umbra.zip
- SHA256 2a71936649752557ef80bad3d8cb227ba888efa1adf7023313862d93e06b230b
General
- Target umbra.zip
- Size 15.4MB
- Sample260925-sw1cpsfb95
- SHA256 2a71936649752557ef80bad3d8cb227ba888efa1adf7023313862d93e06b230b
- MD5 8ee087acba05c9be20743b41f25bf06a
- SHA1 8a20588976b2922afbb6b2e81ba8627810cbcae2
- SHA512 78318c83c646caf2a3836462a86f55733f73d94884ff0798808bf29794842bb7dbaeb1bc083af6ef5c7d53c5cc80196e9783b0ddff104841ecb85887a759ab0d
- SSDEEP 393216:NoNYpXMy3cAVCSY3TGHne8yaQTSZS1hpFrrTJ56QPoahwDO1cx4+oo66Ngi:NGYpr8SCF2QTBoLDOe4KNZ
- TLSH T171F633C56E8A1850F631BBB92ACF76846BA053048D90B33997787EC176D53E14831AFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule static1/unpack001/medal.dll themida -
resource yara_rule static1/unpack001/Loader.exe vmprotect - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader.exe unpack001/Umbra.dll unpack001/medal.dll unpack001/umbra.exe
File Explorer
-
umbra.zip.zip 15.4MB
-
Loader.exe.exe 5.2MB
-
Microsoft.Web.WebView2.Core.dll.dll 794KB
-
Microsoft.Web.WebView2.Core.xml.js .xml 571KB
-
Microsoft.Web.WebView2.WinForms.dll.dll 38KB
-
Microsoft.Web.WebView2.WinForms.xml.xml 40KB
-
Microsoft.Web.WebView2.Wpf.dll.dll 80KB
-
Microsoft.Web.WebView2.Wpf.xml.xml 139KB
-
Monaco/index.html.html .js 218KB
-
Monaco/vs/base/worker/workerMain.js.js 133KB
-
Monaco/vs/basic-languages/lua/lua.js4KB
-
Monaco/vs/editor/editor.main.css294KB
-
Monaco/vs/editor/editor.main.js.js 2.1MB
-
Monaco/vs/editor/editor.main.nls.de.js46KB
-
Monaco/vs/editor/editor.main.nls.es.js46KB
-
Monaco/vs/editor/editor.main.nls.fr.js49KB
-
Monaco/vs/editor/editor.main.nls.it.js48KB
-
Monaco/vs/editor/editor.main.nls.ja.js52KB
-
Monaco/vs/editor/editor.main.nls.js38KB
-
Monaco/vs/editor/editor.main.nls.ko.js46KB
-
Monaco/vs/editor/editor.main.nls.ru.js75KB
-
Monaco/vs/editor/editor.main.nls.zh-cn.js36KB
-
Monaco/vs/editor/editor.main.nls.zh-tw.js36KB
-
Monaco/vs/loader.js.js 29KB
-
Newtonsoft.Json.dll.dll 695KB
-
Newtonsoft.Json.xml.xml 696KB
-
Umbra.dll.dll 4.7MB
-
bin/Monaco/index.html.html .js 164KB
-
bin/Monaco/vs/base/worker/workerMain.js.js 133KB
-
bin/Monaco/vs/basic-languages/lua/lua.js4KB
-
bin/Monaco/vs/editor/editor.main.css294KB
-
bin/Monaco/vs/editor/editor.main.js.js 2.1MB
-
bin/Monaco/vs/editor/editor.main.nls.de.js46KB
-
bin/Monaco/vs/editor/editor.main.nls.es.js46KB
-
bin/Monaco/vs/editor/editor.main.nls.fr.js49KB
-
bin/Monaco/vs/editor/editor.main.nls.it.js48KB
-
bin/Monaco/vs/editor/editor.main.nls.ja.js52KB
-
bin/Monaco/vs/editor/editor.main.nls.js38KB
-
bin/Monaco/vs/editor/editor.main.nls.ko.js46KB
-
bin/Monaco/vs/editor/editor.main.nls.ru.js75KB
-
bin/Monaco/vs/editor/editor.main.nls.zh-cn.js36KB
-
bin/Monaco/vs/editor/editor.main.nls.zh-tw.js36KB
-
bin/Monaco/vs/loader.js.js 29KB
-
bin/editor.lua.bat 144KB
-
medal.dll.dll 5.7MB
-
options.txt39B
-
runtimes/win-x64/native/WebView2Loader.dll.dll 162KB
-
umbra.exe.exe 1.1MB
-
version.txt6B
Loader.exe
- IMPHASH 84d14eb40645315e5816139b90e7c454
- SHA256 552266481e6405e97a20f90227c6d62345c84595fbc1fa298d884ec79bc50c92
- MD5 b78266abaffb5b05468e195e8d5a8fcd
- SHA1 9c1e201862752bd998167716dc230188f582d750
- SHA512 c7933d4b7e534d33284670664dd9e40b6dffbbaa15404fb508e7a4703a35ef8924cee4547ab6cb9c9590c2b98dd5a982107352d642d6bdde1d2f6ac242710958
- SSDEEP 98304:/fAGqHA1s/rinKMD+OZ6tpb/nFyCGJ+D6H68+SxYb5dznqW:/fizMKMD+OZ6tpb/ICS+DEAScbn
- TLSH T1534612ED2298334CC41A84389433FD09B1B6561F4EEA99FDB1DBBED07766820DA41F16
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3586634
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
DuplicateHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
GetSecurityDescriptorDacl
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Name
.text
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vmp0
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.vmp1
Size
5.2MB
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Microsoft.Web.WebView2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 535d7278fbaa78fd71863a25712517dc1f65e741b2ee31b6f69298c319c9a581
- MD5 4081cad4e480b858e36b7344fe479d2d
- SHA1 d269cc845322528076f233225b654d720684f0ee
- SHA512 f2d74206564560da81550a7403024b882d8bb92bd2e09f194b86a5a431f387c0acdf8cfce587c503f8ae665dcebe5a452216cd18b5b4a1ddb7758033ca0c914f
- SSDEEP 12288:LUOp5VKrBt5IE3zFI26JQr+iA81hKmYYDnMiRFXTSONZvZMwDAeA+igcmK8i7P2K:LF
- TLSH T1AF050C2223FD421AF6F37FB9A97416609BFAFC96BD78D64D4694101D0D72B8099A0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0f:43:de:e9:cb:3c:4f:7f:70:59:72:8b:02:70:43:83:66:76:e3:8c:66:b3:ff:b0:06:dc:8b:e7:9c:b4:96:ef
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 10, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:fe:6b:ce:da:d6:c8:03:03:a3:00:00:00:00:03:fe
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Aug 20, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:3605-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f7:58:20:75:04:ca:fb:c2:f4:00:01:00:00:01:f7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
808826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\PrereleasePackage\Microsoft.Web.WebView2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
782KB
Virtual Size
781KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Web.WebView2.Core.xml
- SHA256 23fc5cba9eafa8f7f731ac2c34a5cc125525584f51b4b48fabb2f062101d2c26
- MD5 7a7e22c70fda7af47190b4fa7a046a7b
- SHA1 4b9e1544aa52c305ef0883e067ef8b0bead0b9fc
- SHA512 23af244cc728d365e9b1a08ac61add023cee45751a73fd9f1eb251bf99595d72ba27ec73f0fe0d595f81b45ad87d4fd96633388f04f62763e537d109bed592a7
- SSDEEP 12288:rl/cM0fctDZuwKxNPPVeLoBWkKBVB7VBunO9hb/2Jms4cayPYB2/YAg5GcMUH5O5:qjWwTWra
- TLSH T10BC42F01A28CD6310DB10BCA69B8B6D4FF1D6A6731D7AA25348C4F570F739A2F1AF590
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft.Web.WebView2.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 44a5983b3d2d11c14ac5afcd634888c5cf44264dc6fc6dd7ec61bf09732706c0
- MD5 244d64cdfcbd48431a925de31d17d8ba
- SHA1 78052e07c9091e9ae639926f4f59accd37e5dc9c
- SHA512 0a4eae371c852626242f82683ea9be4c7a939a162286c74e6e5fa5f75ae32ea19e953d10067e330b144757e54e9a4fbaea739db33b7741094a77228e47713c88
- SSDEEP 768:5lN2oOMtBtKlfdCyXK0rPceQYZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZG4:R2oOXsIjrPceQYZDgcEST3p4JjrjaeFa
- TLSH T191034B0082EC8517EAEB2FB8B974826117B9BEC37E60D3591D85B1DA1CB3790551077B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8a:85:f9:4b:55:24:73:43:91:08:74:83:e4:01:7a:77:f4:54:bb:13:29:d9:ae:0a:cc:eb:e7:c9:cd:75:6f:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 10, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:fe:6b:ce:da:d6:c8:03:03:a3:00:00:00:00:03:fe
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Aug 20, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f6:83:2f:26:6a:54:5d:22:c1:00:01:00:00:01:f6
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
34030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Experimental APIs\net462\Microsoft.Web.WebView2.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Web.WebView2.WinForms.xml
- SHA256 4b40e49aec5dbda597224f997d57a16645ddc2eb00f31a6329204d1853a2245a
- MD5 c09409aac254f17c1c648e6f0464b035
- SHA1 22acb08e12e6ccbc4005c393e78d78be4f64b28e
- SHA512 53c46df0f24cafcd81ddedd195bae8dbedef7dd1387691a3ebf856b4dd239c3859fb58a1eaa9a31baa1fbb6e1986270ce567f3e70d110d1d88817f27c8a0dd5a
- SSDEEP 768:3OsdyK4aSPgPxW3uyCG4yCGdryCG/L+GZiyCGRL+P1xb9zU4QPgcRJFXCfPgKehG:3OsdyTaSPg5W3uyf4yfdryf/LzZiyfRI
- TLSH T17D03FC01A28DC72249E21ACE19B0E4D4FF2D677775D6EE11384C4B560F73EB0E2AB691
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft.Web.WebView2.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbce5bb3c0bc161cabd08ae64783269c599bd402d9341a6f57ae1da7800df633
- MD5 3f4ae7fb445fd900b8dba4cd3a44659b
- SHA1 c225073a020018b0f17b4dc2ed5577ac57ceacd2
- SHA512 e701a18ca983225b344c046259df6095d20f14028884450c8cef3a092c39d1335c21c555b2f676c83012a39cc74dc1bf5132d15e21250047af2a06bae34c2f7a
- SSDEEP 1536:Tlz9veaOXft6hyTublMnkMPha87Y1DHfFWyEb30mpc4Jjr4YeUq+HhxU0udwzvUe:Rxsl6hyuM5a8+DHfFC30mpc4Jjr4YeUz
- TLSH T1AA836E5153BC4923C6EF5BFD7DA050280BB9F9C3B962DB9E2A84B2E808D73921504777
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2c:6d:04:88:15:80:ba:a4:51:d1:8c:ec:23:6a:04:33:63:30:3c:79:dc:32:ed:38:29:3b:ee:66:bf:8b:f2:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 10, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:fd:36:44:39:73:0d:dc:02:28:00:00:00:00:03:fd
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 22, 2024 - Aug 20, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:571A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fb:cb:cb:6c:37:67:e5:30:95:00:01:00:00:01:fb
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
77658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Experimental APIs\net462\Microsoft.Web.WebView2.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Web.WebView2.Wpf.xml
- SHA256 d2a287558b133325dc5bd890b994ef954a78486ad488fed422b88386eb47eda8
- MD5 1f752a8bf8c538c6823159b4d159bde1
- SHA1 37879ee6032745a1aaf46c6e5b2e24301c9fd256
- SHA512 1c0704e7975f446c05c75fbf3b02d8582f6c4a6936931bbba4e97eee8a4b4d43214fb54f92d840a249844b88026355a9bf9ffacd0632c72fd3a03bab830fce8d
- SSDEEP 3072:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtLryDnLfryDYO/LPm8RLP9R3Ly1vb9QUXd:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtM
- TLSH T192D3EC10A28CD62248F657CE2AA8F4D0FF2C266735D3DA15304D5F161F77AB1F2AB291
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/index.html
- SHA256 c76f11bcfbe34a45f9ab4b50e55efadfe72359936249479f69c240d3c320e780
- MD5 9a126b7ca3cd443227174309704a5564
- SHA1 e7e3de2b3dc84e1d7034e9b5e8ecd1e558641c9b
- SHA512 5aafb2776d5505cf7f492fb24f500ef59cf67188c9e0e85b26e2bb945193d7ca17de689fdbd4a0312cb0e92ca3725fcb6dc54737638d17042ba79b04aac8e248
- SSDEEP 6144:AGmYMQ/TYiDCHdMwkJzIarm+osMvZMQmLwieyCPMP6edTlflqk0ZesEmcqpGYdB+:AolcjgKs
- TLSH T12F2440D5F60D2C132A875321615F7EAD3B7C40B0E9221BCBBA6CE72425D469D01AFB78
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/base/worker/workerMain.js
- SHA256 b19ada1ffe036707eecf00f4e1bc0e3c4c6ab546fb7e5d4d52f5a62de4caf0d6
- MD5 b838e4d4ca3a40a357225bd920ade768
- SHA1 4108724d46fac36b42521b70c99cc6a3ac32e2d2
- SHA512 9d689e2be1cfc52444d22ffc590efb5ff2fd9ead6ef7f01323b57156365eff7b4f31c3a0b9e97872844373791ba40384f768f4f2655a75f37d0a5f2da74cfe46
- SSDEEP 3072:W1DOqzYJv4cw7ktL4JqX8PPiz93don3F9s:gDOqzYJv4cw7gL4JqX8PsI16
- TLSH T156D3C5CD72A5B4125397A1B1507F120FF33A296A980D44BCF365C8DD2DBA48A617BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/basic-languages/lua/lua.js
- SHA256 4ea76aa12e7e1072dd553b93e0c17b34b6d11a28640ce0dad2d193f75e940ba7
- MD5 ee5ad27a99a4740d57fb4382b93115ff
- SHA1 63cd68497ea351005a3b73db40ea0f031de9fd6f
- SHA512 b915885921c5cd783f7061a153d476521b8b0ba6da4bf14b67fabedd973d46affd40afd8419d56e991f54eecfbb9ae8ed9da2cb5074bcfc5b149c1350111982a
- SSDEEP 96:SD3OXPlI+iI+6OOfCDv9VtKI9fTxdeT2Nhq6i+G/uMB:jXtI1I+7DVVtKI9X6y7G1
- TLSH T130913FC2CD8CE25E8BF5F7848EDEA0E6F58D4236C43516BAFED0455C160CA88865E735
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.css
- SHA256 8d61f9e0aeeec43bdaf720bde7ead8e7d3de85f3497a0b784a723628c6d68dee
- MD5 ea5ab85681f5442fbfbcb4d410f200f2
- SHA1 5bd08fc669c7c830e88e0f37f7643a6a01e456ed
- SHA512 5d622a2702c58dbdded3b55c23e976bfbc2f451bf560ffb237919c5a612c893a69499e9d132619285ac79454468c78349c3d3741b41fa57343524c98b713c3d1
- SSDEEP 6144:UzsUTrsZ7KcNkuwcv2As0aMY/Y/RR9MtpWKco:UzsUTrsZXkW4/50i
- TLSH T15A54196F650A2B5A28DD28778596ED4EF4B4F0B2D8034FD4E8AE7F74804A7D8054736C
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.js
- SHA256 02d2a1d4369056be8bdb63f3fb53f507aa30f21fa4040eea0ca7eb69a84e56e4
- MD5 8fc60410aaf374e79953adf9d711c5af
- SHA1 83ee02480a62b7ac5d48c421b1315b84f1aa58f0
- SHA512 edcbe8f1e4cb5776121949bca97e7d8dac289d2297b5b4ea6fc4ae1409d889fe735acab694b3d0506643ded39e0838be3ac12e601b3386b4f2a3937e46b3c558
- SSDEEP 12288:SOX+W5dL4JbNfMQpSoQ7S6IkqrQXP84Kf9gOmAoaoLwgdRZC17REQLhhVrDAoxJY:SOoh3kqrQ/6f9gOmA5oOEQLhjrDpRpTw
- TLSH T121A5E7997155742243C7A0F6A4BF050BB23A5469E80A50ACB3B8D8ED2CFF5496337F78
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.de.js
- SHA256 4840ce5d29dbedcc21e3aef15fd1c4ebb82371e7f967d298fcf9668b6ab7162b
- MD5 ad9bf818536f91931fb650b3216dd18c
- SHA1 403d2a77da3ef57d26ae8517ab1911a2e06bc18a
- SHA512 a7489f6e059edd044902db53a486c3881ec363d9db065651692b60043b2a3b388dcd2f8041d460a5fb0a11201e94277815cea27145a3df00792953b602c95bac
- SSDEEP 768:HuYC1xYdRB1a3XqGzdigBdQqAaI/23LNdPxFpST1kF4AJhYmz7behjYWMuRBk3hv:HqxgVuXqGzdi6QqAaI/27NdPxFpWxAJ7
- TLSH T1A72307B19D46702A5FC963E1BB415D3B3A1CE2AE7A56500E487DC427204BAF9C6DF433
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.es.js
- SHA256 39c20b04dffe19f781303934bb52275bca7163b44f395e6caf37db4ca29e2ae3
- MD5 b5d76ad10828693d4789877118b40bce
- SHA1 0368e36c2dee4e6135e5d619870ef49feb932769
- SHA512 81e8e6f77ea88765333a127858c709df146d1d4ce7bc0106a5106b6ad1035250bf09a6de87894004e2c6f25d87a5705aa8c6b645b17c420dda3db82077c71ec1
- SSDEEP 768:N8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPnBANt7+OlzDKPp4I:SKFyVRcdzHqIkGMvnmvoKA9OfxjB3EVs
- TLSH T18623A73647CC175315D303CEF2D3D513D188AC89B068C1DBA1BA9AA560CCEECD56FA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.fr.js
- SHA256 2476075bf25a091da61bbeee0c870169f796e68f30dd70ee6c8d28995f3920d6
- MD5 609979a6bd0e729fe66215c1fa383a89
- SHA1 6daf268486dec76a48de52731addcc2f450d6618
- SHA512 5afb9b43b684d2c517792947702dbe9a7ac7446abd4628b00bfb14ce90854995e06e7c5135056b52aa2450cec5644e66861a8ce98a51ba49277c37109e55f9ac
- SSDEEP 768:ILjlgb2uZ5CcXQ6Q3edz3uzATaY3l0y+dg90TWIvkUqBkiuP/oOjF4Zoczc3A4qJ:2liv5Ccg67SATaYVKEkimTjFAoAaZw
- TLSH T12933A61FA6C421920EC61BC3F5625593E874C88CB35DE316ADAF53D912C68DCE2DB6E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.it.js
- SHA256 01d14ba84f1e2efe3d153fe5ca48e04391620fc39a01b35f90e2db89ea3d9e7d
- MD5 3e3d0b63e450ec97e699801d491d91e5
- SHA1 8d28e0cfbac8ce6f70664a054d61c7ad69e1882e
- SHA512 a7eeed13a281d532567cc53cae6ee9fed68e57b7ff68868b7814dce90a537d9a3b9972757d9333866c7557023c37b13f3c7a3f8ed0e50d519445080726d785e6
- SSDEEP 768:gqEy7izsuMa01VaiYR2L8XoXNj8YtvnYbP4ymMb3d/gyKJdnPTrysribj5K3m0MR:j7fQL/j4Qq2FA1J1qn4mB7agn
- TLSH T1A123A83D0281211029DF13DEE176604EFB67A8CCBD5C316959BC052D35CEF98B19E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.ja.js
- SHA256 61c4daa3f0e1358fc78e69a057b5e1da3b639c94a70ea5ad6de5623d496d5517
- MD5 1b4528114945e6cada91efe8ce5c19f6
- SHA1 0d49f278175e0711af2f1d539934b98e9de995b4
- SHA512 aadf263e9dd6d4722a76154d0a521774e7d51500b5233c661ed55bce95014a94b724e6a196cd5ac47032ce508c00b2b183ae3b570576b633e45568df8d4928db
- SSDEEP 384:hg2PXPtm+04LZ+FFHr0ZA9qOSTvvIEveG1vz14NdahWMpA1Uj4vHba3RPDScLBkm:bPfLsIOCam3rJrYEIk/872rpvsk
- TLSH T11F33603CA7C0A8394D2593632A9DB4EA3455AD5BEC227736C13DE021B9B03CDD185BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.js
- SHA256 d91fb15a406fa334895f5fa5bdf1da02afca9cdc50220b4b597f18ca6869e75a
- MD5 25a6f54d69d6ff2426396a68e19b53fa
- SHA1 6edc8f277381e88de77d0f4462366c6fc7974b98
- SHA512 2340b961e83abfc4dd067cf4e51ad71b48b16e4ea6c7d224754912cd5e3711c4eb63d70adb8a7f42fb5d42dc9dc68bc32ace46ef005373f579ac0d937f9e3947
- SSDEEP 384:hO8LKmvQkKEQq4xlX7lrp1E1bIJUeYB4jV87XfVGZ3H6Sq6B4wCJjocN986t7J9L:U8LlfQq4xPp7pFBsZjYKqk1Vetbe/
- TLSH T11E03FAA3A3481337298B06EBB6EEC194672A5D3C7711535AA4EDD43821874F093BF9F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.ko.js
- SHA256 ae5895709821f36a7edc58a61967e925a3d3d7b0a3ae29042a948743cff8d0a9
- MD5 43f772044f04b44c2db113388a6a5fb8
- SHA1 cc6714152dc7b7ae61b0a74444f84d0462f9a9ac
- SHA512 c36cf14b60fcf431949de5afbee0fc836afea5c01632560df704848332d43277cfced62ea38c89488350b66db539d64b3e5982fac55c6a0d2a11e28bf6f1fe6f
- SSDEEP 768:cOnmkUxK1pLkKgljQM1r0xXDj8kCpY2XlGyrHuivU1Azrtu1QrWp4cX6v:RZUxKgKzxzrCp9GyrHuiFrCQKp4cX6v
- TLSH T1A72301E239DB93983547CA815AE1B6758382E5B7FB8301C0CD96CCB0CD589E7444B9BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.ru.js
- SHA256 25fe81d3e67512248d7c361a44f65b6902818a27a6674484fd168524f6e10e2b
- MD5 8e4f383a3091adcf8902b126d58d2bd5
- SHA1 fe277bc0dc079282b51f38486d3d609edf3de599
- SHA512 1730546448dec4f573f53caa088f0efbd583395b181f35e8a0b28f04a8600d727b13908d7c2f413e2b80ee5fd57a53bfefc729a89d23f614aa20287aa4d90061
- SSDEEP 1536:U/0F6MhjpIMbBBKOXnFCSHhEUVCcan9oARyGuYQI/c:tPhjpIcB8OX/HhE1canGARyGyI/c
- TLSH T1CB7337A156DA50AE0200B50BDD087E493EEB46FE3FAB533615B43D7E34F3024C66E669
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.zh-cn.js
- SHA256 f4d6e40540aecd433aeae871fb64ea1d711949b10843c61adacb13a2c7565b06
- MD5 368b9af46e5b7dc798f0d9bf8286374d
- SHA1 3442974703766081a3afdbe0dfa0bcfe112690f9
- SHA512 56a29d8b195f2b23fcfbe930a1845a645f53e3c7982fb2000d5590cd2d501a538c238bc2376adb621c2eb7938440439388a1e6128a7579715cc47101f140e3c9
- SSDEEP 768:kbVMLHwwytIZgIlChuIW9P4CAz9NlLNYAdszzHfVBI/C4Y00llmR+V63:YPPdzhuIWQszzHf3IXY00llmMV63
- TLSH T173F2C6941BDC6FF93C021381671E85267908670B753BE021A7F3FD9D20919EE46E7A72
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/editor/editor.main.nls.zh-tw.js
- SHA256 04a70ba24136660ea074095aa01d4d01a399cb9104cbfe8bded202538ff76d68
- MD5 1f4ff6a381a8c58e1c91e28da60f42b6
- SHA1 f9a54cf63658a87f6ab1130eeba0bf183be57fc5
- SHA512 66a31b61d711030171c12dede7de56942e19ca3add1a3c646f1dcddfd34b9084c3f114d1e1cdfe3d457c2cfc12e68dc5a1b21ba84ef43923c0bca21ca542d817
- SSDEEP 768:bHetcy+xQHM2k00fZvOjRUcdFF/JwN+QVEWrn05ZxXUeqJ1wrv6Vl900pgL+K14t:isxQHM24ZvgdFF/yN+QpiUeqJ1wrv6VP
- TLSH T199F218650FBD5BF83A05F3AD270921161C0E6B0BBC3661159B7E7EA424977CC23DA8B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Monaco/vs/loader.js
- SHA256 f4f992573d388f87598c275da26f8597a68801378ee8438166c703bae1bfa1d0
- MD5 28d495de7e571f6cc67ffa30927dc189
- SHA1 8dffcad06874610e2ae2cb89be4e8bea9414aa46
- SHA512 12336df4ada164eeda296d8f47927c9b8a98af8d8fa940511481aef2865f871808ad15aea953009cfa65f4f2d1ddc6f94597d1a32e8b3c75bd65925c2cd1d269
- SSDEEP 768:DJ6C/Hdqo+gvwTeMq/soU2j8hHN0mJJjvrCfn5SU4RVV+g:N6gH3PwTRLpJ91t
- TLSH T1D9D284CDBB9474234347F4E8D07F111BE2BA965A144D842CB11DD8DE2CBD58AA23EB78
- MD5 SHA1 SHA512 SSDEEP TLSH
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.xml
- SHA256 79ee87d4ede8783461de05b93379d576f6e8575d4ab49359f15897a854b643c4
- MD5 d398ffe9fdac6a53a8d8bb26f29bbb3c
- SHA1 bffceebb85ca40809e8bcf5941571858e0e0cb31
- SHA512 7db8aac5ff9b7a202a00d8acebce85df14a7af76b72480921c96b6e01707416596721afa1fa1a9a0563bf528df3436155abc15687b1fee282f30ddcc0ddb9db7
- SSDEEP 6144:XqqU+k/Rik5aG0rH3jGHdl0/IdHXpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DU1
- TLSH T155E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA252FB6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Umbra.dll
- IMPHASH 8e2c1e0b4318f3a01088c7f01f31573a
- SHA256 a842f8a09361a9caf657b0ca68bfe680a5e24f257e6fa68c8de8557d46a5cfce
- MD5 a5d41a7b91f56196699a72c832f5e02a
- SHA1 139ed84600a6e438c956b850441dc800135407c8
- SHA512 9b54dc2bb8f5c7dcb42bbe76778720abd23d1f1a291058f430aa63a25a57048ec154cc27f49cb42734a078725bdfc32ee75f469412ca5496db6384c8cd00ca78
- SSDEEP 49152:+4oYI4oYI4oYI4oYuJVwK8mCVWF+4AM7r33NXDz/e7qbYoCRdCpHCziDaipAhcRz:4VwdHqE6WhcDG0QR/Gcn7ZoOVY3
- TLSH T1D7366D82A6E322D8E213C1B60B03550BF9B2BF540354D9EF49E265A55B33BE2537C36D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3830344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
bcrypt
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty
ws2_32
select
ioctlsocket
getsockopt
WSAResetEvent
WSAIoctl
htonl
getpeername
gethostname
closesocket
recvfrom
send
sendto
accept
socket
listen
htons
WSACleanup
ntohs
getsockname
__WSAFDIsSet
WSAGetLastError
setsockopt
getaddrinfo
freeaddrinfo
recv
connect
bind
WSACloseEvent
WSACreateEvent
WSASetLastError
WSAStartup
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
crypt32
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertCreateCertificateChainEngine
CryptQueryObject
CertGetCertificateChain
CertFreeCertificateChainEngine
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CryptBinaryToStringA
kernel32
GetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
FormatMessageA
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
GetLocaleInfoA
LoadLibraryA
IsDBCSLeadByte
GetProcAddress
VerSetConditionMask
FreeLibrary
SetEvent
CloseHandle
CreateEventA
GetCurrentProcess
GetCurrentProcessId
VirtualQuery
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleMode
ReadConsoleA
GetConsoleMode
GetLocalTime
FillConsoleOutputAttribute
SetConsoleCP
GetConsoleWindow
SetConsoleOutputCP
SetConsoleCursorPosition
AllocConsole
SetConsoleTitleW
CreateDirectoryW
GetTickCount64
CreateDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
GetSystemDirectoryA
GetEnvironmentVariableA
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerifyVersionInfoW
CreateFileA
GetFileSizeEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
AcquireSRWLockShared
ReleaseSRWLockShared
CreateFileW
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
Sleep
user32
SetWindowLongPtrW
CallWindowProcA
GetRegisteredRawInputDevices
RegisterRawInputDevices
GetWindowThreadProcessId
keybd_event
GetDpiForWindow
GetAsyncKeyState
MapVirtualKeyA
mouse_event
FindWindowA
GetWindowRect
IsWindowVisible
SetWindowPos
ShowWindow
GetWindowTextA
CallNextHookEx
MessageBoxA
DefWindowProcW
GetKeyState
GetMessageExtraInfo
LoadCursorA
GetSystemMetrics
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
SetCursorPos
GetCursorPos
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
CryptHashData
CryptEncrypt
CryptImportKey
CryptDestroyKey
GetCurrentHwProfileA
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptAcquireContextA
CryptGenRandom
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteW
SHGetFolderPathA
ole32
CoTaskMemFree
msvcp140
_Strxfrm
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?bad@ios_base@std@@QEBA_NXZ
?fail@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??Bios_base@std@@QEBA_NXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Query_perf_frequency
_Query_perf_counter
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Random_device@std@@YAIXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
winhttp
WinHttpConnect
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpWebSocketCompleteUpgrade
WinHttpSetTimeouts
WinHttpWebSocketClose
WinHttpSetOption
WinHttpWebSocketSend
WinHttpWebSocketReceive
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
__C_specific_handler_noexcept
__RTDynamicCast
_CxxThrowException
__current_exception_context
__std_exception_destroy
__std_exception_copy
__std_terminate
__std_type_info_compare
_purecall
__std_type_info_name
__C_specific_handler
strstr
strchr
memcpy
memmove
memset
memcmp
strrchr
memchr
__current_exception
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_errno
_beginthreadex
__sys_errlist
abort
__sys_nerr
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
api-ms-win-crt-string-l1-1-0
strspn
strncpy
isalnum
strcspn
tolower
isspace
strncat
toupper
isalpha
strncmp
strpbrk
isupper
isxdigit
iscntrl
ispunct
isdigit
islower
_stricmp
isblank
strcmp
_strdup
isgraph
api-ms-win-crt-heap-l1-1-0
free
realloc
calloc
malloc
_aligned_malloc
_aligned_free
_callnewh
api-ms-win-crt-time-l1-1-0
_localtime64_s
strftime
_time64
clock
_gmtime64_s
_difftime64
_gmtime64
api-ms-win-crt-stdio-l1-1-0
_fileno
_read
fgetc
fgets
_close
_lseeki64
_write
_open
fwrite
feof
__stdio_common_vswprintf
fgetpos
setvbuf
freopen_s
__stdio_common_vsprintf_s
fopen
ungetc
fsetpos
fread
_fseeki64
_get_stream_buffer_pointers
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vfprintf
fputs
__stdio_common_vsscanf
ftell
fseek
_wfopen
fflush
fputc
fclose
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_unlink
_stat64
_access
_fstat64
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtod
atoi
strtol
wcstombs
strtoul
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
tan
log2
log10
sin
pow
_dclass
_fdclass
_ldclass
_ldsign
sqrtf
ldexp
round
_fdopen
modf
acos
sqrt
frexp
acosf
asin
sinh
atan
atan2
_dsign
_fdsign
ceil
ceilf
llround
sinf
cos
cosf
cosh
exp
floor
floorf
fmod
tanh
log
fmodf
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
wldap32
ord30
ord79
ord35
ord33
ord200
ord27
ord26
ord22
ord41
ord217
ord32
ord50
ord45
ord60
ord211
ord46
ord143
ord301
normaliz
IdnToAscii
IdnToUnicode
NextHook
Name
.umbra
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
789KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
56KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=7, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=39, id=261, version=35207,
count=1, id=262, version=30795,
count=125, id=260, version=33519,
count=2, id=257, version=33813,
count=5, id=259, version=35226,
count=12, id=260, version=34120,
count=35, id=257, version=30795,
count=628, id=1, productName=Unmarked objects,
count=347, id=264, version=35226,
count=1, id=256, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,
bin/Monaco/index.html
- SHA256 4910758aed671aed35492c58ef1c73523128ebeefbb80e72f80e1e00ca9d34b0
- MD5 be7f32892b4397b2ac32044e90b96710
- SHA1 cf5c9980d785c0527b8e1cf6e80119811d1241b4
- SHA512 66a015136b09dcfdd69de2a0981379add20003def8c3b2bfb6db0f7f643e18bdd1176468aec4f8a431431a51479665a637a82705b15f96007003a41924c2d1cb
- SSDEEP 3072:Nk4J09UmmJv8kBpZaFD48VOAGUWYPjDZlLJbRBiPEP8yKUz2Ojmjr8zM3KP7pblv:64J09BA3pZaFD48VOAGUWYPjdlLJbRBp
- TLSH T156F3F19AF1122D5226C79230619BBE297FF19490BE766B424B9CF3201091FDF116FBB4
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/base/worker/workerMain.js
- SHA256 e90d1a8f116fa74431117a3ad78dde16dde060a4bf7528dfe3d5a3ad6156504b
- MD5 d0ac5294c58e523cddf25bc6d785fa48
- SHA1 1b3661b6db36f1b14fd80dc9a739bfc69c68dfe5
- SHA512 fea07a1ea5d29a3b4c614248655f4d1ddd94c10c6a6b5c8b428a8b4c0cbec7e7492fa0665c5001e65ce167240ffdfc5ac2c2ed14da3d6f508ae8d8b3c8e8eebb
- SSDEEP 3072:bzjH/zYJc5c/7tMLrJ78II4F9N8+em5W+:XjH/zYJc5c/76LrJ78I7BL
- TLSH T1D4D3C5CD72A5B4125397A1B1507F110FF33A296A980D44BCF365C8DD2DBA48A617BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/basic-languages/lua/lua.js
- SHA256 ac729efb3164f48d6b08f74d4b15060c126a30d40fb4cd4fc9cc94f2e19bd7c7
- MD5 eebda1fdd970433750c115eae2f03865
- SHA1 3f1a1cddb99dead013eac825eb418241656d4bf0
- SHA512 8b188f3ae73a14a9318dce9761312d9dd2360ab00ee36e83ca6b74288a109c91770954db7537fd84a76707a1e79528fffc97f3a718bcd924545b469a1363c9cb
- SSDEEP 96:HDGAW6FJJJkCO8evcIWtdrvrg+1/sLMiWAOKjLobLMzD:BWCDqC20IWtZD92pzOKvomD
- TLSH T1CEA182C6FDCCA35E8BFAF7C4CAF1E976F58DC231C02550BAFAD05508060CA89965E625
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.css
- SHA256 615824c59ed1e07f5924286e9f02f3120b9064d59e115d3f668a914e07839451
- MD5 23c7db6e12f6454ef6e7fb98d17924d8
- SHA1 06398b44a338db5eeab2d461347334fc69af5af1
- SHA512 5ed3103e4f6640ca71e103e7f3752aca3027d8c563084d519f9d6358018ccdfacd0c4c08b69e510f88effa2b56dce04241ee7f92f3db99d9077b49ed7271d924
- SSDEEP 6144:TzsUTrsZ7KcNkuwcv2As0aMY/Y/RR9MtpWKco:TzsUTrsZXkW4/50i
- TLSH T1FA54196F650A2B5A28DD28778596ED4EF4B4F0B2D8034FD4E8AE7FB4804A7D8054736C
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.js
- SHA256 9e2fb6171592f7a3c33d3b5baef58b516b36473ff7717bbd643574991923435e
- MD5 a7e3083cfe200263edfb4bf011b893a3
- SHA1 18b52dc38e7a8a612892f5e60a08d9b19e1f472f
- SHA512 6bbb149102958e23c42accbbd18595fcfffd547bb826f2309956c036983692e83b7313567a42e50d98a1c946fab554e32b77ef4d0f8bc0cc7f0dda196fd7e23b
- SSDEEP 24576:jFFExk98EXl2uRJxjP3Gdv6QLtQ2MbRpn:Yxk98EXl2ixjP3Gdv6QLtdMf
- TLSH T143A5E6997155342243C7A0F6A4BF050BB23A546DE80A506CB3B8D8ED2CFE9496377F78
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.de.js
- SHA256 cb1c3416ff242a738c45c3b2590d7d222b159a95a69ce3b7b8d7c8d18ea70828
- MD5 d1fd2fb756c73970b9c5e0ba07bff708
- SHA1 470057b3244886dccc9f6074297cc8bc2a9c1b39
- SHA512 db2432182ff4c85fcca5093d0e433ed9cf5bed3ea3db9ed82fedc87af4d260e0d0f29ff67f0b8ac78e162586a74998ad082a91e8f9a76717827a83d5b2f775cf
- SSDEEP 768:ocuLC1xYdRB1a3Xq1GdigBoQqAaI/QQUEYPxFpXT1kF7bJZYmz7lehjDWMQRBk3Z:oclxgVuXq1GdiRQqAaI/QvEYPxFpDkbg
- TLSH T1F12308B19D46702A9FC963E0BB415D3B3A1CE2AE7A56500E4C7DC427204BAF9C6DF432
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.es.js
- SHA256 327437ee3793e9ae0686c78196b459592c282ed2e86f95ce28d32693b76d7654
- MD5 36f546b28ca17ece9f8eb9bcf8344e13
- SHA1 d43934b9041587799e332b2f568aa81666227258
- SHA512 13f8cc23038c07b6840514db4fc7b503b7a38ae1ec3baab44f1bfbded40ac50ae03c05c754f9678eecd0c8fcefab958152b39b731068b8c2c976c4c57e97f36d
- SSDEEP 768:oX8nKFyVgAYwTQG8zHqIkGMvnmvoKA9OfxjB3EVuU13pjbazPn0ANy7+IkLDKPp9:oMKFyVRcdzHqIkGMvnmvoKA9OfxjB3E5
- TLSH T17A23A73647CC175315D302CEF2D3D513D188AC89B068C1DBA1BA9B6560CCEECD96FA6A
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.fr.js
- SHA256 6ed837dc1905c06a20d102921ff06a0bda003c5368ed0576bf7e69494e889ae8
- MD5 1a29080733878dd44e0c118e84cd0c39
- SHA1 60c158e23962b11918f6cae26445fad5b63bc65a
- SHA512 5cc68cabb583100320d7c875fd7c46f5c618c3968ac2a7c2b60f90ec74b29349a557049c17d5c851cabb54d5ef26cd65e8d2288d70b62ede06ee1762e25dbd60
- SSDEEP 768:op8flgb2uZ5CcXQ6Q3edz3uzATaY3l0y+wj90TWIvkU5BkREPTtOjNjZocYV3A4k:owliv5Ccg67SATaYVKPkRskjNGBAa3k
- TLSH T1BE33A61FA6C421920DC61BC3F5625593E874C88CB39DE316ADAF53D912C68DCE2DB6E0
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.it.js
- SHA256 4fe2c4420294758883e134bdf7da9e6c2abf631d3a89c765f32f6c1d0f62653c
- MD5 18e88f58301ad5ae926204507ab99c6b
- SHA1 8eb03235312e88b941f3be212c0efa12b24e6d5f
- SHA512 f66283ec4182e9062f9f03a83acb3f2a49b98fb9ef67e48eaf5227236919ca279831b822fcb3ae252cfeafd81d12fe9c89a2843d91ab140a2b79b6bbc1d4f013
- SSDEEP 768:opTEy7izsuMa01VaiYR2L8XoXNj8YtvnYbP4ymMb3d/gyKJdnPTrysribj5K3m05:of7fQ2qd4yq2FA1J1qn4VN7CgL
- TLSH T1DA23B83D0281211029DF13DEE176608EFB67A8CCBD5C716959BC052D31CEF98B19E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.ja.js
- SHA256 1f3556ea7233843b9e08b3c97b6727c533d702563e195c2090a438070dc85f0f
- MD5 3bf851cc70f515cbbe1d39da93e4f041
- SHA1 88fe6323bbe14b55b6eec078574318e8474be613
- SHA512 61ffe9ec3550d2f8dfbc30d7d61327584833bb714a9d2cfc9788449190089dbdeaa293bb9921a43da782e1c36b7d242e13ac052b46210d2e79793626e921169d
- SSDEEP 384:hyd/PwPtm+04LZ+FFHr0ZA9qOSTvvIEveG1vz14NdahWMpA1Uj4vHbX3IPDScLBV:olP4LsIOCaT3lJr/Tvk6892vU1ssD
- TLSH T121336F3CA7C0A8394D2593632A9DB4EA3455AD5BEC227736C13DE021B9B03CDD185BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.js
- SHA256 5ff0084e6a7eee82a735616239aaf2190ea9d90e89e19340831f3d590828016a
- MD5 e871d4d9539c26d7d2bf32801ebdecf0
- SHA1 711460f619ef09fa23d272d97bfc00593a5319a8
- SHA512 b6b9bf96c132db9dfc99d70320231630fc46a8a83f500d8e4f677e2d03206364f2666946f69061dcba2e759f005261dae1ece73e054aa56b8210551bc353cced
- SSDEEP 384:hy38McmvQkKEQq4xlX7lrp1E1bIJUeYB4jV87XfVGT3H6Sq6Q4wCJjoce1u6I7JS:o38M7fQq4xPj7+lJcYYKqkGSVetbesy
- TLSH T15E03FAA3A3481337298B05EBB6EEC195672A583C7711539A74EDD43821874F093BF9F4
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.ko.js
- SHA256 98e649fa40d8e2ccfdc212341feb8165a7d7bbec31e8a77d9819ad9474e4b8ba
- MD5 60fcd422ac97a1b645ff48cb6928f7af
- SHA1 da5b57dfbd257720155e303f0e75e263f0e74190
- SHA512 52439f47f1e12ccf37db40f9fa8fa4966579cd6b327cde1768187cd7fdc7ebdd444e1953e29ed09bdced40d764c2e8f7131d44908c00bfd350e856a9df661aa4
- SSDEEP 768:oNOnmkUxK1pLkKgljQM1r0xXDj8kE6q2XlGZrAPPvzcDzr5u1QrWp4cX6go:o4ZUxKgKzxzrE63GZrAPPkrmQKp4cX6L
- TLSH T1482301E239DB93983547CA815AE1B6758382E5B7FB8301C0CD96CCB0CD589E7444B9BB
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.ru.js
- SHA256 1bb069d95a395bf258d1f262814591aa762c4b30529adde32ccbcaa7c7ca508d
- MD5 6e7d5b984917b00f131c47473ce2b866
- SHA1 97f94134ff8f73ab48c0635550f2d8054c239c7f
- SHA512 f2595e7e1812073c50bfa058db3c7918dd8d7a6f0d20a576c68d854a4c61ed74bef3ad5ab23430567065677d737d81c7f17010055a069b9e38b5594d65e882a0
- SSDEEP 1536:ox/PFmMhjpIMbBBKOXnPCSHhiaV6can9oA2yG+YQI/Y:QbhjpIcB8OXdHhiXcanGA2yGiI/Y
- TLSH T1C57337A156DA50AE0200B50BDD087E493EEB46FE3FAB573615B43D7E34F3024C62E669
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
- SHA256 e9adc8ffca9853ef6e0bd4e955af9f395a570bc7772fc2dac0c0ff241aac864b
- MD5 05e49314cf801f5d3992b55243690ea7
- SHA1 c20fca9f037adf2edec34ccf67a08e56d1d71bbf
- SHA512 7d499b41ae9bee2e72b721a49c0d053029624b19af1ede71a4378e14d3f6b407539c18d29422fb8d21681ce7dc160d2f11e80064017f5c8a5f645d6c1a77cc75
- SSDEEP 768:oJbVMLHwwytIMTAlthuIjOP4CAz9NlL2/AdszzHsVBI/C4j00llmR+V66U:odPPZ+huIjTszzHs3IXj00llmMV6j
- TLSH T1B3F2B6941BDC6FF93C021391671E85267908630B753BE022A7F3FD9D20919EE46E7A72
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
- SHA256 94a7ff81b8ec3217a46bc5cdebe2c6aee98f73e6e902b7d9cf394836d052bbe5
- MD5 becbf441d95b0bc1565faf47ce9de373
- SHA1 f660a8a29dc9861f7ff7e228622d492f1630b873
- SHA512 feee8ef6e36984309186b8ff491982efe4f144859c3f48d147b26bd61af6af751e013a951e945f02a2057368b485204734f6dc50cd6fca6294426b7fbdbcaa4f
- SSDEEP 768:ozietcy+xQHM2k00fZvOHRUJdFF/JlN+QVtWrn05IxXUeqJ1wrv6Vl900U1LjK1G:o3sxQHM24ZvtdFF/zN+Q2LUeqJ1wrv6y
- TLSH T17FF218650FBD5BF83A05F3AD270921121C0E6B0BBC3661159B7E7EA424977CC27DA8B1
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/Monaco/vs/loader.js
- SHA256 5c3cf09973404ba31d760952f267751ef2bb09f315331d13ca432b65ce2c480b
- MD5 bc15bb48d4d5c60ce7f16819f4d988c4
- SHA1 87c7f328aa357d52b68b2cea0a214365a40cdc36
- SHA512 b5d7481773cafd01f3d738949a54e49c166c9a8fea3a150f6f0eed7449176d630991e27544a4e7b23fdad29700ae7fbba5de42f97c69874b6f2ad374194a9853
- SSDEEP 768:o7J6CgCAqoxgiwYeMX/so92s8hHlDmc0yvrCfS5kUN+WV+X7:oV6lC8fwYeFKcV5k
- TLSH T16AD284CDBB9474234247F4E8D07F111BE2BA965A144D842C711ED8DE2CBD58AA23EB78
- MD5 SHA1 SHA512 SSDEEP TLSH
bin/editor.lua
- SHA256 95802ae593c9a15aef6e2316de9b69df3910c4e2ff154fc6d8abb637b7c07e40
- MD5 b19a2c61396a0d516a9a64ab5a926d29
- SHA1 6d8c29176d2b27d5d0f18360a4fc7a65cd755997
- SHA512 f73973d8deae6ca312ad5e62ffe7131940b466de142ee3b6de82d7e961480943c54b516c790a0ed66cc8c1b31ef6dfa016930dd8a11f0e57926ded9678445653
- SSDEEP 1536:CrUb9dttOvSwbQYQyl71LQziD0Iu+6OXP:KaftOqwbQYQyl71L6ig+5P
- TLSH T1B1E3B82DF29E12E54CA731ACF4372844B83FD47620391249FED9A43A749CEAE41636DD
- MD5 SHA1 SHA512 SSDEEP TLSH
medal.dll
- SHA256 4719cce68f1fd62bace537a0c4ea1219768a2d32cfd221e4e6daafa5be85c5eb
- MD5 33a58faf3633b5478e1bbadb6e904900
- SHA1 d845d8ea5afc52a60c81e0ea550e041cc2d54714
- SHA512 984230862bc63871637ad7f612227b0ca5603a243a4233c2c17b44f1146df0fae9aeca8936a26d9c25a1d84bef5ed0509278fd8844b1191278ebde32c4379db3
- SSDEEP 98304:tHCFJP29qHV9X/nLhaVN92IWKPkEy4D2v0YI1Z63MmHJXKaBREfyowxLTm:JC/PesPnLE4vLAVYa63MmpXHXEfyow9m
- TLSH T17556338917B41CE2E4B9F67BC954EC92A0EF85500589711904BF2EF04B2775FBB282E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12390488
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
start_server
Name
Size
1.4MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
385KB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
128KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
11KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.themida
Size
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=7, id=260, version=35207,
count=16, id=261, version=35207,
count=3, id=257, version=30151,
count=243, id=1, productName=Unmarked objects,
count=385, productName=Unmarked objects (old),
count=1, id=256, version=35226,
count=1, id=258, version=35226,
options.txt
- SHA256 f60e52bbbe2e4ccc779c84d8eeeb91239aa8251b10823c72b878d7c982b9a772
- MD5 3e6a6daed6fb7b4ce02f61ce8c6f369a
- SHA1 2200a963334edff80ec6992ca7a72e740e45bca6
- SHA512 7f257861d7b12bb326b50bf2ca342afc4565aa7729731dd1c77a53de69d62413fe95942134520247fe481997928666cda2db708edd0d16584dce72b926725299
- MD5 SHA1 SHA512
runtimes/win-x64/native/WebView2Loader.dll
- IMPHASH f6946d311bccc86e2042a388e375de41
- SHA256 52b93ea7357591c31099685a58e6487f8090e083d91b3aa803dda7d4aff2aa65
- MD5 02c17055f9dd1329d8c1b66544d8cc03
- SHA1 6bbb5dc2107729d0f8e824eedbe673c9f09c7f63
- SHA512 9cd2ba87e1cb3dfdf3ff0e4ac674140082562d00ab49d83986353510d4b85e8b647ecadf1e4289ef6c910daa5a06f447665a47ea2ec3314dbae99167931008db
- SSDEEP 3072:kPQJpSFTlTRTzWGbThTNTFSkD0bHYVNqGM2h9P58LZZ5Aalq/Tk+EtJfy2a3Pj3:6MMTlTRTzWiThTNTFSzjiBM2h9P5oZIP
- TLSH T1C2F35B4772E9407BE16A8274C9A34A11E77774510B60EBEF03A4477A1F237D4AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ba:c1:a6:0a:ff:88:ef:80:8f:aa:6c:aa:d6:08:4f:5d:f0:0a:ec:60:90:a8:2e:0a:79:69:53:54:c9:d0:0d:24
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 10, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:fe:6b:ce:da:d6:c8:03:03:a3:00:00:00:00:03:fe
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Aug 20, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:321A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:f8:a3:a1:26:0c:0c:40:48:fe:00:01:00:00:01:f8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
87KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
umbra.exe
- SHA256 03a14eaca391b8180c8b6648dc0df6d8d2d8e516ef302c9797270790e782f9f6
- MD5 0e449b4f505343a3e534a7c66077e9cc
- SHA1 ccb7a52d17ca839dcd5acff05a5efd07447d9099
- SHA512 82bde923f84eb33def30a47b9dfcff18e52857dc093fb9fe5f8d2bf3a640c1a9631cd7fec06195c7e7863cacdd90be0bfc3b75e142aa55418b9d93849a64ca95
- SSDEEP 24576:8ez3qMn7YEPOl4VQp25GE9umMP9Z6nBErLvn7gq:8c3TnG6mkY2kPf6BErLvnp
- TLSH T10535C0AC36A0D810D6AAC83682F179D8C3B755AC9EC6D3535FC0F78F6C36946863D14A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
922KB
Virtual Size
921KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
204KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
CuBmyrNw
Size
512B
Virtual Size
22B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.????
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
version.txt
- SHA256 4a0d11d3ed0a12202fb3bab611b36cc923863018d9d6c0d884cf3d14fb7ed5c9
- MD5 b0bb0c328595b7ce0082138da7505797
- SHA1 218b89e923e7c2839e1d2e6682a7a713fb1ba9ba
- SHA512 a63fcccd7b3ff706e62a35ae5f876227e98731cd94a36949f6a8002f3515decfb455f614304d17229ef5adeb6bdc015dcbaf3274e5110b0bc156ae7f41334a35
- MD5 SHA1 SHA512