AmazingSetup (1)[.]exe

resource
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll

AmazingSetup (1).exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 2f18a8a618f2847e512c9eef6bf123477c566d0a7739aed02d5cbab23739889a
MD5 03f8fa7fb28b3480ccc8ea78195b73b9
SHA1 874f6433e4eb0b7fc908572c6b514fa09696ec67
SHA512 fae7b75dde887890d796466090b6e61e437d33b4d5d994cc05240e08130a7e2c697ed7ccdd129cae5d476cf3cb9a931d2c8c31ce4a584297b5c7593c2fe37515
SSDEEP 196608:/oi3hY+N+vVFeM51X8YOvAnje/4UcsKhAd3:/oi3hYm+NYI1sYOvsexcsKG3
TLSH
T17F7633AAB079FC4BC478C877B3F06326846A902F1A590457E2B5B1521FCF7D3191FAA4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ec:3b:2f:4c:79:ac:80:21:82:08:7c:d7:41:65:9d:fb:c8:f3:81:ae:29:88:5a:88:20:0c:17:e4:93:61:de:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Jun 16, 2026

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

2c:3b:82:52:18:b2:66:85:ea:74:ba:b4

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2024 - Mar 8, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AmazingUpdater.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a7a2632a6e20077aa0696b2db5bbfa19a0e3dc20d23851350321cbaf03bc679f
MD5 cf845856069dc4791666c4c4b8549eb0
SHA1 015ace7e600916af953c48bcf3afba684d7f6cc6
SHA512 13849fe94873552298f3ac7539b1c70936cd0cdb6aad671dd064d06d1e8bc75c1c53db205b2788b5fcd00f601539196f34fd31025e1793c8c9c9f9cae017fe42
SSDEEP 12288:/z0cFdnAg/cQmD10Ad4ydTi3O8T5cnj+1+uQlOTvXsIcT04JEk3n2:4MAglQ10AayduOGCn61++bXsW4Jo
TLSH
T173E4CF07E606C79FE56892FCBE134F6C2B25A72CA99677EF46421DDF7C212A00C8815D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

15:31:32:0f:f1:09:72:51:a6:cc:ec:1a:d2:03:e3:59:b9:67:c0:c2:cf:f7:0b:fc:4d:a6:e4:27:0a:b6:2a:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Chains

Jun 16, 2026

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=321508100048299,CN=Individual Entrepreneurship Chuev Nikita Andreevich,O=Individual Entrepreneurship Chuev Nikita Andreevich,L=Noginsk,ST=Moskovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c1063687565766e4079616e6465782e7275,1.3.6.1.4.1.311.60.2.1.2=#13124d6f736b6f76736b617961206f626c617374,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#130f427573696e65737320456e74697479

Serial Number

2c:3b:82:52:18:b2:66:85:ea:74:ba:b4

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2024 - Mar 8, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

4

Entry point

693218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\snegi\GitHub\agg-amazing-launcher\products\updater\src\AmazingUpdater\obj\Release\AmazingUpdater.pdb

NDP46-KB3045560-Web.exe

IMPHASH fa7ad1da1bd0aad446375362ef77bd51
SHA256 e5ced0f95e6aefc4e4ee0884ca7ce317fff7d91edbda32243a436123e46d9439
MD5 58d88886a42aeb5d17e8b232c2697899
SHA1 480ca134b9e3f2437df10719d5a8c77ddec0a4f1
SHA512 712f63dbe88628a8edc2a7b15fd92677eb64c8ea7ea8c92e96820a0403056f062011b3dfc261b0c2749ddde2446c2064c849acc2d351fb48100f3412669fcd7a
SSDEEP 24576:d7uBlJ/jaMSmtLvUDSRbm4Jah1rVxpYRsQ0AQu72O8vUDcsBisPX:dalJ/jCeTUDBzrVx6RPgkiLcf
TLSH
T19A65232233F0C073D0A399319AE4ABB5B97B727626304547F79867191EB27C1663732B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

2a:a6:6c:6b:2b:c4:cc:88:39:93:49:49:c2:fe:ee:25:c6:73:d9:d1:8b:9a:86:86:eb:8f:d0:98:4b:e5:b1:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 22, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

f1:8b:6c:0b:87:fc:e2:10:bc:16:dc:80:47:5f:18:c2:44:f8:da:29

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 22, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:53:ca:02:2b:f0:74:70:56:6c:00:00:00:00:00:53

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

1

Major OS version

5

Entry point

100683

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dd\fx\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetLastError SetEnvironmentVariableW ExitThread GetTickCount GetEnvironmentVariableW GetModuleHandleW LeaveCriticalSection WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc GlobalFree SetFilePointerEx RaiseException

comctl32

ord17

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

shell32

SHBrowseForFolderW SHGetPathFromIDListW CommandLineToArgvW

shlwapi

PathRemoveExtensionW

user32

GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW MessageBoxW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage SetWindowLongW GetWindowLongW LoadStringW CharUpperW

cabinet

ord22 ord23 ord20

oleaut32

VariantClear SysAllocString

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

NDP472-KB4054531-Web.exe

IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
SHA256 4e49c56e4cf9df2e837a8a3010f5a8b4deb096429d56e7fd9ff70ab394663678
MD5 c84209349f18afe5a41ce04e9ae8f487
SHA1 cedbbf404b166a5e72d035760bcb0fa508e4f4cb
SHA512 37006954e3afe07fb02d24894cc34794618b78c27a1b514818985b6cc1fa3e896ed99ba2e4aac3f6469d263819bd94ee70e7113946c51ba83c93b74826fc8fa8
SSDEEP 24576:NGHL3siy9hlzSmtLvUDSRbm4Jah1rVxXmBz5px02ZJX7KnIOXL6LKoAoY4U0GXFy:yL3s7PmeTUDBzrVxofxTZJXOIO76LK/y
TLSH
T17065222676F0C073D4F311718BE0E6F26976B2351334C44BBB58A72D2FA43946ABA356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

b1:09:a9:d4:3c:aa:d0:ba:64:d3:e8:f3:19:68:6a:f2:f3:f3:04:e3:05:dc:22:54:b7:17:99:2f:ae:ed:e0:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 7, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

af:8b:14:7a:71:2b:42:a9:89:27:bf:94:37:d3:f1:79:9b:8f:22:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 7, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b3:39:bb:d4:12:93:15:a9:fe:00:00:00:00:00:b3

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

1

Major OS version

5

Entry point

102119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

GetTickCount SetEnvironmentVariableW GetLastError ExpandEnvironmentStringsW CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW GetEnvironmentVariableW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW GetProcAddress GetSystemDirectoryW LoadLibraryW GetModuleHandleW CreateThread LocalAlloc RaiseException ExitThread WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW FreeLibrary InterlockedExchange RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage LoadStringW SetWindowLongW GetWindowLongW CharUpperW

oleaut32

SysAllocString VariantClear

icon.ico

SHA256 e9b067e06a0b7f83dd38e1700306190886a286f208d57a7f6603891534716920
MD5 9d60b725107b7aaf3bfaa38f6489a2a7
SHA1 f5013f553317f222816fc88c71ff0bd3e79677e9
SHA512 e303c818a48804c7d913773486951ada78636b3632037fa774ce08268b54726b6416a28b93e4aea810a00cfe92e44a90ff46fff9fcf173d54c183ee206815b62
SSDEEP 192:UJv/D3h6qXxA9xUJu1I5ImLPmTze99ezk+xKUDuBfTfACp9ZYTNp:mj3ggxA9qmI7Ue99ez2DHYNp
TLSH
T1C942D0EFCBD7546BD0DE200BF6C085D20EB8263FA18DA95F0C80683690B14466EBF746
MD5 SHA1 SHA512 SSDEEP TLSH

mscoreei.dll

IMPHASH 25f1e57c7a6ed06aaf329cb7b168fa29
SHA256 c6c9e8d77b62c7a52e6e9eac764c1e1345779fc17544b80730e507627a5d5120
MD5 606b77c072a964da4e4710151cac86eb
SHA1 f70fd3b9c4436234743d6df1258fb7bad9a21a6b
SHA512 8d95b2d6f1b80d90ad494106d5641d175282ee26400d4cb606756999b659927e6e61b778a2942105888798b625f51dd57b1b14002ee3a6a7be7c224a5d3da68d
SSDEEP 12288:7xXi1HaimWv0jrzGVzvQa4VptM5P9H1wmCxUFaZtW4:7xypwvzOv50uP9hUZtW4
TLSH
T17AC407437A45D1B2F1AA0C3009AEB37625BD793389267017B3E4EB2D5DB02C7E615B1B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Digest

59:05:f1:b2:e9:33:33:88:1b:41:5f:d3:34:16:73:b0:97:d3:10:74:c5:4c:e2:27:c1:b2:64:03:ee:60:97:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 26, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

77:73:74:b7:11:27:54:e1:c8:be:8c:d5:eb:db:be:e8:5c:59:d1:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 26, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:31:8d:e1:be:a7:9f:0a:35:e0:00:00:00:00:01:31

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 6, 2019 - Dec 4, 2020

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:2264-E33E-780C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:18:fe:3a:f7:d9:1b:d4:b1:33:00:00:00:00:01:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 13, 2019 - Feb 11, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

6

Entry point

75888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mscoreei.pdb

kernel32

WideCharToMultiByte GetFullPathNameW GetLastError GetModuleHandleExW GetProcAddress FreeLibrary LoadLibraryExW GetEnvironmentVariableW SetErrorMode GetModuleFileNameW WaitForSingleObject CloseHandle SetEnvironmentVariableW GetWindowsDirectoryW GlobalMemoryStatus VirtualQuery VirtualAlloc GetSystemInfo GetModuleHandleW DisableThreadLibraryCalls GetCurrentProcess ExitProcess OutputDebugStringW ReleaseMutex CreateMutexW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateFileW WriteFile GetLocalTime GetTimeFormatW GetDateFormatW GetCurrentThreadId GetTickCount GetFileAttributesW FlushFileBuffers GetSystemDirectoryW MultiByteToWideChar SetLastError GetFileSize CreateFileMappingW MapViewOfFile InitializeCriticalSectionAndSpinCount UnmapViewOfFile CreateToolhelp32Snapshot ReadProcessMemory ReadFile lstrlenW FindFirstFileW FindNextFileW FindClose LoadLibraryExA VirtualProtect GetProcessId Module32FirstW Module32NextW GetVersionExW FlushInstructionCache GetSystemWow64DirectoryW GetFileAttributesExW GetSystemDefaultLCID HeapCreate HeapDestroy RaiseException HeapFree HeapAlloc GetProcessHeap GetCPInfo GetACP FormatMessageW IsDBCSLeadByte LocalFree LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW CreateActCtxW ActivateActCtx DeactivateActCtx DebugBreak ReleaseActCtx IsDebuggerPresent GetModuleHandleA GetSystemDefaultLangID GetSystemTimeAsFileTime GetCurrentThread TerminateProcess VerSetConditionMask VerifyVersionInfoW IsWow64Process OpenProcess GetCurrentProcessId CreateProcessW TlsSetValue VirtualFree ReleaseSemaphore HeapValidate CreateEventW SetEvent WaitForSingleObjectEx TlsAlloc ResetEvent CreateSemaphoreW SleepEx TlsGetValue TlsFree EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind InterlockedFlushSList GetModuleFileNameA GetStdHandle GetFileType GetStringTypeW GetConsoleCP GetConsoleMode FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW SetStdHandle SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc IsDBCSLeadByteEx InterlockedDecrement InterlockedIncrement

CLRCreateInstance CallFunctionShim CloseCtrs ClrCreateManagedInstance CoEEShutDownCOM CoInitializeCor CoInitializeEE CoUninitializeCor CoUninitializeEE CollectCtrs CorBindToCurrentRuntime CorBindToRuntime CorBindToRuntimeByCfg CorBindToRuntimeByPath CorBindToRuntimeByPathEx CorBindToRuntimeEx CorBindToRuntimeHost CorDllMainWorker CorDllMainWorkerForThunk CorExitProcess CorGetSvc CorIsLatestSvc CorMarkThreadInThreadPool CorTickleSvc CreateConfigStream CreateDebuggingInterfaceFromVersion CreateInterface DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer EEDllGetClassObjectFromClass EEDllRegisterServer EEDllUnregisterServer GetAssemblyMDImport GetCORRequiredVersion GetCORRootDirectory GetCORSystemDirectory GetCORSystemDirectory_RetAddr GetCORVersion GetCompileInfo GetFileVersion GetHashFromAssemblyFile GetHashFromAssemblyFileW GetHashFromBlob GetHashFromFile GetHashFromFileW GetHashFromHandle GetHostConfigurationFile GetMetaDataInternalInterface GetMetaDataInternalInterfaceFromPublic GetMetaDataPublicInterfaceFromInternal GetPermissionRequests GetPrivateContextsPerfCounters GetProcessExecutableHeap GetRealProcAddress GetRequestedRuntimeInfo GetRequestedRuntimeVersion GetRequestedRuntimeVersionForCLSID GetStartupFlags GetTargetForVTableEntry GetTokenForVTableEntry GetVersionFromProcess GetXMLElement GetXMLElementAttribute GetXMLObject IEE InitErrors InitSSAutoEnterThread LoadLibraryShim LoadLibraryWithPolicyShim LoadStringRC LoadStringRCEx LockClrVersion LogHelp_LogAssert LogHelp_NoGuiOnAssert LogHelp_TerminateOnAssert MetaDataGetDispenser ND_CopyObjDst ND_CopyObjSrc ND_RI2 ND_RI4 ND_RI8 ND_RU1 ND_WI2 ND_WI4 ND_WI8 ND_WU1 OnShimDllMainCalled OpenCtrs PostError PostErrorVA ReOpenMetaDataWithMemory ReOpenMetaDataWithMemoryEx RegisterShimImplCallback RunDll32ShimW RuntimeOSHandle RuntimeOpenImage RuntimeReleaseHandle SetTargetForVTableEntry StrongNameCompareAssemblies StrongNameErrorInfo StrongNameFreeBuffer StrongNameGetBlob StrongNameGetBlobFromImage StrongNameGetPublicKey StrongNameHashSize StrongNameKeyDelete StrongNameKeyGen StrongNameKeyGenEx StrongNameKeyInstall StrongNameSignatureGeneration StrongNameSignatureGenerationEx StrongNameSignatureSize StrongNameSignatureVerification StrongNameSignatureVerificationEx StrongNameSignatureVerificationFromImage StrongNameTokenFromAssembly StrongNameTokenFromAssemblyEx StrongNameTokenFromPublicKey TranslateSecurityAttributes UpdateError _CorDllMain _CorExeMain _CorExeMain2

Name

.text

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mscorlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c1700fa946ea2e36bb69f266a6af5328d9e3a59c7445c6955fc051272f6f4eed
MD5 8962d51c16f28e58b7d76816dc339901
SHA1 0ccb879a7cb9e642799b989d5a46028b861494b4
SHA512 2f1d63b576bb473a30fbce5952d630050315c1dac7684e8cfb4a594f40848e33271e99c27d8981512369bb992a164c33f5c376df6533c6cd3378fa8462fda2a9
SSDEEP 49152:/M9zgT6tSSTpw9EjwQR2ruLuRnOG7v1zbT4A8KfhKsXQCImR7A3uF92j9sk/IRUU:b6kSTpwC2ru6D1zUOhm3VWg4s8T
TLSH
T112466C01A7F89F35F6AB5F3B94B6540856F3FC582713870E350AA62A9C537A04E437A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

8f:37:87:95:81:c5:74:55:30:ce:0d:db:5f:e5:85:9f:cd:60:8b:4e:fe:ed:09:db:3a:c5:5b:08:19:22:3c:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 9, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

5083426

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mscorlib.pdb

mscorrc.dll

SHA256 de6d8d472c0c21aedee69bceaf3e3419dc831825f72d1be201cbaec413a164a7
MD5 8a960d8c91014fd1d36b7b8e067ccd7f
SHA1 62a67606bd4a0bd5355b68cf7616979c2db346c3
SHA512 64897b46c607a48c53a7a7b6ce1e4f1ad03ca8f48d139a2ff86189756ca90b773970b24b5e5d37b84b8b732a8fae78f967e012f0e2b43f47d7d4fb9875140e2f
SSDEEP 3072:PZwZetSqwtRRWIREvu/S3lZkWVYWxinPhN9OnTJzSeU5mfEwj:PFSrtRRbsfkR9OTJzSb+
TLSH
T119845391A7F95218F6F73B74ADB95AA00E7ABC96EC79C21D1240805E5D72E40CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

4d:56:d4:b7:f1:c5:be:45:40:79:43:5f:89:f5:e8:a7:00:3d:ce:c9:91:a4:fb:1f:ae:b2:53:4a:b1:7f:fb:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 24, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

da:49:c9:73:79:97:95:a3:b6:be:4a:0f:37:1e:ea:80:c5:17:15:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 24, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:3a:28:a9:62:84:34:04:3a:68:00:00:00:00:01:3a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:0b:e4:f9:be:8f:6f:4c:1d:d0:00:00:00:00:01:0b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ndp48-web.exe

IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
SHA256 0bba3094588c4bfec301939985222a20b340bf03431563dec8b2b4478b06fffa
MD5 34a5c76979563918b953e66e0d39c7ef
SHA1 4181398aa1fd5190155ac3a388434e5f7ea0b667
SHA512 642721c60d52051c7f3434d8710fe3406a7cfe10b2b39e90ea847719ed1697d7c614f2df44ad50412b1df8c98dd78fdc57ca1d047d28c81ac158092e5fb18040
SSDEEP 24576:xGHL3siy910NSmtLvUDSRbm4Jah1rVx8MjoGO8W6cbZtgd6AmpITsz0+lLF7cy:mL3s7K8eTUDBzrVx8MjoGO8W6cbs8NpT
TLSH
T12165222333B0C473D0A3163097A1A3B62D79B2BB4370854BBFA4572D1F667D066B9B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

6c:cf:56:9a:be:f9:98:a7:cf:36:f7:72:14:a6:e1:e1:58:35:96:b6:c0:49:4b:bc:7e:95:34:67:dd:a2:3a:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 1, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

1

Major OS version

5

Entry point

102119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

GetTickCount SetEnvironmentVariableW GetLastError ExpandEnvironmentStringsW CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW GetEnvironmentVariableW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW GetProcAddress GetSystemDirectoryW LoadLibraryW GetModuleHandleW CreateThread LocalAlloc RaiseException ExitThread WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW FreeLibrary InterlockedExchange RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage LoadStringW SetWindowLongW GetWindowLongW CharUpperW

oleaut32

SysAllocString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

AmazingSetup (1).exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

AmazingUpdater.exe

mscoree

dotnet

NDP46-KB3045560-Web.exe

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

cabinet

oleaut32

version

generic

NDP472-KB4054531-Web.exe

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

generic

icon.ico

mscoreei.dll

kernel32

generic

mscorlib.dll

mscoree

dotnet

mscorrc.dll

generic

ndp48-web.exe

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

generic