d2ef56853391d6f78c515c222b0d31b22a7c44cf249052900a
- SSDEEP 6144:zzN7KmpR6JjQMIsjZlFVMsp+/Y++zyFDSbZFq/mSSkmdI0ZtQmU56BE:zRKaR6iAFVMspC9N0NSSkyIxmO6C
- TLSH T142B48D33BAD0D075E8910176C598DF6978BAA971572A04C3738CAA9E5F303C1AF386D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
df:f1:6e:fe:37:74:ba:8e:bf:a0:4a:7c:25:51:0a:08:88:34:6c:04:d1:a6:7b:43:26:e9:91:c5:93:91:ff:c1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bd:e5:fc:eb:14:f6:65:e1:e9:b5:0f:9d:5b:70:c9:43:6e:f4:46:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
319535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ildasm.pdb
kernel32
WriteConsoleW
HeapReAlloc
SetEndOfFile
LoadLibraryExA
GetCommandLineW
GetVersion
CreateProcessW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
SetStdHandle
SwitchToThread
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
RtlUnwind
CreateFileW
GetConsoleCP
FlushFileBuffers
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount64
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
InterlockedDecrement
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleMode
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
DeleteCriticalSection
ExpandEnvironmentStringsA
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
421KB
Virtual Size
421KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
874KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=50, id=207, version=50323,
count=23, id=205, version=50323,
count=145, id=206, version=50323,
count=264, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=1, id=207, version=40602,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/ildasm.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/lc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4265e6a8c272b414eb9fa6f8e1ca1a43562c873e794a64519c2a68b863a3f9b3
- MD5 f27fe843c8753ce852fffc6e92934ded
- SHA1 ca9fe2ac13ab8a06e051e767e896bc742a5a28ab
- SHA512 f0a0d6f3cb7ce9a1946921b95b82ea9992aebb5c6f5e2ffc19fa2d3c9f31327e19ddf48f007c4c818d51b610cf1948aaf35854a7a7aa224b878ed1ae99e6f035
- SSDEEP 768:wnSMzuxFp27Nc8DO536Iq8Wg5YZiRHdyi+:WS+uxFp27NcQOMfgOZKdy9
- TLSH T13523D82897F81213E6F74BB0ADF5C487AD76F653AE35C75C2889834D09227C09652B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:ad:9d:bd:14:34:87:a4:5c:98:43:67:b4:03:9c:e6:b5:ec:ab:91:47:f1:b0:33:12:71:21:9e:b9:c5:ee:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
46:df:ae:57:18:e7:15:ce:e3:7e:bb:c3:af:5c:76:03:9b:a2:70:e7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
lc.pdb
mscoree
_CorExeMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/lc.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mage.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7bcca9c675e5d5fa19228b908f3782aa471b3dcadfad5e74e59f714e5987892f
- MD5 fb385070072163697b84bfce9048bc83
- SHA1 dd4450919f4b479481c0069bfb8a26564071aac9
- SHA512 5398c4bb46af8f42ccc81a381fa48f6b54def0074de607c637c8099ca6c963c0ecc2e182c520aafe1e716f639232413cd8f823582eb5f30a95771922ca34846f
- SSDEEP 1536:5PNEYvp+o4ncDe2zHB2l1YdhfZyA1YdhfZymCiL1fuMVPQRHQBugjh43Xosh3:5yYvp+o44eAHBCYdhByGYdhBydiL1fuJ
- TLSH T124933B416BDC4316E9FB0A746979E043AE75F25B1922D7093CCD91DC2FA3B9086623B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0e:82:2d:bb:fa:67:7f:10:8e:e6:1b:04:1f:f5:b1:af:9d:16:be:9c:a6:f1:32:bf:97:d1:b7:b9:c2:88:2f:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:87:b2:9d:25:ab:40:06:cd:10:da:52:97:31:3c:38:48:92:9f:12
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mage.pdb
mscoree
_CorExeMain
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mageui.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dba6c3285b9da61c866409567d6a80b2bd50c9805697bfb1eda230f45288fce1
- MD5 adc82c51e6bf961d693c76c8bec7ef7e
- SHA1 989903893150acae7cec0dad9cc354df6dac8377
- SHA512 25d08647a4ad8ff6db89564bf778e2dc370f99135f01cafe22dc49043214d6f1850a735dbdfeaff814e4c2db4897cab63f62d1ac2fbc3d2febc8b1a598cc7538
- SSDEEP 6144:0KbZEDs1H2IDvhTp0rfcn6IkfQOfyAZK4hTp0rfcn6IkfQOfyAZKD3WkAfaPn0oq:0KbZEDs1H2ivhV0rfcnMhV0rfcn/yaAr
- TLSH T118E4843137AA5208D87A1B705C3692C953BB7E6BBF18CA5F2859320C9D3365787127E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:ef:ba:27:6b:e3:97:fe:0f:e4:52:c9:ff:e3:c4:69:73:61:77:86:2b:0c:ab:5d:5d:ba:dc:ee:cb:91:1e:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
97:5f:e2:d0:0d:fe:68:98:3b:02:3f:cf:12:84:40:44:e8:bf:21:9b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
701342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mageui.pdb
mscoree
_CorExeMain
Name
.text
Size
677KB
Virtual Size
676KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/mgmtclassgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e7c7ad12ac7bcbbe9a0416b3ab85b7b6dd6c8e623f1f72ad3ab876abf774ce39
- MD5 57430d13dc79af2a5e0c814eded25953
- SHA1 19eb454582ea78b3fd02fbdfd98880b84e790f1b
- SHA512 3ea4a1de6f4c22800a9fac16f9c51ee04cc6b75cab112cafecb1989f8cff4c0af4fe993db3d1a7919b54b5251e884eb4845be9982ab9770606395cee5834e7c2
- SSDEEP 768:ipJl9YLfWjlpO0lccT6Iq8oYh2ib0UGqeJ:mJbCUHlcc6la2NUGqeJ
- TLSH T16623D824D3F85313F6B78BB099F4D0836D76BA53AD60DB7D248A538D09127809B52B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
13:a1:52:fc:39:f8:c2:27:68:a5:7b:b9:64:fc:db:ad:59:a5:c4:34:ef:63:ca:3c:e2:17:01:9a:a2:20:eb:31
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2a:22:d0:bb:03:8c:04:69:d6:41:9b:46:53:26:a0:33:6f:da:b3:e4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
37214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
MgmtClassGen.pdb
mscoree
_CorExeMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sgen.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2e180af8f6c824647199cec379347f9cdbf769595c571fbaf325d365bee73a2d
- MD5 e4797f6000ffc97067011845d580bfb0
- SHA1 6302fd7bd2d5a41b47293e4560e5adbe5450819f
- SHA512 ee34f20b13d25b2c058fd3d3f0309eff03a580e887ecb4b2ec88b01378a2b23e44f9c8cb1fd51e291b8cfd391e1fddf95202b5d7080cee9489cadf0dcddbae60
- SSDEEP 768:FbRwSIUjOjyET3c8oQyqC56Iq8CUX5oxdijflQwc:NRwMO33cdQRCQFUXEd+Qwc
- TLSH T17D63C61493E81212EDB64AB09FFBC3C39BBEB6835D15D79D345903490D2A7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
67:67:44:05:e7:83:c6:53:e6:bf:b6:14:96:2c:7c:4c:f7:5f:17:9c:a0:dc:57:68:74:75:4a:3c:5a:84:70:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
dc:ff:3a:a6:4d:19:cc:8d:25:f3:ab:0c:6a:4a:8c:cd:e8:bd:f7:b2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
46302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sgen.pdb
mscoree
_CorExeMain
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sn.exe
- IMPHASH 6fd1c67b79af1ea44f7e5d30b1500226
- SHA256 9e74b92f2ed1625772156c0b9a65f59c9d001c1a3ba26e7a064e7dd77ec6813a
- MD5 b849aa942c2c19dfb2009d6d9ee4a694
- SHA1 d6d57344cdbc5677ca3b6e05227b563c70d09733
- SHA512 c1aac1d4ab70648776de1501fed068333810f2c60e66c753cc5cf22370508dd267b3e91d85b4f143f8a9b278088b99f8b0cffd5db366c8784d5bc6323d8b1421
- SSDEEP 3072:P/SWuNmOqFea8F1g+oG1IZga1084irw6pUJVqaDpYRalv8ECONXy2LFXPOfkS:PSNne8F1g+oG1IZgaZOpOOI2JikS
- TLSH T1D5246C237AD1C031D862053985F8C7F2397AF822AF2545C7B3952F5F2E352D26638AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:a6:df:7d:77:a6:e9:6e:a7:72:8f:f0:de:83:16:24:74:f8:bc:99:05:1d:46:24:c8:96:6b:d9:e4:e3:45:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
29:e3:a5:26:f3:99:ac:c3:85:47:ac:3e:d1:d3:76:70:d9:8e:6a:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
104842
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
GetVersion
GetModuleHandleW
HeapReAlloc
SetFilePointerEx
RtlUnwind
MultiByteToWideChar
CloseHandle
FlushFileBuffers
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GlobalUnlock
GetStdHandle
GetOEMCP
IsValidCodePage
GetTickCount64
QueryPerformanceCounter
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
InterlockedDecrement
InterlockedIncrement
FlsFree
FlsSetValue
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
LoadLibraryW
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
WriteConsoleW
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=39, id=207, version=50323,
count=16, id=205, version=50323,
count=111, id=206, version=50323,
count=217, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=207, version=40602,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/sn.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/wsdl.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80145d05468bb9a81560241758c812940553927c945b4bbb384d2f942424e36a
- MD5 52efb69ba051c03a12ac24034ec48291
- SHA1 8dfead7e8d9b87d343774560bd73ecc5ccefe92f
- SHA512 f532e5667e91ccb50b77d46b53ebf3f86c3e7a1a4efd5866c7ae75ef5d8b1514199cb6a7184dd6b49472c417c01b3ff2e030eeac8aafeb256af7d341e612a1fd
- SSDEEP 3072:YYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZw6OgqJIE:2T8rLo9YJ/bhuK3fSRbfMA97cZbC6xg6
- TLSH T1C0A3F71573E80612F9FB0BB06BF692C287FEB5466911D78D2C94128D0C7ABC1AB53727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:0f:15:2e:c4:06:38:9e:17:18:14:ff:5e:3c:f5:cb:8f:d1:ad:08:19:b2:8f:bf:f3:1f:73:d9:9b:bf:bd:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
84:14:df:73:02:51:ff:1f:73:3b:07:46:bb:01:04:27:5c:84:61:14
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
82302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
wsdl.pdb
mscoree
_CorExeMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/wsdl.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/IlDasmrc.dll
- SHA256 f21839bc8431056c6f215db3689181d92bf5b290ce26a6493fe538878fda7a9f
- MD5 840fc4b1cf2a5fa0ceb496a00844caae
- SHA1 59408c85e007ff54d5a5f3cca1a1c16904744f62
- SHA512 0c3627955d229566025ae577667514919c40d996ff10262247581b8256eabdb5476f0aae9282addd6c29fb9c25098f06ed7254e32870f16f5624b059363353e0
- SSDEEP 384:mb3nqW3BHW1ubNYAL1PWbYe3jKESkYqgzPk/57h0GftpBjOzFtAHRN7wslumkLUi:mb3NcubhYKESkkikEImkJ
- TLSH T1CF53B983D3EA84C0D4A199B0AD3B94A59E373D50683282DA4E64FF3F5E7BB509552333
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
ad:32:17:62:f8:40:7a:b0:b4:0e:43:15:e9:11:dd:6f:43:1b:91:7e:c7:a2:e7:24:c8:3c:eb:04:18:0c:90:45
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
56:be:bb:c1:74:c1:35:34:0f:08:ed:67:8c:fd:1a:e3:e7:96:35:b6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/TrackerUI.dll
- SHA256 e65bcd147059c12c94f2600f6d730e70229560b91aa24578e67788d93d003c6a
- MD5 2335713f3d19c960b94fb69c65ad25af
- SHA1 eb909377b3c5232ea97b16ff63ffd87a43aa8fce
- SHA512 6f222462b87297f17164add8e01443e386434663071eb8b199816cd6aca82a1e6031ae2a5304c67edaa2524aa3ef0943c25e147571a5be5da0847a3632dbb35d
- SSDEEP 384:wXWD8WQTK78xJ8xClRAtkQGb/L0GftpBjN74FtAHRN7qplGBSjZlH:JjRGkijvqiBkH
- TLSH T176B2A64147F84142F8F36DB12AF8C9536D3BBBD65930D21D109DD29A1BE3BD09A24B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:3f:c4:a3:7d:6d:90:dc:ad:0c:ad:db:1a:79:a6:13:89:e5:c6:1b:d2:49:76:29:e8:4c:b5:0b:fb:3a:55:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:80:0b:75:85:22:0c:f0:af:52:5e:ae:4a:fb:0c:76:2d:88:4c:ab
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/flogvwrc.dll
- SHA256 c804e695bd2791992f502c3114ea0c89bd4e7e106a26fffdea408f6d556c83e1
- MD5 740459c9f7e1029ba0b5debdfe79e13d
- SHA1 26b714aa485d1707d9c9f3b21b3d5e15fc505ea5
- SHA512 1855703daa1967e07e269e31cc4e2c7ee9369e1d389300fa850eee5ac0161fd6d2e14acb338f08bd2e8b46c09b1318ae89b578b8aa48fc4b241ff2ff3763a0d8
- SSDEEP 384:KWzcqW8RQxnq2ELDF5RKfPMnC0GftpBjNLFtAHRN71zlGBSjZl/:cIcfyiAuBk/
- TLSH T121A21781CBBC8447E8A36DB067B8DA837D3DFBD25D20911E1655F19D2CA27D0EA1072A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
fe:b6:80:60:74:85:47:a3:8b:00:49:6c:1e:af:82:55:22:e5:ea:27:83:a2:5f:8b:2f:48:5b:af:d7:37:32:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
eb:b7:5f:0f:4f:60:61:be:e5:ff:2b:d9:0f:fb:5b:18:cd:81:bb:53
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/gacutlrc.dll
- SHA256 d0c9faf8ca3086be7bda156f833439b86338763e8ef9bef237b85cbf6bc42c7a
- MD5 fd0e244299b906f943838fc7ca1ff710
- SHA1 b61b97d58c0b327c5777d22e796d99dbd2360548
- SHA512 dd097586017bca60dd1998745bac83f1a664203c571b69b2e9713af8b7079d63ed54648a50222cec6966f119f2108aabb7bd6728415d4e3a8f3de46ad6c0e314
- SSDEEP 384:ao1WjGmY5Cg4e6/h2Nc/YK++TJdkpoQrQNCeSWBuBxWI/L0GftpBjn0TFtAHRN7B:aAIecY0QrQNCeKei9pr/Bkch
- TLSH T121F20C8257EC0105F5F73E307AB5A5A21E7ABD82AD39D21D2198916D0AE3B80CD30B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
24:dc:b9:4c:cf:00:4e:81:0d:0c:2b:c4:29:a5:1d:9f:52:c8:09:95:f4:50:1a:5a:a8:8e:5e:e1:b2:99:18:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:d7:dd:19:eb:4a:12:ea:25:1d:e7:48:f5:12:5c:22:5d:5f:a4:2b
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/pevrfyrc.dll
- SHA256 211c5a12176338f7cb507ff427eb57396c6c5439d4bd3e01958f61c130bc2725
- MD5 be48a25b015a104103e45ea7ff0ad9d7
- SHA1 56271c4126dd400cb0cd1c5c341f16e5606dad66
- SHA512 bd9350c5f2a8f22a45eef63d63f315cce34181af4888a8f6ba9eb0477d2e0512ad70c6a5995a1ebb6834e643b64ca5df646433c3390e07c804714f064b3d054d
- SSDEEP 384:guyneWNJXWyh8YMnC0GftpBjEG+FtAHRN7R2lumkLTF:guyL9h8vi6SRhmkTF
- TLSH T153B2D6819BF84142F8F32E7066B9D9463D3FBFC55930D21D0198E16D2EA37C19A64B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
af:a5:2c:6a:32:22:52:4a:9a:5c:43:c3:91:22:d6:b2:6d:48:b3:cc:0a:42:a4:0f:6d:00:88:85:91:74:3c:7c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
fb:62:b9:47:46:5b:ea:35:8e:bd:91:df:c4:0d:35:00:68:7b:35:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/1033/snrc.dll
- SHA256 a4fe8f62b2cbe33a375be673db70359a20d90327af0d75f4e2c3aae58f3e827a
- MD5 3845b003456449eb0a5bf2dbf37f1770
- SHA1 562bac7d9ef1a35641a1f482be2f6d083f46dad3
- SHA512 1a07f3031887930b1a20b5898cd0d9ab4339c547f24519d461e21f3d55d0563089f4455460feb5230d2af585baaefaa767c04cbdde9c4e4d79afbf4ba1c4159e
- SSDEEP 384:54DWJBkW72ekwaaRGm7+bNItWIbdInm8J58MnC0GftpBjEAHFtAHRN7FlumkLa8:LV/sIddInmUji0Wmkt
- TLSH T1D0F22B8193FC4505F4F36F706AB496A21E3BBD91BD38C61E2248D56D09B2F90CA70B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cf:83:85:4e:dd:4b:53:b8:f1:b8:a9:69:9b:c6:a7:d3:a6:3b:a9:d7:17:91:db:b7:8e:03:a0:46:35:e9:2f:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
24:d0:74:85:24:1f:02:34:12:75:7f:93:2d:f9:ce:37:ab:ae:1d:5f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rsrc
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/AxImp.exe
- SHA256 bbd3ea037031f6984c6986af3601ce5f9320f7185ff7c2690e0223b68e88c746
- MD5 ee74e6e742c3c4fdd7ec1f746a42c4c7
- SHA1 048ec50664e7bc05bbd598843a3cef5b45018262
- SHA512 3e88202630b3cdbd4c71db7ba90da2e0049d78e2532e5472a3ad3e2757de67e7c5e03da47ff6f9126350f65c0f4ab79cc9156a5f3db74bd748343836729a0691
- SSDEEP 768:Ngs/JpkuXHwG/5O7QBAEScpoVLnM6Iq8Fdgrj4iRdQpjimki:Ngs/uG/5O7QBkcpoVTrEdgn4oQpjimki
- TLSH T15D53C514A7F81216FAFB4B74ADF5C047593ABA53AE26C65C248D434D0E337809663B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:1e:72:a8:9e:05:bd:73:bc:ac:8c:e0:c3:20:9b:11:c4:5d:17:53:15:1d:50:7a:51:4c:49:ab:71:81:6c:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ea:5b:ba:e3:5a:41:bc:cd:4e:e9:9c:cf:4c:58:d1:e1:90:0d:27:5c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AxImp.pdb
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/CorFlags.exe
- IMPHASH 737eed44e0e3e2f740cf6c506763184a
- SHA256 71d08b20122df9419bbc21b86e754e5e53c8bdd1cd1ba2c562450a54e936cee6
- MD5 bdf5b8b320a7273a0d04b7eeabcf49f0
- SHA1 b77f839b382173f65802e66728e9621c2dd66ed8
- SHA512 c6861bfb45d4ba0f07b8d75b9290d688d5e5438e4a37c56fcdcf70425b8714c1a1efcd7d4da78e3465f2189d9eae0bd2b71342261f2f6b539586e65d9e29e6aa
- SSDEEP 3072:VoiaiIGBdEEImASTwxm+/jjsHf3JF4z17YGPPclzi/zKOfiHRQ/A8uLMkw:VrrRBdELmjTg9rkfH017YyPoVYagkw
- TLSH T153143B4373A490F6E0668538C8D0C7A6A776B8250B3186CF52546B6FBE737D09E387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
83:2f:7a:c5:c1:d5:a5:06:75:3f:7e:1d:1a:90:bd:31:46:bc:bc:95:a5:f1:52:97:27:6c:89:8d:54:31:ef:71
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
2b:9c:cf:68:d2:c0:37:40:78:1b:fe:c1:13:d2:53:c7:c4:c6:14:2f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
35664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
CorFlags.pdb
kernel32
GetConsoleCP
GetConsoleMode
LoadLibraryW
HeapReAlloc
SetFilePointerEx
SetStdHandle
WriteConsoleW
CloseHandle
HeapSetInformation
GetModuleHandleA
CreateFileMappingW
CreateFileW
UnmapViewOfFile
MapViewOfFile
GetFileSize
GetEnvironmentVariableW
FreeLibrary
LoadLibraryExW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetProcAddress
RaiseException
DebugBreak
GetCPInfo
WideCharToMultiByte
FormatMessageW
GetACP
LocalFree
TlsGetValue
SetLastError
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetEnvironmentStringsW
lstrlenW
FreeEnvironmentStringsW
TerminateProcess
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetOEMCP
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
Sleep
GetStringTypeW
FlushFileBuffers
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
user32
LoadStringW
oleaut32
SetErrorInfo
advapi32
RegQueryValueExW
RegOpenKeyExW
EventWrite
RegCloseKey
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=173, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/FUSLOGVW.exe
- IMPHASH e6d4b494c7c8b97faa526620511ba540
- SHA256 e4fd3e973e7228419929e5ab2908bb8f2ba7b618a1c7dbf6e9a1c5bc94e60f6a
- MD5 30ba20235c77f2c02f70011c34fb0c2d
- SHA1 49dfcf90c80b0283a81b7d0aa78adc244c136c0d
- SHA512 c2d4aa4205f6dc46dd889fd3c18e67ab3c0ce25b53f688528bb39034a38e48386ba432c0c5dee7a87b681f622cfd11661c833e25e9ac2617341cd24633ed6052
- SSDEEP 3072:yzJYFWJCAGLPggaRtQDIpkkuwT81+CNCktKIaLQqG3lADFHNwy9U945OkDa41OIB:rLog0+DIpkkfT8tQ+aLQpVAtMIO4ykj
- TLSH T18D245A43739480E6E0665638C9D1C7A6F376B8210F308BCF52645BBEAE236D19D387E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
63:1f:d8:35:fb:7c:5b:32:68:de:ce:fe:82:ca:19:a7:3d:be:37:d9:94:de:7d:cc:3d:1a:1f:c0:64:7f:0d:e2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6d:ad:a1:a0:4c:84:7d:db:79:71:da:d4:a9:62:7c:83:87:cf:46:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
57124
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
fuslogvw.pdb
advapi32
RegQueryValueExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegDeleteValueW
SetEntriesInAclW
RegCloseKey
RegSetValueExW
EventWrite
RegOpenKeyExW
kernel32
IsDebuggerPresent
FindNextFileW
FileTimeToLocalFileTime
DeleteFileW
DebugBreak
LocalFree
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapSetInformation
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetStdHandle
GetModuleHandleExW
RemoveDirectoryW
FindClose
GetProcAddress
SetLastError
lstrlenW
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
GetModuleHandleW
OutputDebugStringW
GetCurrentProcess
LoadLibraryExW
FreeLibrary
FindFirstFileW
GetDateFormatW
HeapSize
GetEnvironmentVariableW
GetSystemDirectoryW
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetLocaleInfoW
GetConsoleOutputCP
GetUserDefaultUILanguage
TlsGetValue
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
WideCharToMultiByte
GetCPInfo
FormatMessageW
GetACP
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
GetEnvironmentVariableA
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
EncodePointer
DecodePointer
GetCommandLineA
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
RtlPcToFileHeader
mscoree
GetRequestedRuntimeInfo
shlwapi
PathRemoveBackslashW
StrCmpW
StrStrIW
PathFindFileNameW
StrStrW
shell32
ShellExecuteExW
wininet
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
GetUrlCacheEntryInfoW
FindFirstUrlCacheEntryW
FindCloseUrlCache
oleaut32
SetErrorInfo
user32
ShowWindow
GetSystemMetrics
SetDlgItemTextW
SendMessageW
LoadStringW
MoveWindow
EndDialog
GetDlgItem
SetFocus
DialogBoxParamW
SetForegroundWindow
GetWindowRect
EnableWindow
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=107, id=206, version=50323,
count=10, id=205, version=50323,
count=202, id=1, productName=Unmarked objects,
count=15, id=185, version=30716,
count=29, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/IlDasm.chm
- SHA256 f379efd624303e9f9535afb7ceec34438e73d5d5868b5d8c1867136546516bc5
- MD5 99137942cb2da17cabbdfe231b31ece4
- SHA1 f9c1ec751ef0f052e523a5b93562941fe97b2317
- SHA512 83ecc0eb9b0c2d1fd050ec044ef9a05d70f35aa652a51a8d4bfcd06d6d04a57136805fbaaf79d713e55d3227a6903b6ec5846f81f1441ba30efab5e564bfc00e
- SSDEEP 384:K9bgPj1gG0VQ4DfodN+FLOP9Ikn97MuffrfpT7w6iTGzq:K6Pj1gG0VQ4DfodQLOqkdRfzx7Pzq
- TLSH T1BA829E3431DB4820FB559D70AFC2A64A5555EE60BD71F9023424E2360EF2B4C73F12B9
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/MSBuildTaskHost.exe
- SHA256 f564a371a9a800df01446911c144ed527ee59b3556f8d559b1384e210ddcdc26
- MD5 59b2329778331d09b5a08f2964e4bd9e
- SHA1 a89521b9b9eb2b6fa9018c1ef38301ffc073c898
- SHA512 dc2cb734e3a50470ccb700fcc2f577e06a46ce34e13e407307d4a97978d6e54340c38f9e948c5c989054b78d9400bd102feaa1f3e56b8f1e56671a76ba3cea27
- SSDEEP 3072:s+vFrQk/NnlQgRFiWfeNLAAfpzVDcnr0BK2rUIEd7yjdVj79S:s+vFZNOgbiWmNLzpRRS
- TLSH T122F35B0063FD1A57E6FF1AB8E4B055064F76FA6BE836D31D4840A6EE1963380DE61327
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:4f:21:3b:a2:19:12:17:8f:0a:c6:1b:ec:35:ed:57:a0:da:51:fc:48:b7:d4:08:0f:a7:f5:a6:e2:77:30:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f1:35:c7:51:82:99:89:73:56:a3:8e:05:81:8e:7b:d8:de:69:fa:73
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\binaries\Intermediate\vsproject\msbuildtaskhost.csproj_1034247265\objr\amd64\MSBuildTaskHost.pdb
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/MSBuildTaskHost.exe.config
- SHA256 d6aea281c52a98c633586f0fb44641efc41f533acee10ce9322aa2d03379aaa6
- MD5 c9db610d35202b83dae4ac19c8db4471
- SHA1 919ee3f49b4e6f20c9d622a645add595352a2c05
- SHA512 ddb2e93d818344fcb87d229203b3330f2f3c9ae3d1457813f9a2b38e27183f3e39cc67fd9a1a9bcb073e896bdb7d81f581fed8d6345c75abd91b88e06e09b8a6
- TLSH T1B021AAA4E1C8BFB14F7109A77A661C64EBAD03A3684D450DB09D7A474F3699A430B132
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/PEVerify.exe
- IMPHASH 8c709d5483b1595d7a170659e58b93aa
- SHA256 3bfc496f6836e8262ed508bc05cbf7ca86f0246b0317b6e0b17bbc7507aa0ad7
- MD5 53d51690d74ab0151a1c5906fea155a4
- SHA1 2d6b034371ce6652dc37cb8aee0b4c381747b265
- SHA512 31942f384600f2580c6e42d6a70fa35ac3c21ae8026f4431ec03a7dda05b5d3f33c0e569c402f68fc99bdb93a35512b77c1202f517807768e0f5e4728414a241
- SSDEEP 6144:BL2oLyPCNNqFT+LXiXRof1kIQRrLJYWFgbkp:BaEyPCNNqvRoSxgo
- TLSH T156345B5A73A4C4F5E4628538CAD1CB96F672B8150B3186CF12641B6FFE23AD11D387E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:a2:60:3c:ac:8b:6c:73:c6:9f:d1:6d:b5:36:46:14:64:4d:84:a8:ec:f2:2b:42:23:e4:77:d6:15:1b:6c:5c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
bb:19:9d:14:40:6e:d8:16:ff:ed:e4:ad:ac:fb:6f:f3:b3:2e:a8:7f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
50772
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
peverify.pdb
kernel32
HeapSetInformation
SetEndOfFile
ReadConsoleW
ReadFile
GetVersion
WriteConsoleW
SetStdHandle
HeapReAlloc
SetFilePointerEx
LoadLibraryW
LCMapStringEx
GetStringTypeW
GetFullPathNameW
MapViewOfFile
CreateFileMappingW
CreateFileW
lstrlenW
FormatMessageW
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
SwitchToThread
GetTickCount
GetLastError
GetFileSize
UnmapViewOfFile
CloseHandle
FreeLibrary
GetProcAddress
LoadLibraryExW
TlsGetValue
SetLastError
GetCPInfo
GetACP
MultiByteToWideChar
DebugBreak
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
FindFirstFileW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
FindClose
GetLocaleInfoW
GetFileAttributesW
FindNextFileW
GetUserDefaultUILanguage
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
TerminateProcess
GetEnvironmentVariableA
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetFileType
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
GetStartupInfoW
GetTickCount64
RtlUnwindEx
Sleep
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidCodePage
GetOEMCP
RtlPcToFileHeader
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SetErrorInfo
user32
LoadStringW
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
EventWrite
mscoree
GetRequestedRuntimeInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=188, version=30716,
count=48, id=207, version=50323,
count=129, id=206, version=50323,
count=10, id=205, version=50323,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=183, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=31, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/PEVerify.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/SvcUtil.exe
- SHA256 ebd0c516b5a866a0252c30fc8eaa42d58876a44ac22e45d49a5e49467f66b1ed
- MD5 f773f80240c6e2311e808b3c0e06e571
- SHA1 ac8136c8e70a0277dbdbccc04245cc16ea744f88
- SHA512 a57ecd15263058d380d4198e632f0955741ac6b421252876d454ae456cec9b210af59871cccf6ba34a402a4ad9d3365e061823bf9e86ae0b9b5b75e70f05dfa9
- SSDEEP 3072:33O/K60xJruHvlli7/qUH+Pz/tY0+ceI46nYNh/u9ck0xcXvUerZwyegYm1/KTSf:nBGxsI46nYNs0xcX5Y+f
- TLSH T150141A3937EC1726F9FB4BB4BCB5C0014E7AFA236917E64D1998129D0571B80C962B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2a:67:17:08:44:81:14:7c:fb:fa:52:be:69:2a:bd:13:45:18:fb:71:73:53:dd:0d:f4:f8:2e:fd:09:09:83:fe
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
34:f1:1a:79:55:07:12:85:fe:be:04:c6:00:12:30:5f:07:56:82:79
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
svcutil.pdb
Name
.text
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/TlbExp.exe
- SHA256 97f595488aa88df5331096c5f8c5ba51499c23598305202ec6f0223d18c06f85
- MD5 7112bbd499e542405ec42a3bb52488a5
- SHA1 561118517c796d1ac405924e150f16cb4daa6f79
- SHA512 5a880ca58a833f3b9602bdb28146a80b6f025ecbfd9b163f7e6b8fe901a7e9db137e767eb69768eb5603799807a3bd2b3cbaf7c7802d57de24799a865ec5f23b
- SSDEEP 1536:68sTxMSqgD2LJ6lXi/KjcTGBWEc6b2G3oJaQinq:68PSFD2LJ6lXTcTGBWEc6b2G4JaQ0q
- TLSH T1BF53F6149BF84212F6FB4B716DF5C0879976F657AE25CB5D38C943880E223C09662B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0b:7b:cc:3b:37:21:63:52:66:50:2b:1c:ce:6a:a7:14:e1:16:ea:7d:87:d2:a0:d7:85:98:94:16:c1:ec:0d:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
91:a1:69:dc:f9:b6:af:71:e2:cd:a9:05:5d:a0:38:3b:0d:ee:10:f0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbExp.pdb
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/TlbImp.exe
- SHA256 76c24910eae1b750141d0c446b0fb18125cc43c4388fa66d29b0fe0da9a4e220
- MD5 acef4e9b8b39de4c677621fdf95049eb
- SHA1 4a130290334e8bf0b8f8df54ff1cd872cb6c7e95
- SHA512 0604709d84d96928687fec7c9bd57d1daed064ba335c9eaa9be3e3423a1dbc9b97f98ce97dc2c77a1eb3b73d4e8cda22e2321b2ec330d61cc031ac180b11b56c
- SSDEEP 3072:x4v7VpD9Zp5q4l0QSmcydxiC7ieldIVr61c3N07Cw5uGjsJx9BzdcOyK7f8y1Ev5:x4v7V19L5q7ytldIZ6C3NmDHh
- TLSH T120142A2567EC4A2AF6FA5775E8F5800687F2F55B2A1BD30D285817FA0A233C04672377
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:fb:bd:b8:5a:e5:63:96:0f:d5:b5:fa:ee:66:d1:16:74:da:fa:d0:29:5b:e4:ba:68:1f:4c:ac:35:47:8b:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
0c:1c:15:b5:6b:a5:d2:97:55:15:95:be:aa:bd:2c:fc:c5:fe:f1:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TlbImp.pdb
Name
.text
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/Tracker.exe
- IMPHASH b517539aa03ef87abb610ee2854c1cd8
- SHA256 5d963c4282e4886b7d45e2af6d66fe3e670988325d6c8c767f45db374c704d0c
- MD5 e75207c8611f4a259640801e4c999aae
- SHA1 14984b5d9e8a22c74e4f187595e17f2442aafd08
- SHA512 b699044d55b24247ba5df79c9fe8d45b91d9c59b5e8708f22094fded77321a7072a5eb3076d8574a422e40ff10852479a08e8a46654012feb632903d9a8106da
- SSDEEP 3072:Wq9nBVeTEle6ef5eFqPmi/Q5hF1pOujmsFxT7XcrCjDu/Gl:dlbeT1Df5s6mntzOuiMhjuU
- TLSH T11BD36C1632E850F6D8A79178DAE18A46E7B6B4B7433153CF076482AA1F637D06E3D331
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:69:24:4f:e4:41:ef:6b:1f:bd:c8:b9:b4:0d:ab:ba:48:c1:cf:7d:0e:73:fa:26:d2:04:2b:c3:34:7f:c2:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
9a:c4:d6:e5:38:a2:c5:3f:f1:b6:4d:45:3d:d6:0b:84:54:01:68:21
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
11468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Tracker.pdb
advapi32
RegQueryValueExW
RegOpenKeyExW
kernel32
GetEnvironmentVariableW
RaiseException
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetExitCodeProcess
SetDllDirectoryW
HeapSetInformation
OpenEventW
SetEnvironmentVariableW
SetLastError
SearchPathW
CreateProcessW
ResumeThread
WaitForMultipleObjects
GenerateConsoleCtrlEvent
WaitForSingleObject
WideCharToMultiByte
GetCommandLineW
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
Sleep
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LCMapStringEx
GetStringTypeW
HeapSize
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
HeapDestroy
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
IsWow64Process
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
LocalFree
FormatMessageW
GetConsoleOutputCP
ReadFile
RtlPcToFileHeader
ReadConsoleW
SetFilePointer
SetEndOfFile
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=45, id=207, version=50323,
count=118, id=206, version=50323,
count=8, id=205, version=50323,
count=120, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=2, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/al.exe
- IMPHASH 364ede3acace322dd1076fa9279da829
- SHA256 53470f7ad31a60a5f058b851f0eecb121dc1ff044d2ce754609dc1335919847c
- MD5 736b03c2b5ee26241be7d01ebf61c320
- SHA1 ad85dd06e7dd97e71f5f11492e62dc32d6341ca0
- SHA512 0d37f34c420928469793998a118d527ea775ce5619f103b37cc75fdce4ca4f9d74f4e706001bec761b0557b196adf2377b466d5b72019a6c51060f69a27ad54c
- SSDEEP 3072:8Bv+81lr0ArllqD1IPLZHTMVCD4Cu1EmoQIhwd75qW3KKvj6rVWOY39wxZQXD4Li:0v+S5lqDQpTnGGmPqwdAYKKLUVY+8oi
- TLSH T1DC246C1132D810F6F4B79638C9A19656EA76BC5A173083CF13A456B99F73FD0AE38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e9:63:7f:d6:cd:7b:ae:e4:db:d0:d1:28:8a:d8:15:34:db:d8:b8:3e:09:2a:5e:4c:6e:36:1d:78:91:a0:56:5e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:3c:39:9a:1e:2f:50:bb:37:70:3e:88:9d:b4:6f:c3:ca:4d:51:7a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
54464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
al.pdb
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetFileType
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
GetLastError
GetProcAddress
FreeLibrary
LoadLibraryA
SwitchToThread
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
CreateFileW
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
HeapSetInformation
ReadFile
GetTempPathW
GetTempFileNameW
WriteFile
DeleteFileW
LoadLibraryExA
RaiseException
HeapDestroy
LCMapStringA
GetEnvironmentVariableA
WriteConsoleW
LCMapStringEx
SetFilePointerEx
HeapReAlloc
LoadLibraryW
OutputDebugStringW
GetEnvironmentStringsW
SetLastError
GetShortPathNameW
GetShortPathNameA
GetFullPathNameW
FindFirstFileW
FindClose
GetFileSize
GetACP
GetCommandLineA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLocaleInfoEx
IsValidLocaleName
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetTickCount64
RtlUnwindEx
Sleep
GetCPInfo
IsValidCodePage
GetOEMCP
GetUserDefaultLocaleName
EnumSystemLocalesEx
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapSize
ReadConsoleW
GetTimeZoneInformation
FlushFileBuffers
LoadLibraryExW
RtlPcToFileHeader
mscoree
ord22
CorBindToCurrentRuntime
GetCORVersion
LoadLibraryShim
shlwapi
PathCommonPrefixW
PathCanonicalizeW
PathIsRelativeW
PathRemoveFileSpecW
PathIsUNCW
PathIsURLW
PathCombineW
PathRelativePathToW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
VariantInit
SetErrorInfo
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
user32
LoadStringW
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=146, id=206, version=50323,
count=10, id=205, version=50323,
count=61, id=207, version=50323,
count=147, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=4, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/al.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/clrver.exe
- IMPHASH 3a07376d2c7c5610b71b0d9a122bf39b
- SHA256 92a572073cdd25c0b487911fdad52430299d8a6e0349dbf136cdebe3630cf762
- MD5 3df1900f00aee7b9e767de9d3276c386
- SHA1 71a35be8cbc01a74edb174450a1edf3d3aa6ccb7
- SHA512 5b6bc4ee39c2db89d6b3128d76c8b8e48ac93f984db1ddbadbe8fe3cf6d543a1bf94a56953b94c26d2f11d6c0910c30d02a8a3fee882e28a2230ecf36442b993
- SSDEEP 1536:UwbG7iTd8NzuoYGszYD69kgwobfMrhd24WmnbI9uBkA:rPTeNzuoYc8kgwobkP2fmnblBv
- TLSH T186837E5822A400FAE8639538D6F1CA16EBBAF893177147CF4754829E1FA37D15E38732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d3:05:8b:0f:50:ba:09:6d:89:56:15:4f:eb:85:4d:e8:05:1b:b1:83:b9:87:64:ab:ed:25:ab:cf:2d:b1:1c:4b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8c:e0:7d:37:13:7d:fb:cb:5e:e1:30:ae:23:a6:47:77:cc:be:cb:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
7368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
clrver.pdb
kernel32
SetErrorMode
FreeLibrary
OpenProcess
GetProcAddress
LoadLibraryA
Process32FirstW
Module32FirstW
Process32NextW
HeapSetInformation
CreateToolhelp32Snapshot
Module32NextW
CloseHandle
GetCommandLineA
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
HeapFree
Sleep
LoadLibraryExW
GetEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=207, version=50323,
count=93, id=206, version=50323,
count=8, id=205, version=50323,
count=83, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/disco.exe
- SHA256 e3f437bf0475c59627ec6df7fa41770a372a62655f53cbf6ea582ebf7d06e46a
- MD5 4ba26b1bf9d687438a84df3fe72c3427
- SHA1 7adc99bae76bdfe4f6bb9f902df4c50fe9f890b4
- SHA512 c6f32bed9366cae9e0c385586b0212642158846a699e2f580c101aea3444a8e12186053f6ed0b8e5b689445c76efed2f6ebabee7e762d4cf9b7bbdb97b2ceccf
- SSDEEP 768:JPJD0SLoVy6f/IELS5c7d1ZstJI6Iq8fhHxox0iMUg8:JxzkVy6fScJgJ3ohHxy0rUg8
- TLSH T1D663E61493E84212E9BB4AB06BFBC3C387BEB5875D21D75D2895634C0C2A7C2795372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ea:01:82:46:69:d9:17:5e:75:ef:ef:d8:e6:eb:be:0f:b3:3a:ce:87:67:33:3c:03:c9:79:c7:03:99:fe:0b:a5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6f:ac:f4:b7:c8:01:c5:82:00:42:66:aa:38:b4:e2:8d:5f:51:dd:07
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:dd:6d:00:00:00:00:00:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
disco.pdb
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/gacutil.exe
- IMPHASH 1859f09c53c6a7ccf0c78b8dbd0cc5a9
- SHA256 7f25f497ee07285262b185af7434f38a21a1770c437b70df32ea61d2902c423b
- MD5 beb512a9b84f30319b01ab27448963f6
- SHA1 0a3eee699071ef0ab96207369d3c4209181a56bd
- SHA512 37af2b1b152e03b712e037e82cadc19183b32fae2a3d00c9fbd12652b94cf9d456337aa5a104e67361fa8611163df6083a8187f22daff5c135e95ba21df9d164
- SSDEEP 3072:OX46OsHdZTdvZsTy7BYqlXW7X2o2cjOWpSjQrqpiLteyLSk7L:OoMZTH8y5KGzcSwDik7L
- TLSH T101D37E6736A860F9D497853889E18A46D776B4731B7193CF026443A91F23BC46F3E332
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e6:e6:fa:e4:60:e9:9e:9e:01:41:7f:91:e9:72:c0:ee:c5:2b:39:e3:36:d6:70:8b:b0:e2:0c:90:a4:bb:bd:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
6b:30:52:18:46:f8:f4:93:91:7a:f1:02:8c:bf:a3:0a:33:1e:3b:c6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:f5:0c:00:00:00:00:00:11
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
26496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
gacutil.pdb
kernel32
GetFullPathNameW
FindFirstFileW
lstrlenA
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetLocaleInfoW
FormatMessageW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
GetConsoleOutputCP
GetStdHandle
GetLastError
GetProcAddress
FindClose
GetFileType
GetModuleHandleA
HeapSetInformation
FindNextFileW
GetUserDefaultUILanguage
CloseHandle
LocalFree
WriteConsoleW
SetStdHandle
CompareStringEx
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetCommandLineW
HeapFree
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetEnvironmentVariableW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
ExitProcess
GetModuleHandleExW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RtlPcToFileHeader
RaiseException
OutputDebugStringW
LoadLibraryW
LCMapStringEx
GetStringTypeW
HeapReAlloc
FlushFileBuffers
mscoree
CLRCreateInstance
user32
LoadStringW
shlwapi
PathCombineW
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=43, id=207, version=50323,
count=95, id=206, version=50323,
count=9, id=205, version=50323,
count=95, id=1, productName=Unmarked objects,
count=7, id=185, version=30716,
count=1, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/gacutil.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/ildasm.exe
- IMPHASH ad5fa249b30d415c373e2bb8cdc77172
- SHA256 d7a8fe9448d0a86251b5e45893fb4e367ef95f950f689a1d82a1a2aba04f48df
- MD5 66886aebf02f9339f9b74e1ea41ec1ca
- SHA1 1d88d8890e1d4c996dec4438df10a1b16bff18e0
- SHA512 d4a79f067a46a7e2d681405cc1fa56ea9521ddf566473be9ed005535b9ef9b3a0ba65bbcb268048368c3057a551fe91429160f49742a9d0422c940b7146983fa
- SSDEEP 12288:X8iPgHkKugX5Sgn03FzdS2axJBRdVJAuK+ft63FcJIU:9YkKugX5Rw3YxrRdVJAumcJR
- TLSH T152C48CA6F39842F9D426817CC892C257F6B278450B3186CB729C5A9F1F337E15E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Digest
40:10:51:ca:31:06:d0:d4:ee:3b:16:52:64:57:a9:08:7f:46:2a:ce:db:07:d8:ee:dd:3b:a0:68:9e:c5:73:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
ce:20:ad:e9:f4:66:0f:31:38:50:da:1a:73:9d:4e:97:83:3e:f5:3f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:92:4a:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
278072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ildasm.pdb
kernel32
GetStdHandle
SetEndOfFile
LoadLibraryExA
GetCommandLineW
ExpandEnvironmentStringsA
CreateProcessW
GetConsoleOutputCP
SetStdHandle
HeapSetInformation
GetFullPathNameW
WriteFile
LoadLibraryW
SetLastError
CreateFileMappingA
lstrlenW
FormatMessageW
WriteConsoleW
SwitchToThread
HeapReAlloc
SetFilePointerEx
LCMapStringEx
GetStringTypeW
HeapSize
GetOEMCP
IsValidCodePage
ReadConsoleW
ReadFile
GetConsoleMode
CreateFileW
FlushFileBuffers
Sleep
RtlUnwindEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount64
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
GetFileType
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
GetCommandLineA
DecodePointer
EncodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentVariableA
TlsFree
TlsAlloc
ReleaseMutex
DeleteCriticalSection
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
GetModuleHandleW
GetWindowsDirectoryA
WideCharToMultiByte
CloseHandle
MultiByteToWideChar
GetLastError
DebugBreak
FreeLibrary
GetProcAddress
LoadLibraryExW
OutputDebugStringW
IsDebuggerPresent
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetConsoleCP
TlsGetValue
FindFirstFileW
GetLocaleInfoW
GetFileAttributesW
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
GetCPInfo
GetACP
LocalFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
RaiseException
GetEnvironmentVariableW
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
VirtualProtect
RtlPcToFileHeader
mscoree
CoUninitializeCor
CoInitializeEE
CoUninitializeEE
CoInitializeCor
GetRequestedRuntimeInfo
gdi32
CreateSolidBrush
TextOutW
SetTextColor
SetBkColor
DeleteObject
GetTextMetricsW
CreateFontIndirectW
GetStockObject
comctl32
ImageList_Create
ImageList_Add
InitCommonControlsEx
ord17
comdlg32
GetOpenFileNameW
GetSaveFileNameW
FindTextW
ChooseFontW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
StringFromGUID2
user32
LoadStringW
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
GetWindowRect
GetActiveWindow
DialogBoxParamW
EnableWindow
GetDlgItem
EndDialog
SendDlgItemMessageW
PostQuitMessage
MoveWindow
FillRect
DrawFocusRect
SetCursor
LoadCursorW
CheckMenuItem
ReleaseDC
GetDC
RegisterWindowMessageW
GetSysColor
LoadImageW
AppendMenuW
CreateMenu
SetFocus
UpdateWindow
ShowWindow
DrawMenuBar
EnableMenuItem
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
SendMessageA
GetClientRect
CreateWindowExW
GetSystemMetrics
RegisterClassW
LoadIconW
DefWindowProcW
DestroyWindow
PostMessageA
shell32
CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
oleaut32
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
GetErrorInfo
SysFreeString
advapi32
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
EventWrite
RegCloseKey
RegQueryValueExW
Name
.text
Size
367KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
133KB
Virtual Size
132KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
883KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=191, version=30716,
count=2, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=51, id=207, version=50323,
count=143, id=206, version=50323,
count=11, id=205, version=50323,
count=265, id=1, productName=Unmarked objects,
count=19, id=185, version=30716,
count=47, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/ildasm.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/lc.exe
- SHA256 ffa352f9ea4380a4ef04c080160cd5f6663928dee609a884ae81abcb99a7cf8a
- MD5 e83f4a38d95ad5e83826f7f1a1f66a0f
- SHA1 8984668625c487cb333a415d4d198da48afc9cf2
- SHA512 95c75dae48be257d390999594c634aa42cda9d080c79dd0d92a7140ac3fa2d01ef16f6d0ee1de116aa7458a899c46d74a442992c2962d74b6d440f62d6124c70
- SSDEEP 768:zSMzuxFp27Nc8DO5O6Iq8Wg587iGdBNGa:zS+uxFp27NcQObfgG77HNGa
- TLSH T1C723E82897F84213F6B74BB0ADF5C487AD36FA53AE75C75D2889434D09227C08A5273E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
09:b6:a6:e0:32:e8:ef:ef:25:b5:e0:8c:2e:7b:81:13:a1:0c:2c:d1:ac:f9:ee:c5:d3:7b:58:1a:84:94:93:d2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
8f:a3:18:26:12:66:06:7c:a8:c5:c1:9c:25:db:68:87:ff:e7:65:ce
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
lc.pdb
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/lc.exe.config
- SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
- MD5 c002006ced9de9edddd0fbc440a33623
- SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
- SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
- TLSH T1FBC08C5946A8FD279C276F2779900E42FF3002C2A0084004F17E3B130B2608C8753312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sgen.exe
- SHA256 e218a5fca6a07f65de07c4152df2d551ee541b91c69b13fac9fbec60e8a82c69
- MD5 69b6756b81b10ccb9ba0674f548ee264
- SHA1 8f88bcb4f15e15375a59b1f35118b857e8129986
- SHA512 8db6e9b29c3cdbca582ea9af1b798c0136f42f831411d0ae4a030c4959b39269b35ef55dff2518a0cc3968a3c8d768dbef6f296d298182d0ec3fe1c28c70dffb
- SSDEEP 768:ubRwSIUjOjyET3c8oQyqCP6Iq8CUX5xxYidd8z:ERwMO33cdQRC2FUXhYq8z
- TLSH T10563C61493E81212EDB64AB09FFBC3C39BBEB6835915D79D345903490D2E7C1BA1372A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:fe:e8:99:1d:b2:41:88:6d:e3:62:7e:f2:5b:de:23:12:97:75:92:26:e3:42:88:ac:7d:2c:1d:b2:9d:3c:f6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
f0:88:e7:bb:74:fe:a8:40:f5:71:b9:a3:cb:0f:a1:79:bb:a6:0e:2c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sgen.pdb
Name
.text
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sn.exe
- IMPHASH b43e39f72141c38455537524fa7ef186
- SHA256 bb9a9594ca93e51d9f465ff68127fca1c5dfacf289be08a532da40e5c858c5f7
- MD5 b1074a14788df5c8f231027a838bc2ca
- SHA1 c2e2e1381933ed5701260f389e1df82b52e3e8c5
- SHA512 0a1a748e9ae90c32be5a9d9e9b2a01be1885e692eb95c6ce7d18872e027b2f0f857c79062e1bd65e3703cfe9f7389edca45ae7ff436c3295a5cd2670c2d04568
- SSDEEP 6144:rH9xY5bF43aCJbGsT35SD2D5b+lrdLtoInBK:rdxYlF43aC1GB2DuM
- TLSH T164343852739488F6E8264538C8D0C7E5B272B8151F35CBDB32A4176EAE337E05D387A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:42:18:8c:1d:28:0c:07:7d:54:1a:a4:24:47:be:b5:61:37:f0:3b:33:5d:3d:63:1d:21:c7:bb:43:3b:ae:7b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
c7:77:d5:d2:7c:f8:64:ef:37:ba:db:fc:67:17:78:51:ff:07:4a:d0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:ea:3e:00:00:00:00:00:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
6
Entry point
74168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
sn.pdb
advapi32
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptDestroyKey
CryptExportKey
RegQueryValueExW
RegDeleteKeyW
CryptSignHashW
RegDeleteValueW
CryptCreateHash
RegEnumKeyExW
CryptDestroyHash
CryptGetUserKey
RegCloseKey
RegSetValueExW
CryptHashData
EventWrite
RegOpenKeyExW
RegCreateKeyExW
kernel32
WriteConsoleW
HeapReAlloc
SetFilePointerEx
LoadLibraryW
MultiByteToWideChar
CloseHandle
LCMapStringEx
GetStringTypeW
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
CreateFileMappingW
GetFileType
GlobalFree
GetProcAddress
SetLastError
GetLastError
GetStdHandle
GlobalUnlock
FlushFileBuffers
RtlCaptureContext
Sleep
GetOEMCP
IsValidCodePage
RtlUnwindEx
GetTickCount64
GetStartupInfoW
InitOnceExecuteOnce
GetModuleHandleExW
ExitProcess
FlsFree
CreateFileW
ReadFile
SetConsoleMode
FormatMessageW
GetConsoleMode
GlobalAlloc
GetConsoleCP
WriteFile
GlobalLock
LoadLibraryExW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
GetFileSize
TlsGetValue
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleFileNameW
lstrlenW
FreeEnvironmentStringsW
FindFirstFileW
GetModuleHandleW
GetLocaleInfoW
GetFileAttributesW
GetConsoleOutputCP
FindClose
FindNextFileW
GetUserDefaultUILanguage
GetCurrentProcess
HeapSetInformation
CreateMutexW
VirtualQuery
HeapAlloc
HeapFree
SetEvent
SleepEx
WaitForSingleObjectEx
VirtualFree
GetProcessHeap
InitializeCriticalSection
TlsSetValue
HeapDestroy
LeaveCriticalSection
HeapCreate
HeapValidate
ReleaseSemaphore
RaiseException
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateSemaphoreW
CreateEventW
VirtualProtect
DeleteCriticalSection
ReleaseMutex
TlsAlloc
TlsFree
DebugBreak
GetCPInfo
WideCharToMultiByte
GetACP
LocalFree
TerminateProcess
GetEnvironmentVariableA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
OutputDebugStringW
IsDebuggerPresent
EncodePointer
DecodePointer
GetCommandLineW
IsProcessorFeaturePresent
SetStdHandle
InitializeCriticalSectionAndSpinCount
FlsAlloc
FlsGetValue
FlsSetValue
RtlPcToFileHeader
mscoree
StrongNameGetPublicKey
GetRequestedRuntimeInfo
StrongNameSignatureGenerationEx
StrongNameKeyGenEx
CLRCreateInstance
StrongNameKeyDelete
StrongNameKeyInstall
StrongNameFreeBuffer
StrongNameErrorInfo
StrongNameTokenFromPublicKey
StrongNameCompareAssemblies
StrongNameKeyGen
StrongNameTokenFromAssemblyEx
crypt32
CertSetCertificateContextProperty
CertDuplicateCertificateContext
CertEnumCertificatesInStore
PFXImportCertStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
user32
OpenClipboard
LoadStringW
SetClipboardData
CloseClipboard
EmptyClipboard
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SetErrorInfo
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
81KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=188, version=30716,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=40, id=207, version=50323,
count=111, id=206, version=50323,
count=10, id=205, version=50323,
count=219, id=1, productName=Unmarked objects,
count=13, id=185, version=30716,
count=35, id=211, version=50323,
count=1, id=201, version=50323,
count=1, id=204, version=50323,
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/sn.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/wsdl.exe
- SHA256 2f483df7d102648951048bd274a1d3e1aa0edc74ec9caf23c4baab03473deaba
- MD5 94d7f58c6ac2e333f67d4d32dc4d127b
- SHA1 3f0658f6f8339320d8e61f71bb38c6feba41efc5
- SHA512 95596da07781532f97199a11749ae90e61217a20b56fb008d59a64ef5b3b6b6a45138d2c444adc2ef379d7d9c12fbe34d4e1e98a16df0b8a3e07d4f100a4dbbc
- SSDEEP 3072:qYCO28rLo9YJ/bhuK3fSRbfMA97cZbCn3kTrcZweOglyRGQ:IT8rLo9YJ/bhuK3fSRbfMA97cZbC69gy
- TLSH T101A3E71573E80711F5FB0BB0ABF692C287FEB9566911D68D2C94124D0C7ABC1AB13727
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2f:fa:3c:f9:14:e5:89:d7:dc:79:e0:c7:40:46:08:26:9c:3f:42:7c:8d:11:25:80:96:4b:4b:71:38:43:07:99
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
a5:50:34:6c:a4:1b:00:49:83:1d:b7:a3:fe:e9:41:1a:43:9a:25:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsdl.pdb
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/wsdl.exe.config
- SHA256 d1e116f59c6cf832090da36f95725827a7f5edb3173cbce13ffedc4fb6b61d2e
- MD5 7033a6fa2f8a457716f6d642137cc7db
- SHA1 7a2cb4bbf68074357e450d6cd6fa9e4fcaf0ed2a
- SHA512 7b3f7532c57590f16bd79a37b66392aed73c1bb2ecb185273e229b32a722ca7a96051f419a42e1df1f28132190170625a09e5354a26773d2482fc749f15ca9da
- TLSH T1FAD022888BA8BC22CC2BAB273A614A01FFB092C290085008F17F33630F2248D0793312
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/SDKs/x64/xsd.exe
- SHA256 4f5f82d032ab09ec1c429345374d64a6acae525532a1b349a182d25ac333563e
- MD5 1d5d04263b58807df2c9feeff1fc5b96
- SHA1 cff0338da55579f74650e4d9c5b59b53f69cc768
- SHA512 2e8bc0831e3d45841ee183759076a503f9b11c7eb8b1a34e3a2c632508f1f1601b800d182f6608208ac892bb94447016652ceeae6ffb12da290d24fb72fe23b3
- SSDEEP 1536:vYfan8nrNH7alpJjucAdfYPHccoxK2WpFBVGU:9nMMlpJjucAdOccoc22F3GU
- TLSH T135930A15ABFD4205F1FB4F34A8F5C0625A7BBA166D31D75C189D928C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:ba:7b:98:21:eb:67:54:d7:3b:64:28:b7:b1:f1:ea:77:4b:40:01:31:6b:15:75:44:be:c6:03:e2:e7:bf:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
b5:1d:ff:45:19:ad:ee:f5:f3:e0:98:3b:72:19:79:02:35:be:ac:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 4, 2012 - Dec 4, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:c8:30:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
xsd.pdb
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/IttihadRAT v1.2/Tools/SDKs/xsd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a20c0479bfd55ed5680d4652d86944d1282fd135994669012e3047628e8844d3
- MD5 e885af77cf8dea8a891f14b5eef4a400
- SHA1 28b570055dbad10778e062245131622480beb141
- SHA512 c0ca5210cd273d72eb4639072034bfdc9ae19ba239dbe53b1eb1748f541fc43c8282f6c024da98ebc7602f60ab067fc2c1acb73ee764e4cee8c1429f19d719e7
- SSDEEP 1536:tYfan8nrNH7alpJjucAdfYPHccoiK2W+OD70GeQ:jnMMlpJjucAdOccot2NOD7uQ
- TLSH T1FA930A14ABFD5205F1FB4F34A8F5C0625A7BB9166E31D65C189D938C0BA3B80C852B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
17:32:7e:01:07:d4:f2:ab:9c:5b:1c:29:8a:88:dd:11:a6:14:e3:ff:80:92:43:7a:74:5d:29:61:e8:13:ed:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
75:18:fb:16:70:1a:b0:99:65:a6:5e:c0:31:39:79:f5:99:61:3b:4a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:12:e2:88:00:00:00:00:00:20
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 20, 2012 - May 20, 2013
Minor OS version
0
Major OS version
4
Entry point
79038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsd.pdb
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/SDKs/xsltc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a9fda11778afc8d4517e89afa36159aa5f4fb971d677ad7fa4b78b824a48ca2a
- MD5 a7239515201dfe38668bf54bd16de93f
- SHA1 b31fe9a9e53dfc939a1c0542de0589ad902cf230
- SHA512 35ac063d062843038c57b03dc2938d19bfcc2656f361c95e7e8f8b8f2f30d11cd3063c21eac8b31648ef9d93b8ced6d582097ceed7a84ae83e3ab36803d8028b
- SSDEEP 1536:nIuzQF3kgdNtQLXWGHAOjoa/MACRB3rZh:nIuzQFUgdNtiWGHAOjzELRBbz
- TLSH T1C0435B55B7FC1213DAF70F71AA7591420F3EEBA32922E52E2888D19D09133C887217B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:99:f3:d5:39:4b:b7:49:96:8f:55:e3:f4:cc:27:12:e2:99:a3:36:eb:5c:89:b6:1b:89:ba:c0:be:af:96:58
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
13:b6:ea:45:8a:b1:ec:59:38:98:31:f0:d7:78:69:6e:87:f0:00:42
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 26, 2012 - Oct 26, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:02:8e:42:00:00:00:00:00:1f
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
50110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
xsltc.pdb
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/3rd-party.txt
- SHA256 6cfbe8553463d2056029563beb188bce1bec4c5d56ad79ac907b52f61e70fd82
- MD5 b9b2c78a4a5a31e52ae7116d72dfe616
- SHA1 5d3f5b4a6d0a53e5f49b04ad1646d1bb11982c20
- SHA512 db879236c444a2b70383dcd4870a231819fc783caed378bce20bf9eb70e67a2f1ae25ce2303fdef9d0cd39200fecc8af6a6c05079c4de6e50503df8282962e3f
- TLSH T1C8F05971024A41DA0D644F58C0A9C385F369258FD716FC8C397E5138E7B4E9243DF04D
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/DllExport.1.5.2.nupkg
- SHA256 618e90213655c042c966673d95648b4b152dadd4c4874c4e193df018f6eda05e
- MD5 fa0463eb37f30431e785112bb3bfe293
- SHA1 a4f042abe3bc9f6e162aeab1969347eef590495e
- SHA512 269ef668f8451dd6c67e1a53ddb73163bcb3389b247e78de941f633a1e75df72a3c65b98fa5bd8d5dcdf9df944f67fe3ecd0f786945fd45eef96b9bdb39323ee
- SSDEEP 98304:gekPhpW1Q7lk4GBi8ZL8ny/V8DO3ihMO2AraYcrGrAd:shs0lk4GBlZgy/V5fsW+rAd
- TLSH T1F20633CBCE49B9C2DF15517A429CDEFE76CBCBCD2380499F831B199101569E80AD37A8
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/License.txt
- SHA256 ff80d40f93f7f62756bc0ce65a47b2e44e4328ca49534c6ce661dcc24e4aba36
- MD5 fc189290a4a863ea831be8ed1123f18c
- SHA1 8fb97b2015b38ede68b5a85cdd0b299f40b7d78b
- SHA512 f54fca9255308039712de28cd763551ab70eff0a5cc822795c90f5b220a91799e87204d72fea4254db64d341492baebaf5e81e1487f5811899e8f786d886f83d
- TLSH T17021A30EB29907621C42536256AAEC86F12FB05A7FAF1E85702EF3495326448D9FB854
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/Readme.md
- SHA256 64b1179453be7d51cb7cbdfceb6dc2a122c7e4d604e557b55e27d82cda209814
- MD5 c3b8507a7b4deab8b7537b808def50e7
- SHA1 d230417dd9acd71c920789162ea9dca044de9119
- SHA512 522ac816c553b1e1eb41b6406fb75c360ae687d7b7e54b8974b3d75f04d5a0a9bfa661e6a0c61a178da9a1c43dfe5da79434403a5370b53098f1583be4c33f63
- SSDEEP 96:j8Vd7N0azzOT7xo9qF3xFvLV9BbdrRnij9jnNdd52X/qZgNoKteRKahoq39HoQmF:4x0aHS3x305Q/qzKA0Rciblj
- TLSH T109F1A5AF0B0914CDAF12599B6B44F1E9EF13421BADC1D8B878AD4334F3DA16501BBA48
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/changelog.txt
- SHA256 3c6a0254f0f9f7b8733dc8498cbc64f291a690d6326a9849d325e54d3b9cd594
- MD5 1a9769ba9b6276dec1f6f8da710254de
- SHA1 866e8c975baa63c6b1f7ceddefc43010b28eecfc
- SHA512 bfb746dc5787132c37a0c9c29de7222686d6b3574211e83bb70595f2c577cc9805ab650150cf0786e586977495ced7d853d7cd7c82c6c46b38e5d42771ba0db9
- TLSH T19581722A56C151EE1AB306B2275DA560FB77110FE743ACC8B44E433C3F76B844697A35
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a2ee2037a59920bbc2f8c942e25ab71448d64d5d1d38dd358257aaac1bf2c5c0
- MD5 e37edd3c83ac1c3d35b5cd73fabfd93b
- SHA1 082a588b197b4f2d10193f8eba565c96378d48c5
- SHA512 e0f18fa36a0feda4e814faffa4a3e47bb5d0e827cf48a2a7513d1c4f940b186e4e40803d5d4d4ba10e9cc5e582cde7e53376838257e42eef5a7e723bbc938390
- SSDEEP 48:6gdGASB7rEr0Jd6tzif2HJKubOrPhBnueJot6Ut/MogqkNXTw:EAy7rzJkef2jOuckrk
- TLSH T18B91622267AC07BFFCBB4B35BEB3934112B5B610DA13CB6E4D8216165C267644C22AA1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.ddNSi
- SHA256 683a4fe842732bc2e5faf03b4c999a51fb07be8bfbe4579c355677d4c1f1d282
- MD5 196488e18bb1d3d1eef97cb0618372df
- SHA1 0d04ba96799b214acd726657662c575c1f48981e
- SHA512 3f117c5b7c34d59388bcc7e41a7166296ae825b4e48b388f647d36a6223aee3cd3e1f336d40ff7b2a72c364b50ec72438991b686a93531b1838406350ed13f91
- TLSH T1A9D022D07F006489C38680780460A8E113FAA0DA4EF4920F30C8220EAC43A376F52451
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/lib/net20/DllExport.dll.raw
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 afe62d5447c2961d89b763fc60380744df38e785f4a386d61556ac0138e70c1b
- MD5 b5e099f5aa58eb62248d02eabb633f65
- SHA1 d447c68f05d70f36cad9e4955b35e9d8bc03947a
- SHA512 0e0e1d0afa2154cdd2e47803162abf44155ab810481766c5bf2be04d28e270314c969c2d2d7b46ad37c890a7a93376de27da0a17a0667a727efb79b2c4ad2cab
- SSDEEP 48:6F1S+014jrjWmqghYhPhjhcuR8SFMDfqKOrPVzu7KysYt6Ut/MogqkNXTw:Mh0OjrykMZdcuRGku2Zkrk
- TLSH T1BAC17422D7A803BEFC7B0B31EE93B74215F1F5158BD3DA2A05811B4B7C267145922B64
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Metadata\obj\Release\DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/DllExportCmdLets.psm1
- SHA256 185b42f00826a38260a51601c8fa87a3af78f19c682f2dbd216deaf7b8605ab0
- MD5 1b821fecb7745515c13825f641eed70a
- SHA1 c627bd27393f7225c5ba57c193f0dbe403ecc963
- SHA512 bf57c8932824f4f9fd2cdabe6fb9e4231ec63a0a2c219927e1ddcf52b021b667ee60c044c85d3665c9be0bea269121482773047188ac8de8972862b6c4a02312
- SSDEEP 96:d2qHTUeaEnqOAzgTuUPUzVt+ZYRJTdPbm4eSnzyxB6/E5:MG9aUDAouUPUzGZCJTdLeSnzyxB6M5
- TLSH T158B141527B05E6C1BBF35766DA42DD49FD4A143701659528F0ACC2C62F32E14C3F2EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Framework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d83b3daa7fc17c7361c8c205a76f92e0d6a881c80375fa518662ceb386af1b4
- MD5 ae1d4372a93befe78284457a0e2d2c94
- SHA1 4f6097cf6a2cfbd1ec9257dc01ab6d34bbf8a4cc
- SHA512 d06e8395f4d077b9341d5210ea86ccef1eb4f9c7c7177de39dd8bd689f6d448b7cdf84d4a1abb6233c73864ea5658df55c69d08ad8903495bb8a3ddd24134e0c
- SSDEEP 768:9v3pyNQdgmg72Ger0Gb1xB1q2aEmPc4YSad5BKMi2jXHUttH:p34NQdgmPGNMLs2ePcYyd9rHUr
- TLSH T17F131A182785CEBEEDB90E74FC6056352731C386F826C71B5764B5AC64C238F66E2A48
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
17:2d:e7:d0:2d:52:fd:a6:20:2d:22:71:ee:22:7c:2b:29:66:27:19
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
42622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Build.Utilities.v4.0.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7761b1955c5a0822ddbb86dfed6801d952a6c65281e6d29c65265285096b01c5
- MD5 0015d9b1cfb6abc0bb8c59aa1849abb7
- SHA1 eea52f295115c4b2152f5f4635477fd0a1e6e336
- SHA512 739b5adb8bcf577ee95a5a45f2a92df24de71ae0452c4b434b17f5646a6925344d9d718b4149a124ed7cad29c78cf9347d780196d080a99c80e06b7dd0363fd0
- SSDEEP 1536:jcXfve+YEEYBqqTU6qNScWXqS7ScM6Nnqj+R8KEOv1hL6THlZ0Nj7BTWWYKVN+RH:w3e+YEEYBqqTU6qsXasScMry+KEOv1hm
- TLSH T1E193D70563FC0229FEB71BB5BDB541190B77FA966923C75E1000125E0B72B5B8AB2B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
99:6b:ca:86:0b:d2:4f:9e:29:f0:66:22:58:b3:7d:6c:db:82:07:7e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
2e:ab:11:dc:50:ff:5c:9d:cb:c0
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2007 - Aug 25, 2012
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:01:cf:3e:00:00:00:00:00:0f
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 7, 2009 - Mar 7, 2011
Subject
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 16, 2006 - Sep 15, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:a2:30:00:00:00:00:00:08
Issuer
CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2008 - Jul 25, 2013
Minor OS version
0
Major OS version
4
Entry point
90162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Microsoft.Management.Infrastructure.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbec9a910488cadbad860c850ceae521a2a346619c5a9da579e5051e270f114c
- MD5 3998804194188c25df75f505ac5c531a
- SHA1 6b15b2d779e7c46e31fcc864fc1ef326fb3d2b50
- SHA512 d7cd7457c753190fd1ae5386a62dffbe5907ace02227ef873f4c890f4a4e987914fb94ab1ec8318f48a76fc55cfe8e7de83b75cfcbec0bb8ff0e18d2d956abdc
- SSDEEP 768:droEzop6gC66+666M66666+vvvvvvvvvvvvvF66666K66n6666666666ZpkLEyXD:nNLEyXCL
- TLSH T1D9F2E8C24341D52ECDEB92BAF0D512E02339F34D67539B0BA718A01EA95FBAD7307A45
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4dfe61f79efe3a8e686a2f045f372476c5fec704ce3015c24608c84270b408cd
- MD5 dd97f2c3467656a5eaccb0ab679dbbb3
- SHA1 b11b247f96054fa0d2eaf52f080b0c759e0b6ce6
- SHA512 162a403dea6cca3381d4b8854057814178c858ad7a2a4c9ad0bdd8bd77cc25497c286832b7aab804a708fa927c2347ca925afcb3cb08fb870c711e080d72a4fb
- SSDEEP 6144:9F7O4dMG5Q4RMYAkUSHzqu4OJDW4i8BO:7OvG5Q17VOJ28B
- TLSH T195447C1627AC5ABFD7CE8B3BE0409A1AC2F8C05E724FDB419CD8D5F92C277959910263
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
273358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\net_4_0_Release\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/NSBin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c39024083771329805ee9e30c3529397e39eb98174cd4dcdfab62442bbcc7ef6
- MD5 0a3ed8a4f354f7516c91f68cfb1e4ece
- SHA1 5a569a08427b66237b20ba90d12efcaa7fca9e80
- SHA512 21293b72bcda196ebcda5430e04f67948c5a99b19d1126f495d1f352c47f02d1aeeb7944f61b96e3765b999774266df209494649f856e68426a4bd1e1ac60f3e
- SSDEEP 384:ZqY1VhOF+5avamTEDbrXSS8yAF1KWNftgpl:RDUF+gvamniU1KUtIl
- TLSH T1E462F6002BF8832ACBBF0B3978F3565106F1EA05AA33C75F1964F4571817B5906B177A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\NSBin\obj\Release\NSBin.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/NSBin.pdb
- SHA256 540e4b28a65346f82a2a4e699d09475e6d7fd6bd603e483675c2ab0243f7e210
- MD5 1c3ef4be1c1a17390a655d328e40f363
- SHA1 30ad53e3259a36b144b21a74752c978b94661764
- SHA512 763dbc54b82de4831c3fc173dce084b8d8d50553afab4c4632d901b3266826b210d0a05adf874fb850103dacdb80e42a43ef6c653db55e9472573e5d4f30993a
- SSDEEP 192:DAoA0AsLATAwAhAqAodOgR1kjxs8Pg2cl64LIkJWw9wd66sn/lGfREhSbPy8eCsL:NDBcx4HYmihy8zV5AjZnZ
- TLSH T179032017FF40DA32E46981347AEB8F2D47B5EC8C9B81975F6345B1683CB23A92D82354
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39faf6e347ac0c31c572193dcfb2d61b7a3eb184b29e8b1b82f90917aec599ef
- MD5 2dad575e994c4ec82023c903c8f89404
- SHA1 14eef09004f1e0c5d726a25a3b74887b3098ef42
- SHA512 c54f0c1b67dab869507b7918df69032af6b3f7186ef38b07603effb67c4a991fefcf9890cd26c071589f1f0399ab2b8db54c5983f0a9ac66a1a491fbdd5f0f01
- SSDEEP 768:TMaXJ/C/iKATxUnlFL5JL3vv1FfmQ91hv/nDE/TV0ZXwtr84ZJ+LZkKZjk6ZH4tC:TMzbAT6lFXZBmQ91hvg/ReX8lZT8/
- TLSH T1F7431904BBE80534F3BB2E7BB07154944F35F787AD12EF5E6891A49E0E527011AA13AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport.MSBuild\obj\Release\RGiesecke.DllExport.MSBuild.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.MSBuild.pdb
- SHA256 929d7c913329c6705f2be9d8d65abf522a38c5f3852c2674709936bd94baba8f
- MD5 610b0b6619fba7cf145e0e83aa889638
- SHA1 638dc3fbd365267f941f10b3196baaeaafe2edf0
- SHA512 81cd6c71abc35ee9a09f1824bc0d9304f0810298accad75063b52a811d7df9148ab9764114153649b8a70e539ea49b56fc0fc547b2d3d1603533a784702aa869
- SSDEEP 768:uTIHnYYZOT/pVRFk12TfPD1fY/lo0R8A8HEQq5q:uTIpZOPRk6BfMlFj2EQq5q
- TLSH T1AFC38257BF14CA72D81985386EEF4B1E0638EACD4B43979F9706B0683EF23761C86254
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04fffee97413dd15c7150fce8c2ec4eb6ba668a919e2aec7be8b44da3cbe19dd
- MD5 76f1a829fe3a0e01490bf68c9a0e96ba
- SHA1 780653b5edccdfb13707673f9b73e8addac4ca01
- SHA512 ebe62260807c58fe1691095ad7745ae6b021818feb963bafa722f09522df33a4576e7eea18d55950248df7c8e0378fbb61007097471b0d3442d8705cccadeeb5
- SSDEEP 1536:AJdpmcyf4uxDoNj8RrewhfVI/j12m6fz9w37vPRnUwoLSE+jHgAUqn:AJfmjguxgQreayH6fzs7vZnUwpEFPqn
- TLSH T159935D2527EC4A69F7AB0E39B8B560120FB5FAC62403EB5D4E44789E1D233418E72777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\RGiesecke.DllExport\obj\Release\RGiesecke.DllExport.pdb
mscoree
_CorDllMain
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/RGiesecke.DllExport.pdb
- SHA256 3380f7127b016409a0b73aa5c333df308abff9b01d51761e881fba4c04e2f1e8
- MD5 1667a09c0b87fb46b0fc8a3176d6e88c
- SHA1 519b62a38104345d05efa0e8f2ea5c01537be5f2
- SHA512 39f784f84a6ca8111dd4839f7bd2fbed9e9670c5b6cd1fd617aa884b9cc8bab54a198f60a43ff10a09156890bc800f70d72c747e92224497b564e56dd67594b2
- SSDEEP 1536:DlZJBMr/6JOw8NvX22Of2TqGcHdgXZguegKxmuRnUNLEAIc+787uughTF+422z7D:DFBMr/vtYfrWyufaUNw78arTZ2UD
- TLSH T156348417BF44CAB2E46A85392BDF8F0D4B34E6884F42572FA785B12C3DE23551D872A4
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/System.Management.Automation.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3a5868584a777422cebcf31d6718fd2b26d5e2314d3b5ba6d8e47aa40faba0c
- MD5 835e9ede7e7c774e7a2d56cfdf6e9b17
- SHA1 a43ed886b68c6ee913da85df9ad2064f1d81c470
- SHA512 74284fd44497beb74326d11a0f63d96aff20aa44cfa8385f6b63b7e6743403c36e2ea4fb0d991767117a97d320e04d2b21f0a4730916244af4ffdaf51e834a26
- SSDEEP 3072:d/SDqTIE+QQVVBCTmAG17iT+Lt8D/1L2iLZdrs81sDotEKjRmarzRm+5gSBZqoEJ:d/PXS6WK2iLZdgotEKj9rzRmkgSBAot
- TLSH T1377408253764DBAFC8AFA276F96544304637DB183922C72359182D2C59CF76BBF12382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
359678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
344KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/LICENSE.TXT
- SHA256 119ff5570dd386f9db9878c0fef47d29aebcc6814a3753ccea8eebd9f65ec852
- MD5 e407a499be3c99b945b783bdea9f13d2
- SHA1 005b44116bfa6323283296cc059b0ed10bd8bb56
- SHA512 e497eed62cee874771a80c0bd83632954f583799d97210a6dc28b5d97304fb4eb37655116fa53949ee709f5de8bbb02426a0c1845d8532d739100b54a1536bcb
- TLSH T11E21931E7256036218A2476145A9ACC5F12BB15A7E6B0985206DF209132A058CAFF868
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/PATENTS.TXT
- SHA256 28aaf37474f9d460b44c5f45001784540f68df3d27c24f04c103542d8d3d27ec
- MD5 c40c5ddda4168114579a752f75561bae
- SHA1 24d97511a8b0f32ae3ed2ab662d8618ca34a7c24
- SHA512 fb439acc8f4136cc6e0f735b905809abdb81e4e034c47b70c62c9cb88bc5633d8ca93bc452e1d298ccf68dc7beabed1c0d94f0a09149f96af9686a4ee3641e5e
- TLSH T11E5173AAAB4E5253CEF14293615638C4B32EF05E7F76585024AC001CB367B7A433BB1D
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/README.md
- SHA256 3319cafc0d27de589d831969161089bb80b0300d4bf06624c338823cccbfd2ce
- MD5 59097c1b59d7a3ba19cae75d0b0e41e5
- SHA1 b77a5d3291d4324fdafe9b0931e01abc506a9df9
- SHA512 cc72f68059782690852a150e208ac036b8bdb5d49a18ff56634198d599f0f004615526b923f003fa750dfbc649cae206708900a040bd3bbb30404f4170c65693
- TLSH T19F01DD114D1DD5E21BE2E1E21048A9BECF4AE4446AFB28903C9E411C23103CB46EF329
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/_Version.txt
- SHA256 5fd7d8d04ab51112c09404a09e4ebc6bdf2d581301867c6ca3fbc96d1de396e7
- MD5 27afea6aa7c8f8dcdb8bbd61ee810eec
- SHA1 9b8cc9df02992ce2049535333bef53eb64c4b14c
- SHA512 08d72ec35b4b0fa9135d9394d8f024d3949d9b39c65b9f0e8f6c17ea87812e85b23af6150c2356de05d28d663a9a51e2dbfde7f948aac7e33d431c8f0aa5cbb7
- TLSH T199F0978F2C371689C1F3D301B64A0728FE9C130CCB41D84A341D0024FBB7A97385DA06
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/changelog.txt
- SHA256 7de8201e673498edf93c22c8a00ad699a2fd922e76895af7b92c38f9991c7855
- MD5 d121612a9fb3a8dd2a58dac73ed15c92
- SHA1 b74c23372477a535bb3e7d3115fec84129a18a40
- SHA512 d228dd79ac061824ef88ff77d71f334351f6ff8852e8ea17c94811da18bfbce6ad49c371b510ac11fc5008b0d9149ee847bcb60bc3b9f5ebfd30681afd522bd5
- TLSH T1691127838C1A506A5A71E3935AC97606E925020FEA873C8CBD6C1339AF79F4116DFB48
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/coreclr.dll
- IMPHASH 4ec23ad5e3f71ff3322a6bac0917b9bd
- SHA256 611784b6c322814f1a1cc5dc29bf966d31146d277c9b115ad208b221071fc0d9
- MD5 cedc881566715873534c5d8fec3ca48d
- SHA1 e4808ec9da3aff012331997a5c5c1661d5399d00
- SHA512 693003053b6f8d5a8db6f0bd7bb3ec780fffbfcb870130642e8c2bc6ee5c0908a0e6a839c23715aef8ba38a27d517140e73c54fe22caf0e1bc4894ebc24306ec
- SSDEEP 98304:wNi1VdVSf5bm7Nz0XOlWJHxINuN0jI5aTpV8Ymg:wNi1VdVi6Jz8OlWJR6uNuI5r
- TLSH T178069F31BAA5803AEA5F1231593FA64E94E972704B3100CBB2F49B1E3EF54D33639657
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb
kernel32
GetSystemTimeAsFileTime
RaiseException
FreeLibrary
GetCurrentProcessId
OutputDebugStringW
IsDebuggerPresent
GetProcAddress
DebugBreak
TerminateProcess
GetCurrentProcess
GetSystemDefaultLocaleName
GetUserPreferredUILanguages
GetUserDefaultLocaleName
GetLocaleInfoEx
CompareStringEx
CompareStringOrdinal
LCMapStringEx
FindNLSStringEx
GetCalendarInfoEx
LCIDToLocaleName
LocaleNameToLCID
EnumTimeFormatsEx
EnumCalendarInfoExEx
ResolveLocaleName
GetThreadPreferredUILanguages
EnumSystemLocalesEx
GetSystemInfo
GetModuleHandleW
SwitchToThread
GetProcessAffinityMask
FlushInstructionCache
VerSetConditionMask
VerifyVersionInfoW
IsWow64Process
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetErrorMode
CloseHandle
CreateProcessW
GetCurrentThread
WriteFile
GetStdHandle
GetConsoleOutputCP
GetLogicalProcessorInformation
SetThreadLocale
MapViewOfFileEx
UnmapViewOfFile
GetTickCount
QueryPerformanceCounter
GetStringTypeExW
WaitForSingleObject
GetTickCount64
CreateFileMappingW
GetFileSize
GlobalMemoryStatusEx
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
ReleaseMutex
SetEvent
ReleaseSemaphore
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
CreateSemaphoreExW
OpenProcess
SetConsoleCtrlHandler
GetCurrentThreadId
GetVersionExW
InterlockedPushEntrySList
GetThreadContext
SuspendThread
ResumeThread
SetThreadContext
Sleep
FlushProcessWriteBuffers
QueueUserAPC
VirtualQuery
QueryPerformanceFrequency
InitializeSListHead
InterlockedPopEntrySList
GetCommandLineW
RaiseFailFastException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
DuplicateHandle
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
SetThreadStackGuarantee
GetThreadTimes
VirtualAlloc
VirtualFree
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SleepEx
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ResetEvent
GetThreadLocale
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
ExitProcess
SetFilePointer
ReadFile
GetProcessTimes
InterlockedFlushSList
GetDriveTypeW
CreateMemoryResourceNotification
RtlUnwind
GetSystemDefaultLCID
GetUserDefaultLCID
GetCurrentProcessorNumber
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
ReadProcessMemory
lstrlenW
OutputDebugStringA
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualUnlock
ResetWriteWatch
GetWriteWatch
SetThreadAffinityMask
MapViewOfFile
FlushFileBuffers
GetLocalTime
GetTimeFormatW
GetDateFormatW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
FindStringOrdinal
GetSystemDefaultUILanguage
GetLocaleInfoW
IsValidLocaleName
LocalFree
FormatMessageW
WideCharToMultiByte
IsDBCSLeadByte
GetCPInfo
GetACP
GetFullPathNameW
GetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleFileNameW
CreateDirectoryW
GetLongPathNameW
GetLastError
EncodePointer
GetFileAttributesExW
GetFileAttributesW
CreateFileW
LoadLibraryExW
SetLastError
MultiByteToWideChar
CreateThread
ExitThread
OpenEventW
LoadLibraryW
LoadLibraryExA
advapi32
SetKernelObjectSecurity
ImpersonateLoggedOnUser
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
EventRegister
GetTokenInformation
EventWrite
SetThreadToken
OpenProcessToken
RevertToSelf
OpenThreadToken
RegEnumValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateGuid
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CLSIDFromProgID
CoReleaseMarshalData
StringFromGUID2
CoRevokeInitializeSpy
CoUninitialize
CoWaitForMultipleHandles
CoRegisterInitializeSpy
CoInitializeEx
IIDFromString
CoGetObjectContext
CoGetContextToken
CoGetMarshalSizeMax
CoMarshalInterface
CoUnmarshalInterface
CoGetClassObject
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SafeArraySetRecordInfo
VarDecMul
SetErrorInfo
CreateErrorInfo
SysFreeString
LoadRegTypeLi
SysAllocString
SysStringLen
GetErrorInfo
SafeArrayGetVartype
VariantChangeType
VariantChangeTypeEx
SysAllocStringLen
VarDecCmp
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayPutElement
VariantClear
VariantInit
VarDecFromCy
VarCyFromDec
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
VarDecRound
SafeArrayAllocData
SafeArrayGetElemsize
SafeArrayGetRecordInfo
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetDim
SafeArrayGetLBound
VarDecFromR4
VarDecFromR8
VarR8FromDec
VarDecFix
VarDecInt
VarR4FromDec
user32
LoadStringW
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
shlwapi
PathFindFileNameW
bcrypt
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
api-ms-win-crt-string-l1-1-0
towlower
wcsnlen
_wcsicmp
towupper
_strnicmp
isdigit
isalpha
iswascii
_stricmp
strnlen
iswspace
iswupper
strcat_s
strcmp
strncat_s
strlen
wcsncat_s
wcscat_s
strncmp
wcsncmp
strncpy_s
strcpy_s
wcsncpy_s
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
fputs
fclose
_putws
__stdio_common_vfwprintf
_flushall
fflush
fwrite
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vsnwprintf_s
_wfopen_s
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
_wfopen
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_invalid_parameter_noinfo
_errno
_configure_narrow_argv
_controlfp_s
_initialize_narrow_environment
abort
terminate
_initialize_onexit_table
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initterm
api-ms-win-crt-convert-l1-1-0
wcstoul
atol
_itow_s
atoi
_ltow_s
api-ms-win-crt-utility-l1-1-0
ldiv
qsort
bsearch
api-ms-win-crt-math-l1-1-0
__libm_sse2_asin
_isnan
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
_copysign
__libm_sse2_atan
ceil
floor
__libm_sse2_acos
_CItanh
_CIsinh
_CIfmod
_CIcosh
__libm_sse2_atan2
_except1
__libm_sse2_cos
__libm_sse2_pow
__libm_sse2_sin
__libm_sse2_tan
modf
_libm_sse2_exp_precise
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-heap-l1-1-0
_free_base
_calloc_base
malloc
free
GetCLRRuntimeHost
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
g_CLREngineMetrics
Name
.text
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
91B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
650KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=206, version=65501,
count=17, id=203, version=65501,
count=422, id=1, productName=Unmarked objects,
count=23, id=259, version=24123,
count=33, id=261, version=24123,
count=18, id=260, version=24123,
count=6, id=259, productName=VS2015 UPD3 build 24210, version=24210,
count=385, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ilasm.exe
- IMPHASH ced05e986d6b96987cf3863cf7e57f3d
- SHA256 cc7593007ab383579584b2cb9f3104a316e8f75b9b4b7daa334daf8bf4aaa401
- MD5 755781ba89b1841c7a542ba09c6b359d
- SHA1 0b1a7051ffc05617cb2572e90b1deb60ca8d84a3
- SHA512 4a96bc40c42a89e056594b528ee0dd5ca7596333156a9b4cb06733917d5789366b3eaae5dcf4db98f7668967a52a195b4832fb2666d1cce14eac77c30569e0ea
- SSDEEP 6144:p9gIO4gkniw89wTXb8Jy6nudUunD2mRYZD6zsw2kGfjqoAu:TLOX5wrTXb8Jy9b2mRs6zVoA
- TLSH T154749E217F47403ACE7303364A96A73562BF50215F6503CB33DCDA5CAA742E2A67D2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
198528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ilasm\Release\ilasm.pdb
coreclr
MetaDataGetDispenser
ole32
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
IIDFromString
CoTaskMemAlloc
oleaut32
SetErrorInfo
SysFreeString
SysAllocString
CreateErrorInfo
kernel32
GetLastError
CloseHandle
GetFileSize
GetFullPathNameW
GetConsoleOutputCP
SetEnvironmentVariableW
UnmapViewOfFile
GetBinaryTypeA
DeleteFileW
HeapSetInformation
CreateFileMappingW
MapViewOfFile
GetStdHandle
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryExW
CreateFileW
SearchPathW
GetModuleFileNameW
GetTempFileNameW
GetTempPathW
GetEnvironmentVariableW
FindFirstFileExW
GetACP
GetCPInfo
FormatMessageW
LocalFree
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FlushInstructionCache
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
SetLastError
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
IsDebuggerPresent
CreateProcessW
GetCurrentThread
lstrlenW
WaitForSingleObject
ReadFile
GetExitCodeProcess
WriteFile
SetFilePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
CreateSemaphoreExW
advapi32
SetThreadToken
RevertToSelf
OpenThreadToken
IsTextUnicode
user32
LoadStringW
shlwapi
PathFindExtensionW
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fopen_s
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vfprintf
__stdio_common_vsprintf_s
fread
__stdio_common_vsnprintf_s
__acrt_iob_func
_wfopen_s
__stdio_common_vswprintf
__stdio_common_vswscanf
fwrite
fclose
api-ms-win-crt-string-l1-1-0
isdigit
wcscpy_s
_wcsicmp
strcat_s
strcpy_s
strncmp
wcsncmp
strncpy_s
isspace
wcscat_s
wcsncpy_s
_stricmp
api-ms-win-crt-convert-l1-1-0
wcstod
atoi
strtod
api-ms-win-crt-runtime-l1-1-0
_set_app_type
exit
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_controlfp_s
_errno
terminate
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_c_exit
__p___wargv
__p___argc
_get_initial_wide_environment
_exit
_initterm_e
_initterm
_configure_wide_argv
api-ms-win-crt-multibyte-l1-1-0
_mbsinc
api-ms-win-crt-heap-l1-1-0
_free_base
_set_new_mode
free
_calloc_base
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
227KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=206, version=65501,
count=16, id=259, version=24123,
count=39, id=261, version=24123,
count=20, id=260, version=24123,
count=12, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=240, id=1, productName=Unmarked objects,
count=51, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasm.exe
- IMPHASH 04376759df9b9515a9f9fabe4dd97d99
- SHA256 1847a66b7a7ae14269589e7648a063fbe741bf172ca73b484ac6d72c1e72287b
- MD5 c80200ca7ee6db914ee94994ad4e7867
- SHA1 75e69c145b2a1b9f61710a4fdb44f2f4cea00c5e
- SHA512 a6124dda96de3792de50df82c7b7148955793a6789276db7ad8272c895203316236e242db16830a12129c186d513efa18249f8a15f227c3ffa063c0abf6d06a6
- SSDEEP 6144:kZhtoA8d2CkbjmqcqOovby/Q2cxBRuaybMpjk2xc:MHPs2vbjFOS2UBUa3c
- TLSH T147748E15FB20F436C89201B3874AA256E4BE69707F434287739C5BDCAB753D2A62C71B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
220720
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\exe\Release\ildasm.pdb
coreclr
MetaDataGetDispenser
GetMetaDataPublicInterfaceFromInternal
GetMetaDataInternalInterfaceFromPublic
GetMetaDataInternalInterface
ole32
StringFromGUID2
oleaut32
SetErrorInfo
VariantInit
SysFreeString
GetErrorInfo
SysAllocString
SysAllocStringLen
VariantChangeType
VariantClear
kernel32
UnmapViewOfFile
CloseHandle
GetFileSize
CreateFileMappingW
MapViewOfFile
SetLastError
WriteFile
MultiByteToWideChar
GetLastError
WideCharToMultiByte
CreateFileMappingA
GetCommandLineW
GetFullPathNameW
GetConsoleOutputCP
GetStdHandle
HeapSetInformation
LoadLibraryExW
CreateFileW
GetFileAttributesW
GetModuleFileNameW
GetEnvironmentVariableW
GetProcessHeap
HeapAlloc
HeapFree
GetACP
GetCPInfo
FormatMessageW
LocalFree
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
FindClose
FreeLibrary
GetProcAddress
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetLocaleInfoW
GetUserDefaultUILanguage
FindFirstFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
EncodePointer
IsDebuggerPresent
GetEnvironmentVariableA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
InitializeCriticalSectionAndSpinCount
RtlUnwind
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
user32
LoadStringW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
_set_fmode
fopen_s
fgets
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf_s
__p__commode
fwrite
__stdio_common_vsprintf_s
fclose
_wfopen_s
api-ms-win-crt-string-l1-1-0
wcsncmp
wcsncpy_s
_wcsnicmp
iswprint
isprint
strcat_s
_wcsicmp
_stricmp
strncmp
strcpy_s
wcscat_s
wcscpy_s
strncpy_s
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
_itow_s
atoi
_gcvt_s
atof
strtod
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
exit
_register_onexit_function
_controlfp_s
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
__p___argc
_errno
_cexit
_get_initial_narrow_environment
_exit
_initterm_e
abort
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initterm
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
852KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=206, version=65501,
count=15, id=259, version=24123,
count=39, id=261, version=24123,
count=18, id=260, version=24123,
count=10, id=203, version=65501,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=234, id=1, productName=Unmarked objects,
count=45, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/ildasmrc.dll
- IMPHASH d792987269cb06308dbf75f94f5169c6
- SHA256 29b9b70111cdbfc46bafe00a1429f01cc6f9251afca7700c4a7d0e9b17cd5bdf
- MD5 c4dfeecb6877c1370201851ba638d04d
- SHA1 8570424e3f7d39dd8037d891dbb734d30f722aca
- SHA512 f649f0512fe62a678a70c7c71aa06b57efc3bfe20a5218c13010c4a7750d672f7b49a7be967573db8f777c0202532f0b0a0e878cd8c992808466c75c50dd7565
- SSDEEP 384:JWU23lTkOLvg/YtHvdEfEbZj8gW34OWyWbYe3jKESkYqgzPk/:JWH3lTk+LNEEDvKESk
- TLSH T161D21C1067F91614F5F77A70ADB595624A3B7D90AA71C70E074C428E0FA7A81CEB2B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4880
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\ildasm\rcdll\Release\ildasmrc.pdb
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_cexit
_initterm
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
_calloc_base
_free_base
kernel32
GetSystemTimeAsFileTime
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentProcess
SetLastError
IsProcessorFeaturePresent
GetLastError
TerminateProcess
RtlUnwind
InterlockedFlushSList
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
700B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=203, version=65501,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=49, id=1, productName=Unmarked objects,
count=5, id=259, version=24123,
count=21, id=261, version=24123,
count=13, id=260, version=24123,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordaccore.dll
- IMPHASH 7a08a43df1dd263450c1a5425087d37d
- SHA256 f87d4d6910c92ab8495d0b4dbf2331d45fca86fa5c6ef5fa9efe5658c6b01343
- MD5 1f7e9db6d2abf2c8ef8e57652728d291
- SHA1 a51717409e8c6f1738da6d495447ef2c2198aee7
- SHA512 27f1285214879c8d6258034cf172dd9f5d2da34a19f0e61ff13a10245a8f0da31423b4b9a3ac3cfab74a55bd3a6d0eb973e73a2ff93e4f84c73168d7940529c5
- SSDEEP 24576:C+yfe57XLtwfvxkHM3i3ABlY/59Yjnlx2Zo/Wi1gHYcS9vvqKuO:4w7hwHxkf3+lY/59YnlxCohKYcCvyKuO
- TLSH T1E3457D2235858836D55E02B08D3EB58F96ADB1314B7001CF32B4AE8D6E75DD2B635AF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
857888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordac\Release\mscordaccore.pdb
kernel32
GetCurrentProcess
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
RaiseException
HeapFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
SetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
ReadProcessMemory
SwitchToThread
GetProcessAffinityMask
GetEnvironmentVariableW
GetFullPathNameW
DebugBreak
TerminateProcess
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
LCMapStringEx
OutputDebugStringW
IsDebuggerPresent
CloseHandle
FreeLibrary
GetSystemInfo
GetProcAddress
GetModuleHandleW
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateFreeThreadedMarshaler
CoTaskMemFree
IIDFromString
CoCreateGuid
oleaut32
CreateErrorInfo
SetErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncpy_s
wcsncat_s
strcmp
strncat_s
strlen
strncmp
wcsncmp
wcscpy_s
_wcslwr_s
strcpy_s
wcscat_s
strcat_s
strnlen
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
abort
_errno
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initterm
_initterm_e
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
_flushall
_putws
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
_calloc_base
_free_base
malloc
api-ms-win-crt-convert-l1-1-0
wcstoul
CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx
Name
.text
Size
934KB
Virtual Size
933KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=259, version=24123,
count=28, id=261, version=24123,
count=19, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=211, id=1, productName=Unmarked objects,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=200, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/coreclr/mscordbi.dll
- IMPHASH d7f1402eeabd14c4f5992750bb791f74
- SHA256 0b962100fb006469b74609e66ab182b3044519ec8be6d4792cfae6e5d2421567
- MD5 339d8f882bb7fa33ec7d73c9bcad982f
- SHA1 ebf63e40d54aac542769d3418e72bde371e6d5b9
- SHA512 7f37dbd93f2c3bb13892e2298a8da4b8858b6df15b617132cf2da87d3b584af7418dd458aec35c0405dcbdfbb3a2d464bd2d01028ff5d523f30200af2530f5b1
- SSDEEP 24576:zjKo2UQBxpa768zGFxPXwc3zq4tHTI1diI:/aUexpae8zoPjRTI1diI
- TLSH T18A256C723E4CC83ADB9F16719D1D625AA07D63314B6104C723B4BA5E2BB01D39E3CD9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
667056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\coreclr\bin\obj\Windows_NT.x86.Release\src\dlls\mscordbi\Release\mscordbi.pdb
kernel32
ResumeThread
FreeLibrary
DuplicateHandle
GetModuleHandleW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
Sleep
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
ContinueDebugEvent
OpenProcess
TerminateProcess
GetCurrentProcessId
IsWow64Process
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetModuleFileNameW
GetEnvironmentVariableW
GetFullPathNameW
CreateThread
GetSystemInfo
MultiByteToWideChar
SwitchToThread
GetACP
GetCPInfo
IsDBCSLeadByte
FormatMessageW
LocalFree
CreateProcessW
CreateSemaphoreExW
ReleaseSemaphore
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObjectEx
CreateMutexW
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
LCMapStringEx
WriteFile
SetFilePointer
FlushFileBuffers
ReadFile
OpenThread
FlushInstructionCache
GetCurrentThreadId
ResetEvent
SetEvent
CreateEventW
WaitForMultipleObjectsEx
GetProcAddress
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetCurrentProcess
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
ole32
CoCreateGuid
CoTaskMemAlloc
IIDFromString
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
SetErrorInfo
VariantInit
CreateErrorInfo
user32
LoadStringW
api-ms-win-crt-string-l1-1-0
strncmp
strcpy_s
wcsncmp
wcsnlen
strncpy_s
wcsncat_s
wcscat_s
_wcsicmp
wcscpy_s
wcsncpy_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_execute_onexit_table
_cexit
abort
_register_onexit_function
_initialize_onexit_table
_errno
_invalid_parameter_noinfo
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
terminate
_initterm_e
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__acrt_iob_func
__stdio_common_vsnprintf_s
api-ms-win-crt-convert-l1-1-0
wcstoul
api-ms-win-crt-heap-l1-1-0
_free_base
free
malloc
_calloc_base
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-math-l1-1-0
_except1
CoreCLRCreateCordbObject
CreateCordbObject
DllGetClassObjectInternal
OpenVirtualProcess
OpenVirtualProcess2
OpenVirtualProcessImpl
Name
.text
Size
748KB
Virtual Size
747KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=259, version=24123,
count=28, id=261, version=24123,
count=16, id=260, version=24123,
count=4, id=206, version=65501,
count=11, id=203, version=65501,
count=225, id=1, productName=Unmarked objects,
count=123, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/init.ps1
- SHA256 117a6ab1449e7d8543519c958ac943cbfb89aa0cd7955e9e498ed1f3b0797ea1
- MD5 5dd6c8248017d5944453220a5282fd0c
- SHA1 46705ccd6d0018be21014637fb64dc8575ba99a8
- SHA512 18ce52cabebfcdcb1a368086f1ee3dc2967540aaaa590762a978650f7a2124ade076d1d18c878466c723bb780ffe6c9aa3e6419a833951a238cc669532dfbbda
- TLSH T147E0E791F16197066CE69BD774C7CCC8265F790652557000B16FC71C5CDED405B4F02C
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/install.ps1
- SHA256 36f5aa39be23e188fa75857197dacf6e02b4eb9ca05b1a27276ee83bd8117862
- MD5 abaccf5a753a04a987f0ae95f16d52df
- SHA1 c7dc15e4c2c54cbb5f42a0ccfa170baeeef97eb9
- SHA512 42debc7186973b0a1358bbc078f13de9b1b1c6f57635f4c992d00a03e04b52ee5540bf1da072ca49be58276f49d85adb9511cf8509b4038e5061e1a8efbbb227
- TLSH T15C4123165E0296F17BF31343CE01EE9AFF8E165E515E5B28F0ADD2803B19806936746B
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 51cbdb2203775f1f578b53939c843bc6a469e798fea7954daccabd45ec0cece1
- MD5 dc0914413399f9c29cda5637ee1f4c16
- SHA1 0012f717ec62b136419282e4abaf62605f2e45b1
- SHA512 c66ae88d304b205973372b5f106696a90e1aa242a9b9d6c31d6119da31067ef4bd6c2f19ca342f7fa6a1ec7c511fda6a479b413f01f581adc499afd1cef3d96f
- SSDEEP 768:WO9yZtvT62StYtXYHr3tiCB6iosctkYtNb+DGtIYtNtPXH5t0gtYfv6ct69w4e7V:vyZxaYer3BNYGGKY7vxGHP7dNaWBe3Q
- TLSH T1C7E2C51137ADA933E7FE8BF52D31A14447B6B512A862DBCD1DC5A19A40E3F804782F93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\prg\projects\DllExport\DllExport\Configurator\obj\Release\net.r_eg.DllExport.Configurator.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.Configurator.pdb
- SHA256 c661ac05d38bce60a65a050b48604f9113d2e833037fa2616453b52f692bb134
- MD5 0f82fefb9b67a8912c616d367c98ca78
- SHA1 7738041a0a17f703294eca3aebf8b744f5f5cb92
- SHA512 6eba882ddf627ab458e29d448a9651860e60a2d2b51e911e0da53827a6de18bc8da255ebe4850f1499110ca966c506def0602d2e9afa0e720884903d110f54fb
- SSDEEP 384:2rPxPpRN92oMQ3NNk2ZoDA//VnVO7T4RbFd8/YL:2rlNBMs+A/lVOARbL8
- TLSH T16F332003FF40CE32E46A867562D78F3D9AB5ED848B42579F538AB15C3DF13551E82260
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/net.r_eg.DllExport.targets
- SHA256 a0e208637101895b2f5bff6aec30fee69151b0040da97f895bd44ff10e2b171a
- MD5 edc613b613939c64607e875b6355c8bf
- SHA1 61446927a6be6cc676852ac2ae776ae035d49987
- SHA512 c4b6faf59d049cfd1e30d8ddaedd684747c958168cd3a81112766aaddc83f60dc9e4cac7b0be7ce84fe43e0a14071b7ef1f8b12ec789c6bb1d81b07d0d3877a9
- SSDEEP 96:AUvZG/WiEz41BD3WzCCFedZF81pEsNznhfonBZzhrAa:5ZG/Wi041BDGduO1pEqznhfo/zhca
- TLSH T1C1B1CA23DF89B4D735A7831617A0C084AD3052B7356125D878AE93627FB762211DFBE3
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadRAT v1.2/Tools/packages/DllExport.1.5.2/tools/uninstall.ps1
- SHA256 7ed414f0f451ff56c4cbd69c8eec50a9768c8882f40ab511632ae8ac9c8e125c
- MD5 a79da006efb58ebdc6f947feba22c89c
- SHA1 2ac7ad3aaccdb329f1ef8bb54d81bc8a7fd0e982
- SHA512 e5c94e1a043a2ebb2a2274dd010b31ca3706fd3c3db6836b6d33d56281ebe24d1d9eda0b6c8f0f305b36eb46fbc354d2199d017074680736d7f258eb7df49091
- TLSH T10F1123419101D2A6F7E35303C941DC8AFED61E1F215AD134F4FFE1C45B9D501A2624A7
- MD5 SHA1 SHA512 TLSH
IttihadTools/IttihadTroll/IttihadTroll.py
- SHA256 2f505f749cf420fe9f67adf1f8cb7868b161701cc2064da9a01c0dc7a2e890fe
- MD5 0f37de8dca9a5ebb8f13dbabe08add6f
- SHA1 c343b9a9e1ff58bc28175b146dac04e7a86d3b91
- SHA512 db36d22f788185cbcfdda55c914fc588045e86663a832ac68bcaf0b71b7e99dfe8506ccc5e48eae8bcf60845b1357a5aff1611c11890eb0eadb0d7d54dd7b5c6
- SSDEEP 96:aYgm68PY+zVEWEYvJe5RzSzrNzAMkuLOfeeNkvJZEjWkA6G6zBX49tTo:3hLznTo5k3aMkUOfeeNkxZ+BX49Fo
- TLSH T16FE1B3118D212DA9E3E7C5EE1E5BCC29A118786B17042974BFACCB940F4D037DAB61F8
- MD5 SHA1 SHA512 SSDEEP TLSH
IttihadTools/IttihadWorm/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
- MD5 bb8f806621637a5a6339bafa3be99238
- SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
- SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
- SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
- TLSH T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
2195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/IttihadWorm/IttihadWorm.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 c98e8bf65f5beb5ddb731e111145b7b5b901c0d3a83e7e83e4e3a992ed2c1b63
- MD5 908d15e6c5f0be0e70179584cdabcbea
- SHA1 2bf09623407bee6c319a24c9bc6f59dd501ea2a3
- SHA512 452299c751de634acf3cfeeaf7adbaa947daae5fafaa30376e9e587e7f17849df1d4e4e15c4e1324945e156f1f926ca501da26f140528d4926b0eaae2ca9ca6c
- SSDEEP 6144:twWNg/BYNoFGJIGsjKjHqDIaJouRwELaCV181Kgr05t+GL263JjpBN/LplWrZ2n:kYVZHqIaJVkCVyvr05txCiJVBNTplWrC
- TLSH T16AD43A9CF8C8D5DAFC0D1A7924ACE133C6001B4D68A10D4B7AD3A31D55BEE4EA61F663
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
189KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/RDP Killer/RDPKiller.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 fb15c989eee152a280a5aab37c6a030afdfa3563ed511567dce56eb9ef65db30
- MD5 7b624e3dcf3f42b5a1bfcb68ee4a4071
- SHA1 0d3d29313c201cbca9a13d6c095273efc37778a8
- SHA512 d993fb44428e56cb3ec7bfd6fc85e35bab43be10f45c25a926b841e44d2dd190fdc35c3e93aceb0c26090b8b196e76b7abad7df3ec0c320907c9b04583e00067
- SSDEEP 384:OjWnN+mly5lsdIv7e2/+bkYy70zDDV60lxbnBPoePmvtWSUk9k+RAz3zaeaierxQ:OjRmlScIT0FyYPD80lxbnBPpPmLU/3N
- TLSH T195D28E5296F4435BFC9B2A787872460236AF94563D6F0E038935FBC40CC130EBEB96A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
IttihadTools/ServiceBuilder/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/ServiceBuilder/IttihadServiceBuilder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 57a3138f8b7d40d53cabd892072f0eb16cce06d64f074adcf8570e73e3eb23ad
- MD5 63d096ae9d45a3beb9c3439f997ef01d
- SHA1 c99c46a4b2be1e3bbe2f16bd646dc4ee3417848b
- SHA512 e91d76defcaabb2f4c2d55ed084dbb989f2fc37c7c637a88c3b61bd543230c785f709142fc56fe085ce6ab627d25e068b6b4249528580d957c3b23a1f54475a2
- SSDEEP 6144:fBg2vjJtFAjI/SqAg8m5xA+eyoJH5tgBg2vj:jjdAjIaqAg8GxPToZqj
- TLSH T141C41802A54B8625CC630D3C4AEAFD9E45AE7FCA0A15821A36DC7D1A7FF1E004D75EE4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
377294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
360KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
184KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/ServiceBuilder/donut.dll
- IMPHASH 21b1752e7eea2cc224406a71808830f9
- SHA256 3c6710646d8eb93fc6055378a71a6114518c5f456e634dab028a72a40c3f47aa
- MD5 45336a23b777f9bc23781f13ba04d3de
- SHA1 ab1b0046761a8e735cd7871573745333342d40b9
- SHA512 2a34facb93a84a8451754cb73fb5214164f3378f32c5f0a3ed8e1b5eeae7f61b29bd102ba3df3e75052d73b9a49bf6b4d7d0f30f0cf9f2d28f045eae84e715fa
- SSDEEP 6144:vlt6D7xhNh2LeL0AGTaObuzrY6ysBcq8n:P6D7xhNh2a0rVK86JBD
- TLSH T15C448C15B3A510F6E8738234C9119706FEB27C4543A09B8F23A85BB6AF776E06D3D790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
kernel32
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
CreateFileMappingA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
SetEndOfFile
ReadFile
ReadConsoleW
FlushFileBuffers
GetTimeZoneInformation
HeapSize
RtlUnwind
Name
.text
Size
143KB
Virtual Size
142KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
38KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=159, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=3, id=253, version=33218,
count=40, id=261, version=33218,
count=17, id=260, version=33218,
count=17, id=259, version=33218,
count=5, id=257, version=30795,
count=106, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=260, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
IttihadTools/VirusBuilder/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IttihadTools/VirusBuilder/VirusBuilder.exe
- IMPHASH 86b20084742a76f095688337078e4d75
- SHA256 8375a8b914d571fd774ec3ff5c12245d9320a6f065ccafda45e89b2ba6c85ec4
- MD5 09e42228e27f1fe2add7b85dbdeda033
- SHA1 39b6ec8ba1c68f1400a3957450909747625a57c6
- SHA512 570037fa8c4244c078e68b0b870646d1f4b308e4061ddd2fa387eb405e2f489e468a45f39d6c13f065b54aad64fe0fb594151560d4bc35eec1b68dc8db05dd30
- SSDEEP 3072:YPDI0Be8nAUmkWHak25qgC10Rdahnr/9Xwh6XAsiSXZw39DG8ZBKBcNCn8n6anor:8IOmxz2LO0enrFgh69I9DG8ZS86ooRt7
- TLSH T18A549D2034A81191ECE3BDF8BADDDC9C1EF4C609E72599756F4C5A63A90A9088FF0D74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
8192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
CreateFileA
ReadFile
CloseHandle
GetFileSize
VirtualAlloc
VirtualFree
ExitProcess
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
SetLastError
GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
GetFileAttributesA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
TerminateProcess
GetEnvironmentVariableA
ole32
CoInitializeEx
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayGetUBound
ntdll
NtQueryInformationProcess
advapi32
RegOpenKeyExA
RegCloseKey
Name
.ITTIHAD
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ITHDC
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ITHDD
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ